Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook privacy fuckup reveals who has your number in their phone

alexmuir.com

Post reply on HN
Print view View original

61–70 of 124 posts

Re: Facebook privacy fuckup reveals who has your number in their phone

#61

Post by herdcall »

AlexMuir wrote: post #52
aristus wrote: post #48

Earlier quoted context omitted.

If you are truly concerned about harm to users, did you try reporting this to facebook.com/security or facebook.com/whitehat? FWIW, I've alerted some people. Your post is unclear on one point. Did you see this screen BEFORE confirming via SMS that you were in possession of the mobile number you entered? If it was after confirmation, that's a very different thing.

For context of readers, I note you are a FB engineer. Thanks for looking at this. 1. I'm not concerned about harm to users from this issue, I don't pretend to be. That should be Facebook's role. 2. This isn't a bug or a vulnerability, it's something you've actually coded - a feature. It doesn't 'accidentally' match up the number I've just entered with other people's phonebooks, you've programmed it to do that. Fine,…

That FB responded 2 hours after the post here on HN speaks for itself. I had logged some bug reports the regular way, and FB got back after one year. Yes, one year.

Re: Facebook privacy fuckup reveals who has your number in their phone

#65

Post by aristus »

herdcall wrote: post #61
AlexMuir wrote: post #52

Earlier quoted context omitted.

For context of readers, I note you are a FB engineer. Thanks for looking at this. 1. I'm not concerned about harm to users from this issue, I don't pretend to be. That should be Facebook's role. 2. This isn't a bug or a vulnerability, it's something you've actually coded - a feature. It doesn't 'accidentally' match up the number I've just entered with other people's phonebooks, you've programmed it to do that. Fine,…

That FB responded 2 hours after the post here on HN speaks for itself. I had logged some bug reports the regular way, and FB got back after one year. Yes, one year.

I'm sorry you had a bad experience. Were you reporting bugs (eg X doesn't work), or a security vulnerability? Where did you report?

Re: Facebook privacy fuckup reveals who has your number in their phone

#67

Post by ttl698 »

Wow, I just duplicated this perfectly.

Signed up with a fake name and throwaway email. Was asked to enter mobile number for verification.[1] Entered mobile number and verified.

The top few 'People You May Know' suggestions were all people who I know have that number on their iPhones, all of whom use the Facebook for iPhone application. (It obviously happens if they use any platform's app to sync contacts, not just iOS)

Don't have the time to check now, but I would imagine Facebook uses this exact same method for suggestions if you use your primary email to sign up. People who have you in their email contacts - and have imported them to Facebook - are probably suggested to you too. That way you'll know who keeps you in their email address book too.

[1] Note: to trigger the SMS verification stage, you have to enter a semi-obviously fake name.

Re: Facebook privacy fuckup reveals who has your number in their phone

#68

Post by kjackson »

aristus wrote: post #48
AlexMuir wrote: post #15

These little privacy leaks are not important on their own. A little data leaks here, a little there. What is concerning is that we can guarantee private investigators and professional identity fraudsters are well on top of all these little loopholes. And combined, I'd say Facebook is probably pissing data out. Some sweet law enforcement potential here - slap in a request to Facebook on a drug-dealing suspect, find a…

If you are truly concerned about harm to users, did you try reporting this to facebook.com/security or facebook.com/whitehat? FWIW, I've alerted some people. Your post is unclear on one point. Did you see this screen BEFORE confirming via SMS that you were in possession of the mobile number you entered? If it was after confirmation, that's a very different thing.

Facebook does not care about user privacy. They have gone on record saying this multiple times (and then quickly recanted it). They do not care about user privacy because it goes against everything that Facebook needs in order to grow.

For example, if you tag a photo with a friend's name, all of that friend's friends can see this photo, even if you restrict who can see your photos. You cannot change this, which means you have now lost control of your own privacy. I do not want strangers seeing my photos, but I can't prevent this unless I stop tagging photos, which is what I have done.

More importantly, I'm moving away from Facebook because they don't give a fuck about privacy.

Re: Facebook privacy fuckup reveals who has your number in their phone

#69

Post by scott_s »

AlexMuir wrote: post #52
aristus wrote: post #48

Earlier quoted context omitted.

If you are truly concerned about harm to users, did you try reporting this to facebook.com/security or facebook.com/whitehat? FWIW, I've alerted some people. Your post is unclear on one point. Did you see this screen BEFORE confirming via SMS that you were in possession of the mobile number you entered? If it was after confirmation, that's a very different thing.

For context of readers, I note you are a FB engineer. Thanks for looking at this. 1. I'm not concerned about harm to users from this issue, I don't pretend to be. That should be Facebook's role. 2. This isn't a bug or a vulnerability, it's something you've actually coded - a feature. It doesn't 'accidentally' match up the number I've just entered with other people's phonebooks, you've programmed it to do that. Fine,…

You did not answer his second question: was this before or after you confirmed through SMS that the phone number is actually yours?
Post reply on HN