Live data from Hacker News

Have I Been Facebooked?

haveibeenfacebooked.com

171–180 of 230 posts

Re: Have I Been Facebooked?

#171

Not sure what’s going on but it says my number is not part of the leak, but I’ve checked myself and it is actually leaked. Just be aware that it may not be complete.

Same, for a contact's number (I'm checking on their behalf). It shows up in the raw dump [1] but not this site. [1] https://archive.is/MZqak

Interesting that Australia seems to be completely missing

Re: Have I Been Facebooked?

#172
post #124

I deleted my (outdated) phone number from facebook years ago and it's still part of the leak, with my name and gender in it. I did not replace the phone number with another phone number. Really says something about what delete means for fb.

How many years ago did you delete your phone number? This is not a recent dump of data, it is just recently been made more widely available. I believe the original leak was some time in 2019.

I moved out of the country mid 2018, and that was around the time I removed the number from every service I had it with. I tried to migrate to 2FA and authy since my phone number was likely going to change frequently. I also tried to switch over to twilio for services that required a number, but a lot of short codes reject it, which really sucks for someone who needs to change phone numbers a lot because of travels.

Re: Have I Been Facebooked?

#173
post #160

Earlier quoted context omitted.

I understand the frustration but they have the data and hence, a rainbow table, sending a pre-hashed phone number is the same as sending an unhashed one, unless the worry is man in the middle, who is just as likely to get the data. The only way to check without giving up personal info is to get the data and look locally, or perhaps search for so many phone numbers that yours is buried in the haystack.

That only holds for numbers already part of the dump. If you submit an unknown phone number that is not contained in the leak, hashing it before sending it will increase data privacy.

So a rainbow table of just 2.9 billion numbers covers the USA phone set. So I think searching for a specific number clear or hashed are roughly similar exposures. Maybe the right way to search without disclosure is really to filter. Meaning instead of putting in your full 10 digits. You just put in 7/8 and it returns a list of the rest for you to see. Then you visually scan to find your number out of the returned 9999 results.

(Assuming seeing hacked numbers are public already - but I don’t love this either)

What’s a secure way of searching without disclosure by either party? (Non troll question)

Re: Have I Been Facebooked?

#174

Not sure what’s going on but it says my number is not part of the leak, but I’ve checked myself and it is actually leaked. Just be aware that it may not be complete.

This could be an incomplete parsing then from the dataset, numbers dont generally follow a standard ruleset or two that makes it harder to parse them out. As well as if this is a collection of breaches, the structure might not be the same across them all.

Re: Have I Been Facebooked?

#175

Not sure what’s going on but it says my number is not part of the leak, but I’ve checked myself and it is actually leaked. Just be aware that it may not be complete.

maybe this website isn't even legit and just about harvesting phone numbers. I mean - who knows?

I checked someone who was part of the leak and the correct initials came up so unless that is by chance, it does seem to be querying the database. You can also read the source code [1] where it does an api call to get the data.

We can be pretty sure the results are legit but yes of course it could be running malicious code and stealing phone numbers. Check the raw data if you are worried[2].

[1] https://github.com/Fumaz/haveibeenfacebooked-api [2] https://archive.is/MZqak

Re: Have I Been Facebooked?

#176
post #160

Earlier quoted context omitted.

That only holds for numbers already part of the dump. If you submit an unknown phone number that is not contained in the leak, hashing it before sending it will increase data privacy.

So a rainbow table of just 2.9 billion numbers covers the USA phone set. So I think searching for a specific number clear or hashed are roughly similar exposures. Maybe the right way to search without disclosure is really to filter. Meaning instead of putting in your full 10 digits. You just put in 7/8 and it returns a list of the rest for you to see. Then you visually scan to find your number out of the returned 999…

> What’s a secure way of searching without disclosure by either party?

Download the original data set. US records are around a GB file.

Re: Have I Been Facebooked?

#177
post #124

I deleted my (outdated) phone number from facebook years ago and it's still part of the leak, with my name and gender in it. I did not replace the phone number with another phone number. Really says something about what delete means for fb.

The same here :/

Re: Have I Been Facebooked?

#178
post #5

Facebook should email those affected... surely they know who was compromised or not. Shouldn't have to use random sites for this. Why has there been no communication from them?

The leak doesn’t provide much. The backlash of sending an email will instantly be way worse than what was actually leaked. Far worse leaks happen routinely from big names. However Facebook’s negative reputation would sway so far against it, you’d think Facebook had doxxed every one. I don’t particularly like Facebook or any big corporation FYI.

I'm pretty sure the GDPR requires notifying affected users in addition to notifying data protection agencies. I haven't seen any public statement about the breach from Facebook, yet alone received any messages from them.

Interestingly my phone number seems to have been exposed but not my e-mail address. I don't recall providing my phone number to Facebook although I do recall explicitly being asked to. I do however use WhatsApp. I wonder if there's more to this.

Re: Have I Been Facebooked?

#179

Earlier quoted context omitted.

Same, for a contact's number (I'm checking on their behalf). It shows up in the raw dump [1] but not this site. [1] https://archive.is/MZqak

Interesting that Australia seems to be completely missing

Yeah, it's almost like it got merged with Austria, given it says "Austriaia"

Re: Have I Been Facebooked?

#180
post #53

Earlier quoted context omitted.

Zuck: Yeah so if you ever need info about anyone at Harvard Zuck: Just ask. Zuck: I have over 4,000 emails, pictures, addresses, SNS [Redacted Friend's Name]: What? How'd you manage that one? Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb f**s.

Culture comes straight from the top. You can certainly tell that with Facebook and Zuckerberg. A good solution to this would be to put a hiring freeze on any ex-Facebooker and claim that if they can overlook Facebook's questionable practices, then they would be a danger for your company and its customers. Hold employees responsible for the actions of their employer. You could institute a "two year freeze" for any FB…

"public statement by an ex-employee rebuking these practices"

This idea sounds uncannily familiar for anyone from the former Soviet bloc.

Post reply on HN