201–210 of 230 posts
Earlier quoted context omitted.
If you read the bottom of the post, the complete phone number database has not loaded into HIBP yet. The results will likely change once it's done.
To be clear: I was listed on HIBP but not on this tool
Maybe I can finally get my last couple of friends to switch to Signal.
I deleted my (outdated) phone number from facebook years ago and it's still part of the leak, with my name and gender in it. I did not replace the phone number with another phone number. Really says something about what delete means for fb.
Edit: I just checked, seems like the form on the frontpage of HIBP also submits your complete email/phone number. Pretty sure I read about how you don't have to submit your personal data to validate against HIBP, not to long ago...
[0]: https://github.com/Fumaz/haveibeenfacebooked-api/blob/master...
I deleted my (outdated) phone number from facebook years ago and it's still part of the leak, with my name and gender in it. I did not replace the phone number with another phone number. Really says something about what delete means for fb.
> Really says something about what delete means for fb. Since the storage of data is so cheap, any company will archive data, for future profit. Why did you believe any data will be deleted in the first place? Were you counting that government will take action if it finds out? Are there any case like this in the past. I find it surprising even programmers believe their data will be deleted by the company. Most people…
Earlier quoted context omitted.
That only holds for numbers already part of the dump. If you submit an unknown phone number that is not contained in the leak, hashing it before sending it will increase data privacy.
So a rainbow table of just 2.9 billion numbers covers the USA phone set. So I think searching for a specific number clear or hashed are roughly similar exposures. Maybe the right way to search without disclosure is really to filter. Meaning instead of putting in your full 10 digits. You just put in 7/8 and it returns a list of the rest for you to see. Then you visually scan to find your number out of the returned 999…
From what I can see, this site sends your whole number to the backend to search for a number in the dump[0], while haveibeenpwned.com will hash the input, send only a prefix to the server and receive a list of hashes with the same prefix. If your hash is in the list, you've been pwned, but you can check without leaking your data to HIBP. Edit: I just checked, seems like the form on the frontpage of HIBP also submits…
From what I can see, this site sends your whole number to the backend to search for a number in the dump[0], while haveibeenpwned.com will hash the input, send only a prefix to the server and receive a list of hashes with the same prefix. If your hash is in the list, you've been pwned, but you can check without leaking your data to HIBP. Edit: I just checked, seems like the form on the frontpage of HIBP also submits…
haveibeenpwned.com does not use the k-anonymity method that you've described when searching for phone numbers: https://www.troyhunt.com/the-facebook-phone-numbers-are-now-...
Still, if I had to chose between hibf.com and hibp.com, I'd lean to hibp.com since Troy is a known name in the industry and has offered this service for a long time without any complaints.
Aren't telephone directories a thing anymore? At least in my country you can just search for a person online and see their phone number. Someone's phone number seems like the least sensitive PII.
Earlier quoted context omitted.
> Really says something about what delete means for fb. Since the storage of data is so cheap, any company will archive data, for future profit. Why did you believe any data will be deleted in the first place? Were you counting that government will take action if it finds out? Are there any case like this in the past. I find it surprising even programmers believe their data will be deleted by the company. Most people…
In EU there's GDPR and right to be forgotten. If I forbid company to store my data they're obligated by law to remove it from their servers.