Hacker News Reader

Comment by dan-robertson | Hacker News Reader

Obviously it is bad if your personal data is compromised after you (or some else) upload it to an online service like Facebook.

But in this case, it’s important to remember that phone companies used to regularly leak most of their customer’s phone numbers (and names) in the form of a telephone directory. So a question to consider is: suppose that the white pages were still commonly produced and contained most people’s numbers. How would you then feel about something like this.

Personally I feel like the problem with phone numbers being leaked is mostly the epidemic of spam calls (especially in the US) rather than some particular breach of privacy.

Aside: I think it is good to consider these counterfactuals in general for questions about information privacy, for example how would you feel if everyone’s tax returns were published publicly like they are in Sweden?

View on HN

The "new" risk with phone numbers is the overreliance on them for login and 2fa and the relative easy of taking one over. I use security keys but still have accounts I can't remove the phone 2fa from despite having two keys tied in.

If you can avoid it, simply don’t give anyone your phone number. Then you can use security keys, hardware keys and recovery codes. Obviously some places require a phone number, but for those that don’t, avoid giving them one.

Spam calls are likely not even affected by leaked numbers. Source of suspicion: My partner and I have phone numbers in close numeric vicinity, and deliberately use one for public purposes and the other one is not known outside of a very close circle of family.

We still get spam on both numbers within short time frames - so I'd say it's likely spammers just auto-dial through.

That's been going on for many years. Brute force calling costs nothing. I've always wondered if charging 5 cents per call would stop them cold, but I am sure no one wants to implement that now.

As far as I can remember, the white pages don't include "biographical information". The kind of details used for idiotic "security questions" on websites too lazy to implement 2FA (your mom's maiden name, your first school, the name of your first pet, etc).

As for public tax returns in Scandinavia, first of all it has guardrails - searches are recorded with your information when you lookup someone - and second, countries have different culture and History for a reason.

Finnish income for those earning 100k and over is bulk downloadable as a csv/json with full names, birth years and provinces, along with taxable salary, capital gains, etc.

You can't compare that at all! They leaked IDs and from that you can go to user profile and learn more about them. You cannot do that from a phone company leak.

Phone companies didn’t leak phone numbers in the conventional sense of the word. I used it to try to draw a comparison. Phone numbers used to be printed in big books and you could usually look someone’s phone number up if you knew their name and rough location. That is, phone numbers were not considered to be particularly private information at all.

I think the comments I most agree with talk about the different security threats people face today with current usage of phones.

The issue of having someone's phone number is completely different these days; in 1985, I couldn't find out your age and your previous addresses and then find dozens or even hundreds of photographs of you alone and/or with your relatives and friends, as I can now - see my other comment:

https://news.ycombinator.com/item?id=26687321

Before the Internet, all you could do with a person's phone number is call them. But now, with PeopleSearchNow.com (the ultimate free source of personal info--feel free to look up your own real phone number in it, assuming you're American) and with Google and the MULTIPLE social networks that virtually everyone between the ages of 20 and 45 has been on now--typically using the same username on most or all of them--you can find out way more in a matter of a few MINUTES than a 1980s private investigator ever could in a span of a month. I can look up your number on PeopleSearchNow and then, if I can't find YOU on Facebook, I'm confident I can find one of your relatives (several of whom will be listed on PeopleSearchNow), and get to you from there--meaning find your other online profiles, thanks to those Facebook friends who know you.

I agree, but also we’ve made it more complicated by using phone numbers as 2FA credentials.

Now suddenly a “white pages of cell numbers” becomes a very convenient tool for getting in to people’s accounts.

Only if you can hijack their number. Knowing a phone number seems like by far the easiest part of breaking SMS 2FA...

This is insane. Phone companies published numbers because it was generally considered helpful and the costs of unsolicited calling were relatively high. By the 70s delisting was an option, and by the late 90s it was very common (in the US). The internet made this a no-brainer, and to suggest that it’s somehow ok just because it used to be (in a totally different world) is beyond ridiculous.

We don’t have the option here — people provide their number to a service to be able to use it, and the numbers are then compromised, in breach of that contract and because of the service’s failures.

The two are not remotely alike, what the fuck are you even talking about.

Please make your substantive points without name-calling and swipes. Those are against the site guidelines and we ban accounts that post that way—it's because we're trying for a different fate than internet-default here, or at least to stave it off a while longer.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and sticking to the rules when posting here, we'd be grateful.

Reply on news.ycombinator.com