Hacker News Reader

Comment by nacs | Hacker News Reader

Holy cow. This is scary.

With T-Mobile USA, the 2nd link correctly identified my phone number.

In the 2nd link though: name, current address, email address, phone number, how long I've had the account, when it renews, who my previous carrier was, my phone hardware details and my current latitude/longitude!

This is scary that anyone can access this with just a site visit.

View on HN

I have T-Mobile prepaid and they have all my info except my first/last name. They must have collected this info when I used my credit card for refilling.

Even in the US, I always thought it was illegal to use payment information for anything other than payment processing. Evidently that is not the case.

What is considered cardholder data may surprise you. I’ve implemented many integrations. It’s very specific and requires the primary account number. For example if the PAN is stored separate the name and/or expiration data isn’t considered cardholder data.

For the record storing this information would be folly - can’t lose what you don’t have. Let the payment processor assume the responsibility by storing and handling that if needed.

(PAN = credit card number, for those outside the industry)

I have T-mobile prepaid and my caller ID info pops up as someone else's name. I've called to complain but they claim it's not possible to fix this for prepaid plans. I'm sure it's a massive E911 violation but, you know, computers are hard.

Is it possible that you gave them your info to disable the web content filter, which is forced on unless you give them a bunch of PII?

No, I don't know anything about such a filter, and did not give them any PII.

> This is scary that anyone can access this just a site visit.

Well, anyone using your phone on LTE.

Any script running on your phone with LTE.

Well, any website that you connect to while on LTE should have access to this data, no?

Yep. Or any app that runs on your phone that makes even 1 outgoing API request can get all of this info.

So literally - and I use the word literally correctly - any of the thousands of shady, useless, scammy apps can get my name and current coordinates?

The ONLY thing this advertising-surveillance industrial complex is missing is a sample of my DNA!

23andme got you covered

Reply on news.ycombinator.com