Facebook does not plan to notify half-billion users affected by data leak • Hacker News Board

Re: Facebook does not plan to notify half-billion users affected by data leak

#141

Post by haswell » Thu, Apr 08, 2021, 1:55 PM UTC

SketchySeaBeast wrote: post #120

rocqua wrote: post #102

Earlier quoted context omitted.

My university is known to offer the option payment of tuition through a popular online system. This option is done by sending each student, at the start of the year, an SMS with a link to a payment option. Suppose you can get a list of people studying there, their names, and their phone-numbers. Faking this SMS and putting a payment that goes to you instead of uni would be a nice way to earn about 2000 euros per stud…

> My university is known to offer the option payment of tuition through a popular online system. This option is done by sending each student, at the start of the year, an SMS with a link to a payment option. They don't email this information? They don't put it on an online notification system? I have no idea why SMS seems like the logical option for this.

Kids are more likely to text, less likely to email these days. I can understand why they’d use SMS for their target demographic.

That doesn’t justify the security implications of doing this...

Re: Facebook does not plan to notify half-billion users affected by data leak

#142

Post by londons_explore » Thu, Apr 08, 2021, 2:04 PM UTC

ManlyBread wrote: post #134

londons_explore wrote: post #111

Earlier quoted context omitted.

Facebook can't use the breach itself to contact users, no. The data could have been tampered with, and besides, Facebook doesn't have permission to process the leaked data in that way.

A company that employs dozes of data scientists and has petabytes of data is now supposedly unable to compare and match two datasets? Come on, this is beyond ridiculous.

Clearly they technically can. It's that the GDPR doesn't allow it.

Think about it... If you asked a company to delete your data, are you giving them permission to go refind that data on the dark web, cross reference it with records they should have deleted, and use it to send you email? Clearly not.

Re: Facebook does not plan to notify half-billion users affected by data leak

#143

Post by SketchySeaBeast » Thu, Apr 08, 2021, 2:04 PM UTC

haswell wrote: post #141

SketchySeaBeast wrote: post #120

Earlier quoted context omitted.

> My university is known to offer the option payment of tuition through a popular online system. This option is done by sending each student, at the start of the year, an SMS with a link to a payment option. They don't email this information? They don't put it on an online notification system? I have no idea why SMS seems like the logical option for this.

Kids are more likely to text, less likely to email these days. I can understand why they’d use SMS for their target demographic. That doesn’t justify the security implications of doing this...

Do kids still text or is that a generation or two removed from the current iMessages/WhatsApp/Signal/WhateverComesAfterSignalBecauseImOldAndDontKnow?

Re: Facebook does not plan to notify half-billion users affected by data leak

#144

Post by londons_explore » Thu, Apr 08, 2021, 2:05 PM UTC

willcipriano wrote: post #117

londons_explore wrote: post #111

Earlier quoted context omitted.

Facebook can't use the breach itself to contact users, no. The data could have been tampered with, and besides, Facebook doesn't have permission to process the leaked data in that way.

If they find a match against the leaked data, that would validate it and prove it had not been tampered with and at least allow them to contact a subset of users. Why can't they do that at least?

They can do that. They probably won't because they'll argue it's all part of peoples public profiles and therefore published information rather than private information.

Re: Facebook does not plan to notify half-billion users affected by data leak

#145

Post by heletoto » Thu, Apr 08, 2021, 2:09 PM UTC

Why should they notify us? They are stealing our data right under our noses. I hope that non-tech people would be aware of what's happening right now as they might have something to say about this.

Re: Facebook does not plan to notify half-billion users affected by data leak

#146

Post by pilsetnieks » Thu, Apr 08, 2021, 2:10 PM UTC

jaywalk wrote: post #122

qwertox wrote: post #66

Earlier quoted context omitted.

Because I would really like to know if I'm affected. According to "Have I Been Pwned" my phone number is not in the list, but about one or two weeks ago I noticed that my spam folder was unusually full, which led me to believe that something new must have happened. Shortly thereafter Facebook's leak hit the news. From my point of view it is their obligation to notify all the affected users. It's morally the right thi…

The leak did not include email addresses, so your email spam issue is unrelated.

Newer Android versions have an SMS spam folder as well, they might have been talking about that.

Re: Facebook does not plan to notify half-billion users affected by data leak

#147

Post by pilsetnieks » Thu, Apr 08, 2021, 2:12 PM UTC

haswell wrote: post #139

pilsetnieks wrote: post #127

Earlier quoted context omitted.

Because they might have deleted some of the accounts they no longer have an obligation to notify the rest that they haven't deleted?

While this may be true, this doesn’t have to be an all-or-nothing thing.

It isn't true, that was the point of my question. They could (and must) notify the ones they still have data about.

Re: Facebook does not plan to notify half-billion users affected by data leak

#148

Post by long_warmup » Thu, Apr 08, 2021, 2:14 PM UTC

Years ago facebook kicked me out from their platform. After reading this article I feel I was right to keep it that way.

Re: Facebook does not plan to notify half-billion users affected by data leak

#149

Post by Bluestein » Thu, Apr 08, 2021, 2:15 PM UTC

tacone wrote: post #87

For years companies have been steadily asking, mandating or even trickling users to give them their phone numbers under the excuse of security (while the real reasons were different), now what? How can they be trusted anymore? This also strikes a great point about the data sharing between Facebook and WhatsApp. Linking data between services augments the dangers and the consequences are not obvious to the end user. I…

Further, I think sovereigns should mandate a class-action monetary compensation from F'book to each and every user affected, as a pre-req for further continued operation in each national jurisdiction.-

This, of course, due fines aside ...

Edit: See my further comment upthread on this, or other solutions.

Re: Facebook does not plan to notify half-billion users affected by data leak

#150

Post by Vinnl » Thu, Apr 08, 2021, 2:16 PM UTC

twobitshifter wrote: post #104

cblconfederate wrote: post #56

The "real names" myth was the biggest scam played against people in the past 15 years. The media are also wholesale responsible for perpetuating that damaging trend. Historians of the future will look at the past 2 decades with disbelief.

Yeah, it’s fine to have some public facing content online, but the first thing a child used to learn before going online was to never use your real name and to never give out any personal information like your address and telephone number. At least that’s how it was where I grew up. I remember when Facebook launched I had a visceral reaction after seeing all the content being shared out in the open. My dad didn’t eve…

I started using my real name online when I realised it was better than things that I control come up when you search for my name, rather than whatever someone else posted online with my name next to it.