Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Look Up Unknown Phone Numbers Using Facebook Reset Password

bytexd.com

Post reply on HN
Print view View original

71–80 of 140 posts

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#71

Post by taneq »

Hamuko wrote: post #63
kristopolous wrote: post #59

Y'all know we used to publish everybody's phone number in a book along with their address and then distribute copies to every household, right? We did it for many decades and it was fine. Every pay phone, which was a phone anyone with a couple coins could make anonymous calls from, had this giant book right there for your reference. Everyone knows this, right? If you didn't know someone's number you could look it up…

> Y'all know we used to publish everybody's phone number in a book along with their address and then distribute copies to every household, right? And we didn't use to tie second-factor authentication into SMS messages to your phone number.

We didn't used to have two-factor authentication at all for most things though.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#72

Post by hadrien01 »

rsync wrote: post #36

I have a shell script named 'lookup' that lets me know (through twilio) the location, mobile carrier, and registered name of a phone number. I wrote it to quickly identify mobile vs. non-mobile numbers that I might text - also from the command line. I won't paste the entire script here (mostly authentication and argument parsing) but the meat of it is: /usr/local/bin/curl -X GET "https://lookups.twilio.com/v1/PhoneNu…

Where do they get the names from?

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#73

Post by kristopolous »

debaserab2 wrote: post #69
kristopolous wrote: post #64

Earlier quoted context omitted.

30 years ago things were far more ripe for fraud and abuse. Things couldn't be verified in the slightest. In the 1800s a famous fraudster invented an entirely fictitious country and then sold fraudulent land grants and bonds for it - really, https://en.wikipedia.org/wiki/Gregor_MacGregor There's a reason why the most famous confidence tricks have names that go back hundreds of years (eg, spanish prisoner) and there's…

The fact that these risks existed a century ago is a poor argument for suggesting they shouldn't be taken seriously in the present. We live in an era where things can be done instantly online with sufficient information. A sophisticated conman from the 1800's can now execute fraud in seconds instead of plotting for weeks, and they can do so in an automated fashion. The risk isn't anywhere near the same. A white pages…

Right but if I presented this problem to you without using the word "phone" I'm pretty sure the answer would be "throttle and rate limit" and ban for abuse, not kill off the feature.

These lists are still available for purchase and thus they are still available. I'm not a criminal so I don't know what websites to go to but I'd be shocked if a file with a name like "US-ATT-SUBSCRIBERS-2020-12.sql.gz" doesn't exist.

As an example, my friends pool together as a "family plan" and we get a discount. I frequently get texts and calls from people asking for the person who pays the account. I don't use their name in anything I sign up for and they don't use my number. We don't even live at the same address - the phone bill is literally the only paper trail that connects us.

Therefore, the only way this mistake is possible is if these marketers bought the subscriber list or found a copy online somewhere.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#74

Post by jsnell »

pcthrowaway wrote: post #47
epmaybe wrote: post #46

Earlier quoted context omitted.

Are large organization subnets sufficiently masked that this would not work? For example, a university network.

If not, you could possibly use the domain facebook displays for the recovery email (for example x @cornell.edu) to direct you to the network you need to retry from

Facebook does not reveal even a single letter of the recovery email's domain.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#75

Post by kevin_thibedeau »

kristopolous wrote: post #70
cik wrote: post #65

Earlier quoted context omitted.

Part of the issue is the meaning of privacy now. Decades were spent fighting for the right to not receive, or to receive targeted phone calls. We're now (at least my cohort) in a world where no one, ever answers the phone. Either you're in my phone book, or I'm never answering the phone. It's rather liberating.

That's only because calling is the new fax. Would you ignore an SMS from an unknown number? Let's say the content was "Hey, how've you been? It's been a while!"

Yes they get ignored because that's the entry point for scammers building lists of active numbers. Same as one should mute but not disconnect spam voice calls as that gives them info about your presence.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#76

Post by mct »

hadrien01 wrote: post #72
rsync wrote: post #36

I have a shell script named 'lookup' that lets me know (through twilio) the location, mobile carrier, and registered name of a phone number. I wrote it to quickly identify mobile vs. non-mobile numbers that I might text - also from the command line. I won't paste the entire script here (mostly authentication and argument parsing) but the meat of it is: /usr/local/bin/curl -X GET "https://lookups.twilio.com/v1/PhoneNu…

Where do they get the names from?

CallerID information. There are a bunch of lookup services available for it: https://www.voip-info.org/cnam/

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#77

Post by usr1106 »

talonx wrote: post #66
kristopolous wrote: post #59

Y'all know we used to publish everybody's phone number in a book along with their address and then distribute copies to every household, right? We did it for many decades and it was fine. Every pay phone, which was a phone anyone with a couple coins could make anonymous calls from, had this giant book right there for your reference. Everyone knows this, right? If you didn't know someone's number you could look it up…

While this is factually correct, what you are missing is the point that most people have mobile phones these days, and their phone numbers are tied to a ton of other accounts and services. These include second factor auths (using text or voice calls) for other websites, bank accounts, social security ids (I'm not talking about the US), insurance policies - the list goes on. You would not want your number to be availa…

Here in Finland many if not most mobile phone numbers are in the phone book. Well, no physical book has been printed for years, but you can call directory enquiries or look them up online. Even reverse look-ups are possible. (Only an ever shrinking minority of households still owns a landline.)

How exactly would that subvert 2FA via SMS? Except for calling and ask please read the SMS you just received for me. While that will work with some people, I am not worried in my case.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#78

Post by oauea »

kristopolous wrote: post #70
cik wrote: post #65

Earlier quoted context omitted.

Part of the issue is the meaning of privacy now. Decades were spent fighting for the right to not receive, or to receive targeted phone calls. We're now (at least my cohort) in a world where no one, ever answers the phone. Either you're in my phone book, or I'm never answering the phone. It's rather liberating.

That's only because calling is the new fax. Would you ignore an SMS from an unknown number? Let's say the content was "Hey, how've you been? It's been a while!"

At most I might send back a "Who is this?", but yes, I'd probably ignore it if it wasn't signed by a familiar name.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#79

Post by wwwwewwww »

kristopolous wrote: post #59

Y'all know we used to publish everybody's phone number in a book along with their address and then distribute copies to every household, right? We did it for many decades and it was fine. Every pay phone, which was a phone anyone with a couple coins could make anonymous calls from, had this giant book right there for your reference. Everyone knows this, right? If you didn't know someone's number you could look it up…

I'm sure not everyone knows this, because there are are people on this site who have not grown up with phone books.

The article talks about a reverse phone book: according to the author, given a phone number, you are able to look up name (and profile picture). To my understanding there were no reverse-lookup phone books like that back in the day.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#80

Post by usr1106 »

fy20 wrote: post #57
rsync wrote: post #36

I have a shell script named 'lookup' that lets me know (through twilio) the location, mobile carrier, and registered name of a phone number. I wrote it to quickly identify mobile vs. non-mobile numbers that I might text - also from the command line. I won't paste the entire script here (mostly authentication and argument parsing) but the meat of it is: /usr/local/bin/curl -X GET "https://lookups.twilio.com/v1/PhoneNu…

In countries which have number portability this may not always be right. For example my phone number returns Vodafone, which was the carrier it was originally assigned to 15 years ago, but I've been on other networks for over a decade.

When Finland got number portability some 15 years ago it also got a free look-up service to see the real operator of every number. This was required for price transparency. Calling within your own network can be cheaper than to a competitor and you should be able to know so before making the call.

Not sure how other countries have handled that. The US had the different approach, callee pays for the mobile part.

Have not looked into the issue for a decade...

Post reply on HN