Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook privacy fuckup reveals who has your number in their phone

alexmuir.com

Post reply on HN
Print view View original

31–40 of 124 posts

Re: Facebook privacy fuckup reveals who has your number in their phone

#31

Post by zmitri »

rickdale wrote: post #22

I deleted my facebook account in March 2010. In November, six months later, the only evidence of my account was that my facebook information was loaded onto my friends telephone. He had my profile photo, plus some random tidbits of information automatically grabbed from facebook by his phone.

I deleted my facebook account ~6 years ago, but before I completely deleted it I changed my name to "DLC Text".

About a year ago I started getting emails from facebook recruiters, and guess what my name was resolving to in their system? Yep, that's right -- "DLC Text".

For 6 years they have kept my information even though it was deleted.

Re: Facebook privacy fuckup reveals who has your number in their phone

#32

Post by LetBinding »

AlexMuir wrote: post #23
FaceKicker wrote: post #21

Earlier quoted context omitted.

On the account I just created, that URL just redirects to the home page (where it wants me to import contacts from email, etc.).

Not sure what to suggest - I just hope someone else is able to replicate it or I'll look like an arse. I was on a UK IP, without erasing cookies between logging out of my old FB and creating a new one.

This is interesting.

I signed up with a new email address. Put in my phone number. I _do not_ have this phone number on my primary account. Now on my dummy account, I get a long list of friend suggestions, most of them from my primary account, and some unknown.

My dummy account and primary account are not linked in any way. All cookies cleared. So how did my dummy account suggest so many friends from my primary account? It didn't before I entered my phone number in my dummy account. Some of the friend suggestions live in other countries, and I doubt they would have my US phone number.

Re: Facebook privacy fuckup reveals who has your number in their phone

#33

Post by stevensanderson »

AlexMuir wrote: post #29
lysol wrote: post #26

I was able to duplicate, but took a little bit different process. Sign up, add your mobile, confirm it, then log out and back in. The result was definitely people who had done what the author said but it was also interspersed with friends of friends, muddying the waters a bit.

I'm glad you've managed to recreate. As mine was a new, friendless account my list was purely people with me in their phonebook.

I also reproduced something like this.

On "Step 1: Add Friends", it showed people who I actually know (presumably who have my phone number, since that's the only info I gave that actually relates to me)

On "Step 3: Profile Information", it offered many more people, most of whom I don't actually know (presumably friends of the people from step 1)

Note that to trigger the mobile-number-confirmation request, you may need to enter dubious-looking profile information. In my case, I entered a name like "Blaah Blahh", with a throwaway email address from www.mailinator.com. If your fake name is too realistic, it won't necessarily trigger the security check.

I do have the same mobile number on my primary account, so it's possible they found me that way. But either way, it's notable that in step 1 they managed to show just the people who I would expect actually do keep track of my phone number.

Re: Facebook privacy fuckup reveals who has your number in their phone

#34

Post by AlexMuir »

stevensanderson wrote: post #33
AlexMuir wrote: post #29

Earlier quoted context omitted.

I'm glad you've managed to recreate. As mine was a new, friendless account my list was purely people with me in their phonebook.

I also reproduced something like this. On "Step 1: Add Friends", it showed people who I actually know (presumably who have my phone number, since that's the only info I gave that actually relates to me) On "Step 3: Profile Information", it offered many more people, most of whom I don't actually know (presumably friends of the people from step 1) Note that to trigger the mobile-number-confirmation request, you may nee…

Jackpot - the name is the trigger, possibly combined with an own-domain email address.

Re: Facebook privacy fuckup reveals who has your number in their phone

#36

Post by gregschlom »

kunalb wrote: post #25

I'm not particularly sure about this, but why would revealing the people who have stored YOUR phone number to YOU be such a big deal? I'm assuming phone number verification checks that you own the number via SMS; so it just acts as a reverse-stalker (I'd be worried about people I _don't_ know having my phone number saved).

Because, as the article says, it can reveal Facebook accounts that you didn't knew your friends had, such has this friend of the OP who has a "straight" and a "gay" FB account.

Re: Facebook privacy fuckup reveals who has your number in their phone

#37

Post by [deleted] »

AlexMuir wrote: post #34
stevensanderson wrote: post #33

Earlier quoted context omitted.

I also reproduced something like this. On "Step 1: Add Friends", it showed people who I actually know (presumably who have my phone number, since that's the only info I gave that actually relates to me) On "Step 3: Profile Information", it offered many more people, most of whom I don't actually know (presumably friends of the people from step 1) Note that to trigger the mobile-number-confirmation request, you may nee…

Jackpot - the name is the trigger, possibly combined with an own-domain email address.

[deleted]

Re: Facebook privacy fuckup reveals who has your number in their phone

#39

Post by [deleted] »

stevensanderson wrote: post #33
AlexMuir wrote: post #29

Earlier quoted context omitted.

I'm glad you've managed to recreate. As mine was a new, friendless account my list was purely people with me in their phonebook.

I also reproduced something like this. On "Step 1: Add Friends", it showed people who I actually know (presumably who have my phone number, since that's the only info I gave that actually relates to me) On "Step 3: Profile Information", it offered many more people, most of whom I don't actually know (presumably friends of the people from step 1) Note that to trigger the mobile-number-confirmation request, you may nee…

[deleted]
Post reply on HN