Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.
Have only 5M accounts linked their phone numbers on Twitter? That's less than 2% of their total accounts (~290M). I don't know what the industry average is for linking phone numbers, but this seems like an exceptionally low ratio.
Similarly, any time an American car has a fender-bender, or at least one of its wheels leaves the ground, it explodes in a massive fireball.
For example in the UK the country code is 44, all mobile phone numbers start with 7, with 9 digits after that.
(Assumption: They were checking only one number per second, either to avoid detection or because they were rate-limited.)
[1] https://www.bleepingcomputer.com/news/security/twitter-revea...
And for anyone who didn't read TFA, this incident goes well beyond leaking what phone numbers use the product, it leaked the usernames associated with each as well.
Or if this functionality needs to return the value, require an authenticated user and impose rate limits based on reputation (which could just be account age)
For instance, Facebook and Twitter used to tell you which profile a phone number belonged to when you put it in the search box (maybe it was this issue). You could restrict that to authenticated users that were 30 days+ old and impose rate limits per day on top of that. A regular user could still look up a few numbers per day but someone enumerating phone numbers would need lots of 1 month old accounts (more effort/cost)
They can then earn money from people who want to rent access to these botnets.
There are also free VPN services who, in their fine print, say that users grant them permission to route other traffic via their connections.
And this is service offered by registered Israeli company that get formal agreement from "bots" to route traffic through them. Very shady, but totally legal service that used by a lot of data collection agencies for price tracking on Amazon or getting data from Linkedin, etc.
Bad login? "Not a valid user/pass combo"
Password recovery? No matter what email or phone provided, simply say "If the email matches our records, we will send a recovery link".
They range from 4 (St. Helena) to 13 (Austria), I believe.
Filtering out *5*... would remove 1%. So wouldn't ***555**** remove closer to 0.01%, not 0.1%?
The purposes of phone numbers:
1. Verify you are a not a bot: no need to store anything except TRUE once verified.
2. 2FA - well use something better than SMS, but if you must, store the hash, and make me enter my number for the 2FA each time. Compare with hash and then send SMS.
- Account search during password recovery (lets users search for their account by phone number): https://twitter.com/account/begin_password_reset
- User discoverability and account recommendations (users who upload their address books can find others by phone number, users who share their number can be found by others): https://help.twitter.com/en/using-twitter/account-suggestion...
Hashing numbers has other implications, like support impact (some folks don’t know their own phone number), preventing the ability to offer SMS updates in countries that need it (or to reactivate that feature in national emergencies for countries that SMS support was pulled from), as well as making potential marketing, data mining, satisfying legal requests, and future feature development harder.
So your suggestion is a good one for a privacy-conscious service that doesn’t already depend on (or that is unwilling to relinquish) unhashed numbers, but it probably isn’t in the nature of twitter to seek to protect user data at the expense of existing or future features, even after leaks like this.