My number was leaked (checked the dump myself) but I don't show up on this site. Seems like there are some bugs to work out
can confirm.
Have I Been Facebooked?
31–40 of 230 posts
Re: Have I Been Facebooked?
#32Earlier quoted context omitted.
Why would you give it to Facebook?
Because 12-13 years ago when a lot of people signed up, it wasn't clear that they were exceptionally evil. Pre-IPO, pre-ads, back when it was just status updates and photos, it didn't strike a lot of people (myself included) as a particularly bad idea. We hadn't seen the monster social media would become when it suddenly had to improve quarterly profits.
Ads began in 2007, over 13 years ago.
I purchased my first FB ad in late summer 2007. Not sure if that’s also when it opened up.
Re: Have I Been Facebooked?
#33Earlier quoted context omitted.
Allowing searches with wildcards is analogous to publishing the entire database. That being said, I think the cat is out of the bag on this one so maybe that wouldn’t be the end of the world.
>Allowing searches with wildcards is analogous to publishing the entire database. What's the harm in publishing a list of phone numbers, without any other info attached? I can generate a list of all phone numbers in north america by iterating through all the digits.
A list of valid phone numbers is more valuable than a list of all possible phone numbers, for the same reason that a list of valid passwords is much more valuable than a list of all possible passwords. It saves miscreants a lot of time and effort.
Re: Have I Been Facebooked?
#34Earlier quoted context omitted.
Why would you give it to Facebook?
Because 12-13 years ago when a lot of people signed up, it wasn't clear that they were exceptionally evil. Pre-IPO, pre-ads, back when it was just status updates and photos, it didn't strike a lot of people (myself included) as a particularly bad idea. We hadn't seen the monster social media would become when it suddenly had to improve quarterly profits.
ELI5 why facebook is exceptionally evil. (Of course I'm inviting downvotes, but please give me a comment too; ideally a reason that isn't also applicable to 'internet as a whole').
Re: Have I Been Facebooked?
#35Facebook should email those affected... surely they know who was compromised or not. Shouldn't have to use random sites for this. Why has there been no communication from them?
> Why has there been no communication from them? It's not like they care even a bit. And they wouldn't win any goodwill from it. If you have been zucked, you've been zucked, that is it.
the GDPR would reuire that from them but hen again..
Re: Have I Been Facebooked?
#36Earlier quoted context omitted.
>Allowing searches with wildcards is analogous to publishing the entire database. What's the harm in publishing a list of phone numbers, without any other info attached? I can generate a list of all phone numbers in north america by iterating through all the digits.
A list of valid phone numbers is more valuable than a list of all possible phone numbers, for the same reason that a list of valid passwords is much more valuable than a list of all possible passwords. It saves miscreants a lot of time and effort.
I'm not sure how it works in other countries, but for the US the numbers are generated by area code, and they're constantly allocating new ones because the old ones have been used up[1]. This is with number recycling. Therefore if you randomly generate a phone number for an "old" area code you probably are going to get a valid number.
[1] https://en.wikipedia.org/wiki/List_of_North_American_Numberi...
Re: Have I Been Facebooked?
#37So, a few things.
1) no indication that there's any rate limiting here beyond a 2 second cooldown (thanks for that, grenoire), but I only tested it using burp intruder community edition, and I only tested it on a set of numbers guaranteed to return false. If anyone wants to test a range with a known-leaked number in it, up to you.
2) it's very possible that if there is rate limiting, it acts invisibly.
But if there's no rate limiting as I suspect, someone can easily just iterate through this data set and extract every number (well, until cloudflare trips the requests). Alternatively, someone can request a large set of numbers that includes their own in order to fuzz the range their own number is in.
Re: Have I Been Facebooked?
#38So, a few things. 1) no indication that there's any rate limiting here beyond a 2 second cooldown (thanks for that, grenoire), but I only tested it using burp intruder community edition, and I only tested it on a set of numbers guaranteed to return false. If anyone wants to test a range with a known-leaked number in it, up to you. 2) it's very possible that if there is rate limiting, it acts invisibly. But if there's…
Why would anyone scrape this site when they could just download the leaked dataset?
Re: Have I Been Facebooked?
#39So, a few things. 1) no indication that there's any rate limiting here beyond a 2 second cooldown (thanks for that, grenoire), but I only tested it using burp intruder community edition, and I only tested it on a set of numbers guaranteed to return false. If anyone wants to test a range with a known-leaked number in it, up to you. 2) it's very possible that if there is rate limiting, it acts invisibly. But if there's…
Read the backend, two-second cooldown
Re: Have I Been Facebooked?
#40I'm looking forward to the sequel, "Have I Been 'Have I Been Facebooked'ed" when it turns out this is just a data harvesting operation. If you don't want your phone number leaked don't hand it over to a random website that pinky swears it won't keep it. It's maybe not a scam, but still...
Any one can enter any phone number. What does leaking a phone number without any ties except an IP mean?
You look up my number, and then I'll look up your number. Now, we're anonymized as the tracking codes that could be employed will associate my number with you, and vice versa.
no problemo