Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Look Up Unknown Phone Numbers Using Facebook Reset Password

bytexd.com

Post reply on HN
Print view View original

41–50 of 140 posts

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#41

Post by kfarr »

MattGaiser wrote: post #25
awinter-py wrote: post #7

password reset flows are generally a privacy leak if you use email as some kind of account key, you can generally find out whether that email has signed up (if not the username) automatic password reset and email verification are good for businesses and users in a lot of ways so this is a tradeoff if FB is showing the specific account linked to an SMS that's IMO negligent but shrug, they employ more lawyers than I do…

Can't you just say that a password reset email has been sent? That is what we did when I worked in banking as a way to prevent this. Whether or not you have an account, the system says a reset email has been sent.

Yes this is the correct answer. I've seen some systems respond with "if there's an account registered to this email address you will receive a password reset email" whether or not the address is registered

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#42

Post by bamboleo »

kumarvvr wrote: post #33

I think the whatsapp profile doesnt work until the other party messages you or gives you a reply.

It depends on their settings. I usually can see photo and name as soon as I add them. For my own number however people can’t see either piece of information until I add the number to my contacts.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#43

Post by Merman_Mike »

janzer wrote: post #40
Merman_Mike wrote: post #37

Earlier quoted context omitted.

What does a few lookups a week cost you? Just a few cents per?

According to https://www.twilio.com/lookup 1.5 cents per lookup, would be 1 cent without the carrier information.

Thanks. I've wanted to do this. Didn't know if there was some account overhead or other fees.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#44

Post by zwog »

kumarvvr wrote: post #33

I think the whatsapp profile doesnt work until the other party messages you or gives you a reply.

It depends on the user's privacy settings. You can set who can see the profile photo: everyone, your contacts or no one.

But I don't know what is the default setting.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#45

Post by zwog »

MattGaiser wrote: post #25
awinter-py wrote: post #7

password reset flows are generally a privacy leak if you use email as some kind of account key, you can generally find out whether that email has signed up (if not the username) automatic password reset and email verification are good for businesses and users in a lot of ways so this is a tradeoff if FB is showing the specific account linked to an SMS that's IMO negligent but shrug, they employ more lawyers than I do…

Can't you just say that a password reset email has been sent? That is what we did when I worked in banking as a way to prevent this. Whether or not you have an account, the system says a reset email has been sent.

In most cases you can find out whether an account with a specific email address exists by trying to sign up with it, though.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#46

Post by epmaybe »

dn3500 wrote: post #31
jsnell wrote: post #11

Before gathering up the mob and handing out the torches and pitchforks, you should probably establish what the facts actually are. I don't think the author of this post has really done that. The way these systems should work, and appear to work in Facebook's case, is that the amount of information revealed depends on risk analysis. For example, I just tried recovery from an IP I've used Facebook from, and from a fres…

It actually says right there on the screenshot "You can see your name and profile picture because you're using a computer network you've logged in on before." So this is only working because the author has used this computer (or one on the same subnet) to log in to his FB account before (private browsing mode does not obscure the IP address). It will not work in the general case.

Are large organization subnets sufficiently masked that this would not work? For example, a university network.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#47

Post by pcthrowaway »

epmaybe wrote: post #46
dn3500 wrote: post #31

Earlier quoted context omitted.

It actually says right there on the screenshot "You can see your name and profile picture because you're using a computer network you've logged in on before." So this is only working because the author has used this computer (or one on the same subnet) to log in to his FB account before (private browsing mode does not obscure the IP address). It will not work in the general case.

Are large organization subnets sufficiently masked that this would not work? For example, a university network.

If not, you could possibly use the domain facebook displays for the recovery email (for example x@cornell.edu) to direct you to the network you need to retry from

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#48

Post by actuator »

This doesn't seem like something which is of concern but on a tangential note, I wanted to check how you guys maintain your phone number privacy. Consider the cases:

- I absolutely hate giving phone number to new ecommerce sites as it is just a database that will eventually get leaked. The only one I can trust here is Amazon probably.

- Phone number on packages. A person can read your name, address and phone number from a package which seems like a lot of info. Address is required but phone number shouldn't be as you can very well redirect the call using custom pins.

- Talking to new people on dating apps. I don't use IG, so phone number is something I have to exchange. Now I would never give my number to an anon on internet but on dating apps I have to for my own benefit.

Do you guys maintain burner phone numbers for these cases?

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#49

Post by vmception »

actuator wrote: post #48

This doesn't seem like something which is of concern but on a tangential note, I wanted to check how you guys maintain your phone number privacy. Consider the cases: - I absolutely hate giving phone number to new ecommerce sites as it is just a database that will eventually get leaked. The only one I can trust here is Amazon probably. - Phone number on packages. A person can read your name, address and phone number f…

I maintain dual sims in my iphone. For dates this means that my "burner number" also has blue text messages, revealing to them it is an iphone and that other features are available like facetime and airdrop in the future.

I also maintain google voice numbers to set up additional accounts on places and more easily filter spam.

Right now, my one device has three numbers on it. (2x sim, 1x google voice).

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#50

Post by wyattpeak »

throwaway201103 wrote: post #20
MrRiddle wrote: post #15

Earlier quoted context omitted.

Phone number meant to be private shouldn’t be associated with any other info whatsoever.

Then you probably shouldn't be announcing it in your caller ID when you call random people.

Probably not, but does making a person in making one mistake abdicate their right to privacy?
Post reply on HN