6 ms·

So, at the risk of getting murdered for this sentiment: Who cares? So what if someone knows your address? I guess it's a bigger problem for celebrities or for

by shawn 8y ago

So, at the risk of getting murdered for this sentiment: Who cares? So what if someone knows your address? I guess it's a bigger problem for celebrities or for those who are targeted. But even then, the police are there. Just call them. I'm trying to understand the other side of this.

kaishiro 8y ago
I'm actually with you to a degree - but on the flip side, should we expect repercussions for something like this? Should we just be ok with it? As an industry we tend to play it pretty fast and loose compared to other engineering disciplines.
vvanders 8y ago
> But even then, the police are there. Just call them. Uh, isn't that the exact problem? Once someone knows your address you're a voip call away from swatting.
- shawn 8y ago
  Ah, yeah, I completely forgot about swatting. Good point. The sooner that problem gets solved, the better.
  - AnthonyMouse 8y ago
    > The sooner that problem gets solved, the better. We could just stop having SWAT teams. The events that supposedly justify them are so exceedingly rare that most members of SWAT teams go their entire careers without ever seeing one. But once they exist they get used for all kinds of routine operations that don't actually require them, where all they do is raise tensions and unnecessarily escalate matters. There is a reason there is supposed to be a hard wall between the police and the military. If you really need a military presence, the governor can call in the National Guard. But when does that happen? Even they mostly end up getting called in for hurricane relief and that sort of thing.
    - gm-conspiracy 8y ago
      The National Guard is called in when the local police force kills innocent civilians.
uxp 8y ago
Think of it this way: Two people are playing an online game, and one gets mad at the other. He or she then sends a link to an image or something else to the player they are mad at, effectively siphoning off their IP address. By using this flaw, it could make it trivial to find their real address if it was a comcast customer, and send the SWAT team to their house.
- trocadero 8y ago
  Finding a location by IP address is not always reliable. The first result when googling my IP address yields a city 1,000 miles away (other results have the correct city). Then, knowing the first digit of a street address gets you a range of addresses that can represent anywhere from 1 to hundreds of homes. It's theoretically possible to get a specific address from this method but it's unlikely and not reliable.
  - Firerouge 8y ago
    The point of the article is that you could essentially get the exact address house address from just the IP of a Comcast customer
    - trocadero 8y ago
      Right, and my point is that you essentially can't. For my address the best you could do is narrow it down to ~30 or so homes that share the same first digit as my address. For this to work you have to: (1) Have the IP address return the right location (2) Not have duplicate street names in that location (3) Have a single digit address OR be the only home starting with that number That's going to be a pretty rare combo. Probably less than 1%.
      - meowface 8y ago
        They'll be able to narrow it down to 10-30 homes, but from there they can see who owns those homes, research those people on social media etc., and determine who their likely target is.
arzel 8y ago
The information you obtain from vulnerabilities like these are used to obtain “original” social media accounts, and are then sold for a lot of money. To define what “original” is, take for instance “@shawn” on Instagram or Twitter. When these people target celebrities, they are mainly looking for a laugh and believe their “method” is about to be patched. For example, T-Mobile and Verizon vulnerabilities are used to SIM swap and get around 2FA on instagram or twitter. Usually, they first try to find an employee who works at the store and has access to the database, before going through all the trouble of finding a vuln. This has been an “underground” space for quite some time, but is slowly coming to light. Source: I use to be in this space and made so much money off original usernames. To give you an idea of what a username goes for, I sold the Instagram @b*ss for $20,000.
- lawnchair_larry 8y ago
  How did you get that username?
- komali2 8y ago
  How do users in this space securely transfer money without the FBI kicking down their door the next day?
- shawn 8y ago
  Wow, this is a fascinating answer. Thanks for sharing.
phil248 8y ago
In many jurisdictions, the police will do little or nothing until a crime is committed. It's possible to experience a life-altering amount of harassment before the police will intervene in any meaningful way.
sampl 8y ago
I’m close with someone who actively keeps her address from public records to keep an old stalker from finding her. The psychological effect of having someone treat you like an object, repeatedly hunt you down after moves, and gaslight you/landlords/cops into believing it’s not happening is harmful as it is—let alone the not-so-unlikely chance that someone with this high degree of intelligence and mental health issues will physically hurt you if they find you. There’s not much you can do besides a paper restraining order. By the time the cops come it’s too late. This possibility is a very real part of many people’s lives, but maybe less talked about with men like me because statistically female victims are more common.
- PhantomGremlin 8y ago
  There’s not much you can do besides a paper restraining order. By the time the cops come it’s too late. The cops don't have a specific obligation to "come" to help you. Nor to enforce a restraining order. https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzales https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzale... Everyone should read those two Wiki entries. The law often isn't what people think it is. OTOH if someone breaks into your house and you smoke 'em, then in most states you're in the clear, even without a restraining order. I know that's not what most people here want to read, but it is "the law of the land" in terms of legal precedent.
deleted 8y ago
[deleted]
threatofrain 8y ago
The police? That sounds like a very ineffective solution. People aren't safe because of the police, they're safe because of the trustworthiness of their neighbors. The police can't be there to intercept most crimes; instead they show up to write a report post-fact. But at that point, you're calling the police for documentation of a crime for insurance. Police can't be there to intercept the metaphorical brick through your window. The reason why we feel safe walking outside everyday is because of the fabric of trust in our community.
deftnerd 8y ago
If you operate any kind of Bitcoin related service where someone discusses their wealth (message board, wallet provider, etc), then being able to turn an IP address into a physical address could have resulted in very lucrative forced-entry events where threat of force was used to leverage private keys.
- HeyLaughingBoy 8y ago
  How is this different than just breaking into houses in rich neighborhoods?
  - smelendez 8y ago
    Most rich people don't have huge volumes of cash or anything as liquid as Bitcoin lying around.
matt4077 8y ago
The "other side" consists of: - a select few with good reasons to avoid their address being widely known. Because stalkers etc. - All those infsec bros with their "attack vectors" and their "threat landscape". They'll scream "security by obscurity" when you're using an unlisted URL to share holiday photos, but get really miffed if someone finds out where they live, or where they go running.
nextlevelwizard 8y ago
OK, I bite. Please post your current home address.
- shawn 8y ago
  I was thinking that exact thing in the name of experimentation. A sort of "Please come harass me, I want to see what people have to deal with."
  - LeftTurnSignal 8y ago
    I think that scenario was what happened with one of the more recent swattings in the news. Person A and Person B are getting hot and bothered about something stupid. Person A says "come at me bro, here's my address." Person A gave Person B Person C's address instead. Person B swatted Person C. Person C had no idea what was going on, went outside, maybe panicked, maybe whatever, but Person C was shot and killed because SWAT had no idea. I believe A and B were arrested, but usually the cops don't get lucky. They couldn't find the idiot who tried swatting me, but they don't exactly have a ton of resources either. Shit's scary, especially since it can happen anytime.

by shawn 8y ago

kaishiro 8y ago

I'm actually with you to a degree - but on the flip side, should we expect repercussions for something like this? Should we just be ok with it? As an industry we tend to play it pretty fast and loose compared to other engineering disciplines.

vvanders 8y ago

> But even then, the police are there. Just call them. Uh, isn't that the exact problem? Once someone knows your address you're a voip call away from swatting.

shawn 8y ago
Ah, yeah, I completely forgot about swatting. Good point. The sooner that problem gets solved, the better.
- AnthonyMouse 8y ago
  > The sooner that problem gets solved, the better. We could just stop having SWAT teams. The events that supposedly justify them are so exceedingly rare that most members of SWAT teams go their entire careers without ever seeing one. But once they exist they get used for all kinds of routine operations that don't actually require them, where all they do is raise tensions and unnecessarily escalate matters. There is a reason there is supposed to be a hard wall between the police and the military. If you really need a military presence, the governor can call in the National Guard. But when does that happen? Even they mostly end up getting called in for hurricane relief and that sort of thing.
  - gm-conspiracy 8y ago
    The National Guard is called in when the local police force kills innocent civilians.

uxp 8y ago

Think of it this way: Two people are playing an online game, and one gets mad at the other. He or she then sends a link to an image or something else to the player they are mad at, effectively siphoning off their IP address. By using this flaw, it could make it trivial to find their real address if it was a comcast customer, and send the SWAT team to their house.

trocadero 8y ago
Finding a location by IP address is not always reliable. The first result when googling my IP address yields a city 1,000 miles away (other results have the correct city). Then, knowing the first digit of a street address gets you a range of addresses that can represent anywhere from 1 to hundreds of homes. It's theoretically possible to get a specific address from this method but it's unlikely and not reliable.
- Firerouge 8y ago
  The point of the article is that you could essentially get the exact address house address from just the IP of a Comcast customer
  - trocadero 8y ago
    Right, and my point is that you essentially can't. For my address the best you could do is narrow it down to ~30 or so homes that share the same first digit as my address. For this to work you have to: (1) Have the IP address return the right location (2) Not have duplicate street names in that location (3) Have a single digit address OR be the only home starting with that number That's going to be a pretty rare combo. Probably less than 1%.
    - meowface 8y ago
      They'll be able to narrow it down to 10-30 homes, but from there they can see who owns those homes, research those people on social media etc., and determine who their likely target is.

arzel 8y ago

The information you obtain from vulnerabilities like these are used to obtain “original” social media accounts, and are then sold for a lot of money. To define what “original” is, take for instance “@shawn” on Instagram or Twitter. When these people target celebrities, they are mainly looking for a laugh and believe their “method” is about to be patched. For example, T-Mobile and Verizon vulnerabilities are used to SIM swap and get around 2FA on instagram or twitter. Usually, they first try to find an employee who works at the store and has access to the database, before going through all the trouble of finding a vuln. This has been an “underground” space for quite some time, but is slowly coming to light. Source: I use to be in this space and made so much money off original usernames. To give you an idea of what a username goes for, I sold the Instagram @b*ss for $20,000.

lawnchair_larry 8y ago
How did you get that username?
komali2 8y ago
How do users in this space securely transfer money without the FBI kicking down their door the next day?
shawn 8y ago
Wow, this is a fascinating answer. Thanks for sharing.

phil248 8y ago

In many jurisdictions, the police will do little or nothing until a crime is committed. It's possible to experience a life-altering amount of harassment before the police will intervene in any meaningful way.

sampl 8y ago

I’m close with someone who actively keeps her address from public records to keep an old stalker from finding her. The psychological effect of having someone treat you like an object, repeatedly hunt you down after moves, and gaslight you/landlords/cops into believing it’s not happening is harmful as it is—let alone the not-so-unlikely chance that someone with this high degree of intelligence and mental health issues will physically hurt you if they find you. There’s not much you can do besides a paper restraining order. By the time the cops come it’s too late. This possibility is a very real part of many people’s lives, but maybe less talked about with men like me because statistically female victims are more common.

PhantomGremlin 8y ago
There’s not much you can do besides a paper restraining order. By the time the cops come it’s too late. The cops don't have a specific obligation to "come" to help you. Nor to enforce a restraining order. https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzales https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzale... Everyone should read those two Wiki entries. The law often isn't what people think it is. OTOH if someone breaks into your house and you smoke 'em, then in most states you're in the clear, even without a restraining order. I know that's not what most people here want to read, but it is "the law of the land" in terms of legal precedent.

deleted 8y ago

[deleted]

threatofrain 8y ago

The police? That sounds like a very ineffective solution. People aren't safe because of the police, they're safe because of the trustworthiness of their neighbors. The police can't be there to intercept most crimes; instead they show up to write a report post-fact. But at that point, you're calling the police for documentation of a crime for insurance. Police can't be there to intercept the metaphorical brick through your window. The reason why we feel safe walking outside everyday is because of the fabric of trust in our community.

deftnerd 8y ago

If you operate any kind of Bitcoin related service where someone discusses their wealth (message board, wallet provider, etc), then being able to turn an IP address into a physical address could have resulted in very lucrative forced-entry events where threat of force was used to leverage private keys.

HeyLaughingBoy 8y ago
How is this different than just breaking into houses in rich neighborhoods?
- smelendez 8y ago
  Most rich people don't have huge volumes of cash or anything as liquid as Bitcoin lying around.

matt4077 8y ago

The "other side" consists of: - a select few with good reasons to avoid their address being widely known. Because stalkers etc. - All those infsec bros with their "attack vectors" and their "threat landscape". They'll scream "security by obscurity" when you're using an unlisted URL to share holiday photos, but get really miffed if someone finds out where they live, or where they go running.

nextlevelwizard 8y ago

OK, I bite. Please post your current home address.

shawn 8y ago
I was thinking that exact thing in the name of experimentation. A sort of "Please come harass me, I want to see what people have to deal with."
- LeftTurnSignal 8y ago
  I think that scenario was what happened with one of the more recent swattings in the news. Person A and Person B are getting hot and bothered about something stupid. Person A says "come at me bro, here's my address." Person A gave Person B Person C's address instead. Person B swatted Person C. Person C had no idea what was going on, went outside, maybe panicked, maybe whatever, but Person C was shot and killed because SWAT had no idea. I believe A and B were arrested, but usually the cops don't get lucky. They couldn't find the idiot who tried swatting me, but they don't exactly have a ton of resources either. Shit's scary, especially since it can happen anytime.