Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A database of Facebook users’ phone numbers found online

techcrunch.com

Post reply on HN
Print view View original

161–170 of 177 posts

Re: A database of Facebook users’ phone numbers found online

#161

Post by paulddraper »

bpchaps wrote: post #59
cm2012 wrote: post #44

Wow, a phone book. Do HN readers know you can buy lists of millions of people's names and phone numbers from companies whose sole purpose is collecting them, like infogroup?

Yes, you can get tons of personally identifiable information from things like public records laws and such. That's irrelevant, though. This is a phone number tied to a facebook account, not just their name. A major difference here is the ability - at scale - to associate people with their facebook accounts. There are people who do not want to be associated with by their facebook account, and reasonably so. Not sure w…

> There are people who do not want to be associated with by their facebook account

I figured that ever since Facebook instituted the "real name" policy, this isn't necessarily possible.

Re: A database of Facebook users’ phone numbers found online

#162

Post by bifrost »

userbinator wrote: post #86
bifrost wrote: post #18

Earlier quoted context omitted.

Google only really does http/https, finding mongodb requires scanning for 27019 and then pointing a client at it. I believe Shodan does this.

It also indexes ftp, but that may unfortunately be coming to an end[1]. Ironically enough, Google's mission statement is still "to organize the world's information and make it universally accessible and useful", which if taken to its logical conclusion would mean such humorously delightful things as scanning for mongos and indexing their contents too... [1] https://news.ycombinator.com/item?id=20721609

Its almost like people need a tool to tell them not to leave stuff open like that...

Between MongoDB, Jenkins and Elasticsearch, thats a whole ecosystem of pwnability that is probably just starting to be exploited.

Re: A database of Facebook users’ phone numbers found online

#163

Post by tzs »

raisedbyninjas wrote: post #145
ben174 wrote: post #32

Earlier quoted context omitted.

Is this true? Got a link for reference?

Sorry, no link. Just personal experience when we lost the account info for an employees phone.

Did you have a PIN/Passcode on the account [1]? That a 6-15 digit number you can set on an account that you have to supply when you call support, or have to give to your new carrier for them to get your phone number ported off of T-Mobile.

[1] https://support.t-mobile.com/docs/DOC-37477

Re: A database of Facebook users’ phone numbers found online

#164

Post by mulmen »

onion2k wrote: post #117
jonny_eh wrote: post #115

Earlier quoted context omitted.

Does that make it easy to steal phone numbers, and therefore identities?

Based on the fact that never seems to happen, no.

Didn't it happen to Jack Dorsey last week?

https://www.forbes.com/sites/jeanbaptiste/2019/08/31/why-twi...

Re: A database of Facebook users’ phone numbers found online

#165

Post by amaccuish »

ZeWaren wrote: post #144
amaccuish wrote: post #140

Earlier quoted context omitted.

It's actually a terrible system though. It relies on the original issuer of the number maintaining essentially a "proxy" to your new provider. So if I transferred from o2 -> EE, and o2 had network issues, it's possible (and has happened to me personally) that I am affected even though I have left o2. I think also calls are actually physically routed through the original network. Lots of weird things can happen like t…

I've been switching back and forth between two providers for the last 5 years, and I've always wondered now that I'm back to my first provider if calls/texts to me go directly to A, or go A->B->A->B->A.

Should just go straight to A. The way the numbers work is that the prefixes are assigned to various operators. When you transfer, the "owning" operator forwards calls on to the target operator. If you returned presumably the forwarding is removed.

(From [0]): "One of the very few countries not to use ACQ/CDB is the UK, where once a number has been ported, calls to that number are still routed via the donor network. This is also known as "indirect routing" and is highly inefficient as it is wasteful of transmission and switching capacity."

And

"Because of its donor dependent nature, indirect routing also means that if the donor network develops a fault or goes out of business, the customers who have ported numbers out of that network will lose incoming calls to their numbers."

[0] https://en.wikipedia.org/wiki/Mobile_number_portability

Re: A database of Facebook users’ phone numbers found online

#166

Post by bpchaps »

paulddraper wrote: post #161
bpchaps wrote: post #59

Earlier quoted context omitted.

Yes, you can get tons of personally identifiable information from things like public records laws and such. That's irrelevant, though. This is a phone number tied to a facebook account, not just their name. A major difference here is the ability - at scale - to associate people with their facebook accounts. There are people who do not want to be associated with by their facebook account, and reasonably so. Not sure w…

> There are people who do not want to be associated with by their facebook account I figured that ever since Facebook instituted the "real name" policy, this isn't necessarily possible.

Troll post? This would either imply that Facebook has 100% valid identity checks or that 100% of people are honest about their identity.

Re: A database of Facebook users’ phone numbers found online

#167

Post by paulddraper »

bpchaps wrote: post #166
paulddraper wrote: post #161

Earlier quoted context omitted.

> There are people who do not want to be associated with by their facebook account I figured that ever since Facebook instituted the "real name" policy, this isn't necessarily possible.

Troll post? This would either imply that Facebook has 100% valid identity checks or that 100% of people are honest about their identity.

Or 100% of people are reported?

IDK how it works; I just know Facebook requires my real name.

Re: A database of Facebook users’ phone numbers found online

#168

Post by bpchaps »

paulddraper wrote: post #167
bpchaps wrote: post #166

Earlier quoted context omitted.

Troll post? This would either imply that Facebook has 100% valid identity checks or that 100% of people are honest about their identity.

Or 100% of people are reported? IDK how it works; I just know Facebook requires my real name.

You're suggesting that Facebook is 100% accurate in determining whether a name is real, or a pseudonym.

Imagine this: someone is on Facebook and wants to hide their identity for some reason. Best examples I can think of right now is teachers who don't want their profiles accessible to their students (because high schoolers can be little shits). Or someone trying to create a new life after domestic abuse. It makes full sense that they wouldn't want to give their full name so that they can't be found. Facebook isn't good enough in real name detection to get it right 100%. How could they?

With this sort of dump, a domestic abuser can much, much more easily find the person they abused, when that person was previously under a pseudonym.

This is just a small example. It gets much more complicated when considering how many millions of phone number:Facebook IDs were released.

Re: A database of Facebook users’ phone numbers found online

#169

Post by davinic »

lovecg wrote: post #155
bubble_talk wrote: post #127

So let us say I go to some page which lists some "potentially well off" folks, like this one: https://github.com/orgs/google/people or this: https://github.com/orgs/microsoft/people or even this :-) https://github.com/orgs/facebook/people Given GitHub actually even provides a convenient, public, unauthenticated API, it makes it even more easy: https://api.github.com/orgs/facebook/public_members And then I match it wi…

Yeah but who answers calls from unknown numbers anymore? It’s pretty much 99% spam already.

But if you can see any of their Facebook friends, just look up one of their cell number and spoof it when you make the call.

Re: A database of Facebook users’ phone numbers found online

#170

Post by davinic »

inetknght wrote: post #33
raisedbyninjas wrote: post #30

Heads up: T-mobile will allow you to take over an account if you can guess one of the most recent phone numbers that the target account has called.

That sounds very secure indeed. Nobody would ever guess that I'd recently called my folks! /s

And conveniently Facebook often lists your relatives' accounts right on your profile.
Post reply on HN