Hacker News Reader

Are you an adult over the age of 21? Cause if so all your info was likely dumped in the Equifax breach a couple years ago if you had interacted with credit in anyway. It's one of those things that you just have to accept its out there and secure yourself the best you can, 2fa everywhere, password manager, don't re-use passwords, etc. Most of that info is most dangerous when it can be used to break into a weaker account that may be used as auth for a stronger account, like T-Mo redirecting your 2fa texts to an attacker that paid off a customer support agent to sim swap your number. Your phone line is a huge security liability because of 2fa texts and the lax policies around line transfers. And this basically extends to any server, if they can get into your email, they can get into any account that uses your email as auth.

The thing I haven't been able to figure out, once reaching the mental place you describe above, was what to do about it.

It really feels like the answer is "do nothing, and hope no one ruins your life". Which isn't a great place to be.

I really wish I had a better answer for you, but I'm stuck there myself. Short of major reform that those that profit off this shit will just lobby away, there's literally nothing we can do but wait for the current notion of credit to collapse, unfortunately.

I guess the only course of action would be to work to make the leaked information out of date. You could change your name and address. Personally, I would not pursue that option.

I live in Washington State, where up until recently, birth records for anyone could be requested by anyone.

Address? If you own a home, already a matter of public record.

Phone #, not secret at all (heck it is part of many people's email signatures!)

Talk to an investigative journalist some time and find out exactly what info can be had publicly.

On a related topic, a few years back I went to a presentation from a member of TMO's marketing team. They mentioned how they used a ad-tech company to real time query the mortgage status of people who visited TMO's homepage in order to help dynamically determine what line of phones to show. Live in a nice neighborhood and didn't have a bunch of late payments? iPhones showed up.

To be clear, their is a vendor out there with an API that offers up, in real time, what your current mortgage status is. "You" of course are determined by a bunch of other web trackers.

A few weeks ago Best Buy sold off the the fact that I was in their store looking at robotic vacuum cleaners. (Either that or some app on my phone was using really good location tracking, but Android has seriously cut down on that, AFAIK background apps aren't granular enough anymore to get section-in-store data) While I was impressed with the ad tech that made that level of targeting possible, it also means I am not likely to step inside a best buy again.

Have you noticed that in Best Buy stores their price tags are now all eink paper?

If they can 'electronify' a price tag, you know they have some precise beacons in that store.

Could be ultrasonic tracking beacons, see here:

https://www.wired.com/2017/05/hundreds-apps-can-listen-beaco...

I can always tell what my wife is buying for my birthday, I get ads for the stuff she searches for even though we do not share devices, Google seems to make associations from the IP address.

I watched a video review of a drone on YouTube and that was a huge mistake, got slammed with drone ads for weeks afterwards.

Watching any video mentioning “Planet X” seems to sign you up for a semi truck full of crazy also.

Name, address and phone number has been available for a long time in the phone book. People throw parties and post birthday information all over social media constantly.

That information shouldn't be a risk. It's too easy to get for everybody.

I never posted my real birthday on social media, but then one day it magically showed up on IMDB. That one still pisses me off.

Information posted in the phone books during the time of phone books couldn't really be weaponized against you like it can be now. So yes, times have changed. Just because something used to be done doesn't mean it should still be done that way.

I think the aim of who you responded to was that we should find ways to blunt the weaponization of this information.

For my part, I think both can be pursued. Let's do what we can to help keep things private. Let's also do what we can to keep things irrelevant.

The fact that previous address is relevant is such a strange thing to me. I can't think of anything this actually solves by using, yet it is everywhere with "confirming" you are you. I know I am me, and here's all of these other government issued IDs that say I am me. Prior address does not.

Well.. Except for the fact that my ID has sometimes had my previous address. :)

Especially common for folks that move a lot. Students, for example.

yeah, and so? your id has a gov't issued number. that's the thing that should be used. your address is, as you've stated, not permanent, so why would it be used as an identifier?

even as a second qualifier to reduce the number of exactly 1 hits on a unique number it's not very useful.

Apologies, I didn't intend that as a strong rebuttal. Just an ack that it can be convenient in a non adversarial way to confirm identity. Mainly during transition periods.

But, I fully ack that it is a poor piece of information to do this.

You can edit IMDB data about yourself.

please, show me how. i have tried long in the past and was not able.

Lamentably, we're at the point where your information is likely out there. It is a shitty feeling, being the victim.

I got the email from my employeer this year that my application for unemployment was reject because I'm still working (I didn't apply). I had an tax check stolen and attempted to cash.. (the bank stopped that one.. Dominican Republic bank cashed that one..), IBM backup tapes with maybe my personal information went missing..

A friend who is supper vigilant had someone apply for a credit card with his credentials.. The card company sent him a letter asking if he had moved.. The card was approved and ready to go.

Its sad, but you have to stay vigilant. I don't know if its worth getting a new cell number. It is kinda your identity now.

Lock your credit.

Thanks. It’s locked through the 3 US credit company.

> Should I get a new number and replace my number at all services that use this number?

Here's a guide to removing your phone number from all security functions: https://blog.kraken.com/post/219/security-advisory-mobile-ph...

Just made a separate post about it here, since it doesn't appear to have been posted at HN before: https://news.ycombinator.com/edit?id=28283321

Thank you, this is very useful info.

I got a message that they changed my pin and put the new pin in the sms message. Kinda shocked.

I got the same text. I think if people get access to your number, and your number is used as part of a 2fa for another service like your bank, then it is only a matter of time before you get hacked.

The only time it's actionable is if you inquire damages honestly. And even then it's an uphill battle cause you'll have to prove it was because of the leak and not something else.

I got the same text, and I’ve never had a prepaid phone. The exposure clearly goes beyond the credit applications T-mobile claims.