A database of Facebook users’ phone numbers found online • Hacker News Board

Re: A database of Facebook users’ phone numbers found online

#131

Post by mehrdadn » Thu, Sep 05, 2019, 8:50 AM UTC

codedokode wrote: post #130

dataflow wrote: post #37

Earlier quoted context omitted.

Off topic, but I'm amused to see xkcd was hacked. And that its database used MD5 for hashing emails, passwords, and IP addresses!

Hashing an IP address (or phone number) doesn't add much security because such hashes are easy to reverse. Better idea is to delete IP address after some short time. You might keep it for a week on month to prevent mass registration, but after that time you don't need it.

> Hashing an IP address (or phone number) doesn't add much security because such hashes are easy to reverse.

Only if they hashed them separately.

Re: A database of Facebook users’ phone numbers found online

#132

Post by wodenokoto » Thu, Sep 05, 2019, 9:08 AM UTC

bubble_talk wrote: post #127

So let us say I go to some page which lists some "potentially well off" folks, like this one: https://github.com/orgs/google/people or this: https://github.com/orgs/microsoft/people or even this :-) https://github.com/orgs/facebook/people Given GitHub actually even provides a convenient, public, unauthenticated API, it makes it even more easy: https://api.github.com/orgs/facebook/public_members And then I match it wi…

Couldn’t you already match those lists against the phone book?

Re: A database of Facebook users’ phone numbers found online

#133

Post by Yuval_Halevi » Thu, Sep 05, 2019, 9:08 AM UTC

Facebook is proving itself over and over again as a company who don't care at all about their users.

the amount of data scandals they had in the last few years is insane

Re: A database of Facebook users’ phone numbers found online

#134

Post by velox_io » Thu, Sep 05, 2019, 9:11 AM UTC

nullymcnull wrote: post #122

viraptor wrote: post #120

Earlier quoted context omitted.

What do you mean never? It has a name and is pretty common in Bitcoin exchange fraud: https://en.wikipedia.org/wiki/SIM_swap_scam

The specific UK mechanism that is the subject of this subthread was introduced in July; it's not what your wikipedia link describes (social engineering to get a number ported).

I'm also in the UK, I've had the same phone number for at least a decade. It has been easy to carry your phone number to a new provider for as long as I can remember.

You just contact your existing provider, tell them you wish to leave and need the PAC code. After they beg to stay and throw you a sweetheart deal. They'll send it via text or post.

Re: A database of Facebook users’ phone numbers found online

#135

Post by ForFreedom » Thu, Sep 05, 2019, 9:23 AM UTC

So how does one check if their data is compromised?

Re: A database of Facebook users’ phone numbers found online

#136

Post by [deleted] » Thu, Sep 05, 2019, 9:29 AM UTC

mehrdadn wrote: post #131

codedokode wrote: post #130

Earlier quoted context omitted.

Hashing an IP address (or phone number) doesn't add much security because such hashes are easy to reverse. Better idea is to delete IP address after some short time. You might keep it for a week on month to prevent mass registration, but after that time you don't need it.

> Hashing an IP address (or phone number) doesn't add much security because such hashes are easy to reverse. Only if they hashed them separately.

[deleted]

Re: A database of Facebook users’ phone numbers found online

#137

Post by viach » Thu, Sep 05, 2019, 10:14 AM UTC

Imagine what's going to be found online after Libra is implemented - accounts, phone numbers and the history of purchases including supplier's name and type - a dream database for target advertising.

Re: A database of Facebook users’ phone numbers found online

#138

Post by captain_qwark » Thu, Sep 05, 2019, 10:33 AM UTC

Is it that difficult to encrypt phone numbers before storing to a database? Or do they just use ridiculously easy to break encryption algorithms? Or does Facebook just not care?

Re: A database of Facebook users’ phone numbers found online

#139

Post by rpastuszak » Thu, Sep 05, 2019, 10:33 AM UTC

_puk wrote: post #114

52-6F-62 wrote: post #56

Earlier quoted context omitted.

Yep. As far as I’m accustomed most people do whatever they can to maintain their phone numbers even across services. So much so that it’s law in Canada a provider can’t lock in your number and must let you take it with you to another provider.

In the UK it's as easy as sending a text [0] to get your number ported to a new carrier. Carriers must oblige. 0: https://www.ofcom.org.uk/about-ofcom/latest/media/media-rele...

I love how they used to pretend that their response to regulatory pressures was in fact a new product/feature offered by them. For instance, allowing me to keep my phone # was phrased in a way that would make me think that EE/O2/... let me do that for free, yay. Same applies to the EU regulations dealing with lowering roaming charges—the carrier I used at that time even developed branding for it. It’s a bit damaging given how little UK citizens know about EU.

Re: A database of Facebook users’ phone numbers found online

#140

Post by amaccuish » Thu, Sep 05, 2019, 10:43 AM UTC

_puk wrote: post #114

52-6F-62 wrote: post #56

Earlier quoted context omitted.

Yep. As far as I’m accustomed most people do whatever they can to maintain their phone numbers even across services. So much so that it’s law in Canada a provider can’t lock in your number and must let you take it with you to another provider.

In the UK it's as easy as sending a text [0] to get your number ported to a new carrier. Carriers must oblige. 0: https://www.ofcom.org.uk/about-ofcom/latest/media/media-rele...

It's actually a terrible system though. It relies on the original issuer of the number maintaining essentially a "proxy" to your new provider. So if I transferred from o2 -> EE, and o2 had network issues, it's possible (and has happened to me personally) that I am affected even though I have left o2. I think also calls are actually physically routed through the original network. Lots of weird things can happen like texts from certain networks never arriving.

I had to get a new number when I discovered my NZ family could receive my texts but their replies never arrived at my end.

For more info, see https://www.theregister.co.uk/2017/07/20/uk_number_porting_c...