Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

533M Facebook users' phone numbers and personal data have been leaked online

businessinsider.com

Post reply on HN
Print view View original

261–270 of 524 posts

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#261

Post by dlandis »

rpastuszak wrote: post #119

I don’t have FB or or WhatsApp but my Insta account (using a separate email address and no personal details) keeps recommending my therapist to me. How are we still ok with this shit? The sooner we get rid of the cancer that FB is, the better. I didn’t share my contact book with FB apps either. It was probably her—a person in her 70s, not necessarily experienced with tech. The main reason this company exists, or that…

> The main reason this company exists, or that ad tech can maintain a facade of not being a mainly bullshit industry with made up metrics, is the lack of informed consent.

Exactly, the industry is built on a foundation of obfuscating the myriad ways in which they are using people's personal data. Uninformed consent is the cornerstone of their business model.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#262

Post by flas9sd »

antibland wrote: post #107

I’m curious about the pool of Facebook users who seldom use the product, retaining it solely for groups and to keep in touch with family. Will this event loosen that final brick and drive these users to delete their accounts?

"keep in touch with family" can be subsumed by chat apps. But for discussion groups and special interests, facebook is still the most accessible site to run (small) groups in, or am I mistaken?

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#263

Post by bellyfullofbac »

djokkataja wrote: post #170
tnolet wrote: post #85

Interesting numbers in the linked tweet in the article. 5M accounts for the Netherlands exposed. Almost 1/3 of the population. Compared to Germany where “only” 6M are leaked, not even 10%.

They've also got Tunisia in the list twice, and the number for the first instance is 39.5M, when the population of Tunisia is not even 12M.

I wonder if Tunisia is famous for FB click farms?

A quick google indicates "maybe": https://about.fb.com/news/2020/06/may-cib-report/

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#264

Post by sn_master »

rpastuszak wrote: post #119

I don’t have FB or or WhatsApp but my Insta account (using a separate email address and no personal details) keeps recommending my therapist to me. How are we still ok with this shit? The sooner we get rid of the cancer that FB is, the better. I didn’t share my contact book with FB apps either. It was probably her—a person in her 70s, not necessarily experienced with tech. The main reason this company exists, or that…

I had the same problem but figured it out at last. The Instagram recommendations are based on who is on your phone contacts. Anytime I add a new contact number, they show up on my Instagram recommendations even if we never interacted in anyway not even by the phone.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#265

Post by QUFB »

i_have_an_idea wrote: post #260

There's not much to see here. Someone scraped some public profiles. Someone then brute forced a poorly implemented "look up by phone number" feature. They linked the two datasets on the unique facebook user id. Leaking data that is or was in the public domain is not much of a leak. The only noteworthy thing would be the leak of the non-public phone number, however that vulnerability has been widely known since 2019 (…

Not much to see? Not noteworthy?

Where could I, or any Internet user, trivially download these details on 533M Facebook users prior to this dump? If nothing else, it seems extremely noteworthy that someone was not only able to obtain the data through scraping or some attack, but has shared with the world.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#266

Post by coldcode »

groby_b wrote: post #109
dan-robertson wrote: post #100

Obviously it is bad if your personal data is compromised after you (or some else) upload it to an online service like Facebook. But in this case, it’s important to remember that phone companies used to regularly leak most of their customer’s phone numbers (and names) in the form of a telephone directory. So a question to consider is: suppose that the white pages were still commonly produced and contained most people’…

Spam calls are likely not even affected by leaked numbers. Source of suspicion: My partner and I have phone numbers in close numeric vicinity, and deliberately use one for public purposes and the other one is not known outside of a very close circle of family. We still get spam on both numbers within short time frames - so I'd say it's likely spammers just auto-dial through.

That's been going on for many years. Brute force calling costs nothing. I've always wondered if charging 5 cents per call would stop them cold, but I am sure no one wants to implement that now.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#267

Post by anonymouse008 »

hanspeter wrote: post #241
anonymouse008 wrote: post #181

Earlier quoted context omitted.

You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola! I wouldn't throw the elder person under the bus on this one, the tactics are sophisticated, and honestly, just a precursor to what will happen with AR. To give a bit more of how it's implemented (at least how I would propose it in iOS), Insta/FB/Whats queries availabl…

Not sure why you're suggesting shenanigans like wifi SSID tricks (and others jumping the bandwagon), when the actual thing that happened here is obvious: GP visited their therapist's website, the website had FB/IG advertising tracker installed, the therapist had a campaign running that targeted all visitors from their site.

I appreciate that idea, however, I've been testing my own 'friend suggestions' and keep a strong track of my antics... also, it's become a hobby of mine to debunk each time someone says 'they're listening to my microphone!!!'

Most of the time the 'listening to me' conversations are based on origin IP to insta/fb/whatsapp servers. One person talks about idea X, another person looks it up (either in the room or later at home by themselves), and now everyone who was at that IP together will get ads for X.

What's more, Google maps uses Wifi SSIDs to get better location data when GPS gets a bit spotty... so, I'd venture to say it's a small step to associate accounts and make friends.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#268

Post by 0x_rs »

Personally, I wish Facebook would finally get slammed with the long overdue consequences of questionable practices when it comes to data handling and transparency, let alone minuscule control users have on own account and PII. This leak may have been preventable for a vast number of individuals. I suppose many are familiar with the old account "deletion" process that would — years later, too — prove itself not to be a real removal, but a mere deactivation, waiting to return from their graveyard whenever pinged by the simplest of login attemps by bots or ill intentioned individuals. At this point in time, considering the sheer amount of I believe accounts struck in a limbo, a dedicated fast track deletion process should be enforced on Facebook. I have, in my little knowledge, not found any case of GDPR requests granting one's wishes to see old accounts (that did not accept their newer ToS and cannot be authenticated in any possible manner permitted currently, in which registration and connected e-mails are not) be permanently removed from their systems. My attemps, at least, have come short.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#270

Post by i_have_an_idea »

QUFB wrote: post #265
i_have_an_idea wrote: post #260

There's not much to see here. Someone scraped some public profiles. Someone then brute forced a poorly implemented "look up by phone number" feature. They linked the two datasets on the unique facebook user id. Leaking data that is or was in the public domain is not much of a leak. The only noteworthy thing would be the leak of the non-public phone number, however that vulnerability has been widely known since 2019 (…

Not much to see? Not noteworthy? Where could I, or any Internet user, trivially download these details on 533M Facebook users prior to this dump? If nothing else, it seems extremely noteworthy that someone was not only able to obtain the data through scraping or some attack, but has shared with the world.

> Where could I, or any Internet user, trivially download these details on 533M Facebook users prior to this dump?

On Facebook. Literally. You can scrape any public profile info. It's against ToS, but it's not illegal (some caveats apply, see the hiQ Labs v. LinkedIn case for more info).

The only noteworthy thing is the phone number vuln. Except that's been known since 2019, so it's certainly not news.

Post reply on HN