Have I Been Facebooked? • Hacker News Board

Re: Have I Been Facebooked?

#161

Post by skytreader » Tue, Apr 06, 2021, 9:06 AM UTC

MarcoBuster wrote: post #145

I am a co-author of the site. We are already aware of your concerns about giving out your phone number. The source code is free and reviewable on Github. We know it's not possible to verify what's running on a server but we hope it adds a level of trust. We are currently hashing all phone numbers so we don't have to deal with them anymore. We will keep you updated.

> Your phone number has not been found in the leak. This is good, but you should be worried anyway.

I, too, am wary of Facebook but to other people, without reasoning provided, this sounds like FUD. Maybe at least link to an article explaining why they should be concerned anyway.

Re: Have I Been Facebooked?

#162

Post by 74d-fe6-2c6 » Tue, Apr 06, 2021, 9:06 AM UTC

tngranados wrote: post #141

Not sure what’s going on but it says my number is not part of the leak, but I’ve checked myself and it is actually leaked. Just be aware that it may not be complete.

maybe this website isn't even legit and just about harvesting phone numbers. I mean - who knows?

Re: Have I Been Facebooked?

#163

Post by sabujp » Tue, Apr 06, 2021, 9:11 AM UTC

MarcoBuster wrote: post #145

I am a co-author of the site. We are already aware of your concerns about giving out your phone number. The source code is free and reviewable on Github. We know it's not possible to verify what's running on a server but we hope it adds a level of trust. We are currently hashing all phone numbers so we don't have to deal with them anymore. We will keep you updated.

checking the code i don't see where it's being hashed in the browser before checking the backend yet

Re: Have I Been Facebooked?

#164

Post by MrGilbert » Tue, Apr 06, 2021, 9:15 AM UTC

Kiro wrote: post #120

Aren't telephone directories a thing anymore? At least in my country you can just search for a person online and see their phone number. Someone's phone number seems like the least sensitive PII.

Well, I can opt-out of a phonebook, at least here in Germany for decades already. I can't do that on this leak.

Re: Have I Been Facebooked?

#165

Post by r00f » Tue, Apr 06, 2021, 9:25 AM UTC

This is the first time when I see the UAE being called ARE in a country list. I even went and asked Google, and it turns out there is in fact one ISO standard that calls it ARE. All the others, including ITU (we are talking about phone codes, after all) call it as UAE. Really strange choice of naming standard for something phone-related.

Re: Have I Been Facebooked?

#166

Post by helb » Tue, Apr 06, 2021, 9:29 AM UTC

Troy just added phone number search to Have I Been Pwned as well: https://www.troyhunt.com/the-facebook-phone-numbers-are-now-... (https://news.ycombinator.com/item?id=26709848)

Re: Have I Been Facebooked?

#167

Post by tzs » Tue, Apr 06, 2021, 9:35 AM UTC

semiquaver wrote: post #38

eganist wrote: post #37

So, a few things. 1) no indication that there's any rate limiting here beyond a 2 second cooldown (thanks for that, grenoire), but I only tested it using burp intruder community edition, and I only tested it on a set of numbers guaranteed to return false. If anyone wants to test a range with a known-leaked number in it, up to you. 2) it's very possible that if there is rate limiting, it acts invisibly. But if there's…

Why would anyone scrape this site when they could just download the leaked dataset?

If they aren't rate limiting, scraping the site may be faster.

So far all the posts I've seen on HN that link directly or indirectly to places you can actually download it are to copies on ufile.io, which limits download speed to 500 Kbps if you aren't paying.

Re: Have I Been Facebooked?

#168

Post by frankacter » Tue, Apr 06, 2021, 9:37 AM UTC

shnp wrote: post #124

I deleted my (outdated) phone number from facebook years ago and it's still part of the leak, with my name and gender in it. I did not replace the phone number with another phone number. Really says something about what delete means for fb.

How many years ago did you delete your phone number? This is not a recent dump of data, it is just recently been made more widely available. I believe the original leak was some time in 2019.

Re: Have I Been Facebooked?

#169

Post by nottorp » Tue, Apr 06, 2021, 9:39 AM UTC

ysavir wrote: post #16

nottorp wrote: post #15

Earlier quoted context omitted.

Answering myself: haveibeenpwned includes the facebook leak in the main page check, so if it doesn't show there, you're not included. No need to give out your phone number if you registered via email.

> if you registered via email My concern is all the people that may have involuntarily signed up via whatsapp, with no email included but only a phone number.

Oh good point. I didn't know that was possible. Could I have another FB identity attached to the number i use for WhatsApp, you think? I signed up before it was bought. I may have even paid 0.99 or something like that, i forget.

I checked my phone # with the above site and it came up clean.

Re: Have I Been Facebooked?

#170

Post by otagekki » Tue, Apr 06, 2021, 9:46 AM UTC

The website says no, but after downloading the whole dataset and doing a quick search using "grep -rnw" I got my current phone number in addition to that of my grandfather's (also on FB), so even if the site says you're not facebooked, please check the raw data available on pastebin archive (https://archive.is/MZqak)