19 ms·
US telcos appear to be selling non-anonymized access to consumer telephone data
- OnePostWonder 9y agoSilicon Valley will have their Snowden moment. http://www.cultstate.com/2017/10/13/The-Butterfly-War/ http://www.cultstate.com/2017/10/13/The-Butterfly-War/
- forrrealman 9y agoI like to think of that link as a more sophisticated take on the old GNAA Slashdot trolling. Or possibly Timecube.
- benbristow 9y agoBoth the demos have been hugged to death
- dawnerd 9y agoIt worked a second ago now the first link instantly fails with a dns error.
- DenisM 9y agoI got “Joe Consumer” on TMobile.
- thsowers 9y agoSame on Google Fi Edit: 2nd demo displayed my phone number correctly
- wlesieutre 9y agoTry the second demo? First one told me my zip code was wrong, second had my phone number, email address, and physical address. Also on T-Mobile.
- confounded 9y agoSecond got my number, but that’s it.
- lima 9y agoBad enough.
- confounded 9y agoIndeed. And of course, T-Mobile do have the rest of my details to sell, and I’ve no idea what’s available.
- sysalphUS 9y agoTurn off WiFi
- confounded 9y agoMe too, for the first link.
- colinbartlett 9y agoI'm using Cricket Wireless and also see Joe Consumer. The second link returned a blank white page to me.
- djsumdog 9y agoSame for me on Cricket (which is owned by ATT). Second site kept timing out. I wonder if they know about the post and disabled the demos.
- rdiddly 9y agoKind of reveals how they think of us. If I were writing a story about a hapless, mindless, shallow, gullible idiot - basically an open wallet with eyeballs, who blithely spends and leaves devastation and waste in his wake, I'd call him Joe Consumer. Sad thing is, I used to be John Q. Public - someone who votes, pays taxes, someone with rights. Now I'm just Joe Consumer.
- rwbhn 9y agoSame here - verizon. 2nd link timed out w/some tcp error.
- pxeboot 9y agoAny way to opt-out of this? I tried both demos mentioned in the article. The first loaded some generic looking data. The second pulled my phone number, name and address correctly.
- jfk13 9y agoThere's a response at the bottom of the article (click "Show all responses") which indicates there's an opt-out mechanism.
- gergles 9y agoOnly for AT&T, and there's a response to that response that suggests that the opt-out is ineffective. I noticed some weasel words in a bank's ToS back in January that should have been a harbinger of this kind of 'service'. I wrote to my carrier's privacy team, and of course, heard complete radio silence in return. Here's what I sent them: > Hello, > I recently opened an account at MEGABANK, and read through the opening documents. Towards the end of the documents is this paragraph: > You authorize your wireless operator (AT&T, Sprint, T-Mobile, US Cellular, Verizon, or any other branded wireless operator) to use your mobile number, name, address, email, network status, customer type, customer role, billing type, mobile device identifiers (IMSI and IMEI) and other subscriber status details, if available, solely to allow verification of your identity and to compare information you have provided to MEGABANK with your wireless operator account profile information for the duration of the business relationship. > You may opt out of this information sharing by contacting your wireless operator directly. > Googling phrases in this paragraph shows many banks and other companies that have identical or very similar language in their terms of service or privacy policies. > I tried to contact customer service to opt out of this sharing (I absolutely do not want to share this with anybody,) but they were unable to help me. Can you please let me know how to opt out of this information sharing on all lines on my account and to provide me with any other details you have available on it? This has been a thing for at least this entire year, and the "opt-out" mechanism appears to be completely ineffective.
- cbhl 9y ago
- arcaster 9y agoBrb, shredding my iPhone and purchasing a DumbPhone TM.
- tskaiser 9y agoWon't help. It gets the information from the telco provider, and does not require GPS or any other fancy hardware.
- deleted 9y ago[deleted]
- chrisfosterelli 9y agoIt helps in the sense that it's difficult/impossible to browse the web on dumbphones, so they won't get your IP in the first place.
- tqkxzugoaupvwqr 9y agoMight as well keep the iPhone and turn off mobile data and wifi.
- criddell 9y agoI think a pre-paid (burner) phone would be anonymous.
- interlocutor 9y agoNot true. If you refill using a credit card then they collect the info at that time. I use T-Mobile prepaid and they have all my info except my name.
- bb101 9y agoJust use a VPN on your phone. Then the IP address accessing websites won't be the same as the IP address from your telco. Surely that would prevent a lookup of your details?
- juskrey 9y agoThis is everywhere. Here in Eastern Europe they go as far as giving away your mobile phone number when you browse (or at least encoded token for spamming you via operator). I was able to opt out though.
- cromulen 9y agoWhat? Where exactly in Eastern Europe? I'm deeply concerned by this.
- lima 9y agoIn Germany, this would be illegal without a very explicit opt-in. While the German data protection laws are stricter than the EU ones, this still surprises me to hear.
- deleted 9y ago[deleted]
- That-one-thing 9y agoDo you have any source for this that I could look at?
- CommentCard 9y agoSo now I need a VPN for my cellular data connection. What happened to privacy laws? You could quickly grab highly personal identifying information by setting up an encrypted wifi network at a business with plenty of foot traffic and no open wifi networks. Then you could have a sign or placard directing passerbys to visit a URL of your choosing to get the wireless password. Then you'd implement this API on your website. Now you've got their personal info. Scary..
- gras 9y agoSeven proxies to be precise, you can't really count on a single VPN provider in case they're in cahoots with the surveillance capitalists.
- jpeg_hero 9y agoNo, this doesn’t work on Wifi. The claim is you need to be on the carrier’s mobile data network, the carrier gives you an IP address, then a website owner asks the carrier who is at that ip address and then the carrier gives the website owner the data that it has on you (your real name, the address where they send the bills, the phone number they assigned to you, etc)
- slipstream- 9y agoYou misunderstood: the commenter said they'd provide a passworded wifi network and a sign somewhere saying "visit this URL to get the password for the wifi!" People would visit that URL using mobile internet...
- CommentCard 9y agoThis is exactly what I was describing. You'd visit the site while on cellular data to get the password.
- k_sh 9y agoYeah, that's what GP is describing, I think - people would visit the evil URL while on a cellular connection in order to, ostensibly, get the password for the secured WiFi connection.
- nacs 9y agoHoly cow. This is scary. With T-Mobile USA, the 2nd link correctly identified my phone number. In the 2nd link though: name, current address, email address, phone number, how long I've had the account, when it renews, who my previous carrier was, my phone hardware details and my current latitude/longitude! This is scary that anyone can access this with just a site visit.
- confounded 9y ago> This is scary that anyone can access this just a site visit. Well, anyone using your phone on LTE.
- deleted 9y ago[deleted]
- itchyjunk 9y agoWhat does this mean for an average person like me? Based on the comments, I can opt out from those specific site but not from the phone company making data available to who ever purchases it? Am I better off going back to no SIM and only Google voice number pointed to a phone? (I did this for some time and recently put a SIM card back in.)
- EGreg 9y agoThe future is in empowering local communities and decentralizing power, via: solar power generation mesh networking local social networks identity that you control on your own phone hopefully the phone hardware and security will be commoditized and auditable. Here is what I'm talking about https://www.youtube.com/watch?v=WzMm7-j7yIY https://www.youtube.com/watch?v=WzMm7-j7yIY Edit: why the downvotes? I am genuinely curious. Can people who feel this way explain?
- ajmurmann 9y agoI think you are being downvoted because you aren't actually answering the parent's question but instead are using the opportunity to sell some vision of the future that might be overly optimistic and in fact might present the parent's concerns as less critical than they should be.
- EGreg 9y agoBut it does answer the root of the question! "Based on the comments, I can opt out from those specific site but not from the phone company making data available to who ever purchases it?" Well you can opt out of the phone company once people decentralize the stuff I mentioned. And then I said the same can be done for power generation companies and so on. But anyway, even though I disagree with it, at least that is a possible reason I was downvoted.
- wallace_f 9y agoWasn't it difficult living without data or a mobile phone connection?
- tehwebguy 9y agoAjit Pai is stoked about this. If you work for AT&T, Verizon, etc you have a responsibility to stop this even by sabotage.
- ethbro 9y agoIf one works for AT&T, Verizon, Comcast, Spectrum (ex Time Warner / Charter), pretty sure they don't have a soul. I know network tech is technically difficult and interesting, but the consumer businesses built around it seem completely devoid of ethics.
- tehwebguy 9y agoI don’t agree, it’s still worth reaching out to these people.
- ethbro 9y agoGranted as possible, I'd just offer the following points. (1) These companies (as far as I know) tend to be technically and creatively conservative (in the sense that they don't like new ideas). (2) They have a captive market and effective monopolies. (3) The type of engineer likely to work at such a company values stability over risk. (4) There is C-level and down support for policies / products like the original article that generate profit. (5) It's a small enough industry (in terms of number of companies) that getting blackballed is feasible. In that context, I don't foresee a logical person making an ethical decision (for leaking or sabotage) when it goes against his or her employer's wishes.
- murukesh_s 9y agoIt's different being the top-management vs working there. You can't generalize all of them as not having soul or is evil. Seriously. Unless you have been in their situation, you cant judge. Not everyone would get the freedom to work at their dream role/job/company.
- ethbro 9y ago
- jlgaddis 9y agoVZW (in .us): First link: Didn't work, kept saying my billing zip code was incorrect. Second link: "We used our mobile authentication to instantly discover your mobile phone number from the phone network." but it didn't show any information.
- sbr464 9y agoVerizon here and everything worked, all info. US
- jsmthrowaway 9y agoVerizon on the first link worked just fine here, but they made up porting dates and a few other things.
- throwaway2955 9y agoAFAIK the carriers require a double opt-in for this. The first opt-in, which the Medium article describes, can be online with boilerplate language. But then you have to opt-in a second time by replying to an SMS sent directly to the device by the provider with language pre-determined by the carrier. The user has to reply YES to the text message, and you have to keep auditable records of these things. If these 2 providers aren't requiring the second opt-in step, I expect they'll be kicked off the platform pretty quickly.
- deleted 9y ago[deleted]
- lima 9y agoIf that's the case, why don't the carriers do the second step themselves? That's the very least they could do to protect their customer's privacy.
- foodstances 9y agoI just visited both sites and both showed my full name, e-mail address, physical address, and T-Mobile billing plan information. I never opted into anything on T-mobile's site (and I can't find any opt-outs that I don't already have), I never opted into a text message, and only one of the sites required any other info (my zipcode).
- Invictus0 9y ago
- throw2016 9y agoThis is a race to the bottom. This industry is neck deep in perpetuating a culture of surveillance that most here benefit from, and see no problem in stalking people around. So much for techies improving the world. That's why moral and ethical posturing must be met with ridicule and skepticism. When it comes to actual action most people are much more narrowly focused with a unique ability to live in dissonance and hand wave and brush away nearly anything. Only regulation with laws and consequences works.
- maxpert 9y agoDidn’t work for me
- davidmurdoch 9y agoSame here. First link returned "Joe Consumer" for me, second link errored out.
- tyingq 9y agoYou do have to turn off WiFi, in case you missed that.
- confounded 9y agoI wonder if this is behind so many of the stories about seemingly impossible de-anonymization by Facebook.
- artificial 9y agoProbably more to do with horrible opsec and machine vision than anything. Even pornhub can process their content to identify actors. FB buys a ton of data and accumulates from public sources. Other advertising companies do similar things by partnering with creditors. A use for this is matching sales with lead origination. Grocery stores do this with coupons.
- austenallred 9y agoThey’ve been doing this for years. You can also license real-time GPS and WiFi location. Perfect for geotargeted ad campaigns.
- confounded 9y agoCan a telco access those things? My understanding was that this would need to come from the phone’s OS (or an app with appropriate access).
- SamReidHughes 9y agoIf you’re connected to the cellular network, they know where you are.
- derimagia 9y agoThey aren't not talking about cell towers like the article mentions. They said GPS.
- icebraining 9y agoMany telcos have their own "customized" version of the OS.
- walterbell 9y agoHow about iOS, can a telco access GPS location if there’s no telco app installed?
- willstrafach 9y agoAt the very least, they can use Cell-ID
- foodstances 9y agoIn addition to both sites correctly showing my full name, phone number, mailing address, and e-mail address, (and the Danal site showing my T-mobile phone plan info) the Payfone site shows this ominous description: https://i.imgur.com/WkPj5Gb.png https://i.imgur.com/WkPj5Gb.png I've had someone tell me they visited a shopping site once and without giving the company any information, they got an e-mail from that company a day later. I told them it wasn't really possible (from just the browser's perspective) and that they must have been tracked through some 3rd party cookies. Apparently that was false and it's totally possible for a site to use one of these APIs and instantly get your full name, phone number, e-mail address, and physical address just by looking up your IP, and then track you across "switching carriers, changing phone numbers, upgrading devices, and replacing lost devices". Scary shit.
- chinathrow 9y agoI really hope that the EU slashes these companies once its 2018.
- pilsetnieks 9y agoShit like that is blatantly illegal under current EU laws already
- davb 9y ago> I've had someone tell me they visited a shopping site once and without giving the company any information, they got an e-mail from that company a day later. I had this once from a Cisco reseller in Glasgow. It looked like they done a reverse DNS lookup on our office IP, then a Whois on the domain and just spammed the crap out of me. They started calling a day or two later. When I told them how creepy and inappropriate it was, they actually seemed proud of the lead gen system they subscribed to. They emailed the admin contact of the domain, which is what tipped me off.
- philip1209 9y agoClearbit sells a basic IP lookup system like this
- matheweis 9y agoImpressive; it managed to pull my phone number, my current address, my previous address, all without any info at all (I didn’t provide any info in the first link, just in case that was somehow priming the second one).
- pritambaral 9y agoAnd scary. Any code running on your phone has access to all this information, with just a few HTTP calls, when your phone is on cellular data.
- home_boi 9y agoWell this is scary. We should see more concentration on privacy/security at the mediocre tech companies (because engineer pay is a decent indicator of privacy standards and security strength), ISPs, health care companies and financial companies. They have very personal data and many of them actually sell the data (and apparently even unanonymized data). I feel that all the talk of privacy at the big tech companies like Google, FB, etc. is unwarranted compared to the threat. They have solid security and don't actually sell data. Letting advertisers target viewers based on demographic data is different from providing anonymized data to people and they have policies that make sure that advertisers can't get too narrow with their targeting.
- amrrs 9y agoI know a person in a telecom company in Analytics (Digital and CVM). They have the ability to see the phone number (only encrypted) browsing their current website. This information is part of clickstream but it is not shared with any third party because it's a confidential information that if shared without customer consent will bring loads of issues to company. The recent GDPR is one thing that keeps companies on their toes.
- EGreg 9y agoYeah, so like, we passed this bill this year: https://www.usatoday.com/story/tech/news/2017/04/04/isps-can-now-collect-and-sell-your-data-what-know-internet-privacy/100015356/ https://www.usatoday.com/story/tech/news/2017/04/04/isps-can... And Trump signed it: https://www.nbcnews.com/news/us-news/trump-signs-measure-let-isps-sell-your-data-without-consent-n742316 https://www.nbcnews.com/news/us-news/trump-signs-measure-let... Hey Republicans in the audience, can you at least acknowledge that on this issue, the GOP may have gotten things wrong?
- Moto7451 9y agoNeither link were able to dig up any info on me. My current plan came from a prepaid carrier TMobile purchased so I’m guessing I’m not properly opted in or the TOS that I agreed to that TMobile inherited does not allow it.
- morganvachon 9y agoNeither link worked for me either, but it may be because we're all hammering the servers. Still, FWIW I'm on Xfinity Mobile for my phone (which rides on top of Verizon's service) and Ting on my iPad (on Sprint's network). I'll try again later today.
- throwanem 9y agoNot Ting! I tried the first one expecting a spook, but Ting fed it bogus data: https://i.imgur.com/woOZumM.jpg https://i.imgur.com/woOZumM.jpg ETA: The second one choked up a Wordpress error. So, not sure what to make of that.
- zajd 9y agoTing is so awesome -a happy customer
- ReverseCold 9y agotry the second link :)
- threecoins 9y agoValues with a * are simulated values it seems, which means those values are unavailable, as per the footnote in there. Not bogus data from your ISP atleast.
- misframer 9y agoI'm on Ting (GSM). The second link had my number, name, and address.
- throwanem 9y agoWell crud.
- edwhitesell 9y agoI'm on Ting, CDMA (Sprint) and neither link worked. Not found errors.
- foodstances 9y agoFWIW, both sites showed my real information initially, and now one of them shows that bogus info. I think they're just showing that default data due to load problems.
- philip1209 9y agoWell, Google Fi does not seem to be selling my information . . . Externally
- gusmd 9y agoSame here. On Fi and don't see any personal information there.
- zpr 9y agoSame here, I'm on Google Fi and none of my information comes up. Only a "Joe Consumer". Ironic?
- harigov 9y agoOr those site builders didn't care enough to make the API calls?
- harigov 9y agoBTW, it doesn't make much sense for Google to sell this information anyway. They build vertical products on top of this information. If a third party wants identity verification, they can use Google account. If they want to sell ads, they can use Google ads. By providing information directly, they will be undercutting themselves. It doesn't make sense.
- minton 9y agoHow is Google Fi? Is it a full replacement for Verizon and others?
- dgacmu 9y agoYes. It's basically an MVNO that resells on Sprint, TMO, and US Cellular, while trying hard to keep calls and data going over WiFi. As a consequence of that, it only works on newer phones that can do fast handoff between WiFi and cell. I use it. It works pretty well. My wife is still on Cricket and she got better coverage in the mountains of Colorado this summer, but I've been happy everywhere else. The pricing is very as-you-use it, which works well for some people and not as well for others (it's great for people who use very little data but want flexibility; the international data roaming is amazing; it's more expensive than other plans for multiple-GB/month users). I put together a spreadsheet (copyable, google sheets) for comparing price vs GB/data used when I was trying to figure which carrier to use. If it's useful - https://da-data.blogspot.com/2015/10/comparing-prepaid-cell-plans-public.html https://da-data.blogspot.com/2015/10/comparing-prepaid-cell-... (Updated: I just updated the pricing, since it was getting a little stale.) (Ob disclaimer: I'm part time at Google, but have no beans in the cellular stuff.)
- Trav5 9y agosarcasm: It's a good thing https is becoming so prevalent to prevent man in the middle privacy concerns.
- pritambaral 9y agoWell, the classical MitM attacker is someone trying to gain/manipulate information. In this case, the "Man" in the middle is simply giving out information it already has.
- joepie91_ 9y agoNot sure what that has to do with anything. Different threat model, different technology.
- jimktrains2 9y agoI have Verizon Wireless and have opted out of all of the options on their account privacy page a long time ago (at least a year), but I still show up in these tests. What recourse do I have?
- SubiculumCode 9y agoI have long felt that opt outs are not respected.
- larkeith 9y agoA VPN. ISPs and Telcos have made it abundantly clear that without significant legal and financial pressure, they will never respect the slightest modicum of consumer privacy.
- jimktrains2 9y agoAnd how do I know the VPN is trustworthy?
- Whitestrake 9y agoOne option would be paying for a VPS on AWS or Linode or DigitalOcean or Vultr or any number of similar providers - pick the lowest spec machine, raw network throughput is not very hardware dependent - and set the VPN up yourself. Streisand is pretty useful for this purpose. https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
- nasredin 9y agoIf you go that route, please set up hosts-based adblocking as a FU to the advertising industry.
- closeparen 9y agoWhy is a random VPS provider's ISP more trustworthy than your own?
- QUFB 9y agoSo what happens now? They shut down the scary demo site, keep selling the information, and the new administration's FCC won't do a thing about it.
- woobar 9y agoBest case scenario - the story picked up by the media. If somehow this is not covered by the TOS, an entrepreneurial lawyer will file a class action lawsuit. And we will get $10 credit for our service after the settlement. And then this 'service' will become a part of the telcos TOS.
- nasredin 9y agoWhat's the worst case scenario Mr. Cynic? This is not Equifax-big so apart from the outrage by all the nerds nothing will happen and we will all be here next year outraged at some new privacy-raping revelation.
- yardie 9y agoThe dev link appears to be down. I guess someone shut the door or the API crashed.
- SomeStupidPoint 9y agoI propose we use this technology for a lead-gen platform for a campaign about privacy rights. I'm sure collectively HN could sneak this technology onto enough web platforms to reach a sizable portion of the US. So let's do it. Let's just call everyone we can possibly get the number of and tell them exactly how we got it -- their phone company sold it to us when they loaded a bit of code while visiting innocuous websites.
- olegkikin 9y agoThat's why Ghostery is important, at least it can help with the cookie part.
- dawnerd 9y agoNo, it’s why a vpn is important. Ghostery does absolutely nothing to prevent your subscriber details from being released.
- olegkikin 9y agoVPN will not stop them from tracking you with cookies. So both are important.
- thatzerodude 9y agoVPN will sell you out. (See PureVPN). Tor and I2P are important.
- justinclift 9y agoYou might want to look into who the owners of Ghostery are now. They've changed owners since starting out, and the newest ones seem pretty dodgy.
- lunarjones 9y agopatriots are worse
- gabriel34 9y agoGhostery is sort of shady. Try Self Destructing Cookies + uBlock + noScript
- thisacctforreal 9y agoInsane to think an app on your phone can request the demo page to see the details. I assume they have CORS setup properly to not allow any old JS to scrape it, they would have to explicitly allow origins access for that.
- philipn 9y agoI believe a native mobile app would be able to make the request and scrap the data, regardless of CORS. Because basically no suspicious information is transmitted, it'd be pretty easy to squeeze past an app store review. Of course, you could buy one of these services and have access, too.
- Groxx 9y agoCORS is strictly browser-side enforced, so yes - any app can make this query and scrape the response.
- kuon 9y agoHow does it work? I mean, most carrier here in Wurope don't give you an ip, your phone has an internal (10.xxx most of the time but also IPv6 only) ip and you are behind a NAT, which means hundred (up to PAT scalability) of devices may share a common IP. Those API would need the source port number in addition to the IP, is it the case?
- kevin_nisbet 9y agoOne way, although I suspect it's dieing, is some of the network equipment supports header injection. So what will happen, if you go to an approved URL, the network will inject headers into the HTTP request that contain you're 10.xx IP address, IMSI, etc, which can allow it to survive a NAT. This tends to get used mostly for internal traffic and partners where an agreement exists, although I think I read once that a US carrier messed up their configuration once and the header injection was happening on every site. For encrypted traffic, I'm not sure what's happening these day's.
- c_prompt 9y agoI just emailed this company at general@danalinc.com (which is the address stated in their privacy policy [1]) to remove all of my information from all databases/backups and to never collect it again. Came back undelivered with a 550 error (Recipient address rejected: Access denied). [1] https://danalinc.com/privacy-policy/ https://danalinc.com/privacy-policy/ - "Danal is committed to ensuring that the information we obtain and use about you is accurate for its intended purpose. You can contact us at general@danalinc.com at any time to review, update, delete or correct (for future use) your personally identifiable information maintained by Danal. We will reply to your request within thirty (30) days of submission. You can help us maintain accurate records by informing us of changes or modifications to your personal information." Edit: For payfone: https://www.payfone.com/company/privacy-policy/ https://www.payfone.com/company/privacy-policy/ - info@payfone.com
- c_prompt 9y agoReceived an almost immediate message back from payfone: "Hi [my name], While we should explain more clearly that these services are used to protect consumers from fraud, with one's consent, you can set up what you are asking about with your phone company. We can send you the procedures to do that. I'd like to go a step further and see if we can just opt you out entirely across the board. I should also note that we do note store any current or historical personally identifiable data. Hold on for more info." As an aside, I didn't provide [my name] with my request - of course they looked it up based on the phone number provided.
- bogomipz 9y ago>"While we should explain more clearly that these services are used to protect consumers from fraud." So if my someone's phone is lost or stolen they won't be able to use their credit card or debit card? Wow that sounds like quite a service - losing access to your phone now means losing access to your money? So your card is blocked because of a fraud alert and you have no ability to call your bank or credit card company. You better hope you are not by yourself when this happens. I would close or cancel any account or card if they ever put me in such an imposition as a result of using this service.
- vermontdevil 9y agoWhat the hell can we do? Cancel phone contracts and just rely on WiFi? Other options?
- rosser 9y agoIs anyone else getting NXDOMAIN for democf.danalinc.com? Is that perhaps an "Oh, shit. They found us!" move?
- pde3 9y agoEFF and other privacy groups fought against this for a long time, and eventually succeeded in having the FCC intervene to stop these practices: https://www.eff.org/deeplinks/2016/03/victory-verizon-will-stop-tagging-customers-tracking-without-consent https://www.eff.org/deeplinks/2016/03/victory-verizon-will-s... Then one of the first things Trump and the Republicans in Congress did after the election was repeal the FCC's privacy rules :( https://www.eff.org/deeplinks/2017/03/five-ways-cybersecurity-will-suffer-if-congress-repeals-fcc-privacy-rules https://www.eff.org/deeplinks/2017/03/five-ways-cybersecurit...
- cmurf 9y agoThat's because privacy is not a right in GOP land. It is a product. And therefore you should have to pay to get it.
- artificial 9y agoWhich country are you from where privacy is a right?
- brianjoseff 9y agoCalifornia Constitution. Article 1, Section 1: "All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy." https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CONS§ionNum=SECTION%201.&article=I https://leginfo.legislature.ca.gov/faces/codes_displaySectio... (not a country of course, but somewhere privacy is a constitutional right. question then is how a state can protect this right)
- boon 9y agoTo be fair, the "pursuit" of those things are considered natural rights. Not the things themselves. Not saying that a right to privacy doesn't exist. I think it exists because a combination of other rights DO exist. But rights can't obligate others, and if your information ends up in the public sphere, I don't believe you have a natural right to have it taken down. If you contracted with a third party, and as part of that exchange, your info was supposed to be secured, you have a right to secure damages within the scope of that contract.
- SolaceQuantum 9y agoNeither links work for me: Wifi disabled on T-mobile iPhone 7.
- matwood 9y agoSame. I think the companies shut down the APIs for damage control.
- dmitrygr 9y agoStraight Talk (att mvno) Demo doesn't work: You have a privacy setting on at Your mobile operator. Try this demo on another phone.
- larkeith 9y agoShamelessly plugging the Librem 5 [1] here, as this article demonstrates precisely why we need a privacy-focused, FOSS phone. While the carriers having access to some of this information would not be prevented on a carrier-based data plan (and I personally am not yet ready to switch to WiFi-only), using a non-proprietary Linux distro means much simpler VPN support (one year of free VPN is also one of the stretch goals!). It might also be possible to compartmentalize PII availability by using WiFi only with an external data hotspot (e.g. the ones sold by FreedomPop), perhaps in conjunction with a VPN. [1] https://puri.sm/shop/librem-5/ https://puri.sm/shop/librem-5/
- jimktrains2 9y agoYou can already vpn pretty easily on an Android phone. The bigger issue is how do we know that the VPN is trustworthy?
- larkeith 9y agoOne fairly trustworthy solution is to just set up a DigitalOcean droplet ($5/month) (or any other cloud provider, I just prefer DO), and host your own VPN. DO provides a guide at https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04 https://www.digitalocean.com/community/tutorials/how-to-set-... With regards to setting it up on Android, that does alleviate this specific privacy concern, however it is still entrusting your OS to Google and our carrier, neither of which have the best track records in consumer information privacy. Android also has limited app access controls and frequently comes with carrier-required bloat/spyware.
- nerdponx 9y agoFWIW, DO can still see who is connecting to your droplet and what your droplet is connecting to. That's probably fine for staying out of sight from your mobile carrier. But many of the top VPN hosts now explicitly offer "no logging" as part of their services, like Private Internet Access. Don't forget that Android is open-source, open-source, non-backdoored versions of Android exist.
- nerdponx 9y agoIt looks like both demo services have been taken down.
- chiefalchemist 9y agoDoes anyone know how to prevent or mitigate this? For example, will my VPN provider's app help? Or is that a false sense of security?
- randomfool 9y agoAT&T’s privacy policy states: “We will not sell your personal information to anyone, for any purpose. Period.” How is this not contrary to that? Additionally, they define personal information as: "Personal Information: Information that directly identifies or reasonably can be used to figure out the identity of a customer or user, such as your name, address, phone number and e-mail address. Personal Information does not include published listing information." http://about.att.com/sites/privacy_policy http://about.att.com/sites/privacy_policy
- jey 9y agoMaybe these are considered "business partners" and not "anyone"? :P
- zymhan 9y agoLooking into the full policy, they seem to punch some pretty big loopholes in it > Here are just some of the ways we use it. To: > Deliver Relevant Advertising; > Create External Marketing & Analytics Reports; http://about.att.com/sites/privacy_policy/full_privacy_policy http://about.att.com/sites/privacy_policy/full_privacy_polic...
- FireBeyond 9y agoProbably by legalese. "We're not selling it, we license it."
- dawnerd 9y agoOr its given away for free as part of a "data sharing" agreement. Or really any number of ways your data isn't directly being paid for.
- droopybuns 9y agoYou can opt out of the advertising collection here: https://cprodmasx.att.com/commonLogin/igate_wam/cmpmobile.do https://cprodmasx.att.com/commonLogin/igate_wam/cmpmobile.do
- 9y ago
- bojackstorkman 9y agoNeither of those examples are accessible through my phone (VeriOn, US). The first one says the dns server couldn’t be found. The second returns “Error code 8 The proxy failed to connect to the web server.” Any idea why this is? I have a pretty much stock S8
- subway 9y agoIs T-Mobile now blocking this? I get their DNS failure page (I'd have sworn I opted out of that too)
- dawnerd 9y agoGetting that too AND I'm using my own dns, so wonder if they just hijacked it.
- kylehotchkiss 9y agoSo when their service gets hacked two weeks from now, we can see the locations of VIPs? Celebrities? Rich people? When they hear about this (after their locations are leaked...) they’ll make telcos fix it, right?
- ericlamb89 9y agolooks like both links have been taken down
- bogomipz 9y agoI am curious are your phone's IMSI and IPv6 address static enough on most US carriers that this service would be reliable?
- libertyEQ 9y agoAfter reading every comment here, I decided to read the actual post and found the links were obfuscated by bitly links. Since I think that is BS: http://democf.danalinc.com/sphere/ http://democf.danalinc.com/sphere/ https://dev.payfone.com/test/mobileauthentication/ https://dev.payfone.com/test/mobileauthentication/
- throwawayjava 9y ago> obfuscated I was reading the article on my laptop and had to type the URLs into my phone, so I appreciated the bit.ly links. Besides, "obfuscated" is a bit strong -- as evidenced by your post, no information is hidden.
- musage 9y agoEven if you provide a shortened link, nothing would stop one from adding the longer link, too. > as evidenced by your post, no information is hidden "not made obvious is a bit of a strong word, as your comment indicates, it does actually exist" It kind of helps when you don't move goal posts mid sentence.
- ben174 9y agoI think the purpose of these "obfuscated" links were to make them easier to type into you phone, if you happened to visit on your desktop.
- kumarski 9y agoairsage.com Safegraph.com Been going on for a long time. I think safegraph does it with SDK data output or something.
- jknz 9y agoIs this service available to personal developers? Do they prevent perverts/psychopath/criminals from using the service? If a malicious stranger on a dating site sends you some link where he gets your IP addres. Using that service, he may be able to collect your phone, full name... and billing address so he can eventually knock at your door a few minutes/hours after your visited the link... How scary...
- sslalready 9y agoThis happens in several parts of Europe as well. It's part of the telcos' billing infrastructures, and many operators for example have middleboxes which allow TCP streams to be looked up against the billing system. I believe the original idea was to allow companies selling ring tones to able to bill customers who downloaded their ring tones directly on the customers' telco bill. From a privacy standpoint it's been a catastrophe. There are countless of operators who have been caught decorating customers' outgoing HTTP traffic with their mobile number or personal details. It's just a few years since one operator was caught doing this in Denmark [1]. Again, just a few years ago, in Sweden, a company setup porn sites and pretty much blackmailed their mobile visitors into paying $$$ for porn they supposedly had agreed to download. This company was using operators' billing APIs to lookup subscriber details from the IP:port numbers of connections to their porn sites [2]. In Norway, a company called MobileTech, use the same APIs to improve unreliable web tracking using cookies. By using these billing APIs they can assign a unique identifier to a particular subscriber regardless if this subscriber clears their cookies or share the connection across multiple devices. Their tracking script (b.mobiletech.no iirc) is embedded on many popular nordic sites. Their improved visitor tracking and demographic data is also sold to third party marketing companies such as Research International. [1] https://www.version2.dk/artikel/mobilsurf-danske-teleselskaber-sender-dit-telefonnummer-til-hjemmesider-70145 https://www.version2.dk/artikel/mobilsurf-danske-teleselskab... [2] https://www.svt.se/nyheter/lokalt/skane/fangelse-for-skaning-som-skickade-porrfakturor https://www.svt.se/nyheter/lokalt/skane/fangelse-for-skaning...
- knowaveragejoe 9y agoHaven't been able to use either site. Anyone know why these are down now?
- codedokode 9y agoWell this is how free market works, isn't it?
- rrggrr 9y agoCaller ID is available via Twilio here: https://www.twilio.com/lookup https://www.twilio.com/lookup Unlisted users might be able to present any data they please here: https://www.listyourself.net/ListYourself/listing.jsp https://www.listyourself.net/ListYourself/listing.jsp
- lunarjones 9y agostill fuming at the way the patriots did that - do we know if the balls had the correct pressure? I think we need better checks. Period.
- lunarjones 9y agoso we know for sure that the patriots screw with ball pressure? seems clear. Period.
- zanedb 9y agoWell, the first demo is now returning a NXDOMAIN error.. they likely just changed their DNS after this blew up. The second domain just returns a WordPress error. So, I never got to experience the data myself but I'm sure it's there. Does anyone have a new working demo URL for either service?
- drumttocs8 9y agoWe all have a lot of outrage over this. What are we going to do about it? What tool can we build to fix it, either on a technical level or at a social level?