10 ms·
One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Y
by qingcharles 2y ago
One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do.
As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd.
And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketplace, find an exec and buy their details for pennies and call them up on their cellphone. (this is usually successful, but can backfire badly -- CashApp terminated my account for this shenanigans)
- hughesjj 2y ago> CashApp terminated my account for this shenanigans Did you call to complain about the termination?
- qingcharles 2y agoWhat's funny is that the exec I got on the phone was super supportive and helpful and was genuinely amused to hear from me and hear what was happening. He put me in touch with their "Executive Support Team" and it was after this that I guess someone realized they didn't like the route I had taken. I feel somewhat vindicated after this announcement (though it does nothing to bring my account back): https://www.engadget.com/cybersecurity/cfpb-fines-block-175m-over-cash-apps-lax-fraud-controls-210749768.html https://www.engadget.com/cybersecurity/cfpb-fines-block-175m... > Accessing any kind of customer service for Cash App was a challenge, too, according to the CFPB. Block included a customer service number on Cash App cards and in the app's Terms of Service, but calling it would it ultimately lead users to "a pre-recorded message directing consumers to contact customer support through the app."
- nehal3m 2y agoAssuming these marketplaces operate within the bounds of the law, would it break HN’s ToS to post them? I’d be interested in pursuing the same strategy.
- gruez 2y agoMost online forums ban "doxing" even if it's theoretically legal.
- nehal3m 2y agoTechnically it's one step removed from doxxing, but I'll take your point.
- WillPostForFood 2y agoMore than one step unless you planned to post it publically. "I need a phone number, where can I get it" is all good!
- deleted 2y ago[deleted]
- gruez 2y ago>One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. >As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. Fortunately this is changing with iOS 18 with "limited contacts" sharing. https://mobiledevmemo.com/wp-content/uploads/2024/09/image.png https://mobiledevmemo.com/wp-content/uploads/2024/09/image.p... The interface also seems specifically designed to push people to allow only a subset of contacts, rather than blindly clicking "allow all". The far bigger issue is the contact info you share with online retailers. Scraping contact info through apps is very visible, drawing flak from the media and consumers. Most of the time all you get is a name (could be a nickname), and maybe some combination of phone/email/address, depending on how diligent the person in filling out all the fields. On the other hand placing any sort of order online requires you to provide your full name, address, phone number, and email address. You can also be reasonably certain that they're all accurate, because they're plausibly required for delivery/billing purposes. Such data can also be surreptitiously fed to data brokers behind the scenes, without an obvious "tiktok would like access to your contacts" modal.
- create-username 2y agoPeople will share their whole list because it’s simpler
- deleted 2y ago[deleted]
- taneq 2y agoOr because they were tricked. eg. LinkedIn’s “Connect with your contacts” onboarding step which sounds like it’ll check your contacts against existing LinkedIn users but actually spam invites anyone on your contact list that doesn’t have an account.
- wkat4242 2y agoLinkedin is so terribly evil these days. I also see the shenanigans of adding new 'privacy' settings and setting them open by default. Another typical Microsoft ploy by the way.
- TheKarateKid 2y agoWhat marketplaces do you use?
- terminalgravity 2y agoIm also curious about this. Is it just a website you place an order or do you have to go through some kind of agent?
- ra 2y agoI'm curious about this too.
- otteromkram 2y agoThanks for letting the group know.
- Physkal 2y agoModeration has really been lax here lately.
- DistractionRect 2y agoIf you're US based, there's tons of data broker sites, and you can glue together the information for free as various brokers leak various bits (E.g. Some leak the address, others leak emails, others leak phone numbers). And that's by design for SEO reasons, they want you to be able to google someone with the information you have, so they can sell you the information you don't have. Some straight up list it all, and instead of selling people's information to other people, they sell removals to the informations owner. Presumably this is a loop hole to whatever legislation made most sites have a "Do Not Sell My Info" opt out. What you do is look up a data broker opt out guide, and that gives you a handy list of data brokers to search. E.g. https://inteltechniques.com/workbook.html https://inteltechniques.com/workbook.html
- 2y ago
- A4ET8a8uTh0_v2 2y ago<< find an exec and buy their details for pennies and call them up on their cellphone. (this is usually successful, but can backfire badly -- CashApp terminated my account for this shenanigans) Honestly, kudos. The rules should apply to the ones foisting this system upon us as well. This is probably the only way to make anyone in power reconsider current setup. << As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And people laughed at Red Reddington when he said he had no email.
- jeanlucas 2y agoExactly this was tried by the likes of James Oliver and journalists/comedians of that caliber running ads and gathering data from politicians in Washington. It was some years ago and resulted in nothing
- lostlogin 2y agoDo you mean John Oliver?
- jagermo 2y agoor Jamie Olive Oil?
- Frederation 2y agoLOL!
- IgorPartola 2y agoThere was a post from someone a long time ago who has an email address and name similar to Make Cuban but not quite. He got quite a few cold call emails meant for Cuban. A lot of them were quite sad (people asking for money for medical procedures and such).
- Aurornis 2y ago> The rules should apply to the ones foisting this system upon us as well. This is probably the only way to make anyone in power reconsider current setup. Unless your problem is with the company doing the privacy violations, this doesn’t make any sense.
- vlan0 2y agoActually this could prove very useful for a resistance movement. Take them down with with their own medicine.
- josephg 2y agoYeah, I wonder if it might help to create a little newsletter for politicians and regulators. Send emails telling them exactly where they are, what apps they use, and so on. And send them the same information about their children.
- codazoda 2y agoI’m relatively sure they would bring the hammer down on the sender.
- whatshisface 2y agoWhat hammer? It's legal, that's the problem.
- mathieuh 2y agoTo use a line sometimes attributed to Beria, “give me the man and I will give you the case against him”. By which I mean that I’m sure they will find some means of making you sorry.
- hnisoss 2y agoDoesn't mean you won't get hammered my friend.
- Aurornis 2y agoGetting access to someone’s contact info legally doesn’t mean you can do whatever you want. This would very easily be covered under harassment laws, which are a separate matter.
- ericjmorey 2y agoThey would make adjustments so that their details are protected, but the regular user is not.
- amelius 2y agoI'm not familiar with these marketplaces. Could you name a few examples?
- qingcharles 2y agoI'm using SignalHire most of the time recently
- XorNot 2y agoThe thing is...contact details aren't really private information, basically by definition. The distinction is contact details privacy is based on the desire not be interrupted by people you didn't agree to be interrupted by - i.e. it's a spam problem - and realistically to solve this requires a total revamp of our communications systems (long overdue). The basic level of this would be forcing businesses to positively identify themselves to contact people - i.e. we need TLS certificates on voice calls, tied to government issued business identifiers. That would have the highest immediate impact, because we could retrain people not to talk to anyone claiming to be a business if there phone doesn't show a certificate - we already teach this for email, so the skill is becoming more widespread. A more advanced version of this might be to get rid of the notion of fixed phone numbers entirely: i.e. sharing contacts is now just a cryptographic key exchange where I sign their public certificate which the cellphone infrastructure validates to agree to route a call to my device from their device (with some provisioning for chain of trust so a corporate entity can sign legally recognized bodies, but not say, transfer details around). This would solve a pile of problems, including just business decommissioning - i.e. once a company shuts down, even if you scraped their database you wouldn't be able to use any of the contact information unless you had the hardware call origination gear + the telecom company still recognized the key. Add an escrow system on top of this so "phone numbers" can still work - i.e. you can get a random number to give to people that will do a "trust on first use" thing, or "trust till revoked" thing (i.e. no one needs to give a fake number anymore, convention would be they're all fake numbers, but blocking the number would also not actually block anyone you still want to talk to). EDIT: I've sort of inverted the technical vs practical details here I realize - i.e. if I were implementing this, the public marketing campaign would be "you can have as many phone numbers as you want" but your friends don't have to update if you change it. The UI ideally would be "block this contact and revoke this number?" on a phone which would be nice and unambiguous - possibly with a "send a new number to your friends?" option (in fact this could be 150 new numbers, one per friend since under the hood it would all be public key cryptography). I think people would understand this.
- gog 2y agoWhat definition of contact details makes them not private? Contact details (your phone number, email or address) are definitively private information, you should be the one that decides who gets them and who doesn't.
- liontwist 2y ago> find an exec and buy their details for pennies and call them up on their cellphone There is a vendor for this very thing in relation to business and government position called “zoominfo”
- tonyhart7 2y agocan we request our data deletion in these vendor????
- tcoff91 2y agoCould you please tell me how to buy this stuff? This sounds like a great way to get customer service when normal channels fail.
- Atotalnoob 2y agoWhat kind of marketplace do you use?
- Aurornis 2y ago> (this is usually successful, but can backfire badly -- CashApp terminated my account for this shenanigans) When I was at a medium-sized consumer-facing company whose name you’d recognize if you’re in the tech space (intentionally vague) we had some customers try this. They’d find product managers or directors on LinkedIn then start trying to contact them with phone numbers found on the internet, personal email addresses, or even doing things like finding photos their family members posted and complaining the comments. We had to start warning them not to do it again, then following up with more drastic actions on the second violation. I remember several cases where we had to get corporate counsel involved right away and there was talk of getting law enforcement involved because some people thought implied threats would get them what they wanted. So I can see why companies are quick to lock out customers who try these games.
- opello 2y agoI realize why this is bad. Full stop. I wonder if it ever evoked an dive into exactly what happened to leave these customers with thinking this was the most likely avenue for success? Hopefully in at least some cases their calls with CSRs were reviewed and in the most optimistic of best cases additional training or policies were put into place to avoid the hopelessness that evokes such drastic actions.
- KennyBlanken 2y agoThat would require empathy from someone who is, right now, bragging about how they sicced their lawyers and the cops on customers they were fucking over. I'm going to guess that the answer would be "nope, didn't care." That Cirrus isn't going to pay for itself, friend...and you can't retire at 40 without breaking a few eggs. I remember when Google was locking accounts because people had the audacity to issue a chargeback after spending hours trying to resolve Google not delivering a working, undamaged phone they'd paid well over half a grand for. Nobody at Google cared, but when the money (that Google never fucking deserved in the first place) was forcibly and legally taken back, the corporation acted with narcissistic rage...
- 2y ago
- _heimdall 2y agoIt is possible to just not use a phone number. I mostly connect through Signal. I do technically have a phone number that my close friends and family have, but its a random VoIP number that I usually change every year or so. Surprisingly no one has really cared, I send out a text that I got a new number and that's that.
- ironmagma 2y agoHow? Most of the services I use, from Walgreens to banks to retirement accounts, require a phone number either for 2FA or just to verify that you’re you when signing up. After changing my phone number this year and having to go through the rigamarole for each service, I decided never again.
- dylan604 2y agoYeah, companies are not dumb, and they know when you have VoIP number vs a full account with an "accepted" company. I can kind of see why not allowing 2FA to a number that could be easier to loose, but that's weak argument. Of course they don't want someone from .ru to get a US number with all of the baggage that would entail
- ironmagma 2y agoThere are flaws to their methodology. For half the companies, to change your number from A to B, you first must verify a NONCE with A, then verify a NONCE with B. This just means you have to possess two phone numbers for a period of time — Weeks, or in reality, months — while you change the long list of services over to the new phone number. There is a simpler/better way and that is to verify you have your email address before allowing you to do a NONCE with B.
- vladxyz 2y agoI've had limited luck feigning ignorance with a bank recently. "I don't know why I'm not getting a code" "No, I don't have another phone number" "I still can't log in to the web portal". They dropped the phone number requirement in favor to sending the OTP to email in the end, but it took way more effort than is reasonable. I tend to include a request to the CS person to pass along a request for TOTP/authenticator apps but given the request for a phone number is likely intentional I doubt the feedback is getting too far. In my naive mind, if enough people do the same, maybe they'll get the message.
- TechDebtDevin 2y agoI can relatively easily skip trace people but where are you buying specific peoples information? Do you mean youre skip tracing or buying directly from data brokers?
- wkat4242 2y agoAnd the combination of contacts are also unique enough to identify you. Even though they change over time. Some fuzzy matching, take in another few bits of fingerprint like device type and country and voila no advertiser ID required. Ps smart idea to use it for that purpose. If I failed to get proper service I'd just review bomb the company everywhere and soon enough I'd get a call fixing my problem and asking to remove them :)
- miki123211 2y ago> And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketplace, find an exec and buy their details for pennies The article author claims that you can't get this stuff for under $10k. Where do you find it for pennies?
- habosa 2y agoTry cold outreach software like Apollo.io As a test I downloaded it and got my wife’s full email and cell phone number easily from their free trial. And the full price would be on the order of pennies per contact.
- qingcharles 2y agoRight now I use SignalHire most of the time
- _pktm_ 2y agoThanks for sharing this approach. I gotta say that I’d love to hear more about how/where you are buying this data, and the CashApp story too.
- ErigmolCt 2y agoSo your data is only as private as the least privacy-conscious person in your social circle.
- speleding 2y agoAs a result of sales drones getting hold of my number, I have to put my phone on silent and never pick up unless I recognize the number. Very unfortunate. What if there is an emergency with my kids?
- emsixteen 2y agoIf you're using iOS you can set certain contacts to bypass silent mode so that you still hear their notifications/calls. I know it doesn't help with unknown numbers, but just saying in case you're not aware. I'd be surprised if you can't do the same on Android.
- adr1an 2y agoYou can. There's DND mode and Favorite contacts. I use auto-DND scheduling option too.
- speleding 2y agoYes, thanks, I've configured that for kids and other loved ones. But I can't pick up anything else, even sales people from India manage to use a number that appears local (in The Netherlands for me), so I might miss a call from the kid's school.
- bluehatbrit 2y agoI've just added the numbers of my kids school onto the list and it's been fine for me. I've never had them contact me from anything other than the schools number, but I'm in the UK and I would be very surprised if a teacher tried to call me from their mobile phone or something.
- Vinnl 2y agoOh wow, I knew this was a rampant problem in the US, but I didn't realise we had that at that scale here in the Netherlands as well. Hoping I can dodge the bullet a little longer...
- WrongAssumption 2y ago
- laserbeam 2y ago>> And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketplace, find an exec and buy their details for pennies and call them up on their cellphone. I find it funny how easy it is to find scammy websites which promise to remove your data (right...), but how hard it is to find the actual marketplaces where people trade this data. It also makes you think about what other systems have similar asymmetric interfaces for the public and the ones in the know (yes, I know there are plenty).
- tonyhart7 2y agocan we request deletion of our private data in this vendor???
- adulion 2y agoI have done this as well. I once got an travel insurance claim rejected by some outsourced handler and found out who the CEO of the insurance startup was. I emailed him and magically it got resolved
- casenmgreen 2y agoI stopped keeping a mobile number many years ago. Phone is wifi only. In particular, I do not use the contacts functionality built into the phone. (This is /e/OS, which helps, but I'll be moving to Mobian as soon as it is viable.)
- skrebbel 2y agoWhat do you do when the car repairman wants to call/text you when the car is finished? Or any other similar situations?
- gausswho 2y agoI use VOIP numbers for that. One per business.
- casenmgreen 2y agoNo car. But in general, email. I can make calls from my phone/laptop, using VOIP. I could receive as well if I wanted to, but I rarely need to be called, so I do not normally keep a number, and I could not be called when out and about anyway, because wifi-only, but you do get an answerphone, so people can leave a message.
- secondcoming 2y agoHow do you do online banking?
- gausswho 2y agoGiven the rampant privacy abuse on phones, I use a laptop.
- casenmgreen 2y agoLaptop, running over Tor. I use cash for all physical payments; never the card. I use the card to withdraw cash, once a month. I very rarely buy on-line, because I stopped using Amazon (treatment of warehouse staff) and buying off of Amazon is hell on toast.
- ebri 2y agoHow do you do this? This is genius
- dheera 2y agoI just block all unscheduled calls and calls from unknown numbers. If there isn't a calendar event and it isn't coming from a known family member or close friend, the call doesn't go through. I also have multiple cell and virtual numbers and give different ones out to businesses, banks, friends, and family. Businesses that don't need to ship me stuff also get a different address than ones that do. I don't register to vote anymore because they leak my residential info. When they can agree to stop leaking it, I will participate again.
- leoqa 2y agoYou may be committing some type of violation of privacy laws if you're contacting them via phone and they're on the do not call list. Because they work at a company does not mean that you and the employee have a business relationship.
- stronglikedan 2y agoyou can call anyone for any reason if you aren't doing it for your own business
- leoqa 2y agoIs it his business if it’s for customer support?
- cooper_ganglia 2y agoI'll call anyone I please, thank you very much!
- triceratops 2y agoDon't do not call laws apply to marketing companies? OP isn't marketing or selling anything.
- matheusmoreira 2y ago> CashApp terminated my account for this shenanigans The audacity of these people. They probably do far worse things to their customers on a daily basis.
- youcouldalways 2y agoChanging your number every year could mitigate as it would introduce entropy and stale data into the system. When done at scale, data lifetime would behave similar to the automatic deletion of messages on whatsapp. Somewhat mimicking an in person verbal conversation where only people's memories remember what was said and even their version gets changed every time memory recall takes place. Systems already exist in real life that protect privacy, it's just that we do a poor job of reproducing them with tech. Changing your telephone number every year could be an artificial holiday like valentines day or halloween. It can be done if people deem it's important.
- idoitalready 2y agoI already do this. It gives me an opportunity to trim the contact list to people I actually talk to regularly which I send the new number too. Also shows me my footprint online since I have to update the number. I only change it for places I actually use regularly or are important.
- ironmanszombie 2y ago[dead]
- MetaWhirledPeas 2y ago> there is no sane way to protect your contact details from being sold I can think of one: make it illegal to buy, sell, or trade customer data. All transfer of data to another party must have a record of being initiated by the individual.
- wand3r 2y agoWhere are you buying this? Might be handy for a job search. Zoominfo basically doesn't have a b2c offering and I am not paying several thousand for an experiment in improving my career
- scyzoryk_xyz 2y agoThat’s a textbook „surveillance capitalism” move. Any chance of a tutorial or some materials on doing exactly this sort of thing?
- pompas 2y ago[dead]