Tell HN: Meta is using my 2FA to call and sell me

> I have a feeling that Meta has some kind of internal system for slurping up everyone's contact info

Yes. It's called Facebook Messenger. All your friends have it installed on their phone and it has access to all the data in their phone's contact list, including anyone who might have saved it in the email field of their contact entry for you.

Right? Isn't this the oldest criticism of Facebook Messenger?

Facebook is the absolute worst with this, Google second.

We spend >$10m on ads annually on FB, yet haven't had a dedicated account rep since 2019.

Instead, they farm out "account marketing specialists" who pitch you on giving up more control to FB algo and generally have significantly less insight and experience with FB ads than the people they are calling.

One week last summer, I received 8 calls in a single day from different FB marking reps. I think they had some kind of call queue system based on the number of ad accounts, instead of on "Business manager" accounts, but it took a lot of firmly saying "Remove me from this list" and accusing them of phishing to get it to stop.

I just assumed I gave my cell to FB at some point, never thought of 2FA.

That is not a statement of fact but a disclaimer of liability. I don't know how this plays out in other jurisdictions but it's hit epidemic levels here.

Some people get away with it though, like people with doctorates calling themselves Doctor on TV and giving out personal, relationship and medical advice while somehow managing not to be sued back to the Stone Age.

Edit: Am I wrong? Tell me why.

I don't know when and I don't know how, but at some point we're going to have to start attaching provenance to data instead of building stringly typed systems where we copy data around as snippets of text orphaned from all possible context.

I suspect the biggest problem with that is not languages and frameworks, which are definitely going to be a problem, but databases. There is no way to map any of this into columns in any database I know about, and I don't know whether databases or operating systems evolve more slowly but they're both bottom quartile for sure. If you build provenance into or onto a prominent databases, we could have multiple frameworks and toolchains within a couple of years.

If you squint a little, Rails has a 1-bit provenance facility, in the form of "have I escaped this string for display in HTML yet?" That is one of a number of aspects that make up "where did you get this?". Rails also has a bespoke system that won't log anything stored in a field called 'password', but it would be better if we could tag tokens, passwords, and private communications as privileged information, and carry that around even if someone does something questionably like interpolates a password into an error message, and then someone else prints that error where it can be seen.

Things get a little tricky with interpolation, because now I need some sort of cardinality to say that the union of data of Type X and Type Y results in data of Type Y, or better Type X,Y which we treat more conservatively because of strict rules on Type Y data.

When I was in college I was briefly recruited by a company that made a Unix Window Manager for the Defense and Intelligence communities. The elevator pitch had a sort of simpler version of this idea. You had a different desktop for each security level, and the clipboard only worked from low security to high security windows. You could paste information from a window showing generally available information into a classified document, but you could not paste from a classified window back into an unclassified document. Yes that meant you couldn't paste a quote from a Presidential Speech out of a classified document, but you also couldn't accidentally select the next three lines of text and past those someplace bad.

Or WhatsApp for that matter, which has access to a lot more people's contacts, even those who might otherwise deny contacts permission to Facebook Messenger.