Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Look Up Unknown Phone Numbers Using Facebook Reset Password

bytexd.com

Post reply on HN
Print view View original

31–40 of 140 posts

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#31

Post by dn3500 »

jsnell wrote: post #11

Before gathering up the mob and handing out the torches and pitchforks, you should probably establish what the facts actually are. I don't think the author of this post has really done that. The way these systems should work, and appear to work in Facebook's case, is that the amount of information revealed depends on risk analysis. For example, I just tried recovery from an IP I've used Facebook from, and from a fres…

It actually says right there on the screenshot "You can see your name and profile picture because you're using a computer network you've logged in on before." So this is only working because the author has used this computer (or one on the same subnet) to log in to his FB account before (private browsing mode does not obscure the IP address). It will not work in the general case.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#32

Post by dasb »

MattGaiser wrote: post #25
awinter-py wrote: post #7

password reset flows are generally a privacy leak if you use email as some kind of account key, you can generally find out whether that email has signed up (if not the username) automatic password reset and email verification are good for businesses and users in a lot of ways so this is a tradeoff if FB is showing the specific account linked to an SMS that's IMO negligent but shrug, they employ more lawyers than I do…

Can't you just say that a password reset email has been sent? That is what we did when I worked in banking as a way to prevent this. Whether or not you have an account, the system says a reset email has been sent.

But then you confuse legitimate users that don't remember what email they signed up with.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#34

Post by hulahoof »

A number of years ago I trialled a reverse look-up using this method (for both mobile numbers and email) as a grey hat project for a data aggregator I contracted to validate existing email / phone pairings (bad email and numbers gets you banned quickly by dispatch partners).

It worked because the returned "is this you" image at the time returned a filename that was a base64 encoding of the users ID for the graph interface, which at the time pulled back a surprising amount of info if you query the key directly (obtaining the key generally required you to be a friend-of-friend or closer).

I got hit rates of about 70% for a sample of ~100,000 email/mobile pairs (that were already suspected to be valid).

Sounds like the trick to get the key has been resolved (I was too early in my career to feel comfortable disclosing my research) but I am surprised a similar vector exists almost a decade on - especially after the whole Cambridge Analytica fiasco.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#35

Post by chris_wot »

wyattpeak wrote: post #4
zenincognito wrote: post #3

This is gross violation of user privacy but if you file a bug with FB they will say - "won't fix" ; is working as intended.

Have they said that? They've previously removed the ability to search for users by phone number, so they recognise the problem. I can see why someone would have unthinkingly added the profile picture to the recovery screen, but since the downside of resetting the wrong account is so low (an SMS that can be ignored by the rightful user), it seems easily fixable.

A guy called Brian had his personal contact information (including phone number) plastered all over Facebook's promotional pages.

https://gimletmedia.com/shows/reply-all/76hdrj

I don't think Facebook ever actually apologised for doing this.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#36

Post by rsync »

I have a shell script named 'lookup' that lets me know (through twilio) the location, mobile carrier, and registered name of a phone number.

I wrote it to quickly identify mobile vs. non-mobile numbers that I might text - also from the command line.

I won't paste the entire script here (mostly authentication and argument parsing) but the meat of it is:

  /usr/local/bin/curl -X GET "https://lookups.twilio.com/v1/PhoneNumbers/$number?Type=carrier&Type=caller-name" -u $accountsid:$authtoken
I use this several times weekly.

EDIT: by "location" I mean their mobile country code - not their actual location which, of course, you cannot get without (ab)using SS7 which is beyond the scope of twilio ...

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#37

Post by Merman_Mike »

rsync wrote: post #36

I have a shell script named 'lookup' that lets me know (through twilio) the location, mobile carrier, and registered name of a phone number. I wrote it to quickly identify mobile vs. non-mobile numbers that I might text - also from the command line. I won't paste the entire script here (mostly authentication and argument parsing) but the meat of it is: /usr/local/bin/curl -X GET "https://lookups.twilio.com/v1/PhoneNu…

What does a few lookups a week cost you? Just a few cents per?

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#38

Post by eyeareque »

I once tracked down a Craigslist scammer by looking up their phone number (it was a groove number) within google voice. It showed his name, google profile, and photo. Their name helped me find their Facebook and Instagram. Long story short, I got my money back.

Iirc: Google used to enable allowing people to look you up by your phone number (it was something along the lines of: help your friends find your account). This used to be on by default, it doesn’t seem to be anymore.

Try looking up your friend’s google voice numbers in google voice and see if they have the option enabled.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#40

Post by janzer »

Merman_Mike wrote: post #37
rsync wrote: post #36

I have a shell script named 'lookup' that lets me know (through twilio) the location, mobile carrier, and registered name of a phone number. I wrote it to quickly identify mobile vs. non-mobile numbers that I might text - also from the command line. I won't paste the entire script here (mostly authentication and argument parsing) but the meat of it is: /usr/local/bin/curl -X GET "https://lookups.twilio.com/v1/PhoneNu…

What does a few lookups a week cost you? Just a few cents per?

According to https://www.twilio.com/lookup 1.5 cents per lookup, would be 1 cent without the carrier information.
Post reply on HN