9 ms·
TeleSign profiles half of the world’s mobile phone users
- hinata08 3y agoRemember when global surveillance used to be a meme among conspiracy theorists ? Pepperidge Farm remembers What can we say about a corporation doing a trust score for half of the connected population in the world ? I wonder about their ego, or what went wrong in their management.
- KoolKat23 3y agoWould this be a breach of GDPR for us EU residents? I'm getting seriously disillusioned with all this surveillance stuff. At first I thought, you know, these were isolated incidents falling through the cracks, but in truth it's become pervasive and global. The scariest aspect is how individual actors have the ability these days to gather, interpret and isolate individuals from massive datasets, anonymising the data seems pie in the sky. I don't see much stopping it either, in society it seems to be the extremes, some wrongly think GDPR applies to everything and others are so sophisticated they can bypass it completely. Have we gotten too advanced, whereby only experts understand the impacts of our actions? Sorry I'm getting all philosophical.
- tourmalinetaco 3y agoOne of the most sobering experiences I’ve had was reading a writeup on how someone was doxxed using ad telemetry. If that can be done by a lone individual, imagine what can be done en masse.
- youngtaff 3y agoDo you have a link to that article that you could share?
- tourmalinetaco 3y agoUnfortunately it appears the site this had been on is not available anymore. However I found an equally interesting article talking about similar things. Rather than buying aggregate data and attempting to de-aggregate it, this is about targeting an individual using previously obtained information (say email, cellphone, or physical address) and “ad sniping” them. https://onezero.medium.com/google-ads-targeted-at-literally-one-person-could-be-the-future-of-doxxing-8c5b0a9117b9 https://onezero.medium.com/google-ads-targeted-at-literally-... https://archive.is/RFtK5 https://archive.is/RFtK5
- youngtaff 3y agoThanks, I’ll take a read
- Nextgrid 3y agoIt definitely would, but GDPR is not being enforced anywhere near enough to matter. Facebook and Google are still alive and you bet their tracking and profiles are much more accurate than these clowns.
- theonlybutlet 3y agoA sad thought.
- donkeyd 3y ago> Facebook and Google are still alive Well, literally billions of people accept their privacy agreements and actively provide them with data from their phones by using their software. That's quite different from an unknown party telling other companies whether you're reliable without your knowledge based on data neither you nor your provider ever agreed to give them.
- Nextgrid 3y agoNobody reads their privacy agreements. They accept them as a formality because these services became effectively mandatory to participate in modern society, but they do freak out when they see the consequences of all this non-consensual data collection: https://www.newstatesman.com/science-tech/2016/09/people-you-may-know-facebook-s-friend-finding-algorithm-putting-you https://www.newstatesman.com/science-tech/2016/09/people-you...
- 0xThiebaut 3y agoIt is, and this article announced Noyb filed a complaint against BICS, TeleSign and Proximus with the Belgian DPA to request actions be taken (investigation, fines, removal of data, …). A translated complaint is available at https://noyb.eu/sites/default/files/2023-06/DRAT%20TELESIGN%20COMPLAINT%20FINAL%20-%20redacted-%20EN%20AUTOTRANSLATION.pdf https://noyb.eu/sites/default/files/2023-06/DRAT%20TELESIGN%...
- ale42 3y agoOriginal in French for those who speak it: https://noyb.eu/sites/default/files/2023-06/DRAT%20TELESIGN%20COMPLAINT%20FINAL%20-%20redacted.pdf https://noyb.eu/sites/default/files/2023-06/DRAT%20TELESIGN%...
- yjftsjthsd-h 3y agoFor that matter, doesn't California have similar privacy laws?
- _ktx2 3y ago> I wonder about their ego, or what went wrong in their management. The article didn't insinuate that data is being used to objectively harm users. It's being used to generate "trust scores" for anti-fraud systems. The specific example given in their piece is allowing a user to attach a certain number for SMS verification. Rather, the point here is that such data could be used to objectively harm users, so those users should have to provide consent. Second to that is that BICS doesn't appear to inform users requesting GDPR data that their data was shared. I'm not sure I'd label that failures in ego, it smells like failures in process and compliance, which also need to be dealt with in lawsuits.
- sologoub 3y agoIt likely does cause users to be treated differently and that may not always be lawful or in users best interest. I was forced to go to a bank branch likely because my provider doesn’t share the data. Better yet, when I realized my mistake of dealing with the said bank, going to the branch was the only way to stop the application.
- hashstring 3y agoI do not agree with these practices. However, I do think there is room for protocols that verify phone numbers in a way. The spam and fraudulent calls that people receive and are hard to distinguish from “good” calls is a problem that deserves more attention.
- wuiheerfoj 3y agoThis would be a nice use case but the reality is everyone still gets a boatload of scam calls, so these companies are farming the data and using it against us instead of for us
- hashstring 3y agoYes, exactly, as expected.
- flangola7 3y ago> This would be a nice use case but the reality is everyone still gets a boatload of scam calls Scam calls are almost unheard of in Europe. Why is it such a problem in the US?
- wuiheerfoj 3y agoI’m in Europe and get plenty of spam calls
- calgoo 3y agoI get a bunch of scam sms messages and calls from scam financial firms here in Spain. That’s ignoring all the local spam calls from every phone provider and insurance company here.
- rnk 3y agoPhone numbers have some value as a verification endpoint, but because it's so easy to steal people's mobile phone numbers via Sim jacking, calling the phone company and saying Hi. I'm xyz and I have a new SIM card and please transfer my number to me, it happens all the time, mobile phone numbers are not safe for this purpose.
- chayesfss 3y ago[dead]
- jaclaz 3y agoSide note/doubt. By asking to have your data through a GDPR request you are effectively giving to the receiver of the request: 1) your full name 2) your phone number 3) your e-mail i.e. basically a confirmation that both the phone number and e-mail are good/active/attended and that they are yours (and that you "exist"), while the data they may already have likely is only the telephone number and the patterns of its usage. I have no idea how it could be possible to make a valid request without providing this kind of info (i.e. providing only the phone number, which they already have). Maybe a sort of (public/certified) authorization service?
- methou 3y agoDoes the full name have to be your legal name? I use different names/email on every site, but phone numbers are always these 2~3 numbers. If I'm going to send a deletion request under GDPR alike laws, it would be under different names.
- donkeyd 3y ago> Does the full name have to be your legal name? Pretty much. Only your person has rights, not the fake identities you created. They can actually request a copy of an ID or something comparable to confirm your identity. You might have a hard time removing your data, in some cases, when using fake names since then your identity can't be confirmed.
- jaclaz 3y agoYes, and unlike a sign up for a random site, you are actually stating the info and signing the form, it is as "official" a document as a non-notarized/non-certified one can be, there could be (improbable anyway in practice) legal consequences if you sign something with fake or non-existing data, it is a false declaration. And when you (if asked/needed by the procedure) provide a copy of your ID, you are actually giving them other data points, like your birth date, often nationality, and in some cases even the address of residence.
- lucb1e 3y ago
- methou 3y agoI know there are several services that helps you with removing your data from data brokers continuously, but only limits to residents in Countries which has GDPR alike laws. I feel defenseless against these sophisticated international corporation mass surveillances. Sending GDPR to each of them when you have learned their existence is like whac-a-mole.
- rnk 3y agoThe only way to stop them I can forsee is them losing expensive lawsuits where the outcome is they have to ask your permission first, along with a clearing house to find out where all of them are so you can check and tell them no - of course they'll try to set it up legally so that if you use your credit card it will indicate default approval or something.
- lxe 3y agoIs there any legal way to obtain your own data from these companies? Does the US have any law that compels them to provide my own data they have on me and any derivative scores they calculate from it?
- humanistbot 3y agoCalifornia does, but not federally.
- lxe 3y agoSo as a California resident, I can request data from them under CCPA? According to this: https://oag.ca.gov/privacy/ccpa#sectionc https://oag.ca.gov/privacy/ccpa#sectionc, yes?
- zie 3y agoAssuming they do business in CA, so CA law applies, yes. That doesn't mean they comply with the law, and as far as I know, enforcement is mostly still on a ya, sure we will get around to it someday attitude. So, just because you can in theory, doesn't mean you can in practice. Let us know how it works out for you!
- rsync 3y ago"Is there any legal way to obtain your own data from these companies?" Of course there is: sign up and use their API. For many years I had the "Ekata Reverse Phone" API enabled in my Twilio account which allowed me, for 8 cents or something, to query a phone number and see subscriber history, "related subscribers", address history, etc. Kind of a neat party trick. It also allowed me to verify and re-verify that the fictional nyms my SIM cards and phone numbers belong to have almost zero history or identification ...
- foo-bar-bat 3y agoThanks for posting this here. Does does like neat party trick. I got randomly assigned a "troubled" phone number once. It was a PITA. It should probably be illegal for phone companies to recycle numbers from old users with certain types of legal or financial problems, to innocent random new users who are literally paying for the privilege of inheriting a hot mess.
- WanderPanda 3y agoWhats up with companies like BICS and SWIFT being in Belgium, is it just chance or is there more to it?
- csomar 3y agoSWIFT was founded 50 years ago, around the time of the Brenton woods system collapse. BICS parent company seems to be much older, from the telegraph era. These are mostly behemoth created as a consequence of the West rising at the time.
- velavar 3y agoI work in fraud prevention with vendors such as this. Let me be the devil's advocate here: trust and risk scores such as these are often very useful for identifying account takeovers and stolen identities in the financial and telecom worlds. We often see folks on HN complaining about how banks don't protect them from fraud losses - companies like this are how there is any hope left for some modicum of consumer protection. You may ask: Then why do banks not protect me from losses better? I say: They're already doing something (invisible as it may be). They can definitely do a better job. But without companies such as Telesign, fraud losses would far, far worse. You may ask: What if my data gathered is used for nefarious purposes? I say: In my experience, data such as this is not allowed to be used for marketing purposes but strictly for consumer protection. I'm not specifically speaking about TeleSign but similar vendors. The worst that should happen is that you get a transaction declined, or get denied for a credit card etc. But no marketing or any other manipulative practice is allowed, in theory. Happy to answer any questions you may have :)
- Andrex 3y agoHow confident are we Telesign will never ever be the victim of a data breach?
- zie 3y agoSince the NSA has shown they can't do it, I'd venture to guess the likelihood of Telesign or any other company being breached is approaching a 100% chance.
- velavar 3y agoAhh that's a great question - it's a very real risk. In my mind, most of the data these companies have is sourced from other companies so all that these vendors do is increase the surface area for the attack vectors. And the (probably naive) hope is that the attackers can't do much with data such as trust scores and the underlying factors.
- tpxl 3y ago> They're already doing something (invisible as it may be). They can definitely do a better job. But without companies such as Telesign, fraud losses would far, far worse. Until banks accept that they got defrauded, not you, whatever they do will be too little.
- deleted 3y ago[deleted]
- peanut-walrus 3y agoPlease someone blow the lid off the telco fraud world already. The reason companies such as telesign exist is because telcos are allowing fraudsters and scammers to run amok using their infrastructure and in lots of cases directly benefiting from their activities or even participating themselves. The whole telephone system is broken and the ones running the show are not showing any intent to fix it.