From email to phone number, a new OSINT approach (2019)

Original Article ↗ Hacker News Discussion ↗

Password-reset flows that partially reveal phone numbers can be chained across multiple services to reconstruct a user’s full number from nothing more than an email address, highlighting a serious privacy weakness in common web security practices. Commenters note that some major platforms still expose multiple digits years after this was reported, and debate whether publishing tools that automate the attack is ethically justified or necessary to pressure companies to fix it. The thread also explores mitigations such as using virtual numbers, per-site email aliases, and stronger identity systems that don’t treat phone numbers or SSNs as de facto secrets.

Technique and Main Idea

  • Commenters summarize the technique: trigger password resets on many sites for a target email; each site leaks different phone-number fragments (start, end, area code, etc.).
  • Combine these partial leaks with public numbering data (e.g., NANPA) and automated scripts to narrow down to likely full numbers.
  • Some note that the original proof-of-concept is somewhat “crippled” and needs services like Twilio to work.

PayPal and Other Service Behaviors

  • Multiple comments highlight PayPal as especially bad, still revealing five digits plus area code in 2019 and, according to recent testers, apparently still doing so.
  • Users share unrelated but alarming PayPal anecdotes (surname changed unexpectedly, support mishandling phishing reports), reinforcing distrust.
  • Others mention that many sites leak various parts of phone numbers and even credit-card digits in reset or account flows.

Ethics of Publishing Tools

  • One side questions releasing a ready-made OSINT tool, arguing that creepy or malicious uses likely outweigh benefits, and prefers publishing technique but not code.
  • Others argue that attackers either already know such methods or will discover them, and public tools:
    • Put pressure on companies to fix poor designs.
    • Provide compelling demos to convince executives to improve security.
    • Are analogous to lockpicking books/tools.
  • Some see tool releases partly as clout-seeking within the security community.

Mitigation Strategies

  • Suggested defenses:
    • Use separate or randomized email addresses per service (custom domains, “+” aliases, Firefox Relay, password-manager integrations).
    • Use VOIP or dedicated SIM/eSIM numbers for 2FA and signup, though VOIP blocking and device/SIM limitations can be problematic.
    • Use desktop–phone integration tools (e.g., KDE Connect, Windows Phone Link) to ease SMS handling.

Debate on Phone Numbers as Secrets

  • Some argue phone numbers are effectively public and relying on their obscurity is flawed.
  • Others note that once an attacker has both email and phone number, more convincing phishing and social engineering become easier.

Other Technical & Regional Notes

  • Discussion of CNAM databases and Twilio lookup to correlate numbers with names.
  • Mentions of number portability as a limitation of location-based inference.
  • International perspectives: in some countries (e.g., Sweden), phone numbers and much PII are public by design; in others (e.g., Australia), reset flows leak fewer digits.