News for hackers. Stuff that matters.
Re:Twitter says an attacker used its API to match usernames ... by RKearney on Wednesday February 05, 2020 @03:23PM (#22250631)
A trick I found to stop this nonsense is, at least on iOS, answer yes to the Application's custom dialog to ask permission. This will then invoke the iOS security dialog where you can click "No" and never be asked again.

Generally what I see happening is apps will ask the user if it's okay, and only when the user says yes will they execute the necessary system call to request access. In iOS at least, if a user clicks No the app can never prompt for that permission ever again. Until the app makes this formal request to the operating system, it does not show up under privacy (as the app had never asked for it in the first place).

Re:Twitter says an attacker used its API to match usernames ... by vincentmarle on Wednesday February 05, 2020 @04:10PM (#22251028)
Your friends/family probably won’t do this, so your phone number is going to be shared with Twitter anyways.
Re:Twitter says an attacker used its API to match usernames ... by cameronbrown on Wednesday February 05, 2020 @06:50PM (#22252104)
Well then the obvious solution is to start treating phone numbers as you would an email address - effectively public.

I would love a version of privacy.com for phone numbers..

Re:Twitter says an attacker used its API to match usernames ... by amalcon on Wednesday February 05, 2020 @09:51PM (#22253054)
Start? It wasn't that long ago that the phone company published a book with near everyone's phone number in it.
Re:Twitter says an attacker used its API to match usernames ... by jacobsenscott on Wednesday February 05, 2020 @10:09PM (#22253132)
There was no book with everyone's phone number in it. There were many books that covered small regions. If you lived in Oshkosh Wisconsin and wanted the number for someone in Kansas City, or even Madison Wisconsin it wasn't that easy to get that book. Maybe your library had it. Phone numbers on paper aren't that useful. You can't robodial a paper phone book without hiring actual people. But no matter what you couldn't get millions of phone numbers while sitting on your couch, and if you could they would be useless because they were all on paper.
Re:Twitter says an attacker used its API to match usernames ... by rileymat2 on Wednesday February 05, 2020 @10:27PM (#22253206)
The books were hard to get, but directory assistance did exist if you called the operator.
Re:Twitter says an attacker used its API to match usernames ... by gwright on Wednesday February 05, 2020 @11:31PM (#22253446)
I'll bet there are quite a few people on HN that have never dialed 411 or 1-<area-code>-555-1212.
Re:Twitter says an attacker used its API to match usernames ... by amalcon on Wednesday February 05, 2020 @10:21PM (#22253180)
None of that let you treat your phone number as anything other than public.
Re:Twitter says an attacker used its API to match usernames ... by burner831234 on Thursday February 06, 2020 @01:06AM (#22253776)
I mean we realize this thread of argument has nothing to do with the point right?

A cell phone number does not equal your kitchen phone in terms of access to information. The whole this is moot. The issue now is that this is my personal phone number, me, personally, and is being used as a piece of validating information in a variety of compromises databases.

Re:Twitter says an attacker used its API to match usernames ... by CPLX on Thursday February 06, 2020 @03:32AM (#22254466)
This just isn’t true. Ever heard of the Haines Directory?

I used it at a summer job in the late 80’s. You could order reverse lookup books for anywhere you wanted, and of course could get that data electronically too. You could also call information for anywhere you could think of by dialing the area code plus 555-1212.

Re:Twitter says an attacker used its API to match usernames ... by jacobsenscott on Thursday February 06, 2020 @08:09PM (#22262262)
Never heard of it, but how much did it cost? How much did the reverse lookups cost? And even if you could get it electronically there was no way practical way to do much with them.

With the twitter leak millions of phone numbers/names are available for free instantly, and the technology to do some harm with them is readily available.

Re:Twitter says an attacker used its API to match usernames ... by ce4 on Thursday February 06, 2020 @05:47AM (#22255036)
In my country it is voluntary to be listed in such a phonebook whereas with already a small number of friends the chances approach 100% that at least one of them has my contact info stolen by Twitter, FB, WA, etc. If i dont like this i would have to stop giving out numbers and not be reachable by sms/call.
Re:Twitter says an attacker used its API to match usernames ... by johnchristopher on Thursday February 06, 2020 @01:23AM (#22253856)
I have a friend of mine who flat out refuses to give email address or any contact info of the people I meet at his house. It has been a bit annoying one time or two.

Phone numbers used to be really public. As in "Someone has collected your phone number, your address and family name and put it in this huge book they update every year. And they drop a copy of this book on everybody's porch.".

Re:Twitter says an attacker used its API to match usernames ... by mosselman on Thursday February 06, 2020 @05:11AM (#22254866)
This is completely correct behaviour if you ask me. So you met me at someone's house, so what, it gives you the right to contact me?

You could always ask your friend to relay a message right?

Re:Twitter says an attacker used its API to match usernames ... by johnchristopher on Thursday February 06, 2020 @05:54AM (#22255079)
These people I have been seeing them at his house on numerous occasions, we are on a first name basis and open jokes.

It's not like I had glimpsed someone's shoulders and wanted to cold call them to pitch them my startup idea of the week or creepily ask for a date (I remember it was to follow through with a conversation about DIY hydroponic with one and coffee brewing with another). Friend got tired of relaying messages at some point :). We rarely got to the point of giving out contact information on the moment though (that was the flow of those meetings and I think it's not a cultural thing to exchange business card in such settings in my country). Also, we are not the kind of people to hang on facebook, so discovery is weak.

Totally agree it is correct behaviour with strangers though.

And it was only a minor annoyance at some point so well... no biggie. (Except that time he divorced and he wouldn't give me his ex-wife's number so I could get back some DVD she had borrowed)

edit: also, I wouldn't ask for contact info if I wasn't confident that it was okay for the person to get a call from me and I am confident that my friend knows I won't mess up things by being inappropriate.

Re:Twitter says an attacker used its API to match usernames ... by mosselman on Tuesday February 11, 2020 @03:50AM (#22297042)
I see where you are coming from. I just meant as a general rule it is better to not give out people’s information.

The message your friend could have relayed could have been “hey is it ok if I get your contact info?”.

What your friend isn’t getting right is that maybe you and his friends DO want to contact each other. He is deciding for both parties that they don’t. He could adjust his behaviour on that front a bit.

Re:Twitter says an attacker used its API to match usernames ... by ebrenes on Friday February 07, 2020 @10:09AM (#22266642)
Why not just ask the people directly for their contact information? Or vice versa ask your friend to ask them if it's okay to hand out your contact information?

I've had several friends ask if it's okay to give out my contact information to third parties who were interested in acquiring this information to continue conversations through more private channels.

But there was always an element of consent involved on my part.

Re:Twitter says an attacker used its API to match usernames ... by u801e on Thursday February 06, 2020 @08:46AM (#22255876)
> I have a friend of mine who flat out refuses to give email address or any contact info of the people I meet at his house.

Is there a reason you do not ask those people for their contact information directly?

Re:Twitter says an attacker used its API to match usernames ... by vageli on Wednesday February 05, 2020 @09:21PM (#22252930)
> Well then the obvious solution is to start treating phone numbers as you would an email address - effectively public.

> I would love a version of privacy.com for phone numbers..

I've used google voice and twilio for something similar, though nowhere near as plug and play as a privacy.com-like solution.

Re:Twitter says an attacker used its API to match usernames ... by u801e on Thursday February 06, 2020 @08:41AM (#22255853)
I wish there was an easy way to effectively only allow white listed callers to call you directly (and the rest of the calls to go to voice mail). That's what I do with my email at least.
Re:Twitter says an attacker used its API to match usernames ... by rootkea on Wednesday February 05, 2020 @11:09PM (#22253356)
You might find this interesting: https://phoneprivacy.co/
Re:Twitter says an attacker used its API to match usernames ... by cm2187 on Thursday February 06, 2020 @06:15AM (#22255157)
I get nuisance phone calls all the time, it is a lot more disruptive than nuisance emails.
Re:Twitter says an attacker used its API to match usernames ... by Diti on Thursday February 06, 2020 @03:24AM (#22254431)
Unless you have no Twitter account.
Re:Twitter says an attacker used its API to match usernames ... by vmateixeira on Thursday February 06, 2020 @03:31AM (#22254459)
That doesn't matter.

As long as one of your friends or relatives has and accepts to upload their contact list (with your number included).

Re:Twitter says an attacker used its API to match usernames ... by hk__2 on Wednesday February 05, 2020 @06:15PM (#22251887)
Note this trick is also generalizable to apps/websites asking for notification permissions.
Re:Twitter says an attacker used its API to match usernames ... by diebeforei485 on Wednesday February 05, 2020 @04:38PM (#22251233)
Ideally, iOS would have an option to say "always deny Contacts access and never bring up a dialog again".

I don't share my contacts with any app, and I hate being asked again and again for every single new app. No means no.

Re:Twitter says an attacker used its API to match usernames ... by twodave on Wednesday February 05, 2020 @04:44PM (#22251286)
Actually for most things in iOS, once the system dialog has been brought up, the operating system won't allow it to be brought up again. It won't stop the application in question from nagging you, but at least then even if you click "allow" on the application pop-up the system will still require you to go into the app permissions and explicitly allow it.
Re:Twitter says an attacker used its API to match usernames ... by realusername on Thursday February 06, 2020 @03:36AM (#22254484)
That's exactly what iOS does, the app is making a fake system popup to ask multiple times and only brings you the real system popup if you agreed to the first one.
Re:Twitter says an attacker used its API to match usernames ... by lonelappde on Wednesday February 05, 2020 @04:02PM (#22250948)
What does Apple allow that for App Store apls? That's obvious circumvention of iOS's privacy control regime.
Re:Twitter says an attacker used its API to match usernames ... by toast0 on Wednesday February 05, 2020 @04:37PM (#22251230)
My post below is wrong, please move along. Keeping as-is, so the replies make sense. Thanks repliers!

The native prompts don't allow for app specific explanatory text to be presented. I haven't reviewed iOS guidelines, but Google provides guidance to inform users of why you're asking for permissions before you do it, and I would guess Apple would suggest the same as well. Pestering people for access once a day is probably not within the scope of the guidelines though.

Re:Twitter says an attacker used its API to match usernames ... by diebeforei485 on Wednesday February 05, 2020 @04:46PM (#22251305)
> The native prompts don't allow for app specific explanatory text to be presented

Not true. iOS apps can specify explanatory text to be included in the native prompt. In fact they are required to do this, since at least two years ago.

The NSContactsUsageDescription string (in the Info.plist file) is the place to specify this.

https://developer.apple.com/library/archive/documentation/Ge...

Re:Twitter says an attacker used its API to match usernames ... by cactus2093 on Wednesday February 05, 2020 @04:42PM (#22251267)
Incorrect, iOS does allow explanatory text on the system prompt, in fact it’s required.

There is no good reason for Apple to allow apps to mask permission requests with their own dialogs, it’s just a case of not bothering to fix this loophole.

Re:Twitter says an attacker used its API to match usernames ... by megablast on Thursday February 06, 2020 @12:21AM (#22253615)
Why do people keep saying clearly wrong stuff. You sound like you know what you are talking about, but are 100% wrong.
Re:Twitter says an attacker used its API to match usernames ... by russum on Wednesday February 05, 2020 @11:47PM (#22253495)
I've had apps ask me to go to system settings myself to enable some permissions because I've disabled it via the said OS prompt.
Re:Twitter says an attacker used its API to match usernames ... by loco5niner on Thursday February 06, 2020 @11:23AM (#22257310)
Similar to being asked "do you like this app?" If you say "Yes", you are directed to rate it, if "No", you are not.
Re:Twitter says an attacker used its API to match usernames ... by ngvrnd on Wednesday February 05, 2020 @04:48PM (#22251318)
this worked for me also.