533M Facebook users' phone numbers and personal data have been leaked online • Hacker News Board

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#51

Post by noxer » Sat, Apr 03, 2021, 4:45 PM UTC

londons_explore wrote: post #28

Looks like this is the "To match users to their friends by phone number, you need an API which can take as input a phone number, and return information about if that number has an associated account" problem. There is no way to let a user find their friends on a service without such an API. Yet if you have such an API, someone can simply brute force all phone numbers worldwide (there are only 10^10), and now they hav…

Telegram had this issue too and they made a setting "who can find me by my number" you set it to "my contacts" so only mutual contacts can find each other.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#52

Post by Nextgrid » Sat, Apr 03, 2021, 4:45 PM UTC

yokaze wrote: post #35

Nextgrid wrote: post #6

Earlier quoted context omitted.

Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely. (before you post a link to enforcementtracker.com please first compare the fine amounts with Facebook's revenue)

> Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely. Not having the data encrypted at rest seems to me a different infraction than the previous ones. The scale also matters, and that it isn't the first infraction. And as I read it, not encrypting at rest is a breach of Article 6 and fined under Article 83 (5) ( https://www.privacy-regulation.eu/en/article…

Facebook's tracking consent flow has been in breach since the regulation went into effect in 2018, and has affected millions of people, both users and non-users. Keep in mind that had Facebook been compliant with the GDPR, the recent Apple changes regarding tracking consent on iOS wouldn't have been an issue for them at all.

I'd argue this is a much bigger issue than the lack of at-rest data encryption, and yet nothing has been done.

They also appear to be ignoring Subject Access Requests with total impunity: https://ruben.verborgh.org/facebook/

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#53

Post by KaiserPro » Sat, Apr 03, 2021, 4:45 PM UTC

yokaze wrote: post #35

Nextgrid wrote: post #6

Earlier quoted context omitted.

Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely. (before you post a link to enforcementtracker.com please first compare the fine amounts with Facebook's revenue)

> Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely. Not having the data encrypted at rest seems to me a different infraction than the previous ones. The scale also matters, and that it isn't the first infraction. And as I read it, not encrypting at rest is a breach of Article 6 and fined under Article 83 (5) ( https://www.privacy-regulation.eu/en/article…

> the existence of appropriate safeguards, which may include encryption or pseudonymisation.

which is not the same as data much be encrypted at rest.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#54

Post by retox » Sat, Apr 03, 2021, 4:46 PM UTC

impostervt wrote: post #40

https://haveibeenpwned.com/ I've been pwned 33 times. At this point, it's just noise. My passwords are all unique (password manager). Honest question - What should I worry about?

You should work about being a smug cunt.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#55

Post by solarkraft » Sat, Apr 03, 2021, 4:46 PM UTC

tpush wrote: post #45

I_am_tiberius wrote: post #16

Would like to know if non Facebook users are included because Facebook has non Facebook user's phone numbers due to the fact that Whatsapp uploads the entire phonebook to Whatsapp. That means Facebook is likely to know your phone number although you don't use Facebook or Whatsapp.

Whatsapp doesn't share phone book data with Facebook.

Yet.

And since it's a Facebook controlled company a leak like this happening again isn't that improbable.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#56

Post by darig » Sat, Apr 03, 2021, 4:46 PM UTC

tpush wrote: post #45

I_am_tiberius wrote: post #16

Would like to know if non Facebook users are included because Facebook has non Facebook user's phone numbers due to the fact that Whatsapp uploads the entire phonebook to Whatsapp. That means Facebook is likely to know your phone number although you don't use Facebook or Whatsapp.

Whatsapp doesn't share phone book data with Facebook.

Facebook doesn't share phone book data with hackers either.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#57

Post by noxer » Sat, Apr 03, 2021, 4:48 PM UTC

spicybright wrote: post #13

baybal2 wrote: post #2

This does not look like scraping. A prima fascie database leak, and an invalidation of Facebook's claims of them not using your phone number past the validation, as well as them claiming using encryption at rest.

The phone number point may still be true though, they have to store the phone number somewhere.

They could store a salted hash instead for almost everything except using the number as actual phone number (call/SMS)

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#58

Post by macintux » Sat, Apr 03, 2021, 4:49 PM UTC

hourislate wrote: post #30

I_am_tiberius wrote: post #16

Would like to know if non Facebook users are included because Facebook has non Facebook user's phone numbers due to the fact that Whatsapp uploads the entire phonebook to Whatsapp. That means Facebook is likely to know your phone number although you don't use Facebook or Whatsapp.

It's sick that they are allowed to get away with this. It's basically a botnet stealing information.

Every time someone argues that people can avoid the privacy problems of Facebook by simply not using it, I point out this issue (plus the shadow accounts).

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#59

Post by OminousWeapons » Sat, Apr 03, 2021, 4:49 PM UTC

rikkipitt wrote: post #5

I’ve been getting a lot of automated/unsolicited calls recently. Begs the question if this might be the source of my woes. Is there a trustworthy phone number version of https://haveibeenpwned.com ?

Not really an answer to your question, but one partial solution to the problem of having your number leaked or sold is to setup a service like Twilio to act like a phone proxy. You can have Twilio forward calls it receives on a different number ("spam number") to your actual phone number ("real number"). You provide spam number to anyone who isn't a business or personal contact. Every few months, you rotate spam number. If your spam number is leaked, you don't care because its only a transient number which isn't more permanently associated with you.

You can also have more permanent proxy numbers for services or people that may need to get in touch with you long term.

Re: 533M Facebook users' phone numbers and personal data have been leaked online

#60

Post by spinny » Sat, Apr 03, 2021, 4:50 PM UTC

tpush wrote: post #45

I_am_tiberius wrote: post #16

Would like to know if non Facebook users are included because Facebook has non Facebook user's phone numbers due to the fact that Whatsapp uploads the entire phonebook to Whatsapp. That means Facebook is likely to know your phone number although you don't use Facebook or Whatsapp.

Whatsapp doesn't share phone book data with Facebook.

Just like Kelly Loeffler didn't share any info with her portfolio manager