Live data from Hacker News

The Facebook phone numbers are now searchable in Have I Been Pwned

troyhunt.com

201–210 of 248 posts

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#201
post #53

Earlier quoted context omitted.

Let's not forget the notable case of Twitter "accidentally" using your provided phone number for advertising purposes [0], and to this day still banning you after registration if you refuse to give it. [0]. https://www.eff.org/deeplinks/2019/10/twitter-uninentionally...

Facebook did this as well.

[deleted]

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#203

Earlier quoted context omitted.

Only ~32m of ~190m USA Facebook accounts were in this leak. The US is surprisingly poorly represented-- a good thing!

As a foreigner I would say this is a bad thing. Ultimately, it'll be the outcry (or lack thereof) in the US that will determine whether or not Facebook will start taking people's privacy more seriously.

It's still 32 million people, that's huge. But you're totally correct there.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#204

I searched the database and haven’t been pawned but of course I know why, I never shared my phone number with FB and this confirms my idea that sharing anything with FB is a terrible idea, even the real name with correct spelling can cause issues. I urge everyone who wants to still hold a social media account to add an alternative spelling for their name. When info leaks or one gets unsolicited messages of any kind o…

This is excellent advice. Years ago I had a misspelling of my name on my drivers license. Very easy to find the source of all my junk mail after that!

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#205
One other attack vector with this data that I've not seen much chatter about is that the phone numbers (and other leaked data) are sufficient to create a Facebook Custom Audience and directly target the associated people with ads. Cross referencing these numbers (or pivot through names) with any external data source and you've got the capability to target specific voters, for example. Facebook made a lot of changes [eventually] to their Custom Audience abilities via user ID as a result of the Cambridge Analytica scandal, this leak makes it not too dissimilar in terms of how you could at least segment and direct target ads.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#207
The data would have been either from abuse of API's by third party apps or find your friend. From the dataset, it seems to be exclusively limited to the data immediately viewable on your profile, hence the reason so few emails appeared in this leak.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#208
post #80

Earlier quoted context omitted.

And Facebook will promptly ignore that too: https://ruben.verborgh.org/facebook/

1. That article is about downloading, not deleting. 2. You don't negotiate with Facebook, you norify the regulators so they can asses another billion-euro fine.

[deleted]

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#209
I’m so confused. I intentionally refused to give my phone number to facebook and it is not set in my profile, yet my number was pwned in this facebook breach. Is FB associating or storing my number without permission? I have a different number set for 2-factor and amazingly it was not pwned!

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#210

Non-technical speculation, but based on my own experience as an ordinary Facebook user: I'm increasingly confident that this breach/leak has come about mostly through the privacy search setting (buried in Facebook's privacy settings - https://www.facebook.com/settings?tab=privacy -) which allows "Everyone" to search for a number in order to find your profile if so enabled. This is a bit like an option that PayID/Osko…

Only ~32m of ~190m US FB accounts were in this breach, so it's not surprising if you live in that country and are not in the breach.

This statistic isn't applicable to me.
Post reply on HN