Hacker News Reader

With adjustable accuracy range you can do binary search to find out where someone is.

Which is where API rate limits come in. But if you really need to know where someone is, today, just be a telco with its own mobile infrastructure, and you can pretty much query the current network+cell ID of any of your subscribers without any limitations.

Same goes for anyone with, say, subpoena powers in your jurisdiction and/or sufficient (social) engineering skills. And cell ID to geo mapping is also a solved problem...

API rate limits don't keep you from doing the nasty stuff when you want to target one specific individual.

Depends on the limit and how it's implemented

Even if API rate limit exists and is strictly enforced, it's also easy to bypass it with multiple API keys and over time. Most people adhere to a weekly schedule.

Rate limits can also be based on the message contents, e. g. max 20 lookups per day for a cell.

Assuming you already know what continent somebody is on, 20 circles of 200km radius (120 miles) should cover most of the major population centers.

If you live out in Nebraska or the middle of the Sahara this attack is easy to defend against, but humans tend to clump up.

Sounds like a great way to DoS someone out of being able to use their banking app.

> AND no rate limit exists.

Reply on news.ycombinator.com