6 ms·

https://twitter.com/UnderTheBreach/status/1418889649708208137 https://twitter.com/UnderTheBreach/status/141888964970820813... this tweet says it's BS (they val

• FabianBeiner 5y ago
  https://zerforschung.org/posts/clubhouse-telefonnummern-en/ https://zerforschung.org/posts/clubhouse-telefonnummern-en/
• PragmaticPulp 5y ago
  According to the Tweet, the leaker provides a claimed data sample that is a list of phone numbers without any additional information. A list of 3.8 billion phone numbers that simply exist is useless. The leak would only have value if the numbers were associated with some identifying information. If it’s really only phone numbers, I wonder if it’s a leak or if someone brute-forced all possible phone numbers against a ClubHouse API that leaked information about whether or not the number existed in their database.
  • sebmellen 5y ago
    If Clubhouse can’t detect >3.8B erroneous requests and shut down that API/microservice, that destroys my confidence more than a data breach.
    • mohanmcgeek 5y ago
      Clubhouse didn't have 3.8B users.. why would they have 3.8B phone numbers? This whole thing seems made up.
      • mcintyre1994 5y ago
        Because they encourage users to upload their contacts so they can connect them on the platform. At one point when it was invite-only these uploaded contacts were the only way to invite friends.
        • makapuf 5y ago
          A fair share of my phone numbers are bogus(old numbers, info I store as a phone number even if its not) so the db extracted from here would be dubious
      • jsjohnst 5y ago
        Last I heard, they had around 10M users. Since they employ the, what I would consider, dark pattern of heavily encouraging folks to upload their contact list, that comes out to an average of 380 people per person. Given the Clubhouse user base demographics, I find this at least plausible.
        • acid__ 5y ago
          That would only be true if it were 380 _unique_ contacts per person. Surely there is significant overlap from user to user.
          • jsjohnst 5y ago
            See my reply to sibling comment here: https://news.ycombinator.com/item?id=27949879 https://news.ycombinator.com/item?id=27949879
        • whatch 5y ago
          Shouldn't it be 380 distinct people?
          • jsjohnst 5y ago
            Not necessarily. Do we know every single number in the 3.8B is unique? I’ve seen zero proof of that, but maybe I missed it.
            • sellyme 5y ago
              I'm pretty sure that would qualify as the number being "made up". If anyone disagrees, I'm happy to sell my database of 100B valid phone numbers.
              • jsjohnst 5y ago
                > I'm pretty sure that would qualify as the number being "made up". Not necessarily. Let me give you an example, if there’s other metadata included with a specific contact list entry, it would be valuable to have duplicate numbers, as that extra metadata could then be leveraged potentially.
• mm983 5y ago
  they didn't "validate" anything, they just opened the csv. also i'd be interested in their take on the second column, that looks like clubhouse's scoring system (which they ran without telling anyone, likely for marketing purposes, according to this* article). if so, you can in fact tell which numbers are more significant than others. *https://futurezone.at/apps/clubhouse-leakt-38-milliarden-telefonnummern-illegal/401453233 https://futurezone.at/apps/clubhouse-leakt-38-milliarden-tel...
  • zinekeller 5y ago
    Hmm, so the "highest" numbers would be publicly-knowable numbers anyway (because they are the numbers to dial and contact the government/customer service of a private company). If this is only a list of numbers and their relative popularity, the best you can do is accusation of adultery (and even in that, you could say that you're "popular" because coworkers also store your numbers).