News for hackers. Stuff that matters.
Re:TrueCaller built a billion-dollar caller ID data empire i... by fareesh on Tuesday March 22, 2022 @10:25AM (#30766456)
When you install the app they steal your contact list and populate their database that way. Most people are unaware of this, or don't care since we are a third world country and privacy is seen as a first world problem. The vast majority of thinking here is not very sophisticated about these types of topics. Only a very tiny fraction of the total population is averse to sharing personal information like phone numbers. It's common to see folks post their tax ID numbers etc on public forums, tweets, etc. too.

For a number of years it was quite common for folks in the lowest income brackets to change their phone numbers quite often because of rampant competition between mobile network providers. The "Mobile Number Portability" system was eventually introduced that minimized this to a large degree. Eventually the competition subsided and this reduced significantly to a point where it's not very common anymore per my understanding.

When I need to use Trucaller I use it via their web interface exclusively with a google account that has 0 contacts for them to steal. I remember finding my number listed many years ago as my name with (web developer) in parenthesis, likely stolen from some old customer of mine.

Re:TrueCaller built a billion-dollar caller ID data empire i... by inglor on Tuesday March 22, 2022 @10:41AM (#30766653)
My wife installed TrueCaller on her phone. She is technical but not a developer.

I asked if she knows they steal your contact list and spy on you and her answer was “so? It’s just phone numbers and names and they need to get the data somewhere as they are providing the service for free”

I live in a developed country and we have a high standard of living.

Giving this anecdote to illustrate many people genuinely don’t see TrueCaller’s spying as a big deal. This is unfortunate but it’s how things often are.

Re:TrueCaller built a billion-dollar caller ID data empire i... by lelandfe on Tuesday March 22, 2022 @11:49AM (#30767541)
It's worth noting that Instagram does this too, under the guise of "Find Your Friends." When you sign up for a new account, they aggressively prompt you to sync your contacts list with the app, and will continually prompt you in the future if you choose not to. Nearly all of my friends have this enabled.

This is not a one-time sync, either. It will upload future new contacts and changes.

And, finally, if you manage to create a new account without a phone number, Instagram appears to flag your account for suspicious activity at some point and mandates that you do. They can then correspond your phone number with other users' contact lists to determine your identity. It can even suss out if you provided a Google Voice/VOIP number and require a "real" one instead.

https://help.instagram.com/195069860617299

Re:TrueCaller built a billion-dollar caller ID data empire i... by thelittleone on Tuesday March 22, 2022 @12:54PM (#30768510)
Contact lists should be treated like PII and have laws and technical controls against sharing them without the permission of the contact. Incredibly difficult to do no doubt. But if people are ok to share their contact let them. Let others opt out.
Re:TrueCaller built a billion-dollar caller ID data empire i... by vmception on Tuesday March 22, 2022 @11:09PM (#30774439)
Facebook has done this periodically over the years as well. So I'm not surprised they ported that feature over or independently evolved to it on Instagram. I had caught on to the concept of breaking the social graph by using a virgin email and never putting in a phone number not even for 2-factor even once. But then there is a great risk that they flag you for "spam" within days or minutes!

Honestly, Apple needs to get in front of this on iOS just like they've done partially with Location data, Photos/Videos, and data brokering. They need to let you select shareable contacts. Kind of like the Circles that Google Wave had. Instead of letting apps force you into an all or nothing approach.

Re:TrueCaller built a billion-dollar caller ID data empire i... by techsupporter on Tuesday March 22, 2022 @01:29PM (#30768956)
> When you sign up for a new account, they aggressively prompt you to sync your contacts list with the app, and will continually prompt you in the future if you choose not to.

Even everyone's much-loved Signal does this. Contacts sync is presented as "not now" or "yes forever." The "not now" message even explicitly says they'll bug you again.

Re:TrueCaller built a billion-dollar caller ID data empire i... by tompagenet2 on Tuesday March 22, 2022 @01:33PM (#30769005)
Are you sure? This page [1] says this is not the case

[1] https://support.signal.org/hc/en-us/articles/360007061452-Do...

Re:TrueCaller built a billion-dollar caller ID data empire i... by Groxx on Tuesday March 22, 2022 @09:55PM (#30773964)
No, they're still uploading the same data as they did before (last I looked into it, it was still enough data to rather easily reverse and get pretty good accuracy. if it wasn't accurate, it would have unacceptably many false-positives, so it's a necessary quality of the system).

Regardless of how you hash them, it needs to work on a phone, and it needs to be reasonably unique... so you can just enumerate literally every phone number ever on a decent computer in a few seconds and, if combined with basically any other information at all (like an area code), that's enough to figure out many or most contacts trivially.

The difference, which that article goes into, is that now they're going all-in on you also trusting Intel's SGX and thus every single thing in between you, them, their hardware delivery pipelines, etc. Which makes collecting that data completely ok (it's done securely now thanks to SGX!), because you should obviously trust Intel because CPU vendors have had such a fantastic track record in their on-chip security systems. (</sarcasm> in case that wasn't clear)

There's a lot to like about Signal's privacy, both in isolation and in comparison to other messengers. They're doing great work. But I have absolutely no idea why they persist in this data collection. Their bull-headedness on zero options around it for years on end smells more suspicious than anything else at this point tbh. About 3/4 of the people I've known who installed Signal immediately left forever because someone they knew contacted them to say "welcome" and they got super creeped out wondering how they knew they had joined. And then the contact-er frequently left too because they had no idea it wasn't consensual, and were creeped out as well.

Re:TrueCaller built a billion-dollar caller ID data empire i... by nathancahill on Tuesday March 22, 2022 @04:25PM (#30771048)
Signal is worse, because when you sign up with a phone number, everyone that has your number in their address book gets a notification from Signal that you signed up.
Re:TrueCaller built a billion-dollar caller ID data empire i... by amitport on Tuesday March 22, 2022 @07:34PM (#30773005)
They claim it is done without revealing these contact to signal.

Assuming they are telling the truth, why would you care that your contacts know you also use signal (like them)?

Re:TrueCaller built a billion-dollar caller ID data empire i... by websap on Tuesday March 22, 2022 @12:50PM (#30768450)
India has a huge problem with spam / robo callers. Also its common for individuals to have more than 1 phone number, see how popular dual sim phones are.

Also true caller adds security when you're from an under represented or a minority groups. I especially know women who use Truecaller to make sure they know who is calling / texting them from new numbers.

Re:TrueCaller built a billion-dollar caller ID data empire i... by signal11 on Tuesday March 22, 2022 @04:02PM (#30770786)
> see how popular dual sim phones are

Having multiple SIMs in India will go away, or at least become something only the rich have, it's only a matter of time. This is because having that second SIM is no longer cost-free.

Multiple SIMs in India were a side-effect of it being near-free to have a prepaid SIM to receive calls. This was subsidized by high calling charges (calling from one part of India to another was expensive) and even higher data prices.

Then Jio entered the market with a ground-up 4G network and said, this is BS. Calls and texts are free, with no reasonable limits. We'll only charge you for data, and we'll provide 1.5GB a day or more -- starting at INR 150 a month paid 3 months at a time. The party ended for a lot of operators at that point as they hemorrhaged customers. Most operators simply folded or merged until now there are only 3 private players and one non-serious state player.

Driven by pressure from Jio, the other two private players (Airtel and Vi, aka Vodafone) have decided to amp up monthly charges for pre-paid phones. Essentially, if you're not spending at least INR 120 a month they don't want you. India has number portability so it's not like you're held hostage or anything.

INR 120 sounds super low but it's not for a lot of Indians who earn salaries closer to India's median per-capita income, and also it's an extremely limited level of service, for actual use you need to pay more -- typically around INR 250 monthly for 1.5GB data per day (remember, most Indians don't have wired Internet so 1.5GB data per day is not excessive). Jio and its competitors have hiked prices substantially, of course.

The last refuge for people on limited budgets is the state-run telco, BSNL, but the government will sell it -- it's only a matter of time. Expect prices to spike again, then.

Anyway, multiple SIMs in India are increasingly less viable for ordinary people. It'll take a while for behaviour to change, but it'll change.

Re:TrueCaller built a billion-dollar caller ID data empire i... by lotsofpulp on Tuesday March 22, 2022 @07:28PM (#30772948)
Coincidentally, the US is also down to 3 mobile networks.

I wonder what the percentiles is for number of networks in populous and large countries. Perhaps 3 networks is the number of maximum economically viable long term networks due to the enormously high cost of installing all the fiber and cell station infrastructure across the country.

Re:TrueCaller built a billion-dollar caller ID data empire i... by paranoidrobot on Wednesday March 23, 2022 @12:00AM (#30774793)
Another data point: Australia basically only has 3 nation-wide mobile networks.

They're broadly compatible from a handset perspective - sometimes there's better coverage for one or the other in some area or newer tech but for most day-to-day use you can get a SIM from any carrier and expect to be able to use it any (non-network-locked) device.

Re:TrueCaller built a billion-dollar caller ID data empire i... by seanp2k2 on Tuesday March 22, 2022 @09:58PM (#30773985)
Don't forget the carrier locking in the US, and the "Verizon phones" / "global phones" vs "ATT phones" with different LTE bands.
Re:TrueCaller built a billion-dollar caller ID data empire i... by sumedh on Wednesday March 23, 2022 @08:07AM (#30777590)
> Then Jio entered the market

If I am not mistaken some shell company bought the spectrum then Jio bought the shell company.

Re:TrueCaller built a billion-dollar caller ID data empire i... by Pxtl on Tuesday March 22, 2022 @02:26PM (#30769619)
> India has a huge problem with spam / robo callers

That's everywhere, not just India.

Re:TrueCaller built a billion-dollar caller ID data empire i... by edgyquant on Tuesday March 22, 2022 @09:35PM (#30773845)
You’re playing coy, India is a source of a huge number of the worlds phone scams. With Brazil being the “most spammed.” As a slightly related caveat, with how frustrating the scammers are for me in the Us I can only imagine Brazil. Their phones must ring 24/7.
Re:TrueCaller built a billion-dollar caller ID data empire i... by Pxtl on Wednesday March 23, 2022 @09:53AM (#30778467)
Yes, but aren't we talking about which country is the target of the scams, not the source?
Re:TrueCaller built a billion-dollar caller ID data empire i... by unmole on Tuesday March 22, 2022 @10:24PM (#30774135)
And do you think Truecaller has anything to do with that?
Re:TrueCaller built a billion-dollar caller ID data empire i... by edgyquant on Wednesday March 23, 2022 @09:29AM (#30778246)
Probably not. But their job is to keep track of all of this, they’ve clearly made a healthy premium, so I do believe they have a part in both not preventing it at this time and helping to prevent some of it going forward. Not sure what that entails but I get a dozen calls a day and need someone to yell at.
Re:TrueCaller built a billion-dollar caller ID data empire i... by websap on Tuesday March 22, 2022 @02:53PM (#30769954)
I cannot speak about all other countries.
Re:TrueCaller built a billion-dollar caller ID data empire i... by aldebran on Tuesday March 22, 2022 @01:35PM (#30769029)
I’ve gone a few steps further and answered the “So?”. My wife thinks I’m a conspiracy nut even though I’ve provided proof of things that have happened. She thinks if it was that wide spread it would have been stopped already.

Fortunately we’ve agreed on not sharing kids pics and information on places like FB insta etc.

Re:TrueCaller built a billion-dollar caller ID data empire i... by digitallyfree on Tuesday March 22, 2022 @11:12AM (#30767030)
Honestly it's the same thing with the (well-educated) people who have their entire lives on the Google cloud and don't have an issue with the privacy practices of Facebook and Tiktok. They know the companies use their data and they don't mind or care - all they want are their free services.

To them features/functionality/cost is first, and privacy is an afterthought. I see this view in a lot of people nowadays.

Re:TrueCaller built a billion-dollar caller ID data empire i... by amelius on Tuesday March 22, 2022 @11:15AM (#30767064)
We definitely need some scenarios where this kind of spying plays out badly for the user, so we can use them in arguments against these practices. Without examples, I can't blame users for calling these dangers hypothetical, really.
Re:TrueCaller built a billion-dollar caller ID data empire i... by dankboys on Tuesday March 22, 2022 @11:36AM (#30767382)
Perhaps too niche, but Bellingcat have used these sort of apps in the past to identify Russian officers
Re:TrueCaller built a billion-dollar caller ID data empire i... by unmole on Tuesday March 22, 2022 @10:22PM (#30774120)
I'm old enough to remember telephone directories. Phone companies would publish listings of name, phone numbers and addresses of everyone who had a phone.

Fun fact: Elector rolls are public record. Your address is already out in the open.

> Giving this anecdote to illustrate many people genuinely don’t see TrueCaller’s spying as a big deal.

That's because it makes no material difference to them.

Re:TrueCaller built a billion-dollar caller ID data empire i... by ehPReth on Tuesday March 22, 2022 @10:29PM (#30774168)
me too! I'm glad it's no longer the case though personally, if you've ditched "land lines" (at least in Canada?)
Re:TrueCaller built a billion-dollar caller ID data empire i... by adolph on Tuesday March 22, 2022 @06:11PM (#30772252)
It used to be that the phone company would annually throw a book on your porch with everyone in your town's name, phone and address. I can see how someone with that as a mental model for contact lists wouldn't see a problem.
Re:TrueCaller built a billion-dollar caller ID data empire i... by jabroni_salad on Tuesday March 22, 2022 @02:14PM (#30769466)
I think a lot of that comes from the fact that phone numbers being private at all is not a universal consideration. My town still, every year, sends me a paper book full of every resident's address and landline telephone.
Re:TrueCaller built a billion-dollar caller ID data empire i... by _jal on Tuesday March 22, 2022 @02:32PM (#30769697)
And here's where how something is used makes all the difference.

I have zero issues with my neighbors having my phone number. If I lived in a smallish place, extending that would be fine.

I have huge issues with spammers and con artists having it.

A locally distributed physical book works great for the first and, at the very least, makes the second work for it.

Online databases are basically made to order for the second, and are far more extensive than needed for the first.

It is just another example where adding automation and cheap storage actively makes a situation worse.

Re:TrueCaller built a billion-dollar caller ID data empire i... by Kiro on Tuesday March 22, 2022 @05:15PM (#30771676)
In my country the same physical book has been available online for decades.
Re:TrueCaller built a billion-dollar caller ID data empire i... by KingOfCoders on Tuesday March 22, 2022 @01:36PM (#30769035)
Not that someone cares, but in the EU she would be responsible for violating the GDPR. Many people don't know that they are responsible as private citizens.
Re:TrueCaller built a billion-dollar caller ID data empire i... by Kiro on Tuesday March 22, 2022 @05:14PM (#30771652)
Only true if she violates a national law. GDPR itself does not apply to private citizens.
Re:TrueCaller built a billion-dollar caller ID data empire i... by KingOfCoders on Friday March 25, 2022 @07:17AM (#30800735)
GDPR does apply to private citizens. It does not apply to private citizens doing private things only eg with their phone.
Re:TrueCaller built a billion-dollar caller ID data empire i... by putlake on Tuesday March 22, 2022 @11:12AM (#30767034)
This illustrates the reverse lookup problem with these services. You can take pains to use a Google account with zero contacts. That safeguards the information of your contacts. But Trucaller already has your information because they get it from other people who have added you in their contacts list, and who aren't as privacy conscious as you are.
Re:TrueCaller built a billion-dollar caller ID data empire i... by mountainofdeath on Tuesday March 22, 2022 @11:21AM (#30767174)
I consider it a fair trade. I hand over my contacts and you tell me with high-confidence who the other person on the other end is.
Re:TrueCaller built a billion-dollar caller ID data empire i... by httgp on Tuesday March 22, 2022 @11:38AM (#30767415)
The issue here is that your contacts did not agree to you sharing their information with a third-party.
Re:TrueCaller built a billion-dollar caller ID data empire i... by withinboredom on Tuesday March 22, 2022 @02:48PM (#30769896)
I don’t know. If you give me a soda, that soda becomes mine to do what I want. I can pour it on the ground, drink it, or give it to someone else. I feel the same way about ways to contact someone. With today’s technology, they can block people they don’t like but it’s not my job to be their gate-keeper.
Re:TrueCaller built a billion-dollar caller ID data empire i... by elevenoh on Tuesday March 22, 2022 @05:12PM (#30771627)
The poor analogy, mild sociopathy view
Re:TrueCaller built a billion-dollar caller ID data empire i... by reaperducer on Tuesday March 22, 2022 @11:38AM (#30767410)
Can you explain what it is that gives you the right to hand other people's personal information to another entity?

Especially as part of a commercial transaction to a for-profit company?

"Hey, Bob! I'm going to give some company your name, phone number, occupation, and whatever else I know about you stored in my contact list in exchange for a beer. Is that OK?"

Re:TrueCaller built a billion-dollar caller ID data empire i... by RubyRidgeRandy on Tuesday March 22, 2022 @12:22PM (#30768037)
Do you make someone sign a legal document when you give them your number detailing the uses and limitations of how they can share your number? No. You don't.

Once you give your info away it is not "your" info anymore. It is info about you, but you do not own it.

Is it rude? sure, but not illegal.

Re:TrueCaller built a billion-dollar caller ID data empire i... by mcronce on Tuesday March 22, 2022 @12:40PM (#30768314)
Lots of things are amoral but not illegal. I also don't think anybody above you claimed it was illegal.
Re:TrueCaller built a billion-dollar caller ID data empire i... by RubyRidgeRandy on Wednesday March 23, 2022 @02:06AM (#30775475)
"what gives you the right..."

okay.

Re:TrueCaller built a billion-dollar caller ID data empire i... by Nextgrid on Tuesday March 22, 2022 @12:25PM (#30768092)
> Is it rude? sure, but not illegal.

Depends on the jurisdiction. Under the GDPR this might very well be illegal, though obviously enforcement of it is significantly lacking so it's unlikely to ever actually be tested in court.

Re:TrueCaller built a billion-dollar caller ID data empire i... by 1vuio0pswjnm7 on Tuesday March 22, 2022 @04:21PM (#30771004)
"When you install the app they steal your contact list and populate their database that way."

What if you avoid using the system default contacts store, i.e., keep it empty, and instead you use an app like OpenContacts.^1 To apps like TruCaller, it will appear the the user has no contacts.

1. https://f-droid.org/packages/opencontacts.open.com.openconta...

https://github.com/sultanhamer/opencontacts

Re:TrueCaller built a billion-dollar caller ID data empire i... by 1vuio0pswjnm7 on Tuesday March 22, 2022 @09:42PM (#30773891)
Re:TrueCaller built a billion-dollar caller ID data empire i... by rajeshp1986 on Tuesday March 22, 2022 @12:32PM (#30768192)
Folks in India consider phone numbers as non-personal Info. They even write their phone no.s on social media profiles openly.

I started using TrueCaller some 8 years back and the biggest reason for me to use it was to prevent Robo callers/spams.

Re:TrueCaller built a billion-dollar caller ID data empire i... by mohanmcgeek on Wednesday March 23, 2022 @12:06AM (#30774821)
> The vast majority of thinking here is not very sophisticated about these types of topics

Oh it's the classist "I'm smarter than the average person in my country" crowd again.

Why do you assume you know better? Perhaps they know what they're trading and perhaps it's worth the cost.

Re:TrueCaller built a billion-dollar caller ID data empire i... by zakember on Tuesday March 22, 2022 @05:51PM (#30772037)
In case you haven't yet done it already, you can ask TrueCaller to unlist your phone number from their System: https://www.truecaller.com/unlisting
Re:TrueCaller built a billion-dollar caller ID data empire i... by jamal-kumar on Tuesday March 22, 2022 @06:11PM (#30772243)
I have two phones, one with a cell phone chip from a third world country, and one which is not.

Guess which one gets all the apps - It's definitely not the one that costs me over 100$/mo to maintain!

Re:TrueCaller built a billion-dollar caller ID data empire i... by drieddust on Tuesday March 22, 2022 @10:01PM (#30774006)
It doesn't matter that you have 0 contacts. They will still be able to map you through other people's contact list.
Re:TrueCaller built a billion-dollar caller ID data empire i... by fareesh on Tuesday March 22, 2022 @10:41PM (#30774253)
I'm fine with having my number listed. I don't want to be the person that includes some other individuals number to them.

I also want to minimize their information about my network.