[HN Gopher] Show HN: Doxx Me - See how doxxable your phone numbe...
___________________________________________________________________
Show HN: Doxx Me - See how doxxable your phone number is
I built this tool that checks publicly available data against your
phone number. I was surprised how one my numbers (which I text and
sign up for services with) has a lot of information attached to it
including my full name, all previous addresses, relatives, emails,
and more.
Author : jimhi
Score : 67 points
Date : 2022-07-29 16:21 UTC (6 hours ago)
(HTM) web link (app.efani.com)
(TXT) w3m dump (app.efani.com)
| gregwebs wrote:
| This really validated my approach of using a Google voice number-
| which was completely doxxed. Whereas my actual personal phone
| number was not.
| ahaseeb wrote:
| Do you ever share your personal number or what's the use case
| with 2 numbers ?
| IYasha wrote:
| Some notes to developer: 1. it was never mentioned that the
| number must be from United States. You'd better add a client-side
| check BEFORE sending data to server 2. does this page
| purposefully disable right-click when number is entered? 3.
| embedded youtube iframe shows captcha page :D 4. as always,
| cloudflare gives a bit of trouble over tor (and not only)
| jimhi wrote:
| Noted. Thanks for the feedback.
| derwiki wrote:
| And this probably isn't including hacked data from companies,
| just legally purchased data?
| ahaseeb wrote:
| It may be. We buy if off data brokers that you can search too.
| We just make it simple to find the info
| spdustin wrote:
| Whatever your sources, it appears to return the same information
| as "search people free dot com," including all the same
| inaccuracies.
| ahaseeb wrote:
| It could be but we use multiple sources . There are hundreds of
| data brokers
| coldblues wrote:
| Do Europeans have it better in regards to this? I think the
| situation is minimal compared to what it's like in the USA.
| jimhi wrote:
| I built this tool. This appears to be mostly American problem
| in terms of how easy it is to find data. Canada seems to be
| second with far less info.
| aojdwhsd wrote:
| My report had an old work address listed. Not sure how that
| could've happened except that I had to have a background check
| performed while I was already there, and listed the work address
| as my address.
|
| There was also an associated phone number that I only ever used
| on my credit card accounts. Hmm.
| jimhi wrote:
| Visa and Mastercard used to sell data on credit card purchases
| until a law was passed in the last decade. That information
| will forever be connected. To this day you can purchase phone
| numbers that connected to certain cell towers.
| tedunangst wrote:
| I'm puzzled by all the complaints that this isn't public
| information. Where do you think they got it? (I guess the actual
| question is what do you think "public" means?)
| ahaseeb wrote:
| Public means any one can access it without obtaining a license.
| Like you can go to whitepages and find info
| BizarroLand wrote:
| It failed to find anything on me and I've had my number for over
| a decade.
| CobrastanJorji wrote:
| Let's see, you got...my name, my spouse's name, my work email, my
| personal email, our birthdays, at least 5 of my former addresses,
| my whole driver's license history, where I went to college, where
| I went to high school, every company I've worked for, my mom's
| name, my parent's names, and my gender. That's more than I
| expected that you could get, wow.
|
| One thing your site could do but doesn't is tell me WHERE it got
| that information, like exactly where. Why just say "publicly
| available data?" I want to know precisely where you got all this
| on me, with annotations. Without that information, this is just a
| scary page that encourages me to sign up for nebulous services.
| ahaseeb wrote:
| Your suggestions are well taken. We should do a better job on
| the page however we're limited on what info to display &
| sources due to privacy laws and to prevent misuse
| snoopy_telex wrote:
| So you can display the private information, but you can't
| display where it came from due to privacy laws? Can you cite
| which privacy laws protect the source of the publicly
| available information?
| prepend wrote:
| I doubt it's privacy laws and more likely the terms of
| service from their data broker. The data broker probably
| doesn't allow it and if they reveal the source, they will
| be cut off.
|
| Their source must be cheap enough to do stuff like this so
| it probably rules out DataAxle, Elsevier and Oracle.
| JasonFruit wrote:
| It seems to me like the data source would welcome the
| free advertising.
| qorrect wrote:
| Having run a few background check websites where there
| was a data broker ... no they hate the attention. I got a
| visit from the FBI for using the name of their database (
| we could show the results from the DB, but we could not
| use the name of it publicly) , which they updated on
| their website to say 'restricted' but did not email us or
| call us. This was early 2000's.
| snoopy_telex wrote:
| Why would the FBI be interested in a civil (contractual)
| violation between companies?
| ahaseeb wrote:
| Not really since it's a wholesale arrangement and don't
| deal with retail
| GameOfFrowns wrote:
| >we're limited on what info to display & sources due to
| privacy laws and to prevent misuse
|
| Of course. We're not not allowed to know who sold our
| personal data to shady 3rd parties due to "privacy laws".
| Hilarious.
| CobrastanJorji wrote:
| Even "we knows this because we bought a package of such &
| such data from Data Broker LLC" would be great.
| jimhi wrote:
| We use a ton of sources. You can google data brokers and
| try some. But just because you find one and get them to
| remove the info, doesn't mean it is gone.
| codegeek wrote:
| You will be surprised how much personal info. is available on
| various websites. Do a google search on yourself and enjoy.
| ranger_danger wrote:
| I don't believe that you're only using publicly available data.
| What are your sources? It should not be legal to store all this
| information tied to only a phone number that just anyone can look
| up publicly online.
| UncleEntity wrote:
| You can lookup a surprisingly large amount of information about
| a person online.
|
| Had this guy who decided to use my Gmail address for stuff and
| I ended up finding his phone number online to text him that is
| wasn't his email address. After the failed attempt send him a
| yard gnome after I reset his Walmart password and was thwarted
| by the security code on the back of credit cards. I still think
| he would have been a good gnome owner.
| ahaseeb wrote:
| you can search for services who'll give it to for sub $10
| blackearl wrote:
| Interesting but not very helpful
| ahaseeb wrote:
| how could it be more helpful
| piscisaureus wrote:
| Not sure if I agree with the scoring model here.
|
| I tried two phone numbers: my primary cell phone number gets a
| great 800+ score but reveals an accurate address history of 9
| years.
|
| The second one gets a poor score (415), but none of the data is
| accurate. Have fun:
| https://gist.github.com/piscisaureus/03d5ebeeb3e77922a858464....
| jimhi wrote:
| The scoring model is based on how likely you are to be targeted
| and hacked. Multiple points of data make it exponentially
| easier to do successfully. So just one address is not always
| the worst thing. Having tons of data on your phone (even if
| some of it is inaccurate) may also make you more of a target.
| DocJade wrote:
| Nothing besides my carrier B)
| vorpalhex wrote:
| What data sources are powering this?
| FiveClientAuto wrote:
| If the data is publicly available as you claim please let us know
| where exactly so we can attempt to mitigate some of this. Thank
| you.
| noasaservice wrote:
| NOTICE that any request of WHERE the data is coming from is
| completely ignored by this company.
|
| For 2 people who claim its for safety and security, sure as
| hell seems like a HN fishing expedition.
| jimhi wrote:
| 1. Privacy laws dictate we can't point people at uncensored
| data.
|
| 2. We are a cybersecurity company. We don't want to show
| people how to hack others.
|
| 3. It would lend to the common belief that there is one
| source of data that you can simply delete or opt out of.
| There are hundreds of companies, databases, and sources with
| this information copied.
| FiveClientAuto wrote:
| This is just plainly not true. MB at IntelTechniques
| publishes one of the best known removal workbooks in the
| industry. There's no reason you can't do the same to teach
| people who to contact to remove their data. See
| https://inteltechniques.com/workbook.html
|
| There is nothing stopping you from doing the same.
| noasaservice wrote:
| Which their response just reaffirms that they're just a
| fly-by-night MVNO doing their own data harvesting.
|
| And they have their own grandiose "nobody can fool us and
| have your SIM swapped here" (YET).
|
| If I received $1 for everything I've read or heard
| "UnHacKaBlE", I could retire immediately.
| jimhi wrote:
| We have $5 million insurance in the case that someone
| does get SIM Swapped which we have prevented so far.
|
| Have you considered our cybersecurity company might have
| made this tool and provided it for free because it is
| good helpful to our target customers and might even help
| some customers find us?
|
| Because that is what this is. Not data harvesting. We
| make money on our phone plan.
| noasaservice wrote:
| It's not if, but when.
|
| Simply put, your security is NOT impenetrable. And I
| would heartily and easily say that your security is not
| up to NatSec minimums. And hell, they can't even keep
| their tools and data from leaking out.
|
| You know, EternalBlue and goodies? Or how about the OMB
| hack. still sour about that one.
|
| > Have you considered our cybersecurity company might
| have made this tool and provided it for free because it
| is good helpful to our target customers and might even
| help some customers find us?
|
| Or you're harvesting legit HN users. Companies don't do
| stuff for free. There's always a reason. ALWAYS. And
| market research of real humans intersecting with HN is a
| very lucrative datasource.
| jimhi wrote:
| Unfortunately it is. I tested out the same steps outlined
| in this book as well as data removal services and it does
| not matter even 8 months later.
|
| Don't believe me? Please try to follow this book and
| check back if our tool is still finding the info in 6
| months.
| bckr wrote:
| I took a risk and used it, and it's pretty spooky what's
| available.
| juice_bus wrote:
| I thought it was pretty neat - not much info on my number.
|
| Here are how results are displayed if someone doesn't want to
| search their number:
|
| ====
|
| The following data is publicly associated with your phone
| number Carrier (MOBILE) Bragg Communications
| Inc. BRAGG/EASTLINK COMMUNICATIONS - SVR /2
|
| Associated Names HXXXXXX NS
|
| No Associated Emails
|
| No Associated Birthdays
|
| No Associated Locations
|
| No Extra Sensitive Info
|
| No Associated Institutions
|
| No Associated Businesses
|
| No Associated Phone Numbers
|
| No Associated Social Media
|
| No Associated People
|
| No Associated Marketing Info
|
| No Known Data Breaches
|
| ====
|
| "Associated Names" is the city and province i reside in, and
| the carrier is more or less accurate. Both things i wouldn't
| expect to be able to keep secret without extreme effort.
| jimhi wrote:
| That means your number doesn't have much information on it.
| Volundr wrote:
| Oh man, mine was actually kind of alarming. It even told me
| my SSN was issued in California. All the info looked accurate
| except for an "associated address" in Ohio that I don't
| recognize.
| ahaseeb wrote:
| Yeah it's an immediate reaction since I share my number every
| where too
| 349ecb77cd62 wrote:
| How long is this data stored if you don't respond "YES"? I
| entered a number I just got yesterday and it comes with a pile of
| random combined people's data that aren't me.
| LinkLink wrote:
| I have a ton of non-correlated data and have no idea why, but
| then I realized. I frequently use services like textnow, which
| link me to phone numbers temporarily, which are often reassigned.
| As a result, it currently thinks for the most part that I am 12
| different people. LOL.
| gcr wrote:
| could you describe this in more detail? it seems like this
| could be a useful countermeasure against these sorts of
| practices
| ahaseeb wrote:
| Probably talking more like using a disposable or burner phone
| number that people have used in the past
| Fargoan wrote:
| What happens if I put in 911?
| 1MachineElf wrote:
| I doubt you'd get any results for it. The service requires an
| verification code sent via text message.
| ahaseeb wrote:
| It may not accept 911. Text verification is to prevent abuse
| tragictrash wrote:
| No privacy policy... Not putting my number in there
| noasaservice wrote:
| Privacy policies mean absolutely jack and shit.
|
| Radio Shack had one. Judge threw it out in bankruptcy court.
|
| Others have a clause "we can change this whenever yadda yadda".
|
| Basically if you think that's going to stop them, I have a
| bridge to sell ya.
| ahaseeb wrote:
| in bankruptcy courts, everything is pretty much thrown out
| and yes every company can update their ToS. For Efani Secure
| Mobile, we clearly tell how we make money. If the goal was to
| harvest the data, service could be super cheap to get people
| in and then make money off it We make money by selling to you
| rather than selling you
| jimhi wrote:
| It's right here https://www.efani.com/privacy-policy
| tragictrash wrote:
| That link isn't in the footer of the page you posted, and the
| help chat covers the link on page load when present on
| mobile.
|
| Also, reading the privacy policy, it looks lacking. I'm not a
| lawyer, but https://www.nolo.com/legal-encyclopedia/what-to-
| include-in-y... clearly states that if your service sends
| text messages, you should make a statement about retaining
| that data indefinitely.
|
| After reviewing the privacy policy, and seeing who else is
| involved in the company, no thanks. Seems very non
| professional.
| z3c0 wrote:
| What are you doing with the information gathered from this
| service? Will phone numbers that are verified active by the text
| verification on this service be sent back to the data broker
| you're using?
| jimhi wrote:
| Protecting and notifying our customers as well as this free
| tool. No we don't send anything to databrokers, we verify so it
| isn't abused.
| z3c0 wrote:
| Thank you for clarifying.
| rootusrootus wrote:
| Looks pretty much identical to what I get on
| truepeoplesearch.com, but they don't redact anything.
| ahaseeb wrote:
| It's because of the difference license
| haswell wrote:
| Elsewhere you mentioned privacy laws. Are you saying that the
| other site is not subject to those laws due to a different
| licensing agreement?
| jimhi wrote:
| I do not know what their legal team has advised them.
| Pretty interesting how most of these sites who show you
| unredacted information seem to be run by people with no
| internet presence and stock images though.
| pbronez wrote:
| Yeah, that's pretty crazy. I'd need to know more about how the
| service works to consider signing up for it.
|
| I'd consider paying for a more detailed report that explains not
| just what can be found, but HOW that data was found, and
| remediation options beyond the mobile service plan.
| jimhi wrote:
| This data is copied and combined by hundreds of data broker
| companies, you can google around. Trying to remove the data is
| pretty futile, but our service prevents the damage that can be
| done by finding this information.
|
| That's why we made the tool and made it free.
| batch12 wrote:
| No thanks. This kind of thing should be something open source
| and/or have published, manually repeatable processes. Sending my
| phone number to a random place associated with my
| ip/device/referrer/etc is just bad practice akin to asking for my
| passwords to evaluate their strength. Especially when it's
| offered by an entity that has an interest in monetizing
| 'protection'
| jimhi wrote:
| Feel free to use a VPN or Tor. This information already exists.
| We are providing it at our own cost at the moment.
| batch12 wrote:
| You don't currently have my data unless you have all data.
| Once I use your service, you'll have it. If you want to build
| goodwill, supply the methodology to enable the people who
| want to do this themselves.
| jimhi wrote:
| I understand your concern but we are limited by current
| privacy laws (for good reason in my opinion). I doubt we
| will build goodwill by showing everyone how to view
| unredacted information.
|
| Feel free to check out https://haveibeenpwned.com/, I think
| you would like that more
| kadoban wrote:
| What privacy laws, in which country would prevent you
| from sharing the source of info? Especially info that
| you're already sharing?
|
| Is this just the ToS of whatever data brokers you're
| using?
| ahaseeb wrote:
| Our license. We're not a data broker and we want to be
| cautious so the information isn't abused. Like taking
| some one phone and then using it for few min to acquire
| the info
| kadoban wrote:
| Your license with who? That seems like a very different
| issue than "privacy laws".
| asadlionpk wrote:
| They already have the data indexed by phone numbers. Your
| ip/hn-referrer is pretty useless in comparison imo...
| haswell wrote:
| > _You don 't currently have my data unless you have all
| data._
|
| What are you trying to say here? They have the data they
| have regardless of whether you choose to try the service.
|
| > _If you want to build goodwill, supply the methodology to
| enable the people who want to do this themselves._
|
| This sets up a false dilemma, i.e. there are other ways to
| build goodwill.
|
| With that said, I suspect the data behind this is not data
| that the average individual would have much success in
| acquiring.
|
| The subtle hostility seems unnecessary.
| ahaseeb wrote:
| Frankly goal was to educate people on how our numbers are
| tied to our identity and then SIM Swapping issue.
|
| This is the best we could think of, but please let us
| know what would be a better approach
| ilikehurdles wrote:
| By providing a phone number, I don't know if I'm helping
| build out their dataset, and I don't know how that data
| will be used, secured, or sold in the future. Even if
| they have the data, simply asking for it can give a
| signal that this data isn't stale - the number is likely
| live and owned by an individual.
| ahaseeb wrote:
| Data brokerage isn't our business and frankly there are
| much easier way to buy it on dark web. We're just making
| it simple for people to learn.
|
| Only data set that'll be of help if we give a bad score
| and it actually get hacked ( which we really don't want )
| kadoban wrote:
| They're likely requesting the data from some broker when
| you type in your number.
|
| The alternative is that they've grabbed a full set of all
| data for all numbers, in advance, right?
| ahaseeb wrote:
| No we pay per query ( It's expensive )
| pininja wrote:
| Having given them my number, I'm unsure if they have a lot
| of raw data. The results come back like "JXXX SXXXX"
| instead of "JOHN SMITH". Maybe they have all the data and
| are obfuscating to prevent misuse, or maybe thats all the
| data they get back from the broker since this is a free
| search.
|
| Having Googled my phone number many times, Doxx Me is
| returning similar results that a bunch of paywalled "people
| search" websites show as a free preview.
|
| I don't personally think it matters what Doxx Me does since
| this data is out there being used without my permission all
| of the time, and they certainly didn't collect it.
| ahaseeb wrote:
| We are not a data broker company. We simply pay data
| brokers per click. It's a loss leader for us and goal is
| to improve our number scoring criteria and create
| awareness on how numbers are linked to our identity & how
| vulnerable they're
| ahaseeb wrote:
| It's purely going to multiple data brokers and paying them
| to give you the info that they've on you. You can search
| for data brokers and hundreds of them will appear. Our goal
| is to create awareness around number security and it's
| linked to our identity
| ahaseeb wrote:
| issue with open sourcing is that the sources are paid which is
| good in a way that criminals can't just run million queries
| making us more vulnerable.
|
| We're just queries dozens of paid sources and crowdsourcing the
| data and displaying what we believe is accurate as it may have
| appeared multiple times
|
| What do you think should be our approach given this is the
| situation
| jzig wrote:
| Why are names, emails, and addresses redacted/censored? There are
| a bunch of names and addresses attached to my phone number that
| belong to someone that isn't me. I've had this phone number for
| over a decade.
| BTinfinity wrote:
| That'll be so you can't put someone else's phone number in and
| start doxxing people
| jzig wrote:
| But you need to a verification code to use the app
| jimhi wrote:
| You can buy old numbers. There are privacy laws we have to
| follow.
| [deleted]
| CobrastanJorji wrote:
| Could you elaborate a bit on the data sources and how the
| privacy laws affect them? I'm curious how the data can be
| publicly available to you but compiling a profile on
| someone with that data and disclosing it might not be.
| jimhi wrote:
| In short, there are laws on data resellers vs data
| brokers. Data resellers can provide uncensored data and
| their sources but there are many more hoops for them to
| jump through in terms of who sees that. We would have to
| do due diligence into every person using our tool in that
| case.
| mbreese wrote:
| Adding this explanation to your page would also be
| helpful...
| ahaseeb wrote:
| What should be the verbiage ?
| CobrastanJorji wrote:
| That's fascinating, thanks! It's bizarre how giving one
| person's information to another person is a big deal, but
| giving millions of people's information to a company is
| totally fine.
| mesozoic wrote:
| What does your service do to stop SIM swaps exactly?
| ahaseeb wrote:
| We're a MVNO so we effectively are your carrier. In an event of
| request of SIM Swap, we follow a very specific set of
| procedures to eliminate any fraudulent attempt.
| prepend wrote:
| So what's your privacy policy?I imagine collecting a list of HN
| phone numbers, especially ones you can link to names and
| addresses, is pretty valuable.
|
| Are you going to use these data or sell these data?
| ahaseeb wrote:
| There are millions of such databases available with much more
| info. Our goal is to educate people on how our mobile numbers
| are vulnerable to SIM Swap and how important are number from
| identify point of view. Our business model is Secure Mobile
| Subscription.
|
| If any one finds a need to protect their number, they'll
| upgrade their carrier to Efani Secure Mobile. We don't sell
| client data and only make money off the difference carriers
| charge us minus what client pays us.
|
| Each of these queries cost us $, so we'll be able to calculate
| the CaC. One day, we may be able to be a standard for this tool
| to be used in OpSec where a number can't be added as 2FA if
| it's below a specific score
| xboxnolifes wrote:
| > One day, we may be able to be a standard for this tool to
| be used in OpSec where a number can't be added as 2FA if it's
| below a specific score.
|
| The world would sooner switch completely off of SIM-baswed
| 2fa instead of such a roundabout solution. We already have
| alternatives, and there is already a push against using SIM-
| based auth.
| [deleted]
| Phlarp wrote:
| > One day, we may be able to be a standard for this tool to
| be used in OpSec where a number can't be added as 2FA if it's
| below a specific score
|
| Or more likely the data you've collected gets liquidated (or
| stolen) at some point.
| bcrosby95 wrote:
| Looks like it found the following information for me and my wife:
| driver's license, date of birth, current and past residences,
| emails.
|
| It also found the names and dates of birth of our extended
| families.
| ahaseeb wrote:
| Yeah. and unfortunately, this is only from publicly listed
| info. Goal is to create awareness on SIM Swap vulnerability.
| How can we do better
| function_seven wrote:
| Anyone here want to write a mini-tutorial on how to pollute this
| data? I assume it's impossible to remove any of it, but it would
| be nice to poison it at least.
| ahaseeb wrote:
| There are multiple guides around it and you can email every
| data broker company . Most of them are obliged to remove it but
| then there may be another hack and the data is again back in
| the market. There are few companies offering solutions and you
| can search for them. Some of them are listed on the page
| xhan0o wrote:
| How would you suggest to make it more secure, staying in current
| line only? Any known solutions? It is spooky AF.
| system2 wrote:
| Once the information is out, it is out. You can't take it back.
| ahaseeb wrote:
| Secure the telephone # or deleting the info ?
|
| For #1 - That's what Efani Secure Mobile does. For #2 - we've
| listed few services but you can also email all the data brokers
| and they'll delete the info. You can also hire firms which do
| this by charging a subscription
| derwiki wrote:
| Which firms?
| kc10 wrote:
| PSA - If you have a Discover credit card, they provide privacy
| protection and data removal services for free. They do scheduled
| scan and also submit data removal requests on your behalf.
|
| https://www.discover.com/security/online-privacy-protection/
| blobbers wrote:
| Is this a tool that farms lists of phone numbers? Why did the OP
| put it here, jimhi?
| jimhi wrote:
| No it's not a farm, this info always existed and we are
| providing it to you at our own cost.
|
| I built the tool - https://www.efani.com/leadership
| mcdonje wrote:
| Nice. I see a bunch of data points for people who aren't me, and
| none for myself. So my plan is to do nothing and interpret my
| number's low score as a high score.
| ahaseeb wrote:
| Yeah not a bad idea
| woodruffw wrote:
| No offense, but it's hard to know whether I should trust you with
| my phone number: your "about us" page 404s[1] and your CEO is
| a...founder of a bitcoin ATM company[2]? I can't even figure out
| what service you sell -- it looks like an MVNO but with some
| additional security promises?
|
| [1]: https://www.efani.com/about-us
|
| [2]: https://www.efani.com/leadership
| pbronez wrote:
| About Us redirects to the Leadership page.
|
| More details at https://www.efani.com/company
| _nhynes wrote:
| > If you're trading crypto, having a secure phone is as
| important as a hardware wallet.
|
| It looks like this is targeted towards crypto whale hopefuls
| who, for whatever reason, store sizeable value in a hot
| wallet/CEX that's controllable using a phone number/SMS 2FA.
| The price point of $99/mo supports this hypothesis.
|
| Honestly, not a bad idea. These people clearly have more money
| than sense.
| ahaseeb wrote:
| Certainly Efani Secure Mobile only caters to a small group of
| high risk individuals. While crypto investors get more
| limelight due to high amounts being involved but politicians,
| finance executives and lawyers are a common target too.
|
| Plus it's not $99/month on top of your plan but it replaces
| your current phone plan + gives $5M Insurance policy too. Our
| other plans are even higher but the security they provide
| isn't required by 99.9% of the population so we don't even
| mention them on the site
| stlynch wrote:
| Business address being "post office box in a storefront"
| doesn't make this trustworthy, either.
|
| Not sure if I'd be compelled to send my information to any
| service that is literally called "Doxx Me" either.... :)
| ahaseeb wrote:
| we've discussed this internally and thought of branding it as
| "Number Score" or something like that.
|
| Do you've any suggestions ?
| Phlarp wrote:
| I gave it my "throw-away" number, after going through the
| text code validation it spit out a relatively high score,
| listed my carrier as Tmobile, "no associations" in all the
| categories and then sent a follow-up text "Thanks for letting
| us doxx you!"
|
| Between that and a crypto bro founder / CEO this seems more
| like a pretext to harvest mobile numbers.
| ahaseeb wrote:
| Agree wording could be improved. For number harvesting,
| there are probably thousands of databased out there with
| far more info for almost free. We made an attempt to create
| awareness on how important your number is as in too many
| identities attached to it and then vulnerability against
| SIM Swap
|
| - Your Crypto Bro
| qorrect wrote:
| I took a chance, and it knows my relatives, all my old
| addresses, my SSN and drivers license number.
|
| It looks legit to me, and a good business idea.
| ahaseeb wrote:
| Doxxing isn't a business idea :) But yes the goal is that
| people will upgrade to Efani Secure Mobile if they're
| security concious
| ciabattabread wrote:
| Also those links to third party companies are just links, but
| they sure look like endorsements.
| idiotsecant wrote:
| What are you actually trusting them with by entering your
| number? those details are already available in the database(s)
| they're querying, the only data you're giving them is that
| you're a phone number that reads hacker news.
| woodruffw wrote:
| It's an additional data point. These databases tend to have
| low S/N ratios -- having a bunch of people put in _known good
| numbers_ (since they 're being confirmed with a text) allows
| a moderately invested consumer to confirm one of the
| identities believed to be linked to the phone number.
|
| (My phone number is public, but it doesn't show up in any of
| these public DBs. I have no idea why.)
| idiotsecant wrote:
| How are they confirming anything? They're literally just
| confirming that someone who clicked that link owns that
| number. I'm not sure how that's confirming an identity
| linked to the phone number. If I click that phone number
| and I have information in there for John Smith and Adam
| Jones how does this contribute to them knowing whether
| they're seeing John, Adam, or someone else?
| woodruffw wrote:
| Like I said, it's a data point. I don't think it
| fundamentally deanonymizes the number (not that it's even
| anonymous to begin with). Instead, it:
|
| * Confirms that a number is a live subscriber;
|
| * If there are N possible identities tied to the number,
| it strongly suggests that the most recent one is the
| "current" one;
|
| * Links my phone number to a browser session, which
| provides further information.
|
| Edit: It also fundamentally turns a passive source of
| information (a DB of phone numbers, of unknown quality)
| into an active one (people are actively confirming that
| some of these numbers are real and currently subscribed).
| jimhi wrote:
| This is not correct. A bad actor can find search for numbers
| a million ways (buy numbers that connect to a cell tower,
| search by birthdate, who responds to your spam, etc).
|
| We are a cybersecurity company and our entire leadership team
| has a decent online presence. You can just look any of us up.
|
| Edit: Whoops meant to reply to the comment below
| xeromal wrote:
| I assume they'd know that you're the kind of person to be
| interested in this. Just an additional data point to what
| they already have.
| ahaseeb wrote:
| Hey - That's me. you're right - We're a Secure MVNO. I'll look
| into the about us page.
|
| We're a MVNO that guarantees protection against SIM Swap .
| We've additional protections but not able to offer it to public
| yet.
| aliqot wrote:
| > guarantees protection against SIM Swap
|
| Not from a marketing standpoint, but from a procedural level,
| how is this guaranteed?
| ahaseeb wrote:
| We follow a 11-layer authentication process to block any
| fraudulent request
| snoopy_telex wrote:
| Can you describe the layers?
|
| I mean, layers could be as simple as:
|
| 1. Does last name match?
|
| 2. Does first name match?
|
| 3. Does middle name match?
|
| 4. Does name suffix match?
|
| 5. Does country match?
|
| 6. Does state match?
|
| 7. Does city match?
|
| 8. Does street match?
|
| 9. Does house number match?
|
| 10. Does apartment number match?
|
| 11. Does phone number match?
| ahaseeb wrote:
| It's much more than that . It's a manual review and we've
| our own set of authentication which includes notarization
| even
| woodruffw wrote:
| I also have this question. My understanding of SIM porting
| (the legitimate form of swapping) is that it's basically
| impossible (and undesirable) to prevent if the originating
| network operator is convinced of the user's identity, which
| is why phishing is so effective.
| adrr wrote:
| Company doing the SMS/phone verification can lookup to
| see if the number was recently ported is the only
| protection that I know. You used to be able go ping E911
| location but they cracked down on selling that data.
| ahaseeb wrote:
| E911 location tracking is still active unfortunately.
| We've came up with the solution through our premium
| offering Black Seal Protection but fairly limited to who
| we can sell it to
| ahaseeb wrote:
| It's just a specific set of procedures that we follow
| which are skipped by traditional carrier. Think of it as
| a boutique approach. Every carrier can frankly stop but
| it's not worth the effort for them due to scale they
| operate with and mass market they've to cater to
| dvtrn wrote:
| _It 's just a specific set of procedures that we follow
| which are skipped by traditional carrier_
|
| Are you able to go into detail about this without giving
| up proprietary/secret sauce? Asking as a former pbx
| engineer at a couple of CLECs who is intimately familiar
| with the LNP process.
| ahaseeb wrote:
| Sure absolutely. So about Sim Swap, if some one request
| we've an internal process to verify - For external ports,
| a carrier can reject a port out . Just having the right
| info doesn't qualifies for automatic port out. Most of
| the companies do it due to FCC requirement of 4 hours.
| We've the resources to identify, reject and approve
| requests
| aliqot wrote:
| I appreciate the response, however it is quite vague, and
| I'm not any closer to a conclusion than when I asked.
| Would a yes/no type of question get a more straight
| forward answer?
|
| Have you had a user get swapped, yes or no?
|
| Guarantee is a word that has weight to it, I'm not seeing
| anything substantiating a guarantee other than the claim.
| I'm trying to understand the spirit of its use in this
| context by asking this.
| ahaseeb wrote:
| No since inception, we had ZERO clients SIM swapped or
| ported out without authorization. We've a $5M Insurance
| policy just if incase but luckily never had to use it
| LinkLink wrote:
| For a mobile carrier to prevent sim swapping assuming
| they themselves have good enough security policies, is
| trivial. Most people get sim swapped bc an insider rep
| sends a request to a local store, or a local store
| doesn't do their due diligence, or even more likely, that
| everyone involved is incompetent, overworked, and doesn't
| care.
|
| The real service being sold here is the idea that in
| exchange for a premium, a company will train employees
| correctly and enforce strong security policies. which
| would be skipped by a normal telco because they want as
| much profit as possible off the top of your 30$ a month.
| ahaseeb wrote:
| Yeah and that's exactly what we do. We do have enterprise
| and gov offering with advanced protection but general
| public isn't the right candidate for that .
| woodruffw wrote:
| Thanks for responding, and for looking into it.
|
| I don't mean to make too fine of a point from it; the
| combination of missing pages and slightly "off" formatting
| (mixed capitalization of the company name, other company
| logos embedded without rounding or blending) sets off my
| phishing alarm.
| ahaseeb wrote:
| Actually you're right in questioning the legitimacy . Will
| get them fixed. 404 error is now gone
| sosodev wrote:
| Why does your landing page say "100% guaranteed protection"
| and then follow it up "$5 million in insurance against losses
| due to SIM swaps"? It directly undermines the 100% claim.
| [deleted]
| ahaseeb wrote:
| It's just an additional protection top for peace of mind.
|
| It's like We guarantee it and you get upto $5M
| googlryas wrote:
| It sounds like they're giving a $5M guarantee that you
| won't be sim swapped.
| ahaseeb wrote:
| it's additional protection and helps with the liabilities
|
| When I was SIM Swapped 4-times, I only got a courtesy
| call saying Sorry for the inconvenience caused.
|
| I thought having $5M Insurance on top of guarantee will
| be better
| randomguy0 wrote:
| Because "100% guarantee" doesn't actually mean anything
| i.e. they have protection in some shape or form.
| rgovostes wrote:
| Pretty good. I entered an old Google Voice number I haven't used
| in a while, and it correctly listed all of my addresses back to
| my early childhood, what I minored in in college, and the
| pseudonym I use on Facebook.
|
| The "doxx me score" gauge is cheesy, and I have a negative
| reaction toward seeing those from disreputable banner ads around
| the internet.
|
| It's not clear to me how the service you are selling (SIM
| swapping protection) and the privacy report are related.
|
| Do you want to clarify what data you are recording as part of
| offering this service?
|
| > We only retain collected information for as long as necessary
| to provide you with your requested service. What data we store,
| we'll protect within commercially acceptable means to prevent
| loss and theft, as well as unauthorized access, disclosure,
| copying, use or modification.
|
| What services are you getting the information from?
| nfriedly wrote:
| I tried it with both of my numbers and there was a lot of
| information, but only half of it seemed to be accurate.
|
| Some of it was from family members who were apparently conflated
| with me, and some of it didn't ring any bells at all.
|
| It had all of my recent addresses, and many more that I had never
| heard of, including cities I've only visited once or twice and
| two countries I've never been to in my life.
|
| One phone number had 4 SSN's associated with it, and while the
| site doesn't show you the actual digits of the SSN, it does say
| the state it was issued in. All 4 were from different states, and
| none were from the state I was actually born in.
| ahaseeb wrote:
| Yes info could be incorrect since we pull it from public
| sources . It may be due to data being linked to you some how
| rootusrootus wrote:
| I assume a good amount of the incorrect data comes from tying
| people together based on shared addresses. For some addresses
| I have, like when I was in the military, there are probably a
| bunch of people who had the same address over a relatively
| short period.
| lotsofpulp wrote:
| somesomething wrote:
| Took a risk and used it, like other people here. Then I saw the
| price for what they are selling. $100 a month?! Wow! Isn't there
| some other way to lock down this info?
| ahaseeb wrote:
| Efani Secure Mobile doesn't delete info. We're a Secure Mobile
| Service which is $99/month. Goal of this is to create awareness
| on how easy is to SIM Swap or get into your mobile account
| system2 wrote:
| Where do you obtain your information?
| ahaseeb wrote:
| We use data broker APIs. Most of them could be found
| through simple google search. Not every data broker has all
| the info so it may be a combination of multiple. I know
| this request has came multiple times but it's hard to tell
| exact source without specifically looking into individual
| case
| jimhi wrote:
| That service is for a 5g phone plan (built on top of
| att/tmobile). So you aren't just paying for the security
| somesomething wrote:
| Thank you! Admittedly I was sticker shocked and missed some
| of the key details they were selling.
| ahaseeb wrote:
| Yeah. Tool goal was to create awareness around SIM Swap
| first
| blep_ wrote:
| What are the data sources for this? I'm curious because it
| returns a lot of garbage for me with a few real results mixed in,
| and I want to know which things to throw more garbage at.
| system2 wrote:
| Data sources is the entire business model for this website. I
| doubt he'd share with anyone.
| ahaseeb wrote:
| No we're not in Data source business. We make money off
| Secure Mobile Subscriptions.
|
| Our goal with the tool is show vulnerabilities around our
| numbers and how easy are they becoming alternative to SSN yet
| easy to be hacked
| KyleJune wrote:
| It appears to be broken for me. When I verify my number it shows
| the gathering information page for a second with the loading bar
| moving, then it just redirects me to the home page. I've tried in
| both Firefox and Chrome. I did get texts afterward saying "Thanks
| for letting us Doxx you" but I never got to see any results.
| jimhi wrote:
| Apologies for that you can email me directly james@efani.com or
| use our live chat and sort out what the issue is. Otherwise try
| again on a different browser?
| [deleted]
| fortran77 wrote:
| I tried it. And one of the most interesting things it did was
| list a location that I use when we are running our GPS simulator
| for testing. My phone has received our signal in the lab (it's a
| shielded room) and apparently they location data was somehow
| associated with my number. It's just a random town in Ohio...a
| place I've never been to.
| ahaseeb wrote:
| Your number may have been added randomly by some one there
| Unselect6889 wrote:
| I'm not going to reveal the phone number used, but I can verify
| that some of the information it returned was incorrect.
|
| ...Looking closer at the report now, all fields which returned
| information were wrong. Perhaps it's returning info based on
| previous customers who have used the number?
|
| Points to consider:
|
| 1) This was not my primary phone number. It's possible that a
| lack of activity used on the phone I tested this with made it
| _seem_ like a previous owner was still the active owner? Perhaps
| if the service is grabbing very outdated information, there
| should be an indicator next to each result "Older than # of
| (time)".
|
| 2) A low score is red...does this mean that a _low_ score mean
| that a _lot_ of information was returned? Comparing this "doxx"
| to a credit card score is confusing, because a credit score is
| generally low because you have a _lack_ of history. With this,
| your score is low because you have a lot of history. It 's weird.
| Maybe low results should = green, with a low score; high results
| = red, with a high score. I see "high score" to mean "high data
| points".
|
| 3) Not every field was filled out for this number, but my score
| was deep in the red. What is the circumstance where a phone
| number lands in the middle? I suppose some fields might be
| weighted higher than others?
|
| Edit:
|
| (Pet peeve of mine. This isn't a personal slam against the
| company, just a criticism against the practice in general.)
|
| I see you have one of those chat widgets in the bottom right. If
| a customer uses that, and doesn't get a response immediately,
| it's pointless and taking up space. If I want to send an email, I
| want the email address listed clearly on the contact page. A
| roundabout way through a psudeo-clippy thing stinks.
| ahaseeb wrote:
| Good suggestion about the email. So you're suggesting we
| shouldn't ask for email at all. I'll certainly bring it to next
| meeting.
|
| - Fields are obscured due to privacy laws and to prevent abuse
| - Score is based on SIM Swap as in how easy is to SIM Swap and
| likely hood of some one attempting to do it like if you're a
| good candidate to attempt a sim swap on. It is based on ROI for
| a criminal - Previous owner info could be attached or some one
| may have used your number some where randomly
| binaryblitz wrote:
| So while some of my info was there, there was DRASTICALLY more
| data listed that has nothing to do with me. I've had this phone
| number since ~2001, any idea why that would happen?
| ahaseeb wrote:
| Some one may have used your numbers randomly and that database
| may be leaked
| jmorenoa88 wrote:
| I got a bellow average score (455) which explains the high
| numbers of scam calls and texts I get daily. The interest thing
| is that out of all this info that can be found through my number
| there was not a single piece of information related to me. I
| think this is because my phone number was recycled.
| ahaseeb wrote:
| How old the number is and did you legitimately get any call
| with reference to previous user ? plus is it different people
| or just one person
| jmorenoa88 wrote:
| Not sure how old the number is. I have gotten calls asking
| for someone else, but I assume it is just a wrong number
| kinda situation. There are 3 different birthdays associated
| with the number, 1 ssn, and 6 names.
| BoorishBears wrote:
| So you mean you made a voter registry search...
| jimhi wrote:
| A voter registry search requires name, date of birth, and zip
| code.
|
| This is just your phone number. The thing you give out to
| people you just met. What the secure app signal requires for
| signup. And what spammers seem to always be able to find.
| t3rabytes wrote:
| NC requires just a name to search the voter registry online,
| I think that's state-to-state
| BoorishBears wrote:
| I can search my phone number and get dozens of results with
| my info that clearly came from voter registry scraping.
|
| I can even find direct links to voter registries in some
| states I've lived.
| somenewaccount1 wrote:
| tell me more about this voter registry search? i actually just
| need a list of my old addresses, i move a lot.
| outworlder wrote:
| A voter registry search requires that you are registered to
| vote, does it not?
|
| I am not allowed to vote. Yet, this tool was able to pull a lot
| of info regardless.
___________________________________________________________________
(page generated 2022-07-29 23:02 UTC)