A privacy flaw in Comcast's automated telephone system

It’s pretty trivial to spoof caller ID though; there is basically zero security that prevents it from happening and many apps that make it easy.

I'm swedish as well, and explaining this to my wife from Peru was a fun experience. The rest of the world is not as open with neither address information or salary information as Sweden is. If this is good or bad, I'm not sure but it saved me in a number of situations to be able to search for someone's number via a public website.

Keep in mind that the social number in USA is apparently also supposed to be secret (like a password) which sounds absolutely crazy to me.

>So are telephone numbers and addresses considered very private in the US?

Only by people who are unfamiliar with how things work in the US.

This thing right here is nothing, I see worse stuff on a daily basis.

>So are telephone numbers and addresses considered very private in the US?

Very private? Not usually. Unless someone chose (and paid) to have them unlisted, they used to be in published whitepages. And the overwhelming majority of people didn't pay to have them removed.

Today cellphone numbers are typically more private although addresses for most people are still usually pretty easy to find and are often part of a public record that can be searched.

> So are telephone numbers and addresses considered very private in the US?

To a degree yes, there is no public resource to lookup that information. There are however brokers who deal in that data however the quality is questionable (e.g. I routinely receive fliers in the mail at my new address from house flippers who wish to purchase my old property).

People in the US consider their address to be private information even if it is easily obtainable.

If you're in the US you receive about 3 spoofed "spam" calls a day telling you the IRS is sending the cops after you, that you need to pay for Mandarin classes (in Mandarin), and "Vacation Opportunities"... so the idea that spoofing a telephone number is difficult or rare is obviously untrue.

The idea that an automated read out of an address (especially any number) makes capture difficult is a little strange. If nothing else, hire Mechanical Turk for 5 cents.

What the value of the information is (and whether it's below cost) I don't know, but the fact that you have Comcast shows that you have a fair bit of disposable income ... so whether it's another spam call to a known good number in a targeted location or just to check if you're home before you're robbed... I'd say it might be worth at least pennies.

You can just say that you want an unlisted number, it is free. So lots of people and numbers are not searchable.

Unless you have access to facebooks internal database, because surely one of your friends have installed facebook...

You could always opt out of the white pages. Not the case here.

There was a thread here recently about how it costs 10 bucks to rent out a cellular tower in Malaysia and co-opt a cell phone number as roaming, in order to defeat SMS security 2FA. Experts on HN were saying that the trunk level protocols for cell phone numbers are pretty much worthless when it comes to security. Their conclusion was that: security in this world is so poor that you might as well live with the assumption that there is no real security for public services.

> Making matters worse, if you then pay the bill on someone else's account, the system prompts you to add yourself as an authorized user and requests the callers phone number, potentially granting them full access to your account.

Uhm yeah sure boring stuff. Can I have your phone number?

> Comcast will let anyone get your home address, name, last 4 digits of SSN with just your IP address!

IP address? Really?

That's not amenable to bulk, automated harvesting however, unless you've compromised their internal network.