Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

533M Facebook users' phone numbers and personal data have been leaked online

businessinsider.com

Post reply on HN
Print view View original

331–340 of 524 posts

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#331

Post by djhn »

153791098c wrote: post #289
I_am_tiberius wrote: post #16

Would like to know if non Facebook users are included because Facebook has non Facebook user's phone numbers due to the fact that Whatsapp uploads the entire phonebook to Whatsapp. That means Facebook is likely to know your phone number although you don't use Facebook or Whatsapp.

It goes so much further than this and it is absolutely frighting. The following sketched situations applies if you don't use Facebook at ALL. 99+% of every single person you meet has either FB, IG or WA installed on their phones and shares their phonebooks with them (assuming you live in [insert western country here]). There is also a very big chance at least some have your full name and address in their phonebook. F…

As a counterpoint I can think of dozens of personal acquaintances who are happily non-users and never interact with Facebook properties (retirees not into tech, busy executives, to cool for Facebook hipsters). If your country or social circle doesn't use WhatsApp, Facebook itself is already dying and Instagram is getting their lunch eaten by Tiktok.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#332

Post by noxer »

xyzzy123 wrote: post #76
noxer wrote: post #57

Earlier quoted context omitted.

They could store a salted hash instead for almost everything except using the number as actual phone number (call/SMS)

You need to do a bit more than that; a one-way transform with no secrets isn't good enough for easily brute-forceable data like phone numbers, SSNs, passport numbers, credit card numbers etc. There's just not enough entropy in the data. There are ways to do these things though so the spirit of your comment is correct.

You can not prevent the phone number form being found eventually but that's not the goal you just need to make it more expensive than a phone number could ever be worth to someone.

If you use a secret you have the same problem as before the legit system need to have access to the secret but an attacker should never get it. So if an attacker gets hashes and the secret(s) he has everything.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#333

Post by banana_giraffe »

b212 wrote: post #328
banana_giraffe wrote: post #272

Looking at the leak others have pointed to, there are a surprising number of people working in a particular imaginary company: sqlite> select company, count(*) as c from usa where length(company) > 0 group by company order by c desc limit 10; company c ---------------------------------------- ---------- Self-Employed 459119 Facebook 181013 Retired 71210 The Krusty Krab 61550 Hollister Co. 42304 U.S. Army 39682 Stay-a…

Could you please tell me how did you convert it to sqlite? I've got a huge 1 GB txt file that crashes my comp every time I try to search for myself there :( Thank you!

Super hacky python script I used to turn the text files into a sqlite database:

https://pastebin.com/gBWhCVGz

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#334

Post by Someone »

londons_explore wrote: post #28

Looks like this is the "To match users to their friends by phone number, you need an API which can take as input a phone number, and return information about if that number has an associated account" problem. There is no way to let a user find their friends on a service without such an API. Yet if you have such an API, someone can simply brute force all phone numbers worldwide (there are only 10^10), and now they hav…

I think there are way more than 10^10 phone numbers in the world. I think there are 10^10 combinations in the USA alone (filtering by unused area code, etc will decrease that number, but even then https://www.ck12.org/c/probability/permutation/rwa/Wrong-Num... says almost 8×10⁹ remain)

Also, at least some countries have longer phone numbers (Germany, the UK and China have 11-digit ones, for example), and the international public telecommunication numbering plan says plan-conforming numbers are limited to a maximum of 15 digits, excluding the international call prefix (https://en.wikipedia.org/wiki/E.164), so the search space, potentially, is a lot larger.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#335

Post by Judgmentality »

varispeed wrote: post #316
tomComb wrote: post #306

Earlier quoted context omitted.

Google has a huge number of activist (and surely some corruptible) employees, and yet the incidents of users data getting out are very close to zero. I think this demonstrates that user data can be managed safely and effectively. Usually the incidents reports on user data leaks show that the company seemed to barely be trying - We need laws that force them (even small companies) to put serious effort into it.

You don't know that. While the publicly available data leaks are indeed rare, you cannot know if they don't use the data for trading or other purposes for their personal gain without disclosing it to the public.

Sure, but if you have no evidence of it happening you have a fairly weak argument.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#336

Post by gwid0n »

I_am_tiberius wrote: post #16

Would like to know if non Facebook users are included because Facebook has non Facebook user's phone numbers due to the fact that Whatsapp uploads the entire phonebook to Whatsapp. That means Facebook is likely to know your phone number although you don't use Facebook or Whatsapp.

Anecdata: I've never provided my phone number to FB, I provided it to Messenger App and Whatsapp, it's not on in the file for my country.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#338

Post by datavirtue »

b212 wrote: post #328
banana_giraffe wrote: post #272

Looking at the leak others have pointed to, there are a surprising number of people working in a particular imaginary company: sqlite> select company, count(*) as c from usa where length(company) > 0 group by company order by c desc limit 10; company c ---------------------------------------- ---------- Self-Employed 459119 Facebook 181013 Retired 71210 The Krusty Krab 61550 Hollister Co. 42304 U.S. Army 39682 Stay-a…

Could you please tell me how did you convert it to sqlite? I've got a huge 1 GB txt file that crashes my comp every time I try to search for myself there :( Thank you!

Try Ultra Edit, free trial. It can read and search massive text files without crashing. Quite responsive.on 10GB files.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#339

Post by tyingq »

randerson wrote: post #282
neogodless wrote: post #197

Earlier quoted context omitted.

Dear god, fastpeoplesearch.com is a horribly obnoxious treasure trove of information.

Just submitted a removal request for myself, a flow full of dark patterns (in fact the Remove button didn't even show up until I disabled my Pi-Hole). Remains to be seen whether all I did was make the data more valuable by confirming my email address. The page recommends signing up at BrandYourself to prevent various other data brokers from showing the same data. How is this not extortion?

"The page recommends signing up at BrandYourself"

Is is a link? BrandYourself has an affiliate program, so they are probably making money on referrals.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#340

Post by dan-robertson »

varispeed wrote: post #319
dan-robertson wrote: post #100

Obviously it is bad if your personal data is compromised after you (or some else) upload it to an online service like Facebook. But in this case, it’s important to remember that phone companies used to regularly leak most of their customer’s phone numbers (and names) in the form of a telephone directory. So a question to consider is: suppose that the white pages were still commonly produced and contained most people’…

You can't compare that at all! They leaked IDs and from that you can go to user profile and learn more about them. You cannot do that from a phone company leak.

Phone companies didn’t leak phone numbers in the conventional sense of the word. I used it to try to draw a comparison. Phone numbers used to be printed in big books and you could usually look someone’s phone number up if you knew their name and rough location. That is, phone numbers were not considered to be particularly private information at all.

I think the comments I most agree with talk about the different security threats people face today with current usage of phones.

Post reply on HN