Snapchat Makes You “Find The Ghosts” To Keep Hackers From Stealing Your Phone Number
Snapchat now verifies new users aren't robots by making them choose its ghost mascot within images. It's an attempt to keep out hackers who could steal phone numbers by exploiting a leaked database of details on 4.6 million accounts.
Context & Ripple Effects
This closes a three-week loop that began when researchers published working code for matching phone numbers on Christmas Day 2013 after their disclosures went ignored, followed by Snapchat's December 27 decision to downplay the flaw while claiming counter-measures were in place. On January 1, hackers used exactly that technique against a database covering 4.6 million accounts, and by January 2 the company had publicly pledged fixes.
The ghost-selection CAPTCHA is the first concrete product of those pledges — but it landed alongside a demonstration that the system could be defeated in under 100 lines of code. Pickup across eight outlets including The Verge, CNET, and VentureBeat reflects how much attention a revenue-free app with no stated monetization path now draws whenever its security posture slips.
First-order effects
- Every new Snapchat signup now faces an extra verification step before joining, adding onboarding friction aimed squarely at scripts harvesting phone numbers from the leaked 4.6 million-account dataset.
Second-order effects
- With the CAPTCHA already shown beatable by a hobbyist script the same day it launched, Snapchat is locked into an iterate-and-react cycle where each counter-measure invites a public crack, keeping its December downplaying of the flaw under scrutiny.
Third-order effects
- If ignored disclosures keep converting into mass leaks, consumer apps will face pressure to adopt adversarial human-verification earlier in development rather than patching post-breach — and the reputational cost lands hardest on companies like Snapchat that have no revenue cushioning user trust.
The trend: Consumer app security is shifting from reactive post-breach patches to an escalating arms race over automated human verification, paced by how quickly researchers publish bypasses.