Live data from Hacker News

The Facebook phone numbers are now searchable in Have I Been Pwned

troyhunt.com

151–160 of 248 posts

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#151
post #54

Getting to the point where we’re going to need phone, email, and SMS to be deny all by default. Can’t reach me unless you’re information is already in my contacts.

I do that already. Prevented e.g. Hult MBA from pitching their exquisite high-end educational services...

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#153
post #91
post #14

Links to the actual data (allegedly): https://pastebin.com/sq7UDyVb

Seems to be missing Australia, I was curious to see what data had been leaked about me, since it seems to vary significantly.

This set is missing Australia yes, but not the other set Troy Hunt was sent - he covers this in his blog post and tweets. There are at least two sets floating around. The ones loaded into HIBP do contain Australian numbers - I've checked.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#155
post #65
post #4

I'm completely unsurprised that my phone number is in there despite the fact that I deleted and closed my account 10 years ago.

If you’re a EU citizen contact your local data protection authority and file a complaint. It literally takes 5 minutes.

(/verytrivial cries in Brexitish ...)

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#157
Non-technical speculation, but based on my own experience as an ordinary Facebook user:

I'm increasingly confident that this breach/leak has come about mostly through the privacy search setting (buried in Facebook's privacy settings - https://www.facebook.com/settings?tab=privacy -) which allows "Everyone" to search for a number in order to find your profile if so enabled.

This is a bit like an option that PayID/Osko (instant bank transfers) in Australia allows - one could bash through random mobile numbers and discover more information than just the number. I've always found this option to be creepy because I don't people who might otherwise have my phone number legitimately to be able to facestalk me.

Please note that this is separate to displaying contact info publicly on one's profile page - yes, there is a dizzying array of different privacy settings on Facebook. Would Mark Zuckerberg provide have ever displayed his phone number publicly? I doubt it. But would he have allowed others who already have his phone number to search for him on Facebook? I'd say almost certainly yes.

I used to use Facebook more than I like to admit and I have provided my phone number to Facebook in the past, yet have managed to avoid being in this breach, whereas some people I know are in the data set. This means I'm quite sure that I'm not returning false negatives with the search.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#158
The previous thread had an amazing trick that worked for me: https://news.ycombinator.com/item?id=26682325

tl;dr; search your real phone number but exclude consecutive numbers to filter out auto-generated pages:

  "(212)555-1239" -1240 -1238
Using this I was able to find all my info (and much more) on sites like: https://www.fastpeoplesearch.com/

I expect many of these "people search" sites to link to your fb profile soon using this breach.

I expect the more sophisticated ones to crawl all your social media accounts (twitter, chat apps, etc) by abusing reverse look up using your phone number.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#159

Earlier quoted context omitted.

I'm in the same situation and very surprised. I've sat here wondering if I'm entering my numbers wrong, or if I'm really not in it. I've read the blog post and I'm entering the 1 in front of my 10 digits, because I'm in the USA. My wife's number isn't in there, either. I'm just really surprised, because I checked facebook the other day and it said I was searchable by email and phone number. I even searched my email a…

US numbers are not uploaded yet

Ah, that makes sense then. I assumed they were because the instructions showed the US style specifically.

Thanks!

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#160
post #111

Earlier quoted context omitted.

Possibly, but we can't do that either. What we need is some balance of both worlds. OOH, we do actually need to be contactable. OTOH, being too contactable means spam. I doubt there's a perfect balance, but either extreme come with too many problems. Email has decent spam filtering, and I think that kind of cat-mouse system will persist. That said, there's "room" for more whitelisting.

"I doubt there's a perfect balance, but either extreme come with too many problems." In principle, "pay me a small fee if you're not on my list, if I put you on my list now it's free" would work well (optionally refund someone who contacts you out of the blue that you approve of), but there's a lot of both engineering and social details between where we are now and such a system. It doesn't take much cost friction to…

This is one of those ideas that appeals to economists and nerds, but rarely works out irl.

Artificially or intentionally aligning interests tends to be a "genie, make me a sandwich^" problem. There are lots of places where "reversing the charges," seems good in theory... but it never happens.

Anyway, linkedin have something like this. In practice, it feels like a better quality of spam, rather than a solution to spam.

^Poof. you are now a sandwich.

Post reply on HN