Hacker News new | past | comments | ask | show | jobs | submit login
Show HN: Doxx Me – See how doxxable your phone number is (efani.com)
98 points by jimhi on July 29, 2022 | hide | past | favorite | 214 comments
I built this tool that checks publicly available data against your phone number. I was surprised how one my numbers (which I text and sign up for services with) has a lot of information attached to it including my full name, all previous addresses, relatives, emails, and more.



No offense, but it's hard to know whether I should trust you with my phone number: your "about us" page 404s[1] and your CEO is a...founder of a bitcoin ATM company[2]? I can't even figure out what service you sell -- it looks like an MVNO but with some additional security promises?

[1]: https://www.efani.com/about-us

[2]: https://www.efani.com/leadership


> If you’re trading crypto, having a secure phone is as important as a hardware wallet.

It looks like this is targeted towards crypto whale hopefuls who, for whatever reason, store sizeable value in a hot wallet/CEX that's controllable using a phone number/SMS 2FA. The price point of $99/mo supports this hypothesis.

Honestly, not a bad idea. These people clearly have more money than sense.


Certainly Efani Secure Mobile only caters to a small group of high risk individuals. While crypto investors get more limelight due to high amounts being involved but politicians, finance executives and lawyers are a common target too.

Plus it's not $99/month on top of your plan but it replaces your current phone plan + gives $5M Insurance policy too. Our other plans are even higher but the security they provide isn't required by 99.9% of the population so we don't even mention them on the site


Hey - That's me. you're right - We're a Secure MVNO. I'll look into the about us page.

We're a MVNO that guarantees protection against SIM Swap . We've additional protections but not able to offer it to public yet.


Thanks for responding, and for looking into it.

I don't mean to make too fine of a point from it; the combination of missing pages and slightly "off" formatting (mixed capitalization of the company name, other company logos embedded without rounding or blending) sets off my phishing alarm.


Actually you're right in questioning the legitimacy . Will get them fixed. 404 error is now gone


Why does your landing page say "100% guaranteed protection" and then follow it up "$5 million in insurance against losses due to SIM swaps"? It directly undermines the 100% claim.


Because “100% guarantee” doesn’t actually mean anything i.e. they have protection in some shape or form.


It's just an additional protection top for peace of mind.

It's like We guarantee it and you get upto $5M


It sounds like they're giving a $5M guarantee that you won't be sim swapped.


it's additional protection and helps with the liabilities

When I was SIM Swapped 4-times, I only got a courtesy call saying Sorry for the inconvenience caused.

I thought having $5M Insurance on top of guarantee will be better


Will you pay out in the event that SS7 is compromised, as opposed to your support people giving the swap to a random attacker?

I think this is cool, but also think it's important to be clear what's being offered.


We do have SS7 level protection but we're unable to offer it to consumers.

About insurance, it's limited to Sim Swap/Port outs


> guarantees protection against SIM Swap

Not from a marketing standpoint, but from a procedural level, how is this guaranteed?


I also have this question. My understanding of SIM porting (the legitimate form of swapping) is that it's basically impossible (and undesirable) to prevent if the originating network operator is convinced of the user's identity, which is why phishing is so effective.


It's just a specific set of procedures that we follow which are skipped by traditional carrier. Think of it as a boutique approach. Every carrier can frankly stop but it's not worth the effort for them due to scale they operate with and mass market they've to cater to


It's just a specific set of procedures that we follow which are skipped by traditional carrier

Are you able to go into detail about this without giving up proprietary/secret sauce? Asking as a former pbx engineer at a couple of CLECs who is intimately familiar with the LNP process.


Sure absolutely. So about Sim Swap, if some one request we've an internal process to verify - For external ports, a carrier can reject a port out . Just having the right info doesn't qualifies for automatic port out. Most of the companies do it due to FCC requirement of 4 hours. We've the resources to identify, reject and approve requests


Maybe you’re new to HN, but this response should’ve been numerous paragraphs long going into excruciating detail about what how exactly the guarantee works. Additionally, there are basic English typos in your response.. as CEO of a phone company, you want to come off more polished and “on the ball”, else you will have a difficult time building trust.


English is my 4th language, but this isn't an excuse for typos, so I'll be more careful.

So to answer the original question on how we can guarantee while other carriers are not. There are two common attacks to compromise your account.

Sim Swap & Port out

In Sim Swap, any employee person can replace the SIM Card without permission by changing the number on the dashboard. Every primary carrier SIM card is available online, so criminals buy 100s of them and then rent logins to change this information. These logins are available for as little as 10k from the dark web.

The port-out attack is when criminal changes your carrier, which requires your account #, Zip Code & PIN in a few cases. Other information can be fake, so it isn't required. Port out must be completed within hours, and carriers have automated the process.

So how does Efani guarantee against it? I've been a victim of SIM Swap and have dealt with hundreds of incidents. No one is perfect, but we're just better at dealing with such attacks.

We authenticate clients using multiple ways and treat every request as fraud. It isn't an automated process & even within the company, it's taken very seriously and has to be approved by multiple resources. Our authentication methods include notary public and video authentication, and clients can also request a unique authentication process. We employ US Citizens who're security cleared and don't outsource support or operations. A lot of our staff isn't public due to security reasons. They are well paid compared to regular CS staff and are well-trained against these attacks. Our SIM cards are not publicly available, eliminating the risk of anyone obtaining them. Information on the account is pseudonymized, so if a client has compromised himself, we're able to stop the impersonation. Cool-off period - In case of high risk, we put a 14-day cool-off period to any request to ensure the client isn't compromised

We follow a few other methods in addition to the above and constantly. We've been able to stop all the attacks so far and are confident in our ability to deliver on the promise; Efani Secure Mobile is also securing clients with $5M Insurance. If you ever get compromised, you'll receive an apology, so we went beyond to ensure peace of mind.

Please let me know if further clarification is required.


I appreciate the response, however it is quite vague, and I'm not any closer to a conclusion than when I asked. Would a yes/no type of question get a more straight forward answer?

Have you had a user get swapped, yes or no?

Guarantee is a word that has weight to it, I'm not seeing anything substantiating a guarantee other than the claim. I'm trying to understand the spirit of its use in this context by asking this.


For a mobile carrier to prevent sim swapping assuming they themselves have good enough security policies, is trivial. Most people get sim swapped bc an insider rep sends a request to a local store, or a local store doesn't do their due diligence, or even more likely, that everyone involved is incompetent, overworked, and doesn't care.

The real service being sold here is the idea that in exchange for a premium, a company will train employees correctly and enforce strong security policies. which would be skipped by a normal telco because they want as much profit as possible off the top of your 30$ a month.


Yeah and that's exactly what we do. We do have enterprise and gov offering with advanced protection but general public isn't the right candidate for that .


No since inception, we had ZERO clients SIM swapped or ported out without authorization. We've a $5M Insurance policy just if incase but luckily never had to use it


Have you prevented any sim swap attempts?


At least few dozen and multiple cases where legal notices were sent to claim ownership of the numbers by 3rd parties such as spouses or hostile take over of exotic numbers


Company doing the SMS/phone verification can lookup to see if the number was recently ported is the only protection that I know. You used to be able go ping E911 location but they cracked down on selling that data.


E911 location tracking is still active unfortunately. We've came up with the solution through our premium offering Black Seal Protection but fairly limited to who we can sell it to


We follow a 11-layer authentication process to block any fraudulent request


Can you describe the layers?

I mean, layers could be as simple as:

1. Does last name match?

2. Does first name match?

3. Does middle name match?

4. Does name suffix match?

5. Does country match?

6. Does state match?

7. Does city match?

8. Does street match?

9. Does house number match?

10. Does apartment number match?

11. Does phone number match?


It's much more than that . It's a manual review and we've our own set of authentication which includes notarization even


Business address being "post office box in a storefront" doesn't make this trustworthy, either.

Not sure if I'd be compelled to send my information to any service that is literally called "Doxx Me" either.... :)


I gave it my "throw-away" number, after going through the text code validation it spit out a relatively high score, listed my carrier as Tmobile, "no associations" in all the categories and then sent a follow-up text "Thanks for letting us doxx you!"

Between that and a crypto bro founder / CEO this seems more like a pretext to harvest mobile numbers.


Agree wording could be improved. For number harvesting, there are probably thousands of databased out there with far more info for almost free. We made an attempt to create awareness on how important your number is as in too many identities attached to it and then vulnerability against SIM Swap

- Your Crypto Bro


I took a chance, and it knows my relatives, all my old addresses, my SSN and drivers license number.

It looks legit to me, and a good business idea.


Doxxing isn't a business idea :) But yes the goal is that people will upgrade to Efani Secure Mobile if they're security concious


we've discussed this internally and thought of branding it as "Number Score" or something like that.

Do you've any suggestions ?


Since Covid we moved remote and having a PO Box is good from Security POV too :)


What are you actually trusting them with by entering your number? those details are already available in the database(s) they're querying, the only data you're giving them is that you're a phone number that reads hacker news.


This is not correct. A bad actor can find search for numbers a million ways (buy numbers that connect to a cell tower, search by birthdate, who responds to your spam, etc).

We are a cybersecurity company and our entire leadership team has a decent online presence. You can just look any of us up.

Edit: Whoops meant to reply to the comment below


It's an additional data point. These databases tend to have low S/N ratios -- having a bunch of people put in known good numbers (since they're being confirmed with a text) allows a moderately invested consumer to confirm one of the identities believed to be linked to the phone number.

(My phone number is public, but it doesn't show up in any of these public DBs. I have no idea why.)


How are they confirming anything? They're literally just confirming that someone who clicked that link owns that number. I'm not sure how that's confirming an identity linked to the phone number. If I click that phone number and I have information in there for John Smith and Adam Jones how does this contribute to them knowing whether they're seeing John, Adam, or someone else?


Like I said, it's a data point. I don't think it fundamentally deanonymizes the number (not that it's even anonymous to begin with). Instead, it:

* Confirms that a number is a live subscriber;

* If there are N possible identities tied to the number, it strongly suggests that the most recent one is the "current" one;

* Links my phone number to a browser session, which provides further information.

Edit: It also fundamentally turns a passive source of information (a DB of phone numbers, of unknown quality) into an active one (people are actively confirming that some of these numbers are real and currently subscribed).


Hypothetically if your assumption is correct, this is the most expensive way to collect this information since there are dumps of data available on the dark web for pennies, while these queries are 100X more expensive. Criminals are trading this information without your permission and exploiting it. We just wanted to create a tool to create awareness


I assume they'd know that you're the kind of person to be interested in this. Just an additional data point to what they already have.


About Us redirects to the Leadership page.

More details at https://www.efani.com/company


Also those links to third party companies are just links, but they sure look like endorsements.


Yeah . We're not affiliated with either of them. Just shared for convenience of others


Let's see, you got...my name, my spouse's name, my work email, my personal email, our birthdays, at least 5 of my former addresses, my whole driver's license history, where I went to college, where I went to high school, every company I've worked for, my mom's name, my parent's names, and my gender. That's more than I expected that you could get, wow.

One thing your site could do but doesn't is tell me WHERE it got that information, like exactly where. Why just say "publicly available data?" I want to know precisely where you got all this on me, with annotations. Without that information, this is just a scary page that encourages me to sign up for nebulous services.


Your suggestions are well taken. We should do a better job on the page however we're limited on what info to display & sources due to privacy laws and to prevent misuse


So you can display the private information, but you can't display where it came from due to privacy laws? Can you cite which privacy laws protect the source of the publicly available information?


I doubt it’s privacy laws and more likely the terms of service from their data broker. The data broker probably doesn’t allow it and if they reveal the source, they will be cut off.

Their source must be cheap enough to do stuff like this so it probably rules out DataAxle, Elsevier and Oracle.


At the moment data source is super expensive so we had to cap daily inquiries. We're not a data broker so have limitations around what can be displayed and what can't be. Hopefully, we're able to create an API that companies can integrate to help their clients be better at their number security


It seems to me like the data source would welcome the free advertising.


Having run a few background check websites where there was a data broker ... no they hate the attention. I got a visit from the FBI for using the name of their database ( we could show the results from the DB, but we could not use the name of it publicly) , which they updated on their website to say 'restricted' but did not email us or call us. This was early 2000's.


Why would the FBI be interested in a civil (contractual) violation between companies?


Edit: I said it wrong in the initial post the FBI visited for a different reason.

They thought I had 'hacked in'. My landlady at the time worked as a secretary at the FBI and misunderstood or did not know the data could be purchased legally through a third party, after I told her what I was doing at a dinner at their house which they invited me to.

I was extremely hung over when they came, I was 25, and did not at all believe they were agents I slammed the door on them (one of them had converse sneakers with their suits though). They slowly convinced me they were in fact legit, I showed them all the paperwork, and shut the site down due to caution. Gave me a good story to tell, ~2005.


Not really since it's a wholesale arrangement and don't deal with retail


Even "we knows this because we bought a package of such & such data from Data Broker LLC" would be great.


We use a ton of sources. You can google data brokers and try some. But just because you find one and get them to remove the info, doesn't mean it is gone.


>we're limited on what info to display & sources due to privacy laws and to prevent misuse

Of course. We're not not allowed to know who sold our personal data to shady 3rd parties due to "privacy laws". Hilarious.


There are dozens of data brokers if not less and you can google for them. There are dozens of data removal companies too. It's probably a billion dollar industry trading your personal info. We're neither a data broker not a data removal. We're in business of securing Mobile numbers and our goal was to create awareness and help people make informed decision about their mobile number security.

We'll have to acquire different set of licenses if we ever have to step into these industries.


You will be surprised how much personal info. is available on various websites. Do a google search on yourself and enjoy.


Would be nice to know which suspected data brokers are used to gather this information, in order to send them CCPA deletion requests.

I've previously spent some time manually sending CCPA deletion requests to a variety of data brokers, and I've even tried two paid services. I know the effort is pyrrhic, and there's probably no way to remove all the information.


Pretty good. I entered an old Google Voice number I haven't used in a while, and it correctly listed all of my addresses back to my early childhood, what I minored in in college, and the pseudonym I use on Facebook.

The "doxx me score" gauge is cheesy, and I have a negative reaction toward seeing those from disreputable banner ads around the internet.

It's not clear to me how the service you are selling (SIM swapping protection) and the privacy report are related.

Do you want to clarify what data you are recording as part of offering this service?

> We only retain collected information for as long as necessary to provide you with your requested service. What data we store, we’ll protect within commercially acceptable means to prevent loss and theft, as well as unauthorized access, disclosure, copying, use or modification.

What services are you getting the information from?


No thanks. This kind of thing should be something open source and/or have published, manually repeatable processes. Sending my phone number to a random place associated with my ip/device/referrer/etc is just bad practice akin to asking for my passwords to evaluate their strength. Especially when it's offered by an entity that has an interest in monetizing 'protection'


Feel free to use a VPN or Tor. This information already exists. We are providing it at our own cost at the moment.


You don't currently have my data unless you have all data. Once I use your service, you'll have it. If you want to build goodwill, supply the methodology to enable the people who want to do this themselves.


> You don't currently have my data unless you have all data.

What are you trying to say here? They have the data they have regardless of whether you choose to try the service.

> If you want to build goodwill, supply the methodology to enable the people who want to do this themselves.

This sets up a false dilemma, i.e. there are other ways to build goodwill.

With that said, I suspect the data behind this is not data that the average individual would have much success in acquiring.

The subtle hostility seems unnecessary.


By providing a phone number, I don’t know if I’m helping build out their dataset, and I don’t know how that data will be used, secured, or sold in the future. Even if they have the data, simply asking for it can give a signal that this data isn’t stale - the number is likely live and owned by an individual.


Data brokerage isn't our business and frankly there are much easier way to buy it on dark web. We're just making it simple for people to learn.

Only data set that'll be of help if we give a bad score and it actually get hacked ( which we really don't want )


Frankly goal was to educate people on how our numbers are tied to our identity and then SIM Swapping issue.

This is the best we could think of, but please let us know what would be a better approach


They're likely requesting the data from some broker when you type in your number.

The alternative is that they've grabbed a full set of all data for all numbers, in advance, right?


No we pay per query ( It's expensive )


It's purely going to multiple data brokers and paying them to give you the info that they've on you. You can search for data brokers and hundreds of them will appear. Our goal is to create awareness around number security and it's linked to our identity


I understand your concern but we are limited by current privacy laws (for good reason in my opinion). I doubt we will build goodwill by showing everyone how to view unredacted information.

Feel free to check out https://haveibeenpwned.com/, I think you would like that more


What privacy laws, in which country would prevent you from sharing the source of info? Especially info that you're already sharing?

Is this just the ToS of whatever data brokers you're using?


Our license. We're not a data broker and we want to be cautious so the information isn't abused. Like taking some one phone and then using it for few min to acquire the info


Your license with who? That seems like a very different issue than "privacy laws".


Having given them my number, I’m unsure if they have a lot of raw data. The results come back like “JXXX SXXXX” instead of “JOHN SMITH”. Maybe they have all the data and are obfuscating to prevent misuse, or maybe thats all the data they get back from the broker since this is a free search.

Having Googled my phone number many times, Doxx Me is returning similar results that a bunch of paywalled “people search” websites show as a free preview.

I don’t personally think it matters what Doxx Me does since this data is out there being used without my permission all of the time, and they certainly didn’t collect it.


We are not a data broker company. We simply pay data brokers per click. It's a loss leader for us and goal is to improve our number scoring criteria and create awareness on how numbers are linked to our identity & how vulnerable they're


They already have the data indexed by phone numbers. Your ip/hn-referrer is pretty useless in comparison imo...


issue with open sourcing is that the sources are paid which is good in a way that criminals can't just run million queries making us more vulnerable.

We're just queries dozens of paid sources and crowdsourcing the data and displaying what we believe is accurate as it may have appeared multiple times

What do you think should be our approach given this is the situation


I tried it with both of my numbers and there was a lot of information, but only half of it seemed to be accurate.

Some of it was from family members who were apparently conflated with me, and some of it didn't ring any bells at all.

It had all of my recent addresses, and many more that I had never heard of, including cities I've only visited once or twice and two countries I've never been to in my life.

One phone number had 4 SSN's associated with it, and while the site doesn't show you the actual digits of the SSN, it does say the state it was issued in. All 4 were from different states, and none were from the state I was actually born in.


Yes info could be incorrect since we pull it from public sources . It may be due to data being linked to you some how


I assume a good amount of the incorrect data comes from tying people together based on shared addresses. For some addresses I have, like when I was in the military, there are probably a bunch of people who had the same address over a relatively short period.


So what’s your privacy policy?I imagine collecting a list of HN phone numbers, especially ones you can link to names and addresses, is pretty valuable.

Are you going to use these data or sell these data?


There are millions of such databases available with much more info. Our goal is to educate people on how our mobile numbers are vulnerable to SIM Swap and how important are number from identify point of view. Our business model is Secure Mobile Subscription.

If any one finds a need to protect their number, they'll upgrade their carrier to Efani Secure Mobile. We don't sell client data and only make money off the difference carriers charge us minus what client pays us.

Each of these queries cost us $, so we'll be able to calculate the CaC. One day, we may be able to be a standard for this tool to be used in OpSec where a number can't be added as 2FA if it's below a specific score


> One day, we may be able to be a standard for this tool to be used in OpSec where a number can't be added as 2FA if it's below a specific score.

The world would sooner switch completely off of SIM-baswed 2fa instead of such a roundabout solution. We already have alternatives, and there is already a push against using SIM-based auth.


> One day, we may be able to be a standard for this tool to be used in OpSec where a number can't be added as 2FA if it's below a specific score

Or more likely the data you've collected gets liquidated (or stolen) at some point.


Whatever your sources, it appears to return the same information as "search people free dot com," including all the same inaccuracies.


It could be but we use multiple sources . There are hundreds of data brokers


Why are names, emails, and addresses redacted/censored? There are a bunch of names and addresses attached to my phone number that belong to someone that isn't me. I've had this phone number for over a decade.


That’ll be so you can’t put someone else’s phone number in and start doxxing people


But you need to a verification code to use the app


You can buy old numbers. There are privacy laws we have to follow.


Could you elaborate a bit on the data sources and how the privacy laws affect them? I'm curious how the data can be publicly available to you but compiling a profile on someone with that data and disclosing it might not be.


In short, there are laws on data resellers vs data brokers. Data resellers can provide uncensored data and their sources but there are many more hoops for them to jump through in terms of who sees that. We would have to do due diligence into every person using our tool in that case.


That's fascinating, thanks! It's bizarre how giving one person's information to another person is a big deal, but giving millions of people's information to a company is totally fine.


Adding this explanation to your page would also be helpful...


What should be the verbiage ?


PSA - If you have a Discover credit card, they provide privacy protection and data removal services for free. They do scheduled scan and also submit data removal requests on your behalf.

https://www.discover.com/security/online-privacy-protection/


Holy cow, I added it to my Discover account, and it found all kinds of stuff that was publicly searchable. Thanks.


Has anyone used it? Have you noticed any differences anywhere?


I have used it and the service found several sites with my information. They automatically submitted data removal request and confirmed the removal as well.

I think they automatically run the tool every quarter and there will be new locations with my data. So, it's a continuous process.


If the data is publicly available as you claim please let us know where exactly so we can attempt to mitigate some of this. Thank you.


NOTICE that any request of WHERE the data is coming from is completely ignored by this company.

For 2 people who claim its for safety and security, sure as hell seems like a HN fishing expedition.


1. Privacy laws dictate we can't point people at uncensored data.

2. We are a cybersecurity company. We don't want to show people how to hack others.

3. It would lend to the common belief that there is one source of data that you can simply delete or opt out of. There are hundreds of companies, databases, and sources with this information copied.


This is just plainly not true. MB at IntelTechniques publishes one of the best known removal workbooks in the industry. There's no reason you can't do the same to teach people who to contact to remove their data. See https://inteltechniques.com/workbook.html

There is nothing stopping you from doing the same.


Unfortunately it is. I tested out the same steps outlined in this book as well as data removal services and it does not matter even 8 months later.

Don't believe me? Please try to follow this book and check back if our tool is still finding the info in 6 months.


Which their response just reaffirms that they're just a fly-by-night MVNO doing their own data harvesting.

And they have their own grandiose "nobody can fool us and have your SIM swapped here" (YET).

If I received $1 for everything I've read or heard "UnHacKaBlE", I could retire immediately.


We have $5 million insurance in the case that someone does get SIM Swapped which we have prevented so far.

Have you considered our cybersecurity company might have made this tool and provided it for free because it is good helpful to our target customers and might even help some customers find us?

Because that is what this is. Not data harvesting. We make money on our phone plan.


It's not if, but when.

Simply put, your security is NOT impenetrable. And I would heartily and easily say that your security is not up to NatSec minimums. And hell, they can't even keep their tools and data from leaking out.

You know, EternalBlue and goodies? Or how about the OMB hack. still sour about that one.

> Have you considered our cybersecurity company might have made this tool and provided it for free because it is good helpful to our target customers and might even help some customers find us?

Or you're harvesting legit HN users. Companies don't do stuff for free. There's always a reason. ALWAYS. And market research of real humans intersecting with HN is a very lucrative datasource.


No privacy policy... Not putting my number in there



That link isn't in the footer of the page you posted, and the help chat covers the link on page load when present on mobile.

Also, reading the privacy policy, it looks lacking. I'm not a lawyer, but https://www.nolo.com/legal-encyclopedia/what-to-include-in-y... clearly states that if your service sends text messages, you should make a statement about retaining that data indefinitely.

After reviewing the privacy policy, and seeing who else is involved in the company, no thanks. Seems very non professional.


Privacy policies mean absolutely jack and shit.

Radio Shack had one. Judge threw it out in bankruptcy court.

Others have a clause "we can change this whenever yadda yadda".

Basically if you think that's going to stop them, I have a bridge to sell ya.


It's not about the privacy policy itself, it's about the company having one that's suitable. I understand where you're coming from, but there are additional red flags to be drawn from beyond that.


in bankruptcy courts, everything is pretty much thrown out and yes every company can update their ToS. For Efani Secure Mobile, we clearly tell how we make money. If the goal was to harvest the data, service could be super cheap to get people in and then make money off it We make money by selling to you rather than selling you


What are the data sources for this? I'm curious because it returns a lot of garbage for me with a few real results mixed in, and I want to know which things to throw more garbage at.


Data sources is the entire business model for this website. I doubt he'd share with anyone.


No we're not in Data source business. We make money off Secure Mobile Subscriptions.

Our goal with the tool is show vulnerabilities around our numbers and how easy are they becoming alternative to SSN yet easy to be hacked


Anyone here want to write a mini-tutorial on how to pollute this data? I assume it's impossible to remove any of it, but it would be nice to poison it at least.


There are multiple guides around it and you can email every data broker company . Most of them are obliged to remove it but then there may be another hack and the data is again back in the market. There are few companies offering solutions and you can search for them. Some of them are listed on the page


I'm not going to reveal the phone number used, but I can verify that some of the information it returned was incorrect.

...Looking closer at the report now, all fields which returned information were wrong. Perhaps it's returning info based on previous customers who have used the number?

Points to consider:

1) This was not my primary phone number. It's possible that a lack of activity used on the phone I tested this with made it seem like a previous owner was still the active owner? Perhaps if the service is grabbing very outdated information, there should be an indicator next to each result "Older than # of (time)".

2) A low score is red...does this mean that a low score mean that a lot of information was returned? Comparing this "doxx" to a credit card score is confusing, because a credit score is generally low because you have a lack of history. With this, your score is low because you have a lot of history. It's weird. Maybe low results should = green, with a low score; high results = red, with a high score. I see "high score" to mean "high data points".

3) Not every field was filled out for this number, but my score was deep in the red. What is the circumstance where a phone number lands in the middle? I suppose some fields might be weighted higher than others?

Edit:

(Pet peeve of mine. This isn't a personal slam against the company, just a criticism against the practice in general.)

I see you have one of those chat widgets in the bottom right. If a customer uses that, and doesn't get a response immediately, it's pointless and taking up space. If I want to send an email, I want the email address listed clearly on the contact page. A roundabout way through a psudeo-clippy thing stinks.


Good suggestion about the email. So you're suggesting we shouldn't ask for email at all. I'll certainly bring it to next meeting.

- Fields are obscured due to privacy laws and to prevent abuse - Score is based on SIM Swap as in how easy is to SIM Swap and likely hood of some one attempting to do it like if you're a good candidate to attempt a sim swap on. It is based on ROI for a criminal - Previous owner info could be attached or some one may have used your number some where randomly


Some notes to developer: 1. it was never mentioned that the number must be from United States. You'd better add a client-side check BEFORE sending data to server 2. does this page purposefully disable right-click when number is entered? 3. embedded youtube iframe shows captcha page :D 4. as always, cloudflare gives a bit of trouble over tor (and not only)


Noted. Thanks for the feedback.


Do Europeans have it better in regards to this? I think the situation is minimal compared to what it's like in the USA.


I built this tool. This appears to be mostly American problem in terms of how easy it is to find data. Canada seems to be second with far less info.


I've found the approach to privacy to be extremely different in my country and the US - people don't see any issue with pasting their identities, linking them to DNA tests and so on.


How would you suggest to make it more secure, staying in current line only? Any known solutions? It is spooky AF.


Secure the telephone # or deleting the info ?

For #1 - That's what Efani Secure Mobile does. For #2 - we've listed few services but you can also email all the data brokers and they'll delete the info. You can also hire firms which do this by charging a subscription


Which firms?


We put a few firms on the bottom of the landing page: https://app.efani.com/doxx/hackernews/

Please consider using our affiliate link as we are providing this tool for free.


Thanks! Do you recommend Privacy Bee? The comments on this article don't inspire confidence: https://sensorstechforum.com/privacy-bee-deletes-user-data-d...


We put 2 options up - them or My Data Removal. Elsewhere online people seem to have an overall good experience with Privacy Bee. I do not think they are a scam or fake company no.

My Data Removal is cheaper so might be more worth it


Once the information is out, it is out. You can't take it back.


My report had an old work address listed. Not sure how that could've happened except that I had to have a background check performed while I was already there, and listed the work address as my address.

There was also an associated phone number that I only ever used on my credit card accounts. Hmm.


Visa and Mastercard used to sell data on credit card purchases until a law was passed in the last decade. That information will forever be connected. To this day you can purchase phone numbers that connected to certain cell towers.


I took a risk and used it, and it's pretty spooky what's available.


I thought it was pretty neat - not much info on my number.

Here are how results are displayed if someone doesn't want to search their number:

====

The following data is publicly associated with your phone number Carrier (MOBILE)

    Bragg Communications Inc.
    BRAGG/EASTLINK COMMUNICATIONS - SVR /2
Associated Names

    HXXXXXX NS
No Associated Emails

No Associated Birthdays

No Associated Locations

No Extra Sensitive Info

No Associated Institutions

No Associated Businesses

No Associated Phone Numbers

No Associated Social Media

No Associated People

No Associated Marketing Info

No Known Data Breaches

====

"Associated Names" is the city and province i reside in, and the carrier is more or less accurate. Both things i wouldn't expect to be able to keep secret without extreme effort.


Oh man, mine was actually kind of alarming. It even told me my SSN was issued in California. All the info looked accurate except for an "associated address" in Ohio that I don't recognize.


SSNs used to follow a pattern[1] (up to 2011) so that's not too difficult

1. https://www.ssa.gov/employer/stateweb.htm


That means your number doesn't have much information on it.


Yeah it's an immediate reaction since I share my number every where too


What are you doing with the information gathered from this service? Will phone numbers that are verified active by the text verification on this service be sent back to the data broker you're using?


Protecting and notifying our customers as well as this free tool. No we don't send anything to databrokers, we verify so it isn't abused.


Thank you for clarifying.


Looks like it found the following information for me and my wife: driver's license, date of birth, current and past residences, emails.

It also found the names and dates of birth of our extended families.


Yeah. and unfortunately, this is only from publicly listed info. Goal is to create awareness on SIM Swap vulnerability. How can we do better


I'm puzzled by all the complaints that this isn't public information. Where do you think they got it? (I guess the actual question is what do you think "public" means?)


Public means any one can access it without obtaining a license. Like you can go to whitepages and find info


So while some of my info was there, there was DRASTICALLY more data listed that has nothing to do with me. I've had this phone number since ~2001, any idea why that would happen?


Some one may have used your numbers randomly and that database may be leaked


Not sure if I agree with the scoring model here.

I tried two phone numbers: my primary cell phone number gets a great 800+ score but reveals an accurate address history of 9 years.

The second one gets a poor score (415), but none of the data is accurate. Have fun: https://gist.github.com/piscisaureus/03d5ebeeb3e77922a858464....


The scoring model is based on how likely you are to be targeted and hacked. Multiple points of data make it exponentially easier to do successfully. So just one address is not always the worst thing. Having tons of data on your phone (even if some of it is inaccurate) may also make you more of a target.


I tried it. And one of the most interesting things it did was list a location that I use when we are running our GPS simulator for testing. My phone has received our signal in the lab (it’s a shielded room) and apparently they location data was somehow associated with my number. It’s just a random town in Ohio…a place I’ve never been to.


Your number may have been added randomly by some one there


It appears to be broken for me. When I verify my number it shows the gathering information page for a second with the loading bar moving, then it just redirects me to the home page. I've tried in both Firefox and Chrome. I did get texts afterward saying "Thanks for letting us Doxx you" but I never got to see any results.


Apologies for that you can email me directly james@efani.com or use our live chat and sort out what the issue is. Otherwise try again on a different browser?


I got a bellow average score (455) which explains the high numbers of scam calls and texts I get daily. The interest thing is that out of all this info that can be found through my number there was not a single piece of information related to me. I think this is because my phone number was recycled.


How old the number is and did you legitimately get any call with reference to previous user ? plus is it different people or just one person


Not sure how old the number is. I have gotten calls asking for someone else, but I assume it is just a wrong number kinda situation. There are 3 different birthdays associated with the number, 1 ssn, and 6 names.


You do not support a way to keep my old number and start using a number that isn't associated with me, so I don't see how the doxx report is related to your offering outside of showing others who know those details can find my number which I consider public info.


We can port your existing number or give you a new. Give our customer service a call, they will step you through it.


Yeah, that's pretty crazy. I'd need to know more about how the service works to consider signing up for it.

I'd consider paying for a more detailed report that explains not just what can be found, but HOW that data was found, and remediation options beyond the mobile service plan.


This data is copied and combined by hundreds of data broker companies, you can google around. Trying to remove the data is pretty futile, but our service prevents the damage that can be done by finding this information.

That's why we made the tool and made it free.


I have a ton of non-correlated data and have no idea why, but then I realized. I frequently use services like textnow, which link me to phone numbers temporarily, which are often reassigned. As a result, it currently thinks for the most part that I am 12 different people. LOL.


could you describe this in more detail? it seems like this could be a useful countermeasure against these sorts of practices


Probably talking more like using a disposable or burner phone number that people have used in the past


Looks pretty much identical to what I get on truepeoplesearch.com, but they don't redact anything.


It's because of the difference license


Elsewhere you mentioned privacy laws. Are you saying that the other site is not subject to those laws due to a different licensing agreement?


I do not know what their legal team has advised them. Pretty interesting how most of these sites who show you unredacted information seem to be run by people with no internet presence and stock images though.


Is this a tool that farms lists of phone numbers? Why did the OP put it here, jimhi?


No it's not a farm, this info always existed and we are providing it to you at our own cost.

I built the tool - https://www.efani.com/leadership


How long is this data stored if you don't respond "YES"? I entered a number I just got yesterday and it comes with a pile of random combined people's data that aren't me.


Took a risk and used it, like other people here. Then I saw the price for what they are selling. $100 a month?! Wow! Isn't there some other way to lock down this info?


That service is for a 5g phone plan (built on top of att/tmobile). So you aren't just paying for the security


Thank you! Admittedly I was sticker shocked and missed some of the key details they were selling.


Yeah. Tool goal was to create awareness around SIM Swap first


Efani Secure Mobile doesn't delete info. We're a Secure Mobile Service which is $99/month. Goal of this is to create awareness on how easy is to SIM Swap or get into your mobile account


Where do you obtain your information?


We use data broker APIs. Most of them could be found through simple google search. Not every data broker has all the info so it may be a combination of multiple. I know this request has came multiple times but it's hard to tell exact source without specifically looking into individual case


Nice. I see a bunch of data points for people who aren't me, and none for myself. So my plan is to do nothing and interpret my number's low score as a high score.


Yeah not a bad idea


This really validated my approach of using a Google voice number- which was completely doxxed. Whereas my actual personal phone number was not.


Do you ever share your personal number or what's the use case with 2 numbers ?


I share it, but basically not on the internet or automated systems.


What data sources are powering this?


And this probably isn’t including hacked data from companies, just legally purchased data?


It may be. We buy if off data brokers that you can search too. We just make it simple to find the info


It failed to find anything on me and I've had my number for over a decade.


I’m fine with my phone number being published in a public directory.


How much 5g bandwidth do you get? What a huge lack of important info


Seems my info came from the massive Facebook breach last year


I don't believe that you're only using publicly available data. What are your sources? It should not be legal to store all this information tied to only a phone number that just anyone can look up publicly online.


You can lookup a surprisingly large amount of information about a person online.

Had this guy who decided to use my Gmail address for stuff and I ended up finding his phone number online to text him that is wasn’t his email address. After the failed attempt send him a yard gnome after I reset his Walmart password and was thwarted by the security code on the back of credit cards. I still think he would have been a good gnome owner.


you can search for services who'll give it to for sub $10


What does your service do to stop SIM swaps exactly?


We're a MVNO so we effectively are your carrier. In an event of request of SIM Swap, we follow a very specific set of procedures to eliminate any fraudulent attempt.


Interesting but not very helpful


how could it be more helpful


Nothing besides my carrier B)


So you mean you made a voter registry search...


A voter registry search requires name, date of birth, and zip code.

This is just your phone number. The thing you give out to people you just met. What the secure app signal requires for signup. And what spammers seem to always be able to find.


I can search my phone number and get dozens of results with my info that clearly came from voter registry scraping.

I can even find direct links to voter registries in some states I've lived.


NC requires just a name to search the voter registry online, I think that’s state-to-state


A voter registry search requires that you are registered to vote, does it not?

I am not allowed to vote. Yet, this tool was able to pull a lot of info regardless.


tell me more about this voter registry search? i actually just need a list of my old addresses, i move a lot.


[deleted]


What happens if I put in 911?


I doubt you'd get any results for it. The service requires an verification code sent via text message.


It may not accept 911. Text verification is to prevent abuse




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: