Live data from Hacker News

533M Facebook users' phone numbers and personal data have been leaked online

businessinsider.com

501–510 of 524 posts

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#501
post #98

Earlier quoted context omitted.

Where did you get the data leak, I want to check too.

https://t.me/freedomf0x/12553 I haven't checked the content myself, but this tg channel is usually legit

Seems like all German accounts with 8-digit phone numbers are missing. Only 7-digit number accounts are shown.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#502

Earlier quoted context omitted.

Is this available to people outside of the US as well and is there a guide for setting this up? Last time I used twilio for a basic sms gateway there was a lot of clicking and typing.

I think it is available for people outside the US. https://support.twilio.com/hc/en-us/articles/223179908-Setti... I would recommend using the Studio workflow which is GUI based and easy. https://support.twilio.com/hc/en-us/articles/115016033048-Fo...

I forgot to mention this earlier, but you can also proxy outbound calls through Twilio:

https://www.twilio.com/blog/make-receive-calls-twilio-number...

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#503

Earlier quoted context omitted.

It turns out that signing up for a new bank account is something that people commonly do at the same time as they're moving to a new place and change their address and phone number.

So you're saying there's effectively no checks for ID for opening a bank account in the US?

"As has been pointed out on HN before, "identity theft" is a made-up concept to make it seem as if you had something stolen from you, when the real problem is banks and other service providers do an absolute shit job of identity verification. They're the ones at fault, and they try to shift the onus onto you to fix things when they screw up."

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#504
post #301

Earlier quoted context omitted.

This is why I don't use my real phone number with apps and HATE apps using phone numbers as a proxy for a user id. Get a virtual phone number if any service requires a phone number from you. Don't submit to this nonsense.

Some more sophisticated services look up the provider and blacklist VOIP / virtual number listers.

I've found that VOIP numbers from certain countries and area codes can evade this problem. Not listing publicly, in case the idiots in charge of the system are prowling this site.

But I don't even understand why they're allowed to look up the provider, or why I can't define myself as a mobile operator.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#505

Earlier quoted context omitted.

Thanks. I'm just getting a "Please open Telegram to view this post from @freedomf0x" message. Any way to access this without signing up for Telegram? The irony of giving my personal info to another 3rd party just to check if my personal info was leaked by a different party is too much...

the telegram has a text file with links to links by country, I've just stuck that at https://pastebin.com/3SvG1FJ0

And since that got taken down, here's a skylink:

https://siasky.net/AAC7DeBiGWL-QbG0cEFpCwuEiRlmrNLu7FdOUrF3t...

And a couple other Sia portals it's available through:

https://skyportal.xyz/AAC7DeBiGWL-QbG0cEFpCwuEiRlmrNLu7FdOUr... https://skydrain.net/AAC7DeBiGWL-QbG0cEFpCwuEiRlmrNLu7FdOUrF...

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#506

Earlier quoted context omitted.

The problem is completely the opposite. The flaw is the existence of social security numbers. Prohibit them from being used for anything but social security. Then there is no "your social security number" or "your identity" for someone to open a bank account against. You open a bank account and they give you a bank card and you set an address and phone number. The day you open it, they shouldn't need to know who you…

Why not FIX how an SSN can be used? It was not created for this purpose but that doesn't mean how we use it can't be fixed. Any time someone attempts to use your SSN to identify themselves as you, you should be notified and your authorization should be required for that use to be allowed. And the higher the value of the authorization, the more care should be required. Companies are able to do this already with 2 fact…

> Any time someone attempts to use your SSN to identify themselves as you, you should be notified and your authorization should be required for that use to be allowed.

So now the government needs a way of contacting you. Suppose they have your address and phone number on file.

Then you lose your way a while and become homeless for two years. You can't afford a phone and no longer have the same address, and have lost your ID or it expired. You finally start to turn it around and go to open a bank account. The government contacts you how? How do they know it's you?

The answer is that it's a new account and you're not trying to prove anything about whether you're the same person who lived at the old address, so you shouldn't have to.

And once you have a bank account or a mortgage or such, you and the bank can arrange for any form(s) of authentication you like. It shouldn't have anything to do with the government, and it definitely shouldn't have anything to do with how you authenticate yourself to your job or your wireless carrier.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#507

Earlier quoted context omitted.

The problem is completely the opposite. The flaw is the existence of social security numbers. Prohibit them from being used for anything but social security. Then there is no "your social security number" or "your identity" for someone to open a bank account against. You open a bank account and they give you a bank card and you set an address and phone number. The day you open it, they shouldn't need to know who you…

Money-laundering rules make it illegal for banks not to know who the customer is. Also various anti-bribery and sanctions rules.

None of those rules are worth the cost. Identity theft, created by the concept of centralized identity, costs billions of dollars. Investigations of those other crimes are still possible without government-mandated privacy invasions by banks, and the privacy invasions are a huge cost in themselves.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#508
post #476

The root of the problem is not the privacy policy or the system security. The root of the problem is the collection itself. All large businesses, health care providers, and governments maintain databases. Every one of them will eventually be leaked. All it takes is a corruptible trusted insider.

I mean, yes, but.. what's the solution? Never collect data? In at least some of those cases (and arguably all), that data does need to be collected and stored. What is the government going to do, not maintain birth registries, tax registries, land owner registries etc? What is a big business like a bank going to do, not collect customer data like your name and address?

I have a different view: it’s not the collection that’s the problem, it’s the firehose attached to the database. For the applications you mention, make aggregation over all records prohibitively expensive by design.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#509
post #508
post #476

Earlier quoted context omitted.

I mean, yes, but.. what's the solution? Never collect data? In at least some of those cases (and arguably all), that data does need to be collected and stored. What is the government going to do, not maintain birth registries, tax registries, land owner registries etc? What is a big business like a bank going to do, not collect customer data like your name and address?

I have a different view: it’s not the collection that’s the problem, it’s the firehose attached to the database. For the applications you mention, make aggregation over all records prohibitively expensive by design.

A good idea, but again, there are plenty of cases where that fails (depending on what you mean by "aggregate").

- "How much money is currently owed in taxes to the government?"

- "Can't tell you that, we're not allowed to aggregate data".

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#510
post #509
post #508

Earlier quoted context omitted.

I have a different view: it’s not the collection that’s the problem, it’s the firehose attached to the database. For the applications you mention, make aggregation over all records prohibitively expensive by design.

A good idea, but again, there are plenty of cases where that fails (depending on what you mean by "aggregate"). - "How much money is currently owed in taxes to the government?" - "Can't tell you that, we're not allowed to aggregate data".

I still think there might be something here. You can allow certain aggregations (like “sum of the tax column”), but they have to be explicitly permitted; otherwise shuffle and hash everything enough times to make a single lookup sort of cheap, while a scan very expensive (plus distribute over enough physical servers and make the network between them low bandwidth to thwart lower level attacks). With enough regulatory or legal pressure on companies to lock down their data, paying this premium might start to look attractive; one could even found a startup peddling the World’s Slowest Database™!

Edit: what I was thinking originally was that in the world of paper-only archives, these massive leaks were all but impossible, yet business could still be done. It should be possible to combine this slowness with the convenience of computers.

Post reply on HN