Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I Been Facebooked?

haveibeenfacebooked.com

Post reply on HN
Print view View original

61–70 of 230 posts

Re: Have I Been Facebooked?

#61

Post by GormHouj »

deeblering4 wrote: post #59
neogodless wrote: post #17

Earlier quoted context omitted.

My phone number is a 10-digit number, the first 3 of which are an area code. It gets spam calls and texts (though that miraculously decreased on November 4th...) as it is. Now, combined with browser fingerprinting, perhaps this site can tie my specific 10-digit number to some other aspects of who I am, but I'll leave that part as an exercise for a willing volunteer. I'm not terribly concerned about entering my phone…

2 factor sms authentication

The commenter is leery of entering their phone number into the article link.

Re: Have I Been Facebooked?

#62

Post by tonymet »

batch12 wrote: post #58
tonymet wrote: post #46

Can someone bcrypt all these phone numbers & emails and make that public? Share the salt and then everyone can just test their own phone number without sending it to some rando

What's the difference in salting if the salt is shared? Edit: Replying again- sorry. Thinking about this some more-- if the person were to concatenate the number with first last or something they could distribute the list and the person's name would be the salt. So 9195551212JohnDoe becomes $hash and user just has to know all the pieces to test locally.

Habit. Prob right salt wouldn't be needed.

Re: Have I Been Facebooked?

#63

Post by batch12 »

tonymet wrote: post #62
batch12 wrote: post #58

Earlier quoted context omitted.

What's the difference in salting if the salt is shared? Edit: Replying again- sorry. Thinking about this some more-- if the person were to concatenate the number with first last or something they could distribute the list and the person's name would be the salt. So 9195551212JohnDoe becomes $hash and user just has to know all the pieces to test locally.

Habit. Prob right salt wouldn't be needed.

Well, maybe you were on to something-- your thoughts inspired me to think about this a little more- we just need a unique salt only the user would know.

Re: Have I Been Facebooked?

#64

Post by tonymet »

batch12 wrote: post #63
tonymet wrote: post #62

Earlier quoted context omitted.

Habit. Prob right salt wouldn't be needed.

Well, maybe you were on to something-- your thoughts inspired me to think about this a little more- we just need a unique salt only the user would know.

still, bcrypt's design means it'll take way too many cycles to brute-force-reverse the dataset, so it should be safe to share.

One downside of a record-specific salt is nicknames e.g. john vs johnathan , or misspellings. (false negatives)

Re: Have I Been Facebooked?

#65

Post by thanksforfish »

tonymet wrote: post #46

Can someone bcrypt all these phone numbers & emails and make that public? Share the salt and then everyone can just test their own phone number without sending it to some rando

If you bcrypt it then the site could just keep the mapping of email to hash value. Then when you do a lookup, the site would know what email you tried.

https://en.m.wikipedia.org/wiki/K-anonymity is likely a better approach to prevent that, which other similar sites like https://haveibeenpwned.com/ are already doing for the email addresses.

Re: Have I Been Facebooked?

#66

Post by juanani »

weird title, since one without a facebook would assume this service is for them. If you have ever signed up for facebook and are wondering if u have been facebooked... yes you have been facebooked.

Re: Have I Been Facebooked?

#67

Post by chillwaves »

No one else wanted to try, but I had a feeling my data is breached (seems to happen every few months?)

Anyhow, my phone number had a hit and they showed my first and last initial and corresponding asterisks; seems legit.

For people saying "why enter your phone number into random site" -- not sure how much value a phone number provides without the accompanying information.

Re: Have I Been Facebooked?

#68

Post by davidjohnstone »

tonymet wrote: post #42
sumeno wrote: post #8

I'm looking forward to the sequel, "Have I Been 'Have I Been Facebooked'ed" when it turns out this is just a data harvesting operation. If you don't want your phone number leaked don't hand it over to a random website that pinky swears it won't keep it. It's maybe not a scam, but still...

exactly! They should be testing a hash of your phone number, not the number itself. Amateur hour here.

I don't think that helps, because the address space of numbers is too small so anything is reversible. My solution to this was to generate 99 extra random numbers that start with the same digits as the real one and send them all to the server. The front-end then shows just the result the user cares about but the back-end doesn't know which is which.

https://www.thenewseachday.com/private-facebook-phone-number...

Re: Have I Been Facebooked?

#69

Post by tonymet »

thanksforfish wrote: post #65
tonymet wrote: post #46

Can someone bcrypt all these phone numbers & emails and make that public? Share the salt and then everyone can just test their own phone number without sending it to some rando

If you bcrypt it then the site could just keep the mapping of email to hash value. Then when you do a lookup, the site would know what email you tried. https://en.m.wikipedia.org/wiki/K-anonymity is likely a better approach to prevent that, which other similar sites like https://haveibeenpwned.com/ are already doing for the email addresses.

i mean bcrypt so ppl can download the dataset and test locally
Post reply on HN