Live data from Hacker News

From email to phone number, a new OSINT approach (2019)

martinvigo.com

61–70 of 127 posts

Re: From email to phone number, a new OSINT approach (2019)

#61
post #60
post #48

Earlier quoted context omitted.

Yes, last four. Don't ask me how I know.. Might be a "born on base" thing but it's no coincidence.

It is a coincidence. You have a 1-in-10000 chance of getting any 4 digit number and they assign 5.5M a year, so we can expect that 550 people get their mother's year of birth every year. You just happened to get 1961. (Total guess but how cool would it be if I was right?)

I have a REALLY hard time believing that but I've never looked into it. Like you said, 550 people a year get it. I just happened to be in the 0.01%? I should be luckier, lol.

https://www.quora.com/What-are-the-odds-that-your-birthday-i...

Re: From email to phone number, a new OSINT approach (2019)

#62

There's one missing piece in that article, and it's the CNAM database (US only). CNAM is the database that carriers use to give you alphanumeric caller ID ("SMITH JOHN" instead of "+1 (555) 123-4567"). Many carriers don't display this data as far as I believe, but most of them make it available. Querying that database isn't free, but you could probably find a way to do it for a few hundred numbers relatively cheaply.…

Why is this not tied to a person's SSN (if possible)?

Why would a phone company know a person's SSN?!

Re: From email to phone number, a new OSINT approach (2019)

#63
post #33

> If it is a requirement, consider using a virtual number like Google Voice or even a dedicated SIM that you only use for this purpose and never give the number away. For the second SIM option, that requires a dual-SIM device, which are still fairly niche in the US. When it comes to VOIP numbers, unfortunately, many sites look up phone numbers and block VOIP providers, which sucks because Android still has no good wa…

eBay doesn't block Google voice numbers. The only site which seems to is Discord in my experience. Personally I prefer to use a non-obvious dedicated email per account e.g. ebpnw@mydomain.com, so the attacker has to guess the email as well.

> Personally I prefer to use a non-obvious dedicated email per account e.g. ebpnw@mydomain.com, so the attacker has to guess the email as well.

Should I stop doing my obvious, ie hackernews@mydomain.com, account emails?

Re: From email to phone number, a new OSINT approach (2019)

#64

Earlier quoted context omitted.

I guess dual SIM is different from having eSIM+physical SIM. Dual SIM typically allows both SIMs/phone-numbers to be active and when you receive a call, you will know which number is being called. With eSIM+physical SIM card, only one can be active at a time. The other has to be disabled. At least, this is what I found few years back.

I know that iPhones with SIM+eSIM can have both active at the same time, and iPhones with just eSIM can have two eSIMs active.

Yeah I found this out the hard way when travelling recently. There are some great apps that let you buy cheap data-only eSIMs in dozens of countries. You can even buy an eSIM before you travel. It’s crazy convenient and much cheaper than roaming fees.

My girlfriend could keep her home phone line enabled while using the eSIM but I couldn’t, even though we have the same model of phone! Turns out her home line uses a physical sim, but mine is set up using an eSIM and the iPhone 12 can only have 1 eSIM enabled at a time. You can do 1 physical + 1 eSIM, but not 2 esims.

I couldn’t get texts or calls from home without noodling with my phone settings each time. And FaceTime kept enrolling and unenrolling my number.

Re: From email to phone number, a new OSINT approach (2019)

#65

> If it is a requirement, consider using a virtual number like Google Voice or even a dedicated SIM that you only use for this purpose and never give the number away. For the second SIM option, that requires a dual-SIM device, which are still fairly niche in the US. When it comes to VOIP numbers, unfortunately, many sites look up phone numbers and block VOIP providers, which sucks because Android still has no good wa…

If you're a Linux user, "KDE Connect" is actually by far the best desktop interface for texting and more. It's changed how my phone and my laptop interact and I think might be my favorite open source project. You can use your laptop as a keyboard, reply to messages from any app that sends a notification, and so much more. The file sending functionality is also far better (and faster) than anything else I've used. It's everything open source software should be.

Re: From email to phone number, a new OSINT approach (2019)

#66
post #62

Earlier quoted context omitted.

Why is this not tied to a person's SSN (if possible)?

Why would a phone company know a person's SSN?!

So that they can seamlessly upsell you on upgrading to a new phone that you'll pay off in installments over the next couple years.

Also, many postpaid plans (like my home ISP) require SSN because they are providing you service on credit. Postpaid cell paone plans have been the "default" in the US for a long time, though prepaid seems to be gaining market share.

Re: From email to phone number, a new OSINT approach (2019)

#67

Earlier quoted context omitted.

I just realized this is from 2019 and confirmed this literally still works on PayPal. SMH

An objective observer would conclude PayPal only exists to cause security problems. I once called PayPal to report an "your account is suspended" phishing email and they angrily told me to follow the directions in the email.

My sister got married and changed her surname. PayPal has inexplicably also changed my surname to my sister’s new surname.

I can’t for the life of me figure out why, or why they would do that without notifying me. At least no good reason. It’s the strangest thing.

I haven’t even fixed it. I just stopped using PayPal because I don’t trust them any more.

Re: From email to phone number, a new OSINT approach (2019)

#68

One thing I've always wondered is how security researchers feel justified in releasing tools like the one in this blog post to the public. I can almost certainly say that the number of bad or creepy uses for an automated email to phone number generating tool massively outweighs the good reasons for having one. Does he get a pass because he's doing this for "research" and it's a grey area anyways? Does he feel better…

Similarly to how Journalists feel justified in stories that have negative repercussions for some parties being reported upon. One way of assessing these decisions is answering the question "Is more harm done than good by releasing information this to the public?" From my perspective, I'm happy that Martin Vigo released this information (in 2019) as it helped me inform my employers (and now my clients) to additional t…

> Similarly to how Journalists feel justified in stories that have negative repercussions for some parties being reported upon. One way of assessing these decisions is answering the question "Is more harm done than good by releasing information this to the public?"

That method leads to the worst evils in the world. Many have concluded, or used it to justify everything from, 'it's ok to take these poor people's land and give it to megacorp, because we'll get a factory' to 'it's ok to silence these journalists because it's for the public good' to 'it's ok to kill my enemies because I think they are bad' to 'it's ok to commit genocide against this group because the world will be better off without them'.

Who am I, or who are you, to decide what is good or bad, or how good or bad, or to weigh those things for others? Beyond our obvious cognitive limitations (as humans, we are too flawed cognitively and morally to make judgments for others) and lack of legitimacy (who elected us?), there is our obvious bias - 'good' is what is good from our perspective, based on our biases, subject to our ignorance of others.

That's why human rights exist: It's their right and you can't make that decision for them; it's up to the person involved. If you think their land, etc. is so important, then ask them - it's up to them whether they want to do it. They have property rights, speech rights, etc. and nobody can abridge them, and in the limited circumstances where they can be abridged, there is a whole infrastructure of legitimacy (democracy), protection from corruption (separation of powers, juries, etc.), process (law, due process).

Re: From email to phone number, a new OSINT approach (2019)

#69
post #55

Fun to see this issue get talked about. Ancedote- I bought some car parts from a semi-scammer. Not a full-on scam but the guy wouldn't ship the complete order even though he had my money for several weeks. We had communicated on a few different platforms. Each platform offered up a little piece of his identity. Last four of this. First four of that. It was enough to piece it all together. I gave him a call at his pla…

[flagged]

I read it multiple times and fail to understand this interpretation at all. Even in context, I don’t see even a drop of “reasonable suspicion”.

Is it a possibility that the goods were stolen? I suppose, but that’s the case with literally anything you purchase online. I wouldn’t have even thought twice about it. I bought stuff, you didn’t send me stuff, so now I’m upset and want you to send me my stuff.

Re: From email to phone number, a new OSINT approach (2019)

#70
post #55

Fun to see this issue get talked about. Ancedote- I bought some car parts from a semi-scammer. Not a full-on scam but the guy wouldn't ship the complete order even though he had my money for several weeks. We had communicated on a few different platforms. Each platform offered up a little piece of his identity. Last four of this. First four of that. It was enough to piece it all together. I gave him a call at his pla…

[flagged]

Why assume that person was stealing anything from the employer, rather than simply being a shitty reseller that only ships when they get a good discount from working in the industry.

A call like that can incentivize them to buy at full price and sell at a loss when their inventory is lacking.

Post reply on HN