Twitter says an attacker used its API to match usernames to phone numbers

Re:Twitter says an attacker used its API to match usernames ... by jacobsenscott on Wednesday February 05, 2020 @10:09PM (#22253132)

There was no book with everyone's phone number in it. There were many books that covered small regions. If you lived in Oshkosh Wisconsin and wanted the number for someone in Kansas City, or even Madison Wisconsin it wasn't that easy to get that book. Maybe your library had it. Phone numbers on paper aren't that useful. You can't robodial a paper phone book without hiring actual people. But no matter what you couldn't get millions of phone numbers while sitting on your couch, and if you could they would be useless because they were all on paper.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by rileymat2 on Wednesday February 05, 2020 @10:27PM (#22253206)

The books were hard to get, but directory assistance did exist if you called the operator.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by gwright on Wednesday February 05, 2020 @11:31PM (#22253446)

I'll bet there are quite a few people on HN that have never dialed 411 or 1-<area-code>-555-1212.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by amalcon on Wednesday February 05, 2020 @10:21PM (#22253180)

None of that let you treat your phone number as anything other than public.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by burner831234 on Thursday February 06, 2020 @01:06AM (#22253776)

I mean we realize this thread of argument has nothing to do with the point right?

A cell phone number does not equal your kitchen phone in terms of access to information. The whole this is moot. The issue now is that this is my personal phone number, me, personally, and is being used as a piece of validating information in a variety of compromises databases.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by CPLX on Thursday February 06, 2020 @03:32AM (#22254466)

This just isn’t true. Ever heard of the Haines Directory?

I used it at a summer job in the late 80’s. You could order reverse lookup books for anywhere you wanted, and of course could get that data electronically too. You could also call information for anywhere you could think of by dialing the area code plus 555-1212.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by jacobsenscott on Thursday February 06, 2020 @08:09PM (#22262262)

Never heard of it, but how much did it cost? How much did the reverse lookups cost? And even if you could get it electronically there was no way practical way to do much with them.

With the twitter leak millions of phone numbers/names are available for free instantly, and the technology to do some harm with them is readily available.

[ Parent | on HN ]