Bruteforcing the phone number of any Google user • Hacker News Board

Re: Bruteforcing the phone number of any Google user

#11

Post by c22 » Mon, Jun 09, 2025, 2:45 PM UTC

Brybry wrote: post #8

> This time can also be significantly reduced through phone number hints from password reset flows in other services such as PayPal, which provide several more digits (ex. +14•••••1779) I've never thought about this but it's extra scary. If you have the same phone number and email address with enough services and they all mask in a different order for reset hints...

Even scarier, whoever has access to admin those services can just look up the unmasked data! Better to use unique numbers and addresses per service.

Re: Bruteforcing the phone number of any Google user

#12

Post by [deleted] » Mon, Jun 09, 2025, 2:45 PM UTC

jasonthorsness wrote: post #9

To anyone whose number hasn't already leaked to the B2B SaaS outbound databases: do everything you can to protect your privacy there is still hope for you, the rest of us are already lost

[deleted]

Re: Bruteforcing the phone number of any Google user

#13

Post by rvnx » Mon, Jun 09, 2025, 2:45 PM UTC

Brybry wrote: post #8

> This time can also be significantly reduced through phone number hints from password reset flows in other services such as PayPal, which provide several more digits (ex. +14•••••1779) I've never thought about this but it's extra scary. If you have the same phone number and email address with enough services and they all mask in a different order for reset hints...

There are now Telegram bots to find such information. The fact that this bruteforce was revealed probably annoyed many users (like the infamous "EoG" bot).

Re: Bruteforcing the phone number of any Google user

#14

Post by ge96 » Mon, Jun 09, 2025, 2:46 PM UTC

jasonthorsness wrote: post #9

To anyone whose number hasn't already leaked to the B2B SaaS outbound databases: do everything you can to protect your privacy there is still hope for you, the rest of us are already lost

I think it's hard to top Equifax's breach/leak

Re: Bruteforcing the phone number of any Google user

#15

Post by rvnx » Mon, Jun 09, 2025, 2:46 PM UTC

dkdcio wrote: post #10

Brybry wrote: post #8

> This time can also be significantly reduced through phone number hints from password reset flows in other services such as PayPal, which provide several more digits (ex. +14•••••1779) I've never thought about this but it's extra scary. If you have the same phone number and email address with enough services and they all mask in a different order for reset hints...

what’s the risk? your email being made public? your phone number?

Get personal info, then call carrier for a SIM swap, access crypto from there. Bonus: no KYC, since it's the other person's identity + you can login from 4G internet, so a trusted IP range.

Re: Bruteforcing the phone number of any Google user

#16

Post by staticshock » Mon, Jun 09, 2025, 2:47 PM UTC

belter wrote: post #5

jeffbee wrote: post #4

It must be a daunting chore to maintain all the legacy pages. The amount of now-years-old stuff that long-standing sites have to maintain, or choose to maintain, is shockingly high, and testing the combination of all that stuff is impossible. If you want an example of how diverse in age these apps are, dig around in the Gmail settings panel. Eventually you will land on a popup that uses the original Gmail look and fe…

> It must be a daunting chore to maintain all the legacy pages. Clearly $350 billion revenue in 2024 is not enough...

In addition to having the money, Google also needs the incentive to spend that money on such projects. If the perceived return on capital is low (or negative!), the incentive is simply not there.

Re: Bruteforcing the phone number of any Google user

#17

Post by Phil_Latio » Mon, Jun 09, 2025, 2:49 PM UTC

Maybe this specific exploit was already known for a long time to an illegitimate actor, because legit actors saw past rewards and simply gave up too early.

$5000 (after complaining lol) really is a joke.

Re: Bruteforcing the phone number of any Google user

#18

Post by lesuorac » Mon, Jun 09, 2025, 2:49 PM UTC

Brybry wrote: post #8

> This time can also be significantly reduced through phone number hints from password reset flows in other services such as PayPal, which provide several more digits (ex. +14•••••1779) I've never thought about this but it's extra scary. If you have the same phone number and email address with enough services and they all mask in a different order for reset hints...

There were a few stories in the past about people social engineering their way past support by asking one companies support for the last 4 of a card and then using that last 4 for a different company.

Re: Bruteforcing the phone number of any Google user

#19

Post by [deleted] » Mon, Jun 09, 2025, 2:50 PM UTC

Phil_Latio wrote: post #17

Maybe this specific exploit was already known for a long time to an illegitimate actor, because legit actors saw past rewards and simply gave up too early. $5000 (after complaining lol) really is a joke.

[deleted]

Re: Bruteforcing the phone number of any Google user

#20

Post by [deleted] » Mon, Jun 09, 2025, 2:50 PM UTC

Brybry wrote: post #8

> This time can also be significantly reduced through phone number hints from password reset flows in other services such as PayPal, which provide several more digits (ex. +14•••••1779) I've never thought about this but it's extra scary. If you have the same phone number and email address with enough services and they all mask in a different order for reset hints...

[deleted]