Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

533M Facebook users' phone numbers and personal data have been leaked online

businessinsider.com

Post reply on HN
Print view View original

511–520 of 524 posts

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#511

Post by edanm »

lovecg wrote: post #510
edanm wrote: post #509

Earlier quoted context omitted.

A good idea, but again, there are plenty of cases where that fails (depending on what you mean by "aggregate"). - "How much money is currently owed in taxes to the government?" - "Can't tell you that, we're not allowed to aggregate data".

I still think there might be something here. You can allow certain aggregations (like “sum of the tax column”), but they have to be explicitly permitted; otherwise shuffle and hash everything enough times to make a single lookup sort of cheap, while a scan very expensive (plus distribute over enough physical servers and make the network between them low bandwidth to thwart lower level attacks). With enough regulatory…

I mean, that slowness is the reason we moved to computers.

That said this is certainly interesting, I wonder if there has already been an exploration of this topic. Could definitely make an interesting startup idea :)

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#512

Post by cutemonster »

thu2111 wrote: post #470
cutemonster wrote: post #444

Earlier quoted context omitted.

> Google has a huge number of activist (and surely some corruptible) employees, and yet the incidents of users data getting out are very close to zero Am I reading this wrong, or are you saying that activists would be more likely to leak data? Then I would wonder what kind of activists you have in mind. Agreed that yes indeed it seems possible to build a security serious company, and that Google is (seems to be) a go…

Surely they would. We already learned that members of their own security team don't seem to see any problems with employees abusing privileged access to mandatory Chrome extensions to agitate for unionisation (at Google of all places!!). Twitter employees screwed with the account of the president of the United States. Ideological employees of big tech firms taking a sudden disliking to someone or some group and abusi…

> employees abusing privileged access to mandatory Chrome extensions

Sounds interesting, you don't happen to have a link? (So I can read more)

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#514

Post by coatmatter »

smdyc1 wrote: post #355
malaya_zemlya wrote: post #110

Earlier quoted context omitted.

https://t.me/freedomf0x/12553 I haven't checked the content myself, but this tg channel is usually legit

Were there any leaks of Australian data? I can only see Austria in pastebin (spelling mangled as Austriaia)

So far it doesn't seem to be clear but to me it appears Australia so far isn't as widely distributed.

Earlier, it appeared Troy Hunt was sent both Australia and Austria:

https://twitter.com/troyhunt/status/1378481134086971394

https://gist.github.com/troyhunt/00b9aa28d486c9b81f18259fa80...

~196 MB vs ~34 MB respectively.

However, he later posted an update later expressing some similar curiosities:

https://twitter.com/troyhunt/status/1378938375881682946

https://gist.github.com/troyhunt/9a081cea0de6cbc63d93ebc0104...

The second gist is the one showing "Austriaia" (Austria, not Australia) and ~35 MB.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#515

Post by coatmatter »

gwid0n wrote: post #336
I_am_tiberius wrote: post #16

Would like to know if non Facebook users are included because Facebook has non Facebook user's phone numbers due to the fact that Whatsapp uploads the entire phonebook to Whatsapp. That means Facebook is likely to know your phone number although you don't use Facebook or Whatsapp.

Anecdata: I've never provided my phone number to FB, I provided it to Messenger App and Whatsapp, it's not on in the file for my country.

Yeah, I feel Messenger or WhatsApp doesn't really come into play here. Facebook has at least two different privacy settings when it comes to phone numbers and how it's shown to people:

1. At https://www.facebook.com/USERNAME/about_contact_and_basic_in... - there's a contact info section where one can fill in a phone number (among other details) and set the visibility to Public/Friends/Friends except /Only me/Custom/custom lists.

2. And https://www.facebook.com/settings?tab=privacy - there's a "How people can find and contact you" section that covers "Who can look you up using the phone number you provided?" with options of Everyone/Friends of Friends/Friends/Only me. I imagine it'd be very easy to select the wrong thing during setup due to the overwhelming number of things to read and click.

I suspect those who have set the latter, or both options to "Everyone" will most likely be in the "free" data dump (except perhaps for most Australian Facebook users, for now).

I feel the second setting is riskier, especially if you don't want employers or colleagues to be able to simply look you up on Facebook by phone number. For example, I could hypothetically display my phone number to "Everyone" on an incognito profile and no one should be able to just wander by and spot my profile and immediately figure out who I am (assuming this profile doesn't somehow get suggested to "Friends you might know" - big assumption, yes; but this would depend on how I complete my profile). Regardless, either one or both set to "Everyone" is a recipe for disaster.

I believe more people would have allowed number searching compared to those who just have their phones displayed to everyone on their contact info sections. In effect, it's a bit of a reverse phone book, plus extra.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#517

Post by mikeiz404 »

xyzzy123 wrote: post #247
mikeiz404 wrote: post #136

Earlier quoted context omitted.

What are some of the ways? I’d assume encryption wouldn’t help much since wouldn’t the key most likely be available if the database was compromised? I would have thought hashing would work if it’s made more expensive such as by choosing an expensive hash function and increasing the number of rounds. Edit: Would first encrypting the value with the salt and then hashing the encrypted value and salt add more entropy and…

To protect "sensitive, low-entropy data", the main things I've seen people do are encryption, tokenizing, or anchored hashing. I'm certain there's a bunch of academic work out there I'm not across so I'm writing from the limited perspective of "things I've seen people do in industry". The best thing to do tends to depend on how you need to use the data, exactly. With hashing alone there's just no reasonable cost func…

Interesting, thanks for the info and links.

So it sounds like all of these techniques are to force sensitive data access to a single well secured point 1) with the hope that these actions will be eventually noticed and 2) to enforce rate limits on actions to slow progress and increase exfil duration to support (1). (2) can only be made so slow since, as you mentioned, the service needs reasonably quick access.

On a related note some HSMs can enforce rate limiting in hardware so even if the machine enforcing this access is compromised the rate limits still cannot be bypassed.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#518

Post by thu2111 »

cutemonster wrote: post #512
thu2111 wrote: post #470

Earlier quoted context omitted.

Surely they would. We already learned that members of their own security team don't seem to see any problems with employees abusing privileged access to mandatory Chrome extensions to agitate for unionisation (at Google of all places!!). Twitter employees screwed with the account of the president of the United States. Ideological employees of big tech firms taking a sudden disliking to someone or some group and abusi…

> employees abusing privileged access to mandatory Chrome extensions Sounds interesting, you don't happen to have a link? (So I can read more)

https://www.nbcnews.com/news/all/security-engineer-says-goog...

Kathryn Spiers, who worked as a security engineer, updated an internal Chrome browser extension so that each time Google employees visited the website of IRI Consultants — the Troy, Michigan, firm that Google hired this year amid a groundswell of labor activism at the company — they would see a pop-up message that read: “Googlers have the right to participate in protected concerted activities.”

Discussion here: https://news.ycombinator.com/item?id=21813619

Note that she wasn't able to do that unilaterally. Some other member of the team approved her CL and others defended her in public.

I have a vague feeling there was another case like this some years ago where some security engineer modified a Chrome extension for political reasons, but I can't remember the exact details and can no longer find it.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#519

Post by rhizome »

kelnos wrote: post #234
rhizome wrote: post #205

Earlier quoted context omitted.

> People by and large don't care enough about privacy Not to play dumb or sealion, but what opportunities are they given to do so? How often have those opportunities been one-and-done, "if you don't do something to protect your privacy in this particular instance at this particular moment, it's gone forever?"

> How often have those opportunities been one-and-done, "if you don't do something to protect your privacy in this particular instance at this particular moment, it's gone forever?" I don't think that question really captures it, because an easy response to that is "Why do I care? Why is my privacy so important that it's a problem that it's gone forever?" To some of us that might seem like an absurd question; we see…

>I think most people adopt the "I have nothing to hide, so what does it matter?" attitude.

I think when this comes up it's a rationalization when the question becomes personal, "what if YOU had your identity stolen." However, for large-scale stories like this, I think defeatism drives the response more than a sense of innocence. You can't fight city hall, a cultural principle that anything a business does is justified, and other "oh well!" type reactions.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#520

Post by bboreham »

AnthonyMouse wrote: post #507
bboreham wrote: post #464

Earlier quoted context omitted.

Money-laundering rules make it illegal for banks not to know who the customer is. Also various anti-bribery and sanctions rules.

None of those rules are worth the cost. Identity theft, created by the concept of centralized identity, costs billions of dollars. Investigations of those other crimes are still possible without government-mandated privacy invasions by banks, and the privacy invasions are a huge cost in themselves.

Maybe.

How would you feel if an investigation stalled when a bank said “we have no idea who these people are, or where the money went”?

Post reply on HN