From: rfranken@cs.umr.edu (Richard Brett Frankenberger)
Subject: Re: ADDRESS
Date: Tue, 5 Jan 1993 16:59:33 GMT
Organization: University of Missouri - Rolla, Rolla, MO

In article <1993Jan4.132812.11524@netcom.com> jimlynch@netcom.com (Jim Lynch) writes:
>In article <158.720.uupcb@ehbbs.gwinnett.com> dan.baer@ehbbs.gwinnett.com (Dan Baer)  writes:
>> Question: Does anyone know a good way to find the address of a person
>>when you only have their phone number. I have tried 'PhoneFile' on
>>CI$ but they do not have the phone number in their database. The
>>phone number should be in Carroll County Georgia (prefix 562).
>
>_PLEASE_ do _NOT_ tell this person how to do this except to say "try directory
>assistance".
>
>I for one would become nervous if everyone on the net could get my address from
>my phone number.
>
>Thank you in advance for protecting our privacy.

That's right.  Don't tell him.  If you don't tell him, then it can't happen.

Seriously, this is 'security by obscurity' and it doesn't work.  Let me use a
more easily explainable example here.  Lets say there is a car alarm system that
is very widely used and is believed by most users to be very secure.  But lets
suppose that there is a problem with it that allows anyone press some easily
accessable button and disable the system.  Soon all car thieves will know about
it.  It won't neet to be posted to Usenet for this to happen.  The 'car-thief
net' will handle that.  If I them come across this information I can either
(1) NOT post it to the net, thereby not informing lots of users of this system
that there is a problem (and possible allowing them to fix it), or I can
(2) Post it to the net, thereby letting all law-abiding citizens who use this
system know what the car thieves alredy know, that there is a problem with it.
 
Many people advocate option number (1) because they don't want everyone to 
know how to do this.  Well, most net-readers probably wouldn't steal a car
just because they knew how.  And most car thieves have better sources of info
than the net anyway.  Of course, it is liekly that posting it would result
in some stolen cars.  Some small time thieves might not already know.  And
some kids might say "wow! lets go try it!)".
 
The same thing applies to means of getting address from telephone numbers.
Its a little bit less clear since getting an address from a tel #, unlike
stealing a car, it not illegal, but its pretty safe to assume that the 'shady'
characters that you really don't want to have your address already know how
to get it.  You may not be anxious to tell me your address, but would it 
really hurt you if I knew it.  No, it wouldn't (Of course, you don't know that,
but on the average, most net readers wouldn;t do anything with it anyway).
 
I for one would like to know how easy it is to get an address from a telephone
number (actually, I have a fairly good idea how easy it is).
 
One way to try is to call the telephone company and say that you didn't get
your last bill when you expected it and that you want to verify the address.
(It works ... I had to do this once (on my own number, because I hadn't
received a bill) ... I called from work and they asked me my telephone
number and my name and from that read back my address ... since I did not
call from my own number, they had no way of knowing who I was except that I
knew my NAME and NUMBER ... Of course, this may not have work if you don't  
have a name to go with the number).
 
       - Brett   (rfranken@cs.umr.edu)
 
OH NO!!! SOUND THE ALARM!!! Now everyone knows how to get addresses from 
telephone numbers.  This is not news.  Hackers have known about this for years.
Now the reast of the world knows and is in a position to do something about it.
Some telephone companies will let you associate a password with your account
and will not give out ANY information unless the person requesting it has a
password or a subpoena.
 
Please do not interpret any of the above post as a flame.  I'm jsut trying to
make the point as clear as possible.
 
Xref: sparky misc.legal.computing:2447 misc.legal:22334