Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Facebook phone numbers are now searchable in Have I Been Pwned

troyhunt.com

Post reply on HN
Print view View original

11–20 of 248 posts

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#11

Post by wccrawford »

jtylr wrote: post #10
Macha wrote: post #6

Earlier quoted context omitted.

Did you ever set up SMS 2fa? Did any of your contacts use the Facebook app to sync their contacts (at least at one point a default behaviour)? Then Facebook has your number. I remember when I still used it being promoted by a bar at the top of the web UI "Is this your number?" With my actual number suggesting I add it to my profile, so I know they have mine.

Despite using 2FA and listing my number on my profile - albeit restricted to "just me", I don't appear in the data. It's not as simple as they just having a record of it somewhere.

I'm in the same situation and very surprised. I've sat here wondering if I'm entering my numbers wrong, or if I'm really not in it. I've read the blog post and I'm entering the 1 in front of my 10 digits, because I'm in the USA.

My wife's number isn't in there, either. I'm just really surprised, because I checked facebook the other day and it said I was searchable by email and phone number.

I even searched my email address, and a lot of other breaches show, but not Facebook.

I guess I got lucky?

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#12

Post by vmception »

Macha wrote: post #6
nikbackm wrote: post #2

I just logged in to Facebook for the first time in years to check the data it has on me. Luckily I never added my phone number or address, so should hopefully be in the clear.

Did you ever set up SMS 2fa? Did any of your contacts use the Facebook app to sync their contacts (at least at one point a default behaviour)? Then Facebook has your number. I remember when I still used it being promoted by a bar at the top of the web UI "Is this your number?" With my actual number suggesting I add it to my profile, so I know they have mine.

I've been intentionally breaking my social graph since at least 2012.

Looks like its worked here.

When I make a Facebook account, usually for my living complex's community or a bunch of Gen-Xer's doing a burning man thing, I use a new email or new phone number for signup and one time passwords.

I don't let it get access to my contacts, assuming I inadvertently installed the Facebook app on a phone.

Doesn't look like they meaningfully go deeper than that.

I find the social graph to be very fungible, so if I really ever want to recreate it I can just add my phone number or give any app access to my contacts. This knowledge also lets me not be married to any of these services.

I'm very content downloading the account data and then deleting the account.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#13

Post by layoutIfNeeded »

nikbackm wrote: post #2

I just logged in to Facebook for the first time in years to check the data it has on me. Luckily I never added my phone number or address, so should hopefully be in the clear.

Haha, no. It’s enough if one of your friends/relatives/etc. had allowed Facebook/Instagram/WhatsApp/etc. to scan their contact list. Your phone number is in there, just not shown, trust me.

In fact Facebook used to show creepy suggestions when such cross-pollination of data occured, like “Click here to confirm that XXXXXX is your phone number!”, but they stopped doing that a few years ago.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#15

Post by mimimi31 »

freebuju wrote: post #7
nikbackm wrote: post #2

I just logged in to Facebook for the first time in years to check the data it has on me. Luckily I never added my phone number or address, so should hopefully be in the clear.

Try creating a new facebook account today. The site won't let you do that without verifying a phone number. The difficulty level increases if you try doing so behind a vpn. Same goes for other SM sites like Twitter.

I don't think that's true. I created a Facebook account a few weeks ago and a Twitter account just yesterday, both without needing a phone number.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#16

Post by HenryBemis »

I searched my number(s), no hits. I did a +/- a few numbers, and there is a hit. The message is though: "Oh no — pwned!"

The only information exposed to me is that the person with that number, has a FB profile. If I am to trust FB (which I don't - for nothing) is that FB has this person's number and lost it. I place no reliance to anything that FB states. For all I know that person is a WhatsApp user and the FB branch 'stole' the number and added that to their FB account (yes, I know this is not how data works, but this is how FB works).

(semi-rant follows - apologies)

There is a mention of 2FA/MFA in another comment. I wouldn't be surprised if FB already has a 'super profile', where all data by FB-WA-IG are merged. I believe that would be a nightmare to do, but hey, FB is good at nightmares.

Edit: I feel this is a semi "Ashley Madison" moment. People who have a 'secret' FB profile may get busted by their BFs/GFs.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#17

Post by shnp »

drcongo wrote: post #4

I'm completely unsurprised that my phone number is in there despite the fact that I deleted and closed my account 10 years ago.

I deleted my phone number around mid-2018 and it’s also part of the leak tying the phone number to my name and gender

https://news.ycombinator.com/item?id=26708923

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#19

Post by polycaster »

I'm sure not to be the first one to point this out, but checking other people's emails is quite revealing. It's very much documenting in public which sort of websites about every person you know is visiting. Among them [1] "Baby Names", "Ashley Madison", "Adult FriendFinder", "diet.com". Want to profile your friends – there you are.

I wonder if the benefits of haveibeenpwned outweights this.

[1] https://haveibeenpwned.com/PwnedWebsites

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#20

Post by paranoidrobot »

polycaster wrote: post #19

I'm sure not to be the first one to point this out, but checking other people's emails is quite revealing. It's very much documenting in public which sort of websites about every person you know is visiting. Among them [1] "Baby Names", "Ashley Madison", "Adult FriendFinder", "diet.com". Want to profile your friends – there you are. I wonder if the benefits of haveibeenpwned outweights this. [1] https://haveibeenpwne…

Troy has covered this several times, but some sites, even showing in the PwnedWebsites list, are not viewable until/unless you confirm control of the email address or Domain.

e: To be clear, the Ashley Madison, and Adult Friend Finder (both breaches) are denoted on the list as not being publicly searchable.

Post reply on HN