Best to avoid using the “Have I been facebooked” website

For example, HIBP does not send your password (or its complete hash) to the backend in order to find if it has been previously exposed. They use this method: https://blog.cloudflare.com/validating-leaked-passwords-with...

Phone numbers are a small search space. You can just iterate through it to generate all possible phone numbers.

Of course, I don’t know that your phone number belongs to you, but I have it. The same applies to this site if you enter your phone number in it. They will have your phone number… so what? They don’t know it’s your phone number, just that it‘s a phone number, which has zero value.

If you search the web for your exact phone number, there’s a very good chance your phone number is on several “who called me?” websites already. How did they get your number? They didn’t. They just list every possible phone number and hope people will add comments saying who called them from that number.

What information are you actually disclosing here, given that the number itself is worthless?

That the phone number is associated with somebody who wants to know if it’s part of the Facebook breach? What value is that information / what are the risks associated with it? Scammers wouldn’t use it because anybody who is looking this information up is probably less likely than the average person to fall for a scam even when tailored to this breach. They’d probably get a better hit rate by excluding these numbers.

How about associating it with whatever information your browser leaks / whatever tracking they can add? Use private browsing / incognito to reduce that. What value is knowing that a person with an arbitrary phone number uses Chrome vs Safari? What value is knowing that a person with a phone number from a certain area is browsing from an IP address also located in that area?

All of the comments people have made about privacy here seem to be useless “oh my god, now they have your phone number!” panic that doesn’t seem to realise that a phone number in isolation is worthless. It’s possible that there are potential privacy problems here, but as far as I’ve seen, nobody has actually mentioned any.

I'm not saying this article is crap -- just that if it is, you probably just happened to see it before the white blood cells kicked in.