Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Look Up Unknown Phone Numbers Using Facebook Reset Password

bytexd.com

Post reply on HN
Print view View original

11–20 of 140 posts

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#11

Post by jsnell »

Before gathering up the mob and handing out the torches and pitchforks, you should probably establish what the facts actually are. I don't think the author of this post has really done that.

The way these systems should work, and appear to work in Facebook's case, is that the amount of information revealed depends on risk analysis.

For example, I just tried recovery from an IP I've used Facebook from, and from a fresh IP from a low reputation hosting provider located in a country unrelated to the account. The first case reveals the user's name, but that's pretty reasonable since the request has a decent amount of affinity for the account. The risky looking recovey does not reveal the name,

Both logins show the first letter of the local part of the email address, which is basically no information leakage at all. (Though honestly, if you show just one letter even for non-risky recovery attempts, why bother? It can't possibly be of any significant help to the users.)

I can't tell whether the profile picture changes based on the risk analysis outcome or not, since I don't have a test account with one.

(It's still possible that this is a bad implementation; e.g. if it were to be revealing my username for any recovery attempt from the correct country, that'd be unreasonable since it's trivial to figure out the country from the phone number. But even so one should still establish what the relevant parameters are, so that we can figure out whether the behavior is reasonable.)

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#12

Post by wyxuan »

nrmitchi wrote: post #6
wyxuan wrote: post #5

Earlier quoted context omitted.

Facebook profile stuff is public info anyway, I don't really see the privacy issue here.

Phone numbers that are meant for account recovery and/or two-factor security only are most definitely not public info.

This method isn't a way of finding out phone numbers from Facebook accounts, so I don't see what you mean here

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#13

Post by awinter-py »

52-6F-62 wrote: post #10
awinter-py wrote: post #7

password reset flows are generally a privacy leak if you use email as some kind of account key, you can generally find out whether that email has signed up (if not the username) automatic password reset and email verification are good for businesses and users in a lot of ways so this is a tradeoff if FB is showing the specific account linked to an SMS that's IMO negligent but shrug, they employ more lawyers than I do…

I’ve seen this obfuscated by some systems by always just throwing the user a message saying the reset email has been sent so that there’s no indication whether or not the email is associated with an account or not. Of course, that doesn’t help someone who can’t remember if they’d signed up or not but it’s probably the safer way to go in general.

yup, need to do it in the signup case as well but it solves the problem

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#14

Post by contravariant »

52-6F-62 wrote: post #10
awinter-py wrote: post #7

password reset flows are generally a privacy leak if you use email as some kind of account key, you can generally find out whether that email has signed up (if not the username) automatic password reset and email verification are good for businesses and users in a lot of ways so this is a tradeoff if FB is showing the specific account linked to an SMS that's IMO negligent but shrug, they employ more lawyers than I do…

I’ve seen this obfuscated by some systems by always just throwing the user a message saying the reset email has been sent so that there’s no indication whether or not the email is associated with an account or not. Of course, that doesn’t help someone who can’t remember if they’d signed up or not but it’s probably the safer way to go in general.

There's typically a system that forbids you from adding an additional account with the same email though.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#15

Post by MrRiddle »

wyxuan wrote: post #12
nrmitchi wrote: post #6

Earlier quoted context omitted.

Phone numbers that are meant for account recovery and/or two-factor security only are most definitely not public info.

This method isn't a way of finding out phone numbers from Facebook accounts, so I don't see what you mean here

Phone number meant to be private shouldn’t be associated with any other info whatsoever.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#19

Post by wyxuan »

MrRiddle wrote: post #15
wyxuan wrote: post #12

Earlier quoted context omitted.

This method isn't a way of finding out phone numbers from Facebook accounts, so I don't see what you mean here

Phone number meant to be private shouldn’t be associated with any other info whatsoever.

Whats the rationale behind this? Outside of prank calling, I don't see what the benefit of having a private phone number.

When I hit someone's voice mail I can get their name, so it's not like most people consider it to be private.

Re: Look Up Unknown Phone Numbers Using Facebook Reset Password

#20

Post by throwaway201103 »

MrRiddle wrote: post #15
wyxuan wrote: post #12

Earlier quoted context omitted.

This method isn't a way of finding out phone numbers from Facebook accounts, so I don't see what you mean here

Phone number meant to be private shouldn’t be associated with any other info whatsoever.

Then you probably shouldn't be announcing it in your caller ID when you call random people.
Post reply on HN