Live data from Hacker News

Have I Been Facebooked?

haveibeenfacebooked.com

71–80 of 230 posts

Re: Have I Been Facebooked?

#71
post #48
post #18

Earlier quoted context omitted.

> If you don't want your phone number leaked don't hand it over to a random website that pinky swears it won't keep it. What's the worst they can do with it? Call me all hours of the day trying to sell me an extended factory warranty for my free Medicare brace that, by the way, has a Security Number that is under arrest by the Security Administration because it made fraudulent IRS payments with iTunes gift cards to l…

"The worst that can happen"... In a world where your bank thinks that SMS is good enough for 2FA... phone number plus other info is good enough for credit reporting agencies to send out your complete file... Variations of this theme. Also, this dump is once more confirmation that Facebook owns lots of data about its users, and doesn't care to protect that data, or to give its users the ability to control personal inf…

Yup - there's another thread related to this breach. A comment led me to do a google search on my phone number.

I found FastPeopleSearch.com, which not only had my current phone number and physical address, but my previous cell phone number, land lines (from back when those were a thing), my Vonage phone number, and previous addresses, all dating about 20 years. If you know my name, you can get a lot more... thanks to these aggregators of public records.

You can attempt to have yourself removed but there are a lot of these types of sites.

Of course, if you take "a" phone number, and use the google search technique, you'll find one of those sites like FastPeopleSearch and learn a lot more about who the phone number belongs to. But presumably anyone who's trying to make use of all this information could do all that without the Facebook breach, if they automate the process.

Of course, the Facebook breach ties a bunch of information to a phone number in a, perhaps, tidy package?

Re: Have I Been Facebooked?

#72

No one else wanted to try, but I had a feeling my data is breached (seems to happen every few months?) Anyhow, my phone number had a hit and they showed my first and last initial and corresponding asterisks; seems legit. For people saying "why enter your phone number into random site" -- not sure how much value a phone number provides without the accompanying information.

I typed my phone number, and it was not found. I'm not too surprised. I never wanted Facebook to have my phone number (and my account is deactivated, though I still use Messenger.) I always ignore prompts for phone numbers on a site/app like that (if at all possible).

Re: Have I Been Facebooked?

#73
post #42
post #8

I'm looking forward to the sequel, "Have I Been 'Have I Been Facebooked'ed" when it turns out this is just a data harvesting operation. If you don't want your phone number leaked don't hand it over to a random website that pinky swears it won't keep it. It's maybe not a scam, but still...

exactly! They should be testing a hash of your phone number, not the number itself. Amateur hour here.

There is a movie from the 80s called Wargames that you might enjoy.

Re: Have I Been Facebooked?

#74

Earlier quoted context omitted.

My phone number is a 10-digit number, the first 3 of which are an area code. It gets spam calls and texts (though that miraculously decreased on November 4th...) as it is. Now, combined with browser fingerprinting, perhaps this site can tie my specific 10-digit number to some other aspects of who I am, but I'll leave that part as an exercise for a willing volunteer. I'm not terribly concerned about entering my phone…

2 factor sms authentication

1 factor of 2 factor auth is completely useless without any identity to tie it to

Re: Have I Been Facebooked?

#76
post #69

Earlier quoted context omitted.

If you bcrypt it then the site could just keep the mapping of email to hash value. Then when you do a lookup, the site would know what email you tried. https://en.m.wikipedia.org/wiki/K-anonymity is likely a better approach to prevent that, which other similar sites like https://haveibeenpwned.com/ are already doing for the email addresses.

i mean bcrypt so ppl can download the dataset and test locally

Yeah. I'd like to self-host a wrapper around the dataset so that people who trust me (friends and family) can safely check if their number's in the breach.

Re: Have I Been Facebooked?

#78
post #46

Can someone bcrypt all these phone numbers & emails and make that public? Share the salt and then everyone can just test their own phone number without sending it to some rando

bcrypting 533M phone numbers alone on my PC would take about (edit: 185) days straight by my calculations

Re: Have I Been Facebooked?

#79
post #46

Can someone bcrypt all these phone numbers & emails and make that public? Share the salt and then everyone can just test their own phone number without sending it to some rando

I downloaded the files for my country the other day. There are some links on an HN page that might point to pages with the files:

https://news.ycombinator.com/item?id=26690044

Re: Have I Been Facebooked?

#80
post #53

Earlier quoted context omitted.

Zuck: Yeah so if you ever need info about anyone at Harvard Zuck: Just ask. Zuck: I have over 4,000 emails, pictures, addresses, SNS [Redacted Friend's Name]: What? How'd you manage that one? Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb f**s.

Culture comes straight from the top. You can certainly tell that with Facebook and Zuckerberg. A good solution to this would be to put a hiring freeze on any ex-Facebooker and claim that if they can overlook Facebook's questionable practices, then they would be a danger for your company and its customers. Hold employees responsible for the actions of their employer. You could institute a "two year freeze" for any FB…

Wow, you spend really a lot of effort on virtue signaling.

Should we also institute public lynching of all employees of companies that had security breaches?

Post reply on HN