Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Meta is using my 2FA to call and sell me

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 84 posts

Re: Tell HN: Meta is using my 2FA to call and sell me

#61

Post by bryan_w »

gamegoblin wrote: post #23
minraws wrote: post #14

Earlier quoted context omitted.

generally most people check company then do, - firstname@company.email - firstnamelastname@company.email - firstname-lastname@company.email - firstname.lastname@company.email from the recruitment side, cause I have asked this question to my company's HR... :P hackers do it as well hence why I am always stressed about phishing, though recruitment mail on professional ids is still rather rare, recruiters also prefer to…

It was definitely not phishing -- I had a friend of mine who works for Meta reach out to the specific recruiter internally and ask them to not do that. They apologized, but a few months later a different recruiter reached out to the same work email. They have my personal email, because they send recruitment spam to that one too.

Are you sure it's not in LinkedIn system? That's where a lot of recruiters buy data from.

Re: Tell HN: Meta is using my 2FA to call and sell me

#62

Post by kevin_thibedeau »

cmatthias wrote: post #11

If you are in the USA, then what you received are unsolicited marketing phone calls under the TCPA, a law which allows you to personally collect up to $1500 per violation of the law or associated regulations, per phone call that you received. If your personal phone is on the federal "Do Not Call" registry, it's possible that there are at least two violations of the law per phone call you received. I would suggest sen…

That doesn't apply when you have an existing business relationship. That constitutes express consent.

Never cross the streams on unrelated accounts.

Re: Tell HN: Meta is using my 2FA to call and sell me

#63

Post by runevault »

Dave_TRS wrote: post #55
rsync wrote: post #54

Don't use your personal mobile phone for 2FA. Use a "2FA Mule" that is only for that purpose: https://kozubik.com/items/2famule/ I have the ringers silenced on mine so I wouldn't know if they got any spam calls ... and I assume they do ...

Google Voice is free and will forward SMS's to email, which can then be set up with rules to various other emails. Most banks accept google voice numbers Twilio numbers are a dollar a month and will also forward to email or you can log into the twilio web interface to pick up sms codes if needed. Rejected by more places the demand 2FA

Some services don't allow GVoice 2fa. I tried it for instagram because I refuse to give Facebook my real number and they rejected it.

Re: Tell HN: Meta is using my 2FA to call and sell me

#64

Post by cmatthias »

kevin_thibedeau wrote: post #62
cmatthias wrote: post #11

If you are in the USA, then what you received are unsolicited marketing phone calls under the TCPA, a law which allows you to personally collect up to $1500 per violation of the law or associated regulations, per phone call that you received. If your personal phone is on the federal "Do Not Call" registry, it's possible that there are at least two violations of the law per phone call you received. I would suggest sen…

That doesn't apply when you have an existing business relationship. That constitutes express consent. Never cross the streams on unrelated accounts.

This is incorrect; see my response elsewhere in the thread for details. Express written consent is always required to send marketing messages or make marketing calls to personal (residential land-line or mobile) phone numbers.

Re: Tell HN: Meta is using my 2FA to call and sell me

#65

Post by kjs3 »

gamegoblin wrote: post #7

I have a feeling that Meta has some kind of internal system for slurping up everyone's contact info, and that some kind of bugs/criteria occasionally cross some streams. Meta recruiting somehow got a hold of my name@amazon.com employer email -- which I have never posted publicly -- and started sending me recruitment emails to my work email. This struck me as incredibly unprofessional, though I understand it's almost…

This struck me as incredibly unprofessional, though I understand it's almost certainly an automated system doing it.

How does "automated system" somehow mitigate it being unprofessional? If you're going to make an automated system, part of professionalism is to make sure it actually works correctly. But then, look at how many people are hiding behind 'it's an algorithm so we can't be held accountable' these days.

Re: Tell HN: Meta is using my 2FA to call and sell me

#66

Post by kjs3 »

hinkley wrote: post #47
gamegoblin wrote: post #7

I have a feeling that Meta has some kind of internal system for slurping up everyone's contact info, and that some kind of bugs/criteria occasionally cross some streams. Meta recruiting somehow got a hold of my name@amazon.com employer email -- which I have never posted publicly -- and started sending me recruitment emails to my work email. This struck me as incredibly unprofessional, though I understand it's almost…

I don't know when and I don't know how, but at some point we're going to have to start attaching provenance to data instead of building stringly typed systems where we copy data around as snippets of text orphaned from all possible context. I suspect the biggest problem with that is not languages and frameworks, which are definitely going to be a problem, but databases. There is no way to map any of this into columns…

When I was in college I was briefly recruited by a company that made a Unix Window Manager for the Defense and Intelligence communities.

Secureware?

Re: Tell HN: Meta is using my 2FA to call and sell me

#67

Post by ajhurliman »

kritiko wrote: post #38
cmatthias wrote: post #11

If you are in the USA, then what you received are unsolicited marketing phone calls under the TCPA, a law which allows you to personally collect up to $1500 per violation of the law or associated regulations, per phone call that you received. If your personal phone is on the federal "Do Not Call" registry, it's possible that there are at least two violations of the law per phone call you received. I would suggest sen…

Using Facebook Business Tools requires you to accept an arbitration clause, which may limit your ability to pursue small claims against them: https://www.facebook.com/legal/commercial_terms/update

If they show up to small claims court they are free to make that argument to change venue. Something tells me they won't show up though.

Re: Tell HN: Meta is using my 2FA to call and sell me

#68

Post by rodric »

therealmarv wrote: post #27
rodric wrote: post #22

You should probably use an app like Aegis (Android) or Raivo (iOS) for two-factor authentication rather than your personal phone number.

FB does not allow you to use 2FA apps like that without giving them a phone number first (at least this is how it worked in the past).

Shame if that is (or was?) the case, but it hasn’t been my experience at least.

Re: Tell HN: Meta is using my 2FA to call and sell me

#69

Post by hinkley »

kjs3 wrote: post #66
hinkley wrote: post #47

Earlier quoted context omitted.

I don't know when and I don't know how, but at some point we're going to have to start attaching provenance to data instead of building stringly typed systems where we copy data around as snippets of text orphaned from all possible context. I suspect the biggest problem with that is not languages and frameworks, which are definitely going to be a problem, but databases. There is no way to map any of this into columns…

When I was in college I was briefly recruited by a company that made a Unix Window Manager for the Defense and Intelligence communities. Secureware?

Not them, but I honestly couldn't tell you who they were, or if they're still around. It's been a long time, there was a little hint of nepotism involved, and it would have meant staying locally so I dumped most of the details from my brain.

Re: Tell HN: Meta is using my 2FA to call and sell me

#70

Post by gamegoblin »

bryan_w wrote: post #61
gamegoblin wrote: post #23

Earlier quoted context omitted.

It was definitely not phishing -- I had a friend of mine who works for Meta reach out to the specific recruiter internally and ask them to not do that. They apologized, but a few months later a different recruiter reached out to the same work email. They have my personal email, because they send recruitment spam to that one too.

Are you sure it's not in LinkedIn system? That's where a lot of recruiters buy data from.

Just verified it's not in any of my LinkedIn settings, also no other company has ever reached out via that employer email, only Meta, so it seems like Meta is the only one who knows about it (or is the only one who uses it, which seems unlikely).
Post reply on HN