Technology

Yes it did. Data brokers are a thing. They sell your information to anyone they want and aren’t responsible for anything that happens.

I doubt there's anywhere where the phone book wasn't digitized. In Germany, the requirement to publish your address + number was eventually dropped, though; maybe because the phone system was privatized.

Your device and account credentials are unique enough to identify you on the carrier-level, SIM/eSIM as well. Ultimately, every time you share your contact info, it should be a unique code (QR would be convenient enough) generated by your cell provider. If it's ever leaked, you just notify your carrier to burn it, and give the contact a new unique code. No two people should be given the same contact, and all of the contacts are simply correlated to your device by the carrier. Additionally, when sharing contacts via QR, they could be modified on the device-level to include e2e encryption keys, thus further securing the transmitted information, not at the trust-me-bro carrier level, but at the user-verifiable device level. If the carrier gets hacked, reset the identifiers, associate the new one in your text app to keep conversations going, and move on like nothing happened. You'll still be better off than if your phone number was leaked. It's not perfect, but it'd be a hell of a lot more secure than what we have now.

In other words: What if a billion dollar company made Signal, but with cell towers, and not as good?

Sure you can have a unique identifier. That’s not the issue. The issue is that anyone can contact you via your phone number! This is not a problem with chat apps where people need permission to add you to their contact list. Why not have a system like that?

Same goes for credit cards. They should need to ask for permission to charge your credit card. Merely knowing your credit card info should not be enough.

I intentionally was vague because there are many possible existing ways to accomplish each thing I said, and it is up to the phone company to innovate.

The simplest way to keep people from guessing phone numbers is to make them very long and sparse. If an autodialer had to dial 1000 invalid numbers before finding a valid number, it would make the endeavor that much harder. This is just a convenient example because the cryptography equivalent is harder to explain, but you could make contact info so hard to guess that it would be basically impossible.

Probably the easiest way to explain how to keep people from passing contact info is to imagine a two step process like facebook has. If I pass your facebook username to someone else, they don't automatically become your friend. The cryptographic equivalent would involve a chain of trust, but again, harder to explain.

Yeah so targeting individuals or specific organisations is pretty hard. It sounds dumb but how do you get someone's phone number if they don't give it to you? Its hard unless you're determined tbh which most people aren't.

Most hackers setup watering hole style attacks, or use phishing which is roughly the same concept. Basically they cast a wide net and see what they can grab, like the browser credentials of Debra from accounting who knows everything about compound interest and nothing about opening an .exe file in an email. There are some big game hunting groups, and the LinkedIn breach made some waves (see the fappening), but your run of the mill discord-as-a-c2 style hacker isn't going after rich people.

Someone "hacking a phone" likely put a kitchen scale iPhone app on the app store, which when first opened asks for permissions for microphone, camera, text messages, contacts and file storage, and sends all that information to Argentina for a week or so until their app gets banned.

Also, the most likely person to hack your phone seems to be someone in your household, abusive parent or spouse sorta thing. Most common devices to get hacked are laptops, usually windows. Its just kinda hard to hack a phone. Unless you know a lot about compressed image formats and the iPhone messages app apparently because NSO made like 5 zero days in a row out of that.