I got a free loaner phone once a few years back ("Samsung Ultimate Test Drive") which came with pre-activated mobile phone service and was very clearly re-using a phone number that someone else had quite recently actively been using.

While it was weird to get SMSes about SoCal drug deals, the strangest thing of all with that phone was opening the Lyft app and being automatically signed in to someone else's Lyft account on the basis of my auto-confirmed phone number. Their active credit card was linked to the account and I could take free rides!

(I didn't... but it was very hard to sign into a different Lyft account when the phone # was actively linked to another, live account.)

Is this because Samsung simply sent you a phone that hadn't been wiped and was still signed into all these accounts, or was it really just auto-signed in due to phone number? I did the Samsung Ultimate Test Drive as well and don't recall being auto-signed into anything (though I also got many SMSes and calls intended for the previous owner).

Well, when I got the device, the Lyft app was not installed. I visited the Play store, installed the Lyft app and ran it, and then: the Lyft app immediately signed me in, told me that my full name was Britney G-------, showed me "my" full e-mail address, and offered to let me book rides on her behalf, paying with her linked Visa card. It wasn't even clear how to switch accounts; it was like they were using the phone # as a primary key.

I sent Samsung some feedback about this but don't think the issue was on their side per se.

You could have signed into Whatsapp as well.

The biggest threat to privacy, is how little (most, nearly all) other users do NOT value someone else's privacy.

Re Spam: Pre-screening, and people that actually say something useful to the (automated) screening service. Actual spammers should get fed to a blacklist (filtered for multiple confirmations), and organizations that prosecute spammers should be able to read THAT list. Everyone else has to use a more public API that's rate limited.

In the case of this article, the reporter should keep separate "digital identities" for people whom she want's to know her affiliation and those who don't. The main mistake there was that she used her "burner number" for ordering a taxi, when it should have been used just for these contacts.

> However, in the case of the article, the reporter should know to inform her sources not to enter _any_ information linking to her real-world identity into their electronic devices.

Yeah, that had me kinda puzzled as well. Sure, the app seems like a terrible idea, but ultimately it was one of her contacts who put that information into it.

Reporters talk to lots of people, who practice very poor tradecraft.

Which suggests: everything this story describes also applies to intelligence and law enforcement services. Imagine you're conducting espionage, or are tracking money laundering or drugs smuggling.

Yeah this is why I keep my old number in Google voice after getting a new one. Not the best option but I can't quite figure out all the ways I could have accounts compromised if some random person with malintent got my old number allocated.