Bruteforcing the phone number of any Google user

Re:Bruteforcing the phone number of any Google user by bscphil on Monday June 09, 2025 @01:53PM (#44227110)

I'd be rather surprised if IPv6 hasn't done some damage to the idea of IP blocking on the whole. It's possible, even as a residential Internet user, to request a /56 or /48 automatically with DHCPv6 Prefix Delegation. I have a /56 with Comcast. That's potentially up to 65536 /64 blocks, just from a residential user, so if you're going to attempt IP filtering for IPv6, it's got to be a lot smarter than swapping out your single-IP blocking for /64 blocking.

[ Parent | on HN ]

Re:Bruteforcing the phone number of any Google user by edelbitter on Monday June 09, 2025 @04:17PM (#44228965)

It actually makes things a easier for both blocking and allocating (e.g. VPS hoster) side.

Once the "oh no, we can't afford that many unique allocations" excuse is away, algorithms that enforce quotas for every prefix size at the same time (with no excuses for CGNAT weirdness) stop being too ruthless.

You can distribute your addresses as needed, and I can track successful and failing attempts - at whatever distribution scheme you use. E.g. group your "unverified" or "trial" accounts at a larger prefix size, so they get each other blocked - but not your paying customers.

[ Parent | on HN ]

Re:Bruteforcing the phone number of any Google user by bigstrat2003 on Monday June 09, 2025 @04:13PM (#44228908)

How are you getting a /56 from Comcast? I can only request up to a /60 from them, any larger and I get a /60 rather than whatever I requested.

[ Parent | on HN ]

Re:Bruteforcing the phone number of any Google user by bscphil on Tuesday June 10, 2025 @03:30AM (#44233749)

Good question, I checked just now and I am indeed getting only a /60. At some point in the past they gave me a /56 but no longer. I didn't notice the change because I have fewer than 16 networks, and networkd handled delegating /64s to them automatically.

[ Parent | on HN ]

Re:Bruteforcing the phone number of any Google user by bigstrat2003 on Tuesday June 10, 2025 @02:15PM (#44239669)

Shame, I was hoping I could get on the /56 train too lol. Thanks for checking!

[ Parent | on HN ]

Re:Bruteforcing the phone number of any Google user by Guvante on Monday June 09, 2025 @01:58PM (#44227186)

It is already pretty common to start with IP blocking but upgrade to blocks when the bad behavior continues.

Assuming a /64 as a starting point is an easy win and bumping it up with repeat offenders seems pretty easy in the grand scheme of things.

[ Parent | on HN ]

Re:Bruteforcing the phone number of any Google user by TechDebtDevin on Monday June 09, 2025 @07:16PM (#44230674)

Doesnt CGNAT make these methods obselete though? All my webscraping is proxied through my phone and I rarely get IP blocked and im very aggressive even on CF protected sites.

[ Parent | on HN ]

Re:Bruteforcing the phone number of any Google user by joelkoen on Wednesday June 11, 2025 @08:18AM (#44246824)

That's neat, could you explain how you achieved that?

I tried a year or so ago and had to round trip to my Android over mobile data so it was too high latency for what I needed. If there's a way to connect to a phone on the same LAN/WiFi but scrape using its mobile network I would be very interested.

[ Parent | on HN ]

Re:Bruteforcing the phone number of any Google user by TechDebtDevin on Wednesday June 11, 2025 @09:35AM (#44247473)

Yes, if you're interested its not too difficult, but I don't really want to put it here on HN (my business kinda relies on these methods, and I'm increasingly worried they will start working on this problem). If you email me at [email protected] I'll send you details.

[ Parent | on HN ]

Re:Bruteforcing the phone number of any Google user by efreak on Thursday June 12, 2025 @02:10PM (#44260804)

You can run an ssh server in termux and run whatever programs you want from there.

There's several options for storage, as well: - connect an external drive via USB (The /Android/media directory on both the internal and external SD card is generally accessible from both termux and other apps on the phone) - if you're rooted you can mount a network storage in termux (or system-wide, but then you have to figure out sandboxing) - if you're not rooted, mount in reverse (mount your phone storage over the network)

[ Parent | on HN ]

Re:Bruteforcing the phone number of any Google user by gck1 on Friday June 13, 2025 @11:19PM (#44273957)

You can pick up a pulled laptop modem like the T99W175 from China for a low price, drop it into a USB enclosure (you’ll be limited to USB 2.0 speeds), and hook it up to OpenWrt. Or grab a GL.iNet GL-X3000 - the Quectel RM520N is already on board and runs over PCIe, so it’s quicker.

Then you can have basically unlimited IPs.

Android messes with your traffic far more than a bare modem (there's unavoidable NAT for one), and it has tighter thermal limits, so higher latency is expected.

[ Parent | on HN ]