4 ms·

This reminds me once again that the weakest link in the privacy chain today is the mobile phone number, especially since governments in many countries have forc

This reminds me once again that the weakest link in the privacy chain today is the mobile phone number, especially since governments in many countries have forced people to link their number to a real ID. It's essentially become a ID number by proxy. However, in the case of the article, the reporter should know to inform her sources not to enter _any_ information linking to her real-world identity into their electronic devices.

mherdeg 7y ago
I got a free loaner phone once a few years back ("Samsung Ultimate Test Drive") which came with pre-activated mobile phone service and was very clearly re-using a phone number that someone else had quite recently actively been using. While it was weird to get SMSes about SoCal drug deals, the strangest thing of all with that phone was opening the Lyft app and being automatically signed in to someone else's Lyft account on the basis of my auto-confirmed phone number. Their active credit card was linked to the account and I could take free rides! (I didn't... but it was very hard to sign into a different Lyft account when the phone # was actively linked to another, live account.)
- jmkni 7y ago
  You could have signed into Whatsapp as well.
- wycy 7y ago
  Is this because Samsung simply sent you a phone that hadn't been wiped and was still signed into all these accounts, or was it really just auto-signed in due to phone number? I did the Samsung Ultimate Test Drive as well and don't recall being auto-signed into anything (though I also got many SMSes and calls intended for the previous owner).
  - mherdeg 7y ago
    Well, when I got the device, the Lyft app was not installed. I visited the Play store, installed the Lyft app and ran it, and then: the Lyft app immediately signed me in, told me that my full name was Britney G-------, showed me "my" full e-mail address, and offered to let me book rides on her behalf, paying with her linked Visa card. It wasn't even clear how to switch accounts; it was like they were using the phone # as a primary key. I sent Samsung some feedback about this but don't think the issue was on their side per se.
mjevans 7y ago
The biggest threat to privacy, is how little (most, nearly all) other users do NOT value someone else's privacy. Re Spam: Pre-screening, and people that actually say something useful to the (automated) screening service. Actual spammers should get fed to a blacklist (filtered for multiple confirmations), and organizations that prosecute spammers should be able to read THAT list. Everyone else has to use a more public API that's rate limited.
DarkWiiPlayer 7y ago
> However, in the case of the article, the reporter should know to inform her sources not to enter _any_ information linking to her real-world identity into their electronic devices. Yeah, that had me kinda puzzled as well. Sure, the app seems like a terrible idea, but ultimately it was one of her contacts who put that information into it.
- dredmorbius 7y ago
  Reporters talk to lots of people, who practice very poor tradecraft. Which suggests: everything this story describes also applies to intelligence and law enforcement services. Imagine you're conducting espionage, or are tracking money laundering or drugs smuggling.
PeterisP 7y ago
In the case of this article, the reporter should keep separate "digital identities" for people whom she want's to know her affiliation and those who don't. The main mistake there was that she used her "burner number" for ordering a taxi, when it should have been used just for these contacts.
mesozoic 7y ago
Yeah this is why I keep my old number in Google voice after getting a new one. Not the best option but I can't quite figure out all the ways I could have accounts compromised if some random person with malintent got my old number allocated.

mherdeg 7y ago

I got a free loaner phone once a few years back ("Samsung Ultimate Test Drive") which came with pre-activated mobile phone service and was very clearly re-using a phone number that someone else had quite recently actively been using. While it was weird to get SMSes about SoCal drug deals, the strangest thing of all with that phone was opening the Lyft app and being automatically signed in to someone else's Lyft account on the basis of my auto-confirmed phone number. Their active credit card was linked to the account and I could take free rides! (I didn't... but it was very hard to sign into a different Lyft account when the phone # was actively linked to another, live account.)

jmkni 7y ago
You could have signed into Whatsapp as well.
wycy 7y ago
Is this because Samsung simply sent you a phone that hadn't been wiped and was still signed into all these accounts, or was it really just auto-signed in due to phone number? I did the Samsung Ultimate Test Drive as well and don't recall being auto-signed into anything (though I also got many SMSes and calls intended for the previous owner).
- mherdeg 7y ago
  Well, when I got the device, the Lyft app was not installed. I visited the Play store, installed the Lyft app and ran it, and then: the Lyft app immediately signed me in, told me that my full name was Britney G-------, showed me "my" full e-mail address, and offered to let me book rides on her behalf, paying with her linked Visa card. It wasn't even clear how to switch accounts; it was like they were using the phone # as a primary key. I sent Samsung some feedback about this but don't think the issue was on their side per se.

mjevans 7y ago

The biggest threat to privacy, is how little (most, nearly all) other users do NOT value someone else's privacy. Re Spam: Pre-screening, and people that actually say something useful to the (automated) screening service. Actual spammers should get fed to a blacklist (filtered for multiple confirmations), and organizations that prosecute spammers should be able to read THAT list. Everyone else has to use a more public API that's rate limited.

DarkWiiPlayer 7y ago

> However, in the case of the article, the reporter should know to inform her sources not to enter _any_ information linking to her real-world identity into their electronic devices. Yeah, that had me kinda puzzled as well. Sure, the app seems like a terrible idea, but ultimately it was one of her contacts who put that information into it.

dredmorbius 7y ago
Reporters talk to lots of people, who practice very poor tradecraft. Which suggests: everything this story describes also applies to intelligence and law enforcement services. Imagine you're conducting espionage, or are tracking money laundering or drugs smuggling.

PeterisP 7y ago

In the case of this article, the reporter should keep separate "digital identities" for people whom she want's to know her affiliation and those who don't. The main mistake there was that she used her "burner number" for ordering a taxi, when it should have been used just for these contacts.

mesozoic 7y ago

Yeah this is why I keep my old number in Google voice after getting a new one. Not the best option but I can't quite figure out all the ways I could have accounts compromised if some random person with malintent got my old number allocated.