Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

github.com

Post reply on HN
Print view View original

341–350 of 363 posts

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#341

Post by austinjp »

armedpacifist wrote: post #337
itronitron wrote: post #336

Earlier quoted context omitted.

I know at least one person who has their own personal family domain set up so that his family members can just create new email addresses specific to the vendor when shopping online (for example, 'amazon@familyrobinson.com' and 'bestbuy@familyrobinson.com' ). Then all their shopping emails just get routed to his domain. Being able to track which company leaked or sold an email address seems like another benefit in ad…

Gmail has this feature baked in. Append a + sign to the username and then append any string you want, ie. username+ycombinator@gmail.com. It will forward these mails to your regular email address. I started doing this for the exact same reason as mentioned above, but you can obviously do more than just creating honeypots. Also you have to ignore the fact that it's Google...

I do this. A small annoyance can crop up when trying to log in to a service with your + modified email address. Hmmm, what did I append after the plus? If you can't remember that, you can't use the "forgot my password" function either :)

Usually soluble, but irritating.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#342

Post by blablabla123 »

m463 wrote: post #339
blablabla123 wrote: post #335

Earlier quoted context omitted.

I'm surprised it has such a harsh name. Years ago I was wondering what would happen if people just came up with random data, e.g. derived from the own personal data, thinking about crawlers, automatized personal data processing. But I'd just call it creating garbage data because that's what it is. Eventually it will be impossible for an algorithm to distinguish between real and garbage data. (And probably not only fo…

I think the trick is that different users might create "identical garbage" so that contacts match on the backend.

Hm ok, that's a nice trick though

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#344

Post by dredmorbius »

Data-poisoning is an attractive approach (and one I've considered and occasionally practiced) but it does relatively little as a practical matter. @cyberlab posted some good links here: https://news.ycombinator.com/item?id=26286686

Cory Doctorow also addressed this in a recent Reddit AMA: https://old.reddit.com/r/privacy/comments/j444u4/how_to_dest...

From the harvesters' perspective, a long list of pattern-matching identifiers with no visible history anywhere else online ... will tend to get junked fairly readily. A small increase in undeliverable addresses from a swipe ... won't increase costs much.

Creating wholesale online personas (effectively: bots and troll farms writ large) might start posing a challenge, but those would still likely give off a strong signal of falseness due to lack of correlation with other identifiers, most notably devices of their own, credit cards or other payments data, other data-linked services (transit or toll passes, etc.).

Ultimately the question is why are you doing this and what do you hope to accomplish?

(Though I've salivated a few times contemplating a system that would stream endless bits as responses to cookie or similar requests, just for shins and grits.)

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#345

Post by skinnymuch »

forgotmypw17 wrote: post #338
skinnymuch wrote: post #321

Earlier quoted context omitted.

The pushback is minimal. A lot of the pushback possibly includes people that are going to be upset by many things. Specific Reddit communities and Hacker News are good examples of that. If these demographics are unlikely to be happy with your social product’s privacy and dark or non dark patterns, catering to them makes no sense. I don’t know any one outside some geeky sites and only one person personally who cares a…

>I don’t know any one outside some geeky sites and only one person personally who cares about any of this. Some do say lame casually. But it’s not going to be a deciding factor for using the app. My experience is completely different from yours. Out of the dozens of people I've spoken with about this stuff, I can't remember a SINGLE PERSON who didn't express dissatisfaction with at least one of: lack of privacy and p…

Sorry, I was exaggerating and didn't make it clear what I meant. Yes people care. A lot of people will especially say something or another. Most won't actually not connect to Clubhouse with their contacts though.

So I see the same dissatisfaction. I find that to be closer to slacktivism level of caring for most people though. If they stop using an app or don't use it from the get go for X reason, it usually doesn't align with how they're using other apps. So technically they did not use something because of the dissatisfaction you described. However, they aren't actually applying that even remotely consistently.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#346

Post by skinnymuch »

forgotmypw17 wrote: post #331
skinnymuch wrote: post #319

Earlier quoted context omitted.

I assumed the OP saying successful social apps as in successful to the point of being known by at least some average people. Metafilter and Hacker News are both very niche and tiny. Hacker News doesn’t have the same business model as others either. It’s to help the namesake incubator. It succeeds with that. Getting contacts etc wouldn’t benefit Hacker News. Hacker News could lose a decent amount of money yearly witho…

Perhaps it is just a fact that we have to accept that large (1M+? 10M+? 100M+?) social networks cannot remain sustainable without abusing their users. That would mean we can benefit from building smaller, sustainable communities for ourselves and those we care about. I'm surprised it's not happening already, to be honest. With today's technology, you can spin up a community website for, e.g. your family or your organ…

Perhaps it is my family being minority immigrants with other caveats. Snooping by employees is rarely done. It most likely isn't going to mess you up too badly either.

On the other hand, the number of people I know who are either deathly afraid or just normally afraid of the government and its agencies like the ones you mentioned is high. This is definitely going to be a minority of people. My family and extended family aren't common cases.

I don't see either as big deals though. Not enough to have people not stick with bigger apps that have network appeal.

I don't believe disruption of anything but more of the same in different clothing happening. I'm a pessimist though.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#347

Post by forgotmypw17 »

skinnymuch wrote: post #345
forgotmypw17 wrote: post #338

Earlier quoted context omitted.

>I don’t know any one outside some geeky sites and only one person personally who cares about any of this. Some do say lame casually. But it’s not going to be a deciding factor for using the app. My experience is completely different from yours. Out of the dozens of people I've spoken with about this stuff, I can't remember a SINGLE PERSON who didn't express dissatisfaction with at least one of: lack of privacy and p…

Sorry, I was exaggerating and didn't make it clear what I meant. Yes people care. A lot of people will especially say something or another. Most won't actually not connect to Clubhouse with their contacts though. So I see the same dissatisfaction. I find that to be closer to slacktivism level of caring for most people though. If they stop using an app or don't use it from the get go for X reason, it usually doesn't a…

I think it is just habit and culture, and both can change very quickly. There are many examples throughout history, e.g. civil rights movement.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#348

Post by Viliam1234 »

lanstin wrote: post #132
lanstin wrote: post #65

Earlier quoted context omitted.

Or even as a a service fake data - feed fake location data and fake contact list. Full of 202-555-1234 type numbers. I always put fake data into web forms and it is a sign that I don’t truly own the phone that I can’t do the same for local software.

Like I want a pop up: this application is requesting your location data. Shall we give the real data, no data, or simulated data. Same for contacts, photos, apps installed, etc.? Not saying that would solve all the problems but it would be user centric in a way the privacy conversation just isn’t.

> Shall we give the real data, no data, or simulated data.

Or even a selected subset of real+fake data. (With the ability to define sets that could be reused across application.)

Sometimes I want the app to have access to some of my contacts, but not all of them. For example, my work contacts but not my personal friends, or vice versa. Or simply "my contacts that told me they were also using this app". PLUS hundred fake contacts to poison the data.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#349

Post by ccleve »

bredren wrote: post #220
ccleve wrote: post #113

This is a common technique in the mailing list industry. It's called "salting". You add fake names, but real email addresses, street addresses, or post office boxes. You then monitor what shows up in these places addressed to "Mr. Fake Name". It's how mailing list companies monitor who is using their lists and helps control misuse.

Have you worked in this industry? Curious about more details of tricks from various list makers/sellers.

I have bought lists. I'm working on a system to manage lists.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#350

Post by yalogin »

alcover wrote: post #236
yalogin wrote: post #173

This is not achieving anything positive. I don’t which privacy threat it’s fixing, other than adding a new app into the mix that could at some point in the future suck up the contacts itself:)

That is pretty insightful. Do you have an email ?

Ha that is a good one.
Post reply on HN