Have I Been Facebooked? • Hacker News Board

Re: Have I Been Facebooked?

#181

Post by 2Gkashmiri » Tue, Apr 06, 2021, 10:36 AM UTC

shnp wrote: post #124

I deleted my (outdated) phone number from facebook years ago and it's still part of the leak, with my name and gender in it. I did not replace the phone number with another phone number. Really says something about what delete means for fb.

i have had an idea. The last time i deleted my facebook account, it had been a 6-7 year old legacy thing and i ended up with manually deleting stuff, photos videos, contacts, calender entries. then waiting for months. I had an idea. This was back when "shadow profiles" had appeared on the news. i figured if i outright delete the account, maybe it would keep it in a "deleted because not coming back" DB. instead if i deleted stuff, maybe the idea would be "okay.. routine stuff.. delete"

apparently both my ideas were wrong but good thing i don't use any facebook property, don't use whatsapp or isntagram and am a hermit. I had telegram since 2015 but since signal whatsapp thing happened, i stopped using it. :-/

Re: Have I Been Facebooked?

#182

Post by idownvoted » Tue, Apr 06, 2021, 11:04 AM UTC

Already getting spammed hourly by text messages pointing me towards URLs I should click.

AFAIK there isn't much awareness about this leak amongst most of FB's userbase: Less tech-savvy and 40yrs ++.

Re: Have I Been Facebooked?

#183

Post by [deleted] » Tue, Apr 06, 2021, 11:04 AM UTC

social_quotient wrote: post #173

bra1n wrote: post #160

Earlier quoted context omitted.

That only holds for numbers already part of the dump. If you submit an unknown phone number that is not contained in the leak, hashing it before sending it will increase data privacy.

So a rainbow table of just 2.9 billion numbers covers the USA phone set. So I think searching for a specific number clear or hashed are roughly similar exposures. Maybe the right way to search without disclosure is really to filter. Meaning instead of putting in your full 10 digits. You just put in 7/8 and it returns a list of the rest for you to see. Then you visually scan to find your number out of the returned 999…

[deleted]

Re: Have I Been Facebooked?

#184

Post by wodenokoto » Tue, Apr 06, 2021, 11:19 AM UTC

Mordisquitos wrote: post #149

wodenokoto wrote: post #139

Earlier quoted context omitted.

I feel like I was doing the same mental gymnastics when I gave fb my phone number in order to log into messenger on my phone, and look where it got us.

How did Facebook know that it was a valid phone number, how did they associate it with your identity, and how did they know that number was really yours?

It’s probably been a decade since I gave them my phone number, so I don’t remember the details. I believe they required it for the messenger app and did a 1 time SMS code for first time log in to messenger.

Re: Have I Been Facebooked?

#185

Post by s_dev » Tue, Apr 06, 2021, 11:27 AM UTC

szundi wrote: post #110

How does one know a site like this is not just an other data harvesting site?

https://www.troyhunt.com/the-ethics-of-running-a-data-breach...

Other than Troy Hunt being well known and building a reputation on being a white hat security guy.

In the world of data the only thing you can trust in absolute terms is encryption. Anything else involving people involves shades of grey.

Re: Have I Been Facebooked?

#186

Post by Y_Y » Tue, Apr 06, 2021, 11:38 AM UTC

darkfirefly wrote: post #179

Semaphor wrote: post #171

Earlier quoted context omitted.

Interesting that Australia seems to be completely missing

Yeah, it's almost like it got merged with Austria, given it says "Austriaia"

Australia anschlussed Austria last week as part of some covid restrictions dodge. Surprised you all didn't hear about it.

Re: Have I Been Facebooked?

#187

Post by robthebrew » Tue, Apr 06, 2021, 11:45 AM UTC

helb wrote: post #166

Troy just added phone number search to Have I Been Pwned as well: https://www.troyhunt.com/the-facebook-phone-numbers-are-now-... ( https://news.ycombinator.com/item?id=26709848 )

I get different results from this and HIBP

Re: Have I Been Facebooked?

#188

Post by deeblering4 » Tue, Apr 06, 2021, 11:48 AM UTC

peteretep wrote: post #74

deeblering4 wrote: post #59

Earlier quoted context omitted.

2 factor sms authentication

1 factor of 2 factor auth is completely useless without any identity to tie it to

we’re talking about the facebook data leak that associates a number to an identity.

Re: Have I Been Facebooked?

#189

Post by kevingadd » Tue, Apr 06, 2021, 12:11 PM UTC

robthebrew wrote: post #187

helb wrote: post #166

Troy just added phone number search to Have I Been Pwned as well: https://www.troyhunt.com/the-facebook-phone-numbers-are-now-... ( https://news.ycombinator.com/item?id=26709848 )

I get different results from this and HIBP

If you read the bottom of the post, the complete phone number database has not loaded into HIBP yet. The results will likely change once it's done.

Re: Have I Been Facebooked?

#190

Post by norco » Tue, Apr 06, 2021, 12:16 PM UTC

Natsu wrote: post #113

obiShawnKenobi wrote: post #22

My number was leaked (checked the dump myself) but I don't show up on this site. Seems like there are some bugs to work out

I'm not surprised, the data dump was an ugly mess of inconsistently encoded data in inconsistent formats with "delimiters" that often appear in the data itself. Cleaning that up is a serious effort and requires operations on huge files that are very difficult for most software to deal with.

I don't understand how a serious effort would be required, even if the chosen delimiter being present within the data is an issue, the phone number is the first field.

I can get all the phone numbers myself with a simple `cat * | cut -d ":" -f 1`