Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Facebook phone numbers are now searchable in Have I Been Pwned

troyhunt.com

Post reply on HN
Print view View original

231–240 of 248 posts

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#231

Post by livre »

officeplant wrote: post #187
0x_rs wrote: post #53

Earlier quoted context omitted.

Let's not forget the notable case of Twitter "accidentally" using your provided phone number for advertising purposes [0], and to this day still banning you after registration if you refuse to give it. [0]. https://www.eff.org/deeplinks/2019/10/twitter-uninentionally...

Haven't given them my number on any of my twitter accounts. Where does this banning rumor come from?

I had that experience, maybe they are more forgiving to IPs coming from certain countries or locations. IPs from my country tend to be treated as suspicious (not as bad as Tor but bad enough to be an annoyance) so as soon as I registered ok Twitter I got a notice about "suspicious activity" and about having to validate a phone number to be able to use the account. At that time (2015 I think, I don't have the account anymore) you could get around that by contacting support, explaining that you don't have a phone number and waiting a few days for them to manually unlock the account.

Edit: this happens with Google and Yandex as well, requiring phone number to sign up (Yandex can unlock you if you contact support). Microsoft isn't as bad and can work with just a secondary email instead of a phone number. Also the whole country is banned from downloading the Lynx web browser at https://lynx.invisible-island.net/

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#232

Post by Naracion »

heleninboodler wrote: post #196
nohuck13 wrote: post #135

Earlier quoted context omitted.

Thanks. For anybody getting a miss and wondering if they messed up the formatting, my US number is coming up now, formatted with a vanilla +1-123-456-7890.

My US number also came up when entered as 12345678901 (1-prefixed but with no extra formatting or chars)

"When you search any of the endpoints on Have I Been Pwned, you can add a + prefix if you like and it'll be automatically stripped off when performing the search. Same with spaces and same with dashes."

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#233

Post by KMnO4 »

ricardobayes wrote: post #126
KMnO4 wrote: post #98

Hm, I already know phone number is leaked, but searching for it (XXXxxxXXXX) doesn’t work. Once I prepended Canada’s country code: (1XXXxxxXXXX) it worked. Maybe this can be fixed with some simple communication? Ie “No result —- ensure you enter your full phone number including country code”

how do you know it was leaked? got spam?

I downloaded the list.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#234

Post by fuzxi »

livre wrote: post #231
officeplant wrote: post #187

Earlier quoted context omitted.

Haven't given them my number on any of my twitter accounts. Where does this banning rumor come from?

I had that experience, maybe they are more forgiving to IPs coming from certain countries or locations. IPs from my country tend to be treated as suspicious (not as bad as Tor but bad enough to be an annoyance) so as soon as I registered ok Twitter I got a notice about "suspicious activity" and about having to validate a phone number to be able to use the account. At that time (2015 I think, I don't have the account…

>as soon as I registered ok Twitter I got a notice about "suspicious activity" and about having to validate a phone number to be able to use the account. At that time (2015 I think, I don't have the account anymore) you could get around that by contacting support, explaining that you don't have a phone number and waiting a few days for them to manually unlock the account.

Same thing happened to me last year in the US. The kicker was that they automatically opt you in to product update, daily digest, etc. emails. But those emails don't have a 1-click unsubscribe - the unsubscribe link takes you to your account settings, which you can't access when your account is disabled. So you can't unsubscribe from the emails or delete the account.

You can either add a phone number to stop the spam, or search around to find the page where you can submit a ticket (because there's not a support link on the disabled account page) and hope someone gets to it eventually. They never even replied to my ticket, they just silently unlocked the account after a week or two.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#235

Post by eru »

kergonath wrote: post #229
eru wrote: post #85

Earlier quoted context omitted.

I'm not sure citizenship is required?

Indeed, citizenship is not required. You just need to be a resident. It would be hard to argue that privacy is a human right and then limit the protections to citizens.

In German legal thought and practice, we have the distinction between Buergerrechte (civil rights, perhaps) and Menschenrechte (human rights).

The former is for citizens, the latter for everyone.

In the US, privacy falls in something like the former: there are supposed to be legal safeguards to keep US citizens from being spied on, but eg the NSA wiretapping foreigners is fine and even encouraged.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#236

Post by hanspeter »

hendersoon wrote: post #168
yosito wrote: post #166

Earlier quoted context omitted.

Interesting. I've still got no hits, which surprises me.

Only ~32m of ~190m USA Facebook accounts were in this leak. The US is surprisingly poorly represented-- a good thing!

Given that the overall share of US accounts on Facebook is in the same range (FB has 2.6 billion users in total), I would say the US is represented exactly as expected.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#237

Post by coatmatter »

ehsankia wrote: post #225
hendersoon wrote: post #170

Earlier quoted context omitted.

Only ~32m of ~190m US FB accounts were in this breach, so it's not surprising if you live in that country and are not in the breach.

Looking at the full breakdown [0], a bunch of middle eastern countries have near 100% breach. It seems like they were the target, and all the other countries were just collateral damage maybe? Canada, US, UK, all sitting around 10-20%. [0] https://datastudio.google.com/u/0/reporting/afa08373-621e-4e...

Facebook has released an official statement which appears to confirm my suspicions about how the data was more or less obtained (i.e., via number search): https://about.fb.com/news/2021/04/facts-on-news-reports-abou... (relevant discussion at https://twitter.com/troyhunt/status/1379579465148157953).

But I too noticed the breach rate in the Middle East seemed unusually high, except my initial assumption was that perhaps the way Facebook was introduced there led to different behaviours in how one finds each other on Facebook. Perhaps it could be even something as simple as small differences in translation that lead to different behaviours when it comes to setting up a Facebook account.

The reason this is my initial hunch (rather than any kind of targeted campaign) is because different parts of the world interact differently with different communications platforms. For example, iMessage is very popular in USA whereas other parts of the world favour WhatsApp, or Telegram, or WeChat, etc. Is there any one concrete reason why one population might choose one "less secure" app over another "more secure" chat app/social network? I'd say probably not and yet, we see large variations depending on which border surrounds a user.

So perhaps a similar 'benign' explanation could explain the high breach rate in certain countries. Perhaps phone numbers are treated differently there too? Other than that, I have no idea. Unfortunately, I know very little about the Middle East let alone the languages there, so this is mostly just a guess.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#238

Post by account42 »

pedrocr wrote: post #5

One thing I didn't find on the website was a way to get an email with the actual data that was leaked so I can evaluate what's at stake. Showing it online would be poor privacy but sending it to the email should solve that. Some of the leaks are from companies I don't even know, that work behind the scenes aggregating information. Particularly for those I'd like to see what was leaked. For the services I actually use…

> One thing I didn't find on the website was a way to get an email with the actual data that was leaked so I can evaluate what's at stake. Showing it online would be poor privacy but sending it to the email should solve that.

Not it would not solve that since HIBP would have to store that data (which they currently don't) and thus might be subject to leaks themselves.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#239

Post by coldpie »

reaperducer wrote: post #212
coldpie wrote: post #197

Earlier quoted context omitted.

I'm in my 30s and I can't think of a single time I have ever received a phone call that I didn't expect. I get several spam calls every day. I would make the trade (and recently have, I block all unknown numbers now).

I'm in my 30s and I can't think of a single time I have ever received a phone call that I didn't expect. I've read that people not answering their phones is the number one reason that COVID contact tracing doesn't work. But your comment makes me think that you've never had food delivered. Never used an Uber. Never owned a business. Never bought or sold real estate. Never rented a place to live. Never went to a restau…

You're pretty much right on all of those. I do own a house (don't remember getting any calls, but that was a decade ago) and I do occasionally get food delivered (why would they call?). Otherwise you're right, I've never done any of those things.

Re: The Facebook phone numbers are now searchable in Have I Been Pwned

#240

Post by hypertele-Xii »

kube-system wrote: post #71
hypertele-Xii wrote: post #30

Can I sue Facebook for leaking my number? Serious question.

What damages have you incurred?

This page [1] suggests that "non-material damages (for example distress)" are sufficient to "claim compensation from the website [...] as they have breached the data protection law by not providing adequate security".

I've gotten spam calls since the breach, sometimes in the middle of the night while trying to sleep. That's distress.

[1] https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Post reply on HN