Hacker News Reader

Comment by andrewguenther | Hacker News Reader

I find it interesting that you can get the mobile carrier from this. The first thing I pictured was a voice phishing attack: "Hello, this is T-Mobile, there's a problem with your account..." you get the gist.

View on HN

Easy enough to do already. Twilio doesn't need to implement this in order to make this interesting.

Not much different than looking up someone's whois and pretending to be GoDaddy.

The sort of person who registers a domain might be a little more alert than the larger group of people who have a mobile phone?

Have you seen those GoDaddy commercials with Danica Patrick? Those commercials appeal to people who, I'd gander, have a lot more to lose (and aren't as wise to the potential sly tricks... of the internet) than what could be phished over the phone from your telco provider.

Not in the US, so I don't see that ad. Good point about lot more to lose, though I wonder if 2FA through phones makes losing phone access a risk as well.

Security through obscurity doesn't always work. You could do the same by calling a list of numbers and playing the odds by using like AT&T or Verizon randomly and get a lot of people that way too.

It's worth noting that the carrier it returns and the brand of network aren't necessarily the same - at least here in the UK.

For example the Giffgaff network is carried by O2, and a UK landline rented through Twilio appears to be carried by Jersey Telecom.

See my answer here - https://news.ycombinator.com/item?id=9300690 - about why you're getting O2 for a Giffgaff number (Giffgaff is an O2 MVNO, and owned by O2's parent Telefonica as it happens).

Re: a Twilio UK landline number coming up as JT, as you're probably looking at the results of a SS7-MAP command that returns the SMS routing info for a particular number, in this case it's likely that JT look after the SMS side of that number (routing for voice and SMS and the networks themselves are generally quite separate).

Ah, glad someone else with experience is in this thread. You've saved me a bunch of typing.

Reply on news.ycombinator.com