Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bruteforcing the phone number of any Google user

brutecat.com

Post reply on HN
Print view View original

191–200 of 204 posts

Re: Bruteforcing the phone number of any Google user

#191

Post by megous »

vesinisa wrote: post #170
megous wrote: post #145

Earlier quoted context omitted.

They can just take your number anyway if you ever insert a SIM, since they control "your" phone.

Interestingly, your phone number is actually not stored on the SIM card. It instead holds a globally unique ICCID number which your operator links to your account (phone number) on their systems. This actually makes it possible to transfer your phone number between SIM cards or even operators, and means your cell phone is blissfully unaware of its own phone number.

While interesting, it's irrelevant. Google can take your number the moment you enter your SIM into the phone. They even have it as a feature.

Re: Bruteforcing the phone number of any Google user

#193

Post by bigstrat2003 »

bscphil wrote: post #176
bigstrat2003 wrote: post #134

Earlier quoted context omitted.

How are you getting a /56 from Comcast? I can only request up to a /60 from them, any larger and I get a /60 rather than whatever I requested.

Good question, I checked just now and I am indeed getting only a /60. At some point in the past they gave me a /56 but no longer. I didn't notice the change because I have fewer than 16 networks, and networkd handled delegating /64s to them automatically.

Shame, I was hoping I could get on the /56 train too lol. Thanks for checking!

Re: Bruteforcing the phone number of any Google user

#194

Post by rlpb »

gumbojuice wrote: post #175
zerof1l wrote: post #62

This article highlights something interesting... it is quite common to get at least one /64 IPv6 block from a hosting provider or ISP. Yet most of the rate-limiting and IP blocking is done for a single IP. Sounds like when dealing with IPv6, an entire block of /64 should be rate-limited or blocked.

I'm on a relatively large Indian ISP, and my home network gets an IPv6 network assigned, which is directly routable. Didn't think about it until tailscale told me it was connecting over a direct IPv6 connection and I wondered how that was possible. Sounds like 90s network rampage may be back here.

Blocking inbound connections using connection tracking is orthogonal to NAT. It's just that NAT implies the former by default due to its nature.

Re: Bruteforcing the phone number of any Google user

#196

Post by gcanyon »

> This request allows us to check if a Google account exists with that phone number as well as the display name "John Smith".

Shouldn't the rate limit be set here, related to the display name "John Smith"? You get 5 "John Smiths" for free in the first minute, then 5 more in the first hour, then 5 more in each day going forward. With the same million phone number combos you'd need roughly half a lifetime (10,000 days) to get the hit on average.

Re: Bruteforcing the phone number of any Google user

#197

Post by joelkoen »

TechDebtDevin wrote: post #148
Guvante wrote: post #105

Earlier quoted context omitted.

It is already pretty common to start with IP blocking but upgrade to blocks when the bad behavior continues. Assuming a /64 as a starting point is an easy win and bumping it up with repeat offenders seems pretty easy in the grand scheme of things.

Doesnt CGNAT make these methods obselete though? All my webscraping is proxied through my phone and I rarely get IP blocked and im very aggressive even on CF protected sites.

That's neat, could you explain how you achieved that?

I tried a year or so ago and had to round trip to my Android over mobile data so it was too high latency for what I needed. If there's a way to connect to a phone on the same LAN/WiFi but scrape using its mobile network I would be very interested.

Re: Bruteforcing the phone number of any Google user

#198

Post by TechDebtDevin »

joelkoen wrote: post #197
TechDebtDevin wrote: post #148

Earlier quoted context omitted.

Doesnt CGNAT make these methods obselete though? All my webscraping is proxied through my phone and I rarely get IP blocked and im very aggressive even on CF protected sites.

That's neat, could you explain how you achieved that? I tried a year or so ago and had to round trip to my Android over mobile data so it was too high latency for what I needed. If there's a way to connect to a phone on the same LAN/WiFi but scrape using its mobile network I would be very interested.

Yes, if you're interested its not too difficult, but I don't really want to put it here on HN (my business kinda relies on these methods, and I'm increasingly worried they will start working on this problem). If you email me at mynameisamodel@gmail.com I'll send you details.

Re: Bruteforcing the phone number of any Google user

#199

Post by cosmojg »

dheera wrote: post #90
atum47 wrote: post #49

I did something similar way back when I was trying to find the phone number for a person, using Facebook. When recovering a password Facebook would give you most of the digits of the phone number, so I wrote them down in a vcard file and imported it on my phone to just look at the pictures. It worked surprisingly good.

This is why I don't use a real phone number with any of these services. They don't need my phone number to operate either.

What do you use instead of a real phone number? How do you get past mandatory phone number verification for services which require it?

Re: Bruteforcing the phone number of any Google user

#200

Post by raxxorraxor »

permo-w wrote: post #36
paxys wrote: post #24

Earlier quoted context omitted.

If it makes you feel better (it probably won't) hundreds/thousands of services have collected your phone number over the years (for 2FA or any other reason), with or without consent, and a large chunk of them have had data breaches. So your name-email-phone number combo is 100% already available in public data dumps.

not so long ago practically everyone's name and phone number was available publicly for free in any phone box

Not the same and you could opt out as well. The discrepancy in potential to access more private information about a person is very large.
Post reply on HN