Bruteforcing the phone number of any Google user • Hacker News Board

Re: Bruteforcing the phone number of any Google user

#201

Post by raxxorraxor » Thu, Jun 12, 2025, 7:39 AM UTC

jcims wrote: post #65

PeeMcGee wrote: post #22

Wow, if I needed any more proof Google is a ghost ship then this is it. The $5K bounty is an insult, and the fact that they low-balled it in the first place makes them look like absolute clowns. Good on you for calling out how little of a shit Google gives about actually protecting user data.

Nobody is forced to participate in a bug bounty. If you don't like the rewards, don't do it. There's a limit to the financial viability of these programs.

This is why there need to be strong fines associated with such security issues. That would provide financial viability enough.

Even if the issue wasn't abused, it looks like data already leaked.

Re: Bruteforcing the phone number of any Google user

#202

Post by permo-w » Thu, Jun 12, 2025, 10:19 AM UTC

raxxorraxor wrote: post #200

permo-w wrote: post #36

Earlier quoted context omitted.

not so long ago practically everyone's name and phone number was available publicly for free in any phone box

Not the same and you could opt out as well. The discrepancy in potential to access more private information about a person is very large.

so what you could opt-out? your info was/is still in any phonebook from before you opted out. any well-prepared organisation, which these modern data-collection firms are, would have no problem whatsoever keeping every edition of the phonebook for this purpose.

yeah the discrepancy is that its harder now. phonebooks were essentially free and had people's addresses in them

Re: Bruteforcing the phone number of any Google user

#203

Post by efreak » Thu, Jun 12, 2025, 6:10 PM UTC

joelkoen wrote: post #197

TechDebtDevin wrote: post #148

Earlier quoted context omitted.

Doesnt CGNAT make these methods obselete though? All my webscraping is proxied through my phone and I rarely get IP blocked and im very aggressive even on CF protected sites.

That's neat, could you explain how you achieved that? I tried a year or so ago and had to round trip to my Android over mobile data so it was too high latency for what I needed. If there's a way to connect to a phone on the same LAN/WiFi but scrape using its mobile network I would be very interested.

You can run an ssh server in termux and run whatever programs you want from there.

There's several options for storage, as well: - connect an external drive via USB (The /Android/media directory on both the internal and external SD card is generally accessible from both termux and other apps on the phone) - if you're rooted you can mount a network storage in termux (or system-wide, but then you have to figure out sandboxing) - if you're not rooted, mount in reverse (mount your phone storage over the network)

Re: Bruteforcing the phone number of any Google user

#204

Post by gck1 » Sat, Jun 14, 2025, 3:19 AM UTC

joelkoen wrote: post #197

TechDebtDevin wrote: post #148

Earlier quoted context omitted.

Doesnt CGNAT make these methods obselete though? All my webscraping is proxied through my phone and I rarely get IP blocked and im very aggressive even on CF protected sites.

That's neat, could you explain how you achieved that? I tried a year or so ago and had to round trip to my Android over mobile data so it was too high latency for what I needed. If there's a way to connect to a phone on the same LAN/WiFi but scrape using its mobile network I would be very interested.

You can pick up a pulled laptop modem like the T99W175 from China for a low price, drop it into a USB enclosure (you’ll be limited to USB 2.0 speeds), and hook it up to OpenWrt. Or grab a GL.iNet GL-X3000 - the Quectel RM520N is already on board and runs over PCIe, so it’s quicker.

Then you can have basically unlimited IPs.

Android messes with your traffic far more than a bare modem (there's unavoidable NAT for one), and it has tighter thermal limits, so higher latency is expected.