Comment by qingcharles

<< find an exec and buy their details for pennies and call them up on their cellphone. (this is usually successful, but can backfire badly -- CashApp terminated my account for this shenanigans)

Honestly, kudos. The rules should apply to the ones foisting this system upon us as well. This is probably the only way to make anyone in power reconsider current setup.

<< As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd.

And people laughed at Red Reddington when he said he had no email.

>One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do.

>As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd.

Fortunately this is changing with iOS 18 with "limited contacts" sharing.

https://mobiledevmemo.com/wp-content/uploads/2024/09/image.p...

The interface also seems specifically designed to push people to allow only a subset of contacts, rather than blindly clicking "allow all".

The far bigger issue is the contact info you share with online retailers. Scraping contact info through apps is very visible, drawing flak from the media and consumers. Most of the time all you get is a name (could be a nickname), and maybe some combination of phone/email/address, depending on how diligent the person in filling out all the fields. On the other hand placing any sort of order online requires you to provide your full name, address, phone number, and email address. You can also be reasonably certain that they're all accurate, because they're plausibly required for delivery/billing purposes. Such data can also be surreptitiously fed to data brokers behind the scenes, without an obvious "tiktok would like access to your contacts" modal.

> (this is usually successful, but can backfire badly -- CashApp terminated my account for this shenanigans)

When I was at a medium-sized consumer-facing company whose name you’d recognize if you’re in the tech space (intentionally vague) we had some customers try this. They’d find product managers or directors on LinkedIn then start trying to contact them with phone numbers found on the internet, personal email addresses, or even doing things like finding photos their family members posted and complaining the comments.

We had to start warning them not to do it again, then following up with more drastic actions on the second violation. I remember several cases where we had to get corporate counsel involved right away and there was talk of getting law enforcement involved because some people thought implied threats would get them what they wanted.

So I can see why companies are quick to lock out customers who try these games.

> CashApp terminated my account for this shenanigans

Did you call to complain about the termination?

As a result of sales drones getting hold of my number, I have to put my phone on silent and never pick up unless I recognize the number. Very unfortunate. What if there is an emergency with my kids?

> And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketplace, find an exec and buy their details for pennies

The article author claims that you can't get this stuff for under $10k. Where do you find it for pennies?

Thanks for sharing this approach. I gotta say that I’d love to hear more about how/where you are buying this data, and the CashApp story too.

So your data is only as private as the least privacy-conscious person in your social circle.

The thing is...contact details aren't really private information, basically by definition.

The distinction is contact details privacy is based on the desire not be interrupted by people you didn't agree to be interrupted by - i.e. it's a spam problem - and realistically to solve this requires a total revamp of our communications systems (long overdue).

The basic level of this would be forcing businesses to positively identify themselves to contact people - i.e. we need TLS certificates on voice calls, tied to government issued business identifiers. That would have the highest immediate impact, because we could retrain people not to talk to anyone claiming to be a business if there phone doesn't show a certificate - we already teach this for email, so the skill is becoming more widespread.

A more advanced version of this might be to get rid of the notion of fixed phone numbers entirely: i.e. sharing contacts is now just a cryptographic key exchange where I sign their public certificate which the cellphone infrastructure validates to agree to route a call to my device from their device (with some provisioning for chain of trust so a corporate entity can sign legally recognized bodies, but not say, transfer details around).

This would solve a pile of problems, including just business decommissioning - i.e. once a company shuts down, even if you scraped their database you wouldn't be able to use any of the contact information unless you had the hardware call origination gear + the telecom company still recognized the key.

Add an escrow system on top of this so "phone numbers" can still work - i.e. you can get a random number to give to people that will do a "trust on first use" thing, or "trust till revoked" thing (i.e. no one needs to give a fake number anymore, convention would be they're all fake numbers, but blocking the number would also not actually block anyone you still want to talk to).

EDIT: I've sort of inverted the technical vs practical details here I realize - i.e. if I were implementing this, the public marketing campaign would be "you can have as many phone numbers as you want" but your friends don't have to update if you change it. The UI ideally would be "block this contact and revoke this number?" on a phone which would be nice and unambiguous - possibly with a "send a new number to your friends?" option (in fact this could be 150 new numbers, one per friend since under the hood it would all be public key cryptography). I think people would understand this.

> find an exec and buy their details for pennies and call them up on their cellphone

There is a vendor for this very thing in relation to business and government position called “zoominfo”

>> And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketplace, find an exec and buy their details for pennies and call them up on their cellphone.

I find it funny how easy it is to find scammy websites which promise to remove your data (right...), but how hard it is to find the actual marketplaces where people trade this data. It also makes you think about what other systems have similar asymmetric interfaces for the public and the ones in the know (yes, I know there are plenty).

Assuming these marketplaces operate within the bounds of the law, would it break HN’s ToS to post them? I’d be interested in pursuing the same strategy.

Could you please tell me how to buy this stuff? This sounds like a great way to get customer service when normal channels fail.

And the combination of contacts are also unique enough to identify you. Even though they change over time. Some fuzzy matching, take in another few bits of fingerprint like device type and country and voila no advertiser ID required.

Ps smart idea to use it for that purpose. If I failed to get proper service I'd just review bomb the company everywhere and soon enough I'd get a call fixing my problem and asking to remove them :)

> there is no sane way to protect your contact details from being sold

I can think of one: make it illegal to buy, sell, or trade customer data. All transfer of data to another party must have a record of being initiated by the individual.

I'm not familiar with these marketplaces. Could you name a few examples?

Actually this could prove very useful for a resistance movement. Take them down with with their own medicine.

It is possible to just not use a phone number.

I mostly connect through Signal. I do technically have a phone number that my close friends and family have, but its a random VoIP number that I usually change every year or so. Surprisingly no one has really cared, I send out a text that I got a new number and that's that.

Changing your number every year could mitigate as it would introduce entropy and stale data into the system. When done at scale, data lifetime would behave similar to the automatic deletion of messages on whatsapp. Somewhat mimicking an in person verbal conversation where only people's memories remember what was said and even their version gets changed every time memory recall takes place. Systems already exist in real life that protect privacy, it's just that we do a poor job of reproducing them with tech.

Changing your telephone number every year could be an artificial holiday like valentines day or halloween. It can be done if people deem it's important.

I just block all unscheduled calls and calls from unknown numbers. If there isn't a calendar event and it isn't coming from a known family member or close friend, the call doesn't go through.

I also have multiple cell and virtual numbers and give different ones out to businesses, banks, friends, and family. Businesses that don't need to ship me stuff also get a different address than ones that do.

I don't register to vote anymore because they leak my residential info. When they can agree to stop leaking it, I will participate again.

I have done this as well. I once got an travel insurance claim rejected by some outsourced handler and found out who the CEO of the insurance startup was. I emailed him and magically it got resolved

> CashApp terminated my account for this shenanigans

The audacity of these people. They probably do far worse things to their customers on a daily basis.

What marketplaces do you use?

I stopped keeping a mobile number many years ago.

Phone is wifi only.

In particular, I do not use the contacts functionality built into the phone.

(This is /e/OS, which helps, but I'll be moving to Mobian as soon as it is viable.)

Where are you buying this? Might be handy for a job search. Zoominfo basically doesn't have a b2c offering and I am not paying several thousand for an experiment in improving my career

I can relatively easily skip trace people but where are you buying specific peoples information? Do you mean youre skip tracing or buying directly from data brokers?

What kind of marketplace do you use?

How do you do this? This is genius

That’s a textbook „surveillance capitalism” move.

Any chance of a tutorial or some materials on doing exactly this sort of thing?

[dead]

[dead]

You may be committing some type of violation of privacy laws if you're contacting them via phone and they're on the do not call list. Because they work at a company does not mean that you and the employee have a business relationship.