Live data from Hacker News

Have I Been Facebooked?

haveibeenfacebooked.com

151–160 of 230 posts

Re: Have I Been Facebooked?

#151
post #111

Earlier quoted context omitted.

There is sourcecode for both front and backend and the creators linked their names. So check the sourcecode and decide whether you trust the people involved that this is actually the code that is running the site

How do you know that the source code they published is the same code that the site uses?

You don't. Their comment literally says that. You can choose whether or not you trust the authors.

Re: Have I Been Facebooked?

#153

I am a co-author of the site. We are already aware of your concerns about giving out your phone number. The source code is free and reviewable on Github. We know it's not possible to verify what's running on a server but we hope it adds a level of trust. We are currently hashing all phone numbers so we don't have to deal with them anymore. We will keep you updated.

Hash the phone number in the browser before sending it to your server. That way it is at least possible to verify via devtools what is being send.

Heck. Allow even prehashed phone number to be entered.

Re: Have I Been Facebooked?

#155

I am a co-author of the site. We are already aware of your concerns about giving out your phone number. The source code is free and reviewable on Github. We know it's not possible to verify what's running on a server but we hope it adds a level of trust. We are currently hashing all phone numbers so we don't have to deal with them anymore. We will keep you updated.

Hash the phone number in the browser before sending it to your server. That way it is at least possible to verify via devtools what is being send. Heck. Allow even prehashed phone number to be entered.

That's what we're planning to do. Thank you

Re: Have I Been Facebooked?

#157

Not sure what’s going on but it says my number is not part of the leak, but I’ve checked myself and it is actually leaked. Just be aware that it may not be complete.

Same, for a contact's number (I'm checking on their behalf). It shows up in the raw dump [1] but not this site.

[1] https://archive.is/MZqak

Re: Have I Been Facebooked?

#158

I am a co-author of the site. We are already aware of your concerns about giving out your phone number. The source code is free and reviewable on Github. We know it's not possible to verify what's running on a server but we hope it adds a level of trust. We are currently hashing all phone numbers so we don't have to deal with them anymore. We will keep you updated.

Hash the phone number in the browser before sending it to your server. That way it is at least possible to verify via devtools what is being send. Heck. Allow even prehashed phone number to be entered.

I understand the frustration but they have the data and hence, a rainbow table, sending a pre-hashed phone number is the same as sending an unhashed one, unless the worry is man in the middle, who is just as likely to get the data.

The only way to check without giving up personal info is to get the data and look locally, or perhaps search for so many phone numbers that yours is buried in the haystack.

Re: Have I Been Facebooked?

#160

Earlier quoted context omitted.

Hash the phone number in the browser before sending it to your server. That way it is at least possible to verify via devtools what is being send. Heck. Allow even prehashed phone number to be entered.

I understand the frustration but they have the data and hence, a rainbow table, sending a pre-hashed phone number is the same as sending an unhashed one, unless the worry is man in the middle, who is just as likely to get the data. The only way to check without giving up personal info is to get the data and look locally, or perhaps search for so many phone numbers that yours is buried in the haystack.

That only holds for numbers already part of the dump. If you submit an unknown phone number that is not contained in the leak, hashing it before sending it will increase data privacy.
Post reply on HN