how many "h"s can you find in:
disclaimer: this was discovered in 2020 and was forgotten on my computer since then. the attack vectors described bellow might have changed.
while browsing on the internet, i founded a strange functionality forgot username?. everyone all know about the forgot password one that often imply to input the user email address and get a link to reset ones password.
when clinking on the link, the user was prompted to either put its email address - its username right? - or a phone number.
one: the phone number was not recognized and the page display it as an error message.
two: the phone number was in the database and yahoo! would ask if i wanted to get a password reset code on the phone number.
obviously when clicking yes a text message was sent to the phone number and i was able to reset its account's password and access the profile data - i only connected that on accounts i owned for ethic and legal reasons.
a weird case scenario that happened was triggered when the phone number was linked to two accounts. in this case, it was possible to reset both account's passwords.
on the picture below lenonfran48 was my account but the other one, starting with ism, was not.
if there were two accounts link to a phone number, twitter would not allow the user to reset its password using the phone number and asked to use the username or email address.
google also allowed to use a phone number instead of an email to login and reset the account password. but, in order to show that the account really belonged to the person with the phone number, google asks for personal information as the user first name and last name.
as google, amazon was asking the credit card last number not before resetting the user password, but when accessing the "personal" section or putting an order.
burner and google voice: these services allowed to buy a temporary phone number and let you choose from a list allowing to test the number against the applications and buy the interesting numbers.
the following table present the raw results obtained by running the collected number.
we see that burner and google voice were not interesting sources in term of phone number. the reason is probably that the number were not really use by users as recuperation device.
company phone number however were really interesting as they tend to be reuse phone number.
renew your phone numbers.
keep an inventory of your phone number usage and update them as needed.

try to show the same message whether the phone number is link to an account or not.
as google and amazon were doing ask for personal information before sending the email.
there is no real vulnerability here as this was mostly a user bad habit. nonetheless, gafam could implement some simple fixes to protect their users from this kind of "attacks".
user
The passage contains ninety-eight "h"s.
assistant