Hacker News Reader

Comment by reaperducer | Hacker News Reader

Facebook: "This dataset is old and appears to have information obtained before we made changes last year to remove people’s ability to find others using their phone numbers."

Not that "old." Some of those "update" dates are just a few days ago.

View on HN

How many people change their phone numbers more than once a decade? How many people change their facebook accounts ever?

The age of this data may be "old" by whatever definition Facebook is using, but it is still of great interest to identity thieves and ne'er-do-wells.

Yep. As far as I’m accustomed most people do whatever they can to maintain their phone numbers even across services. So much so that it’s law in Canada a provider can’t lock in your number and must let you take it with you to another provider.

In the UK it's as easy as sending a text [0] to get your number ported to a new carrier. Carriers must oblige.

0: https://www.ofcom.org.uk/about-ofcom/latest/media/media-rele...

I love how they used to pretend that their response to regulatory pressures was in fact a new product/feature offered by them. For instance, allowing me to keep my phone # was phrased in a way that would make me think that EE/O2/... let me do that for free, yay. Same applies to the EU regulations dealing with lowering roaming charges—the carrier I used at that time even developed branding for it. It’s a bit damaging given how little UK citizens know about EU.

Antibiotic free meat is the latest advertising trend in the US, now that the FDA has explicitly banned its use.

It's actually a terrible system though. It relies on the original issuer of the number maintaining essentially a "proxy" to your new provider. So if I transferred from o2 -> EE, and o2 had network issues, it's possible (and has happened to me personally) that I am affected even though I have left o2. I think also calls are actually physically routed through the original network. Lots of weird things can happen like texts from certain networks never arriving.

I had to get a new number when I discovered my NZ family could receive my texts but their replies never arrived at my end.

For more info, see https://www.theregister.co.uk/2017/07/20/uk_number_porting_c...

I've been switching back and forth between two providers for the last 5 years, and I've always wondered now that I'm back to my first provider if calls/texts to me go directly to A, or go A->B->A->B->A.

Should just go straight to A. The way the numbers work is that the prefixes are assigned to various operators. When you transfer, the "owning" operator forwards calls on to the target operator. If you returned presumably the forwarding is removed.

(From [0]): "One of the very few countries not to use ACQ/CDB is the UK, where once a number has been ported, calls to that number are still routed via the donor network. This is also known as "indirect routing" and is highly inefficient as it is wasteful of transmission and switching capacity."

And

"Because of its donor dependent nature, indirect routing also means that if the donor network develops a fault or goes out of business, the customers who have ported numbers out of that network will lose incoming calls to their numbers."

[0] https://en.wikipedia.org/wiki/Mobile_number_portability

Does that make it easy to steal phone numbers, and therefore identities?

The handset initiates it by sending an SMS to a shortcode.

Shortcodes are phonenumbers that are carrier-specific e.g. the three digit code that you use to access your voicemail etc.

The phone company knows the identity of the calling handset when it gets the text message with a high degree of certainty, as the handset is directly connected to its network.

So the person doing the transfer has to be in procession of the phone, or able to spoof or clone the phone.

Trivia: an attacker who redirects phonenumbers to gain access to a bank account https://williamedwardscoder.tumblr.com/post/24949768311/i-kn...

Based on the fact that never seems to happen, no.

What do you mean never? It has a name and is pretty common in Bitcoin exchange fraud: https://en.wikipedia.org/wiki/SIM_swap_scam

The specific UK mechanism that is the subject of this subthread was introduced in July; it's not what your wikipedia link describes (social engineering to get a number ported).

I'm also in the UK, I've had the same phone number for at least a decade. It has been easy to carry your phone number to a new provider for as long as I can remember.

You just contact your existing provider, tell them you wish to leave and need the PAC code. After they beg to stay and throw you a sweetheart deal. They'll send it via text or post.

you have been ABLE to do that for as long as I can remember (I've kept the same number since 2005 now on all the major networks. I only didn't keep my number prior to that because it was a work provided contract) but depending on which you were dealing with would put up a number of different obstacles when you contact them to make the process as painful as possible (to keep you as a customer... THREE I'm looking at you!) so the new automated SMS process introduced in July is a welcome addition

Didn't it happen to Jack Dorsey last week?

https://www.forbes.com/sites/jeanbaptiste/2019/08/31/why-twi...

> So much so that it’s law in Canada a provider can’t lock in your number and must let you take it with you to another provider.

Same in Germany.

Good to know it's a law. I was discussing this yesterday as being easy and frequent to port over number between providers. Do you know if providers are allowed to charge a fee for the transfer?

No, but if you were on a contract they can charge you the device cost prorated to how much time was left on your contract. And the new carrier can charge a setup or admin fee, though most carriers don’t for competitive reasons, or they call it a SIM card fee and waive it if you activate via eSIM. All the fine print in Plain English: https://crtc.gc.ca/eng/phone/mobile/num.htm

Actual ruling: https://crtc.gc.ca/eng/archive/2005/dt2005-72.htm

Further regulation covers number portability beyond the named carriers, and require all carriers to register with the CRTC, etc. https://crtc.gc.ca/eng/archive/2017/2017-11.htm In return, the CRTC helps guarantee access to the large players’ wholesale networks, though in practice the fight is still ongoing over newly installed fibre optic networks and the uncompetitive rates the incumbents charge for full speed service on their networks.

It’s not all good news - A particularly disappointing CRTC ruling followed Bell Canada’s recommendation that Canadian TV should only be provided via Internet if the household has internet from that TV provider directly. Which has effectively locked out any over the top competition such as YouTube TV from Canadian markets as they won’t be able to offer Canadian OTA channels. Sadly, I can’t find the ruling in the mess on the CRTC site, as CRTC language is obscure to say the least, but as TV is heavily regulated in Canada, the CRTC has old fashioned rules saying IPTV providers must provision a box and a line for service (Internet) in order to offer TV. This limits competition to only those willing to provide Internet in Canada to every household, or requires third-parties to negotiate with incumbents for access to such households. Existing third-party ISPs/Canadian IPTV companies go along with the above rules because nobody wants US providers entering the market, they just want to carve out cheaper Internet+TV price points with competitive Internet speeds that the incumbents don’t offer at competitive wholesale rates and benefit from a high switching cost where switching TV providers means switching ISPs knowing most people won’t do it. Until we have enough VOD content, Canadians are either pirating, using VPNs or paying their ISP for television, not having any other legal choices in this country...

While I can’t find the ruling just yet, here’s an article from 2015 highlighting Bell’s requirement that IPTV be restricted to ISP lines: https://www.cbc.ca/news/business/bell-crtc-25-basic-tv-1.375... And here’s an article where Bell refused to license their networks to VMedia’s Roku app arguing that by going over the public Internet, VMedia was running the content on a private network outside Bell’s control (Most IPTV providers find it cheaper to bundle with Bell’s VDSL) https://www.cbc.ca/news/business/bell-vmedia-iptv-internet-r... This later led to the ruling that only ISPs can provide TV...

Personally I’m more irritated by how much VOD content Bell has exclusive license to, such as their Crave+HBO, which is cheap for now, but helps Bell compete with channels offered by Amazon Prime Video. Corus, formerly owned by Shaw (another cable provider) licenses a lot of US content, and so might limit what content is available north of the border. It’s particularly hard to find VOD episodes from Turner and Viacom networks and the expanded licensing STARZ has with Hulu is completely absent north of the border. When you can’t find a show legally on any VOD network in your country including iTunes, what are you supposed to do...? CRTC rules are not making this any easier for Canadians to watch what they want, wherever they want (ISP requirement means your cell phone must also have service from your IPTV provider, it’s nuts), and on whatever device they want...

This is the case in India as well. You can keep your number and still change the network provider. People tend to keep the same number.

Same in the US

Relevant XKCD https://xkcd.com/1129/

> changes last year to remove people’s ability to find others using their phone numbers.

What? That's not true, I reported the issue about user enumeration via phone numbers being possible in Whatsapp, Messenger and Instagram to them last week and they claimed (paraphrased) "it's a feature, not a security issue".

Do you intend to publish this correspondence? I think some companies prefer to sue people using these "features" instead of changing them. It's a good thing to have on record.

There's not much to publish. It is just me saying that a custom contact book allows finding out a lot of people's accounts, them saying that the behavior respects people's settings and is working as intended.

They removed "people's" ability, but not their own.

I've had my phone number since 2002. It doesn't matter how "old" their dataset is when some of the data predates the entire company.

Yes but

"But the data appeared to be loaded into the exposed database at the end of last month — though that doesn’t necessarily mean the data is new."

Somewhat curious what the Status key represents in this dump, personally.

>ability to find others using their phone numbers."

Ah right, that's why I couldn't find someone...

That just means the database was updated a few days ago, not that the data is new.

The new normal in public relations seems to be to make irrelevant or simply mendacious excuses which seem to suggest that they don't have a clue, but which actually show their contempt for their users.

Reply on news.ycombinator.com