3 ms·
According to the Tweet, the leaker provides a claimed data sample that is a list of phone numbers without any additional information. A list of 3.8 billion pho
by PragmaticPulp 5y ago
According to the Tweet, the leaker provides a claimed data sample that is a list of phone numbers without any additional information.
A list of 3.8 billion phone numbers that simply exist is useless. The leak would only have value if the numbers were associated with some identifying information.
If it’s really only phone numbers, I wonder if it’s a leak or if someone brute-forced all possible phone numbers against a ClubHouse API that leaked information about whether or not the number existed in their database.
- sebmellen 5y agoIf Clubhouse can’t detect >3.8B erroneous requests and shut down that API/microservice, that destroys my confidence more than a data breach.
- mohanmcgeek 5y agoClubhouse didn't have 3.8B users.. why would they have 3.8B phone numbers? This whole thing seems made up.
- mcintyre1994 5y agoBecause they encourage users to upload their contacts so they can connect them on the platform. At one point when it was invite-only these uploaded contacts were the only way to invite friends.
- makapuf 5y agoA fair share of my phone numbers are bogus(old numbers, info I store as a phone number even if its not) so the db extracted from here would be dubious
- jsjohnst 5y agoLast I heard, they had around 10M users. Since they employ the, what I would consider, dark pattern of heavily encouraging folks to upload their contact list, that comes out to an average of 380 people per person. Given the Clubhouse user base demographics, I find this at least plausible.
- acid__ 5y agoThat would only be true if it were 380 _unique_ contacts per person. Surely there is significant overlap from user to user.
- jsjohnst 5y agoSee my reply to sibling comment here: https://news.ycombinator.com/item?id=27949879 https://news.ycombinator.com/item?id=27949879
- whatch 5y agoShouldn't it be 380 distinct people?
- jsjohnst 5y agoNot necessarily. Do we know every single number in the 3.8B is unique? I’ve seen zero proof of that, but maybe I missed it.
- sellyme 5y agoI'm pretty sure that would qualify as the number being "made up". If anyone disagrees, I'm happy to sell my database of 100B valid phone numbers.
- jsjohnst 5y ago> I'm pretty sure that would qualify as the number being "made up". Not necessarily. Let me give you an example, if there’s other metadata included with a specific contact list entry, it would be valuable to have duplicate numbers, as that extra metadata could then be leveraged potentially.
- jimkleiber 5y agoI'd say it's even more of a dark pattern than that. They didn't encourage me to "upload my contact list" but rather "give access to my contacts" (or something like that) Perhaps the difference is trivial in how it's coded yet even though I've removed their access to my contacts, they still have my contacts. I think they should have to delete them whenever I remove their access, or not even upload them in the first place but just read them when necessary. Also, some apps seem to do this with photos, asking for access, does anyone know if these apps also upload all of one's photos once the user grants permission on iOS?