26 ms·

Facebook spamming users via their 2FA phone numbers

550 points by pinewurst 9y ago

HankB99 9y ago
FB (among other web sites) continually asks for my phone number. I continually ignore their entreaties. I always suspected they could not resist the temptation to use it like this. I really expected them to sell it to telemarketers.
- eterm 9y ago
  Not only asks but I've had it display what it thinks is my number and asked, "is this your number?". I've consistently denied telling it my phone number. Of course it has it via whatsapp now but I've repeatedly made clear I don't want it associated with my facebook account. Reading this news I'm very glad I've put up with its demands and not linked it just for 2fa.
  - D-Coder 9y ago
    Call the President. PHONE NUMBERS: Comments: 202-456-1111. Switchboard: 202-456-1414.
- jnbiche 9y ago
  > I really expected them to sell it to telemarketers. reply I doubt they'd sell it to telemarketers, but they'll use it for every dark pattern under the sun to increase your engagement. Frankly, your engagement is much more profitable to them than a one-time sale of an email list.
  - HankB99 9y ago
    They're not mutually exclusive.
    - dx034 9y ago
      Yes, because having exclusive access to that breadth of data makes it valuable. Once they share all their data it's not worth much anymore.
- kaybe 9y ago
  Did they stop asking for email login passwords? (I haven't been there in a while, this being just one of the last straws.)
stratelogical 9y ago
Unbelievable. When signing up for 2FA, FB never said what else it would be used for. From a legal standpoint, aren’t companies are supposed to say what the phone number will be used for when asking for phone number? Somebody from FB - please tell us this is a bug.
- moonka 9y ago
  Judging by how the response has been to companies leaking and abusing our data, I don't know that it will make a difference if it's a bug or intentional.
- deleted 9y ago
  [deleted]
- GCU-Empiricist 9y ago
  Sounds like a good reason to send the spam text message filing report. How much is the fine per incident?
  - txsh 9y ago
    $0 if you own enough lobbyists and congressmen.
    - Slansitartop 9y ago
      That kind of response is too cynical, and just discouragement from actually trying to fight the problem.
      - deleted 9y ago
        [deleted]
      - twothamendment 9y ago
        Cynical? I'd call it realistic. If anyone wants to fight the problem, delete your account. That is the only value that you can take away from that company.
SamLevin88 9y ago
Finally, somewhere I can appropriately vent about this. About TWO years ago I was constantly annoyed by the 'secure your account: add your phone number here' banner frequently displayed at the top of the page upon loading FB, so I input my number to make it disappear for good. (Also, they kept hiding the 'x' (close) icon in different spots, making the banner difficult to dismiss.) A few days later I got a text message containing a Facebook notification. I was flabbergasted. What an EGREGIOUS misuse of personal information. Completely under the guise of account security... Facebook had in reality acquired another way to keep their brand under my nose. Naturally I was livid so I spent the better portion of the day scrubbing whatever sensitive information I could. Sure enough, the banner came back a few days later. And here we are. I realize that the proper solution is to terminate my account and never attempt to log back in.... but I've had my account since 2006 and despite the company's terrible practices, I'm really not interested in disconnecting for good at this time
- mintplant 9y ago
  I had a similar experience around a year ago, with Facebook texting me a notification out of the blue to the number I had set up for 2FA. In a show of futile-yet-satisfying passive aggression, I texted back "go away" to the robot... which promptly posted it as a status update on my timeline, to the confusion and concern of my friends until I noticed and took it down.
  - RikNieu 9y ago
    What a brilliant dark pattern! Make people's assumed private snotty replies to them public and visible to their peers. They out passive aggressived you like a ninja.
    - code_duck 9y ago
      They have the advantage in the power balance of the relationship.
- ASalazarMX 9y ago
  > I realize that the proper solution is to terminate my account and never attempt to log back in I've had a "terminated" account that occasionally gets emails inviting me to "Log back in with one click". When I originally tried to delete the account, it told me it would be actually erased a month after. That was 6 years ago.
tomc1985 9y ago
Seriously, why do the rank-and-file of Facebook engineering allow this to happen? Does anyone stand up to their employers anymore? Or does everyone just drink the koolaid and ask no questions?
- dizzystar 9y ago
  If you personally won't do it, the person next you, or your replacement, may. Toeing the party line sucks at any job, but it's part and parcel to receiving a paycheck assuming you aren't doing something downright illegal.
  - tomc1985 9y ago
    Used to be SWEs were so powerful that we could by virtue of the fact that replacing one costed so much But now, where juniors are hired by the dozen and internships are now a seeming requirement (internships being a worker's first -- and now mandatory, it would seem -- induction into drinking the techbiz koolaid), where lifers are getting more and more scarce... I guess you're right :/
- a-priori 9y ago
  These things are never spelled out in any plans. They're done piecemeal, by separate teams, incrementally over long development cycles. One team implements 2FA, and they add a way for users to enter their phone numbers as a second factor. The engineers are fine with this because it's for the users' benefit, so they can secure their account. Another team implements the mobile notifications, which a user has to turn on explicitly. The engineers there do this for the users' benefit, for those users that want notifications by phone. They're opting in, after all. Sometime in here, the fact that the phone numbers are being collected for 2FA gets forgotten. This sets the stage for a third team, who is tasked with improving engagement numbers. They see that lots of inactive users have phone numbers associated with their accounts. Maybe they might be interested in something their friends are doing? So they try an experiment where they send a notification to these users, and a large percentage of them engage with it! That must mean that the users were interested in the notification right? After all, they opened the link or replied. So they roll it out to a wider audience, and the engagement numbers go up. Awesome! Pats on the back all around. To be clear, I have no idea about how this actually happened, or if this is the right chronology, or anything else. It really doesn't matter, my point is that this is how this sort of thing happens in large organizations. No one has the whole picture, and in their own world view everyone thinks they're doing something good for their users. But if you put them all together, and sprinkle in a little willful ignorance, you get Facebook spamming their users on their 2FA numbers.
drpgq 9y ago
Facebook becomes LinkedIn
- simonswords82 9y ago
  I think you'll find LinkedIn is actually becoming Facebook.
davidbiehl 9y ago
I found a similar thing with email notifications. If you regularly login to FB and look at your feed they will leave you alone. Delete the app from your phone or neglect logging in and you’ll start to get email notifications about the silliest things. Of course they don’t contain much more than “so and so shared a link” without any description of what was shared (trying to get you to login and look.) Not quite as bad as 2FA number, but irritating nonetheless.
- Slansitartop 9y ago
  Facebook has been steadily decreasing the usefulness of its email notifications in order to push more use of its app and website. The old notifications used to give you the content and allow you to reply through email, but not anymore. The notifications are also dark-pattern hard to manage. If you don't want a type, you have to wait to receive an example of it to unsubscribe. Their central notification page only allows you to re-enable particular notifications, but give no way to disable them individually. Facebook is a terrible product that can't die fast enough.
  - newscracker 9y ago
    > Facebook is a terrible product that can't die fast enough. For the sake of humankind, I'd rephrase it as "Facebook is a terrible company that can't die fast enough."
- mintplant 9y ago
  Back when I had the Facebook app installed on my phone, if I didn't open it for a long period the "so-and-so posted an update" push notifications would eventually slow to a trickle and ultimately peter out altogether. But if I so much as touched Facebook, the floodgates would re-open and I'd be spammed with them throughout the day, until the process repeated and they died away again. In a weird way Facebook ended up conditioning me to avoid using it.
- tankenmate 9y ago
  I have blocked all of FB's allocated networks worldwide on my machine (via a look up of allocated IP space and fed into iptables / ipset).[0] So FB doesn't even get "phantom" traffic from me (indirect traffic from FB logos / js on random websites). I only log into FB a few times a year and only via a temporary VPS in another country and using an incognito browser tab. So now FB has taken to emailing me complaining that they are missing me and that I should log in. :) WAYNE: I don't own A gun let alone many guns that would necessitate an entire rack. STACEY: You know Wayne if you're not careful you're gonna lose me. [0] https://news.ycombinator.com/item?id=15222936 https://news.ycombinator.com/item?id=15222936 EDIT: fixed link to go direct to the comment
loorinm 9y ago
This happened to me too. The value of being on facebook is an illusion. In person relationships are vastly more rewarding, both emotionally and financially.
- endless1234 9y ago
  Is that really something people do - substitute in person relationships for Facebook ones? "I could hang out with my SO today, but I guess I'll just go on FB instead"
  - akvadrako 9y ago
    Many people do this habitually, though not so explicitly.
  - loorinm 9y ago
    Well, every time you choose to do one thing, you also choose to not do a million other things. A lot of people are experiencing real harm to their mental state from habitual social media use.
- davidcbc 9y ago
  In person relationships being more rewarding doesn't mean that Facebook has no value. I personally get a lot of value out of being on Facebook
- onychomys 9y ago
  Many of us have family spread all over the country. I can keep in contact with them all via a facebook group instead of one at a time over the phone or group text (...not that my mother would understand how to do that) or the like. Even if you don't appreciate how it connects you to your friends (if it even does), surely you can appreciate how it can connect you to your family.
  - Caveman_Coder 9y ago
    I completely agree. I don't use FB for anything other than keeping up with my family that live in different states. I don't have any casual friends on FB, and especially not co-workers. For seeing pictures of my nieces and nephews and various family gatherings that I can't be a part of FB works fine. But I don't follow any brands or willingly subject myself to advertising...all the stuff that FB wants you on their platform for I willingly ignore.
jeffdavis 9y ago
Network effects work both ways. Can cause a meteoric rise, or a dramtic decline.
ceejayoz 9y ago
If they're not processing STOP as an opt-out, they're in major violation of the CTIA's rules on short codes.
- kelnos 9y ago
  If you send a STOP, though, won't that cause you to stop getting 2FA codes as well?
  - ceejayoz 9y ago
    I'm not sure if the rules carve out an exemption for that. If they don't, polluting the 2FA short code with other types of messages is doubly bad.
- Meph504 9y ago
  these aren't marketing campaigns and a part of your subscribed service, they aren't violating anything, and aren't required to process short codes in this case.
  - ceejayoz 9y ago
    It's my understanding that any short code must respect the STOP wording as an opt-out.
- politician 9y ago
  They are also at risk of a TCPA violation for sending unwanted communications without consent.
duncan_bayne 9y ago
I really hope this is a sign of the end times for Facebook. I genuinely believe that the world will be better off without it, and its effect on culture, mental health, work habits, and socialisation. _Especially_ for young people.
- darkstar999 9y ago
  We might be seeing the (slow) decline of Facebook, but in no way will we see the decline of social media that causes those bad effects.
  - duncan_bayne 9y ago
    Unless there is a sufficient cultural backlash for social media _in general_ to become 'uncool'. "Look at that loser. Spends all his time checking Instagram." Is it Machiavellian to wonder how we could memetically inoculate children against social media?
    - egypturnash 9y ago
      No. Not at all. We teach kids about a lot of dangers already. Some are real, some are highly exaggerated. For-profit social media is a thing we’re starting to realize may be a complicated, subtle danger. Maybe all social media. Maybe just corporate-owned social media.
      - duncan_bayne 9y ago
        Yeah, that's what I meant :) I run my own Mattermost server for friends and family.
    - ldiracdelta 9y ago
      It could become a low class thing like consuming soda.
jzl 9y ago
It's pretty clear from some simple googling that he ended up somehow activating a feature called "Facebook Texts" (the key giveaway -- that replying to the texts posted to his wall): https://www.facebook.com/help/130694300342171?helpref=faq_content https://www.facebook.com/help/130694300342171?helpref=faq_co... I believe that he didn't set this up intentionally and it may very well be a bug that caused him to be signed up, but as bad as Facebook is I'll eat my shoe if they signed up every single person who gave a 2FA phone number to this service. Not to detract from the fact that Facebook's nagging is indeed a huge problem.
- deleted 9y ago
  [deleted]
- reaperducer 9y ago
  > I'll eat my shoe if they signed up every single person who gave a 2FA phone number to this service. Facebook doesn't have to sign up every 2FA person. It can pick a few hundred or thousand and see what happens. If engagement increases, then more 2FA people are brought on board. If this isn't widespread, it may not be the user's fault. It may just be the camel's nose under the tent.
  - akvadrako 9y ago
    The evil of unrestrained A/B testing.
    - throwaway2048 9y ago
      I've heard engagement increases if you give the impression a family member is going through a personal crisis, perhaps facebook ought to look into the technique, seems excellent for the metrics.
- deleted 9y ago
  [deleted]
- skue 9y ago
  No. Look at the following tweet. He explicitly says that he hasn’t enabled this and posted a screenshot of his settings: https://mobile.twitter.com/Gabriel__Lewis/status/963121814166630400 https://mobile.twitter.com/Gabriel__Lewis/status/96312181416... Update: Matthew Green just experienced the same thing, in the midst of tweeting about the security implications of abusing 2FA phone numbers this way: https://mobile.twitter.com/matthew_d_green/status/963766661466787840 https://mobile.twitter.com/matthew_d_green/status/9637666614...
Panino 9y ago
> Importantly, Lewis isn't the only person who claims this happened to him. One Facebook user says he accidentally told "friends and family to go [to] hell" when he "replied to the spam." Wow. I deleted my FB acct. 8 or 9 years ago because it kept getting worse and worse. It's just sad to read about it now. From my POV, Facebook is like a TV series that had an incredible first few episodes but quickly grew progressively and irreversibly worse, with a large percentage of its users only hanging on now with grim determination.
- Caveman_Coder 9y ago
  We've probably hit peak FB...or perhaps FB has jumped-the-shark using your TV series comparison...either way, any news about the decline of FB is good in my book.
  - tomc1985 9y ago
    Like most products it started as something pure and simple, but once all the various business strategy dips got a chance to put their hands on it, it was ruined. Like so many things. It is so saddening that we nerds do this to ourselves, allowing the wonderful things we build to be ruined by foolish idiots, time and time again
  - joering2 9y ago
    I believe we just getting into a period of social networks phenomena, where everyone is sick and tired of the big Facebook, and soon a fresh new thing will pop-up... This network will be smoother, nicer and smarter approach to social networks than Facebook is and will serve same users, just more mature. Sure few years ago FB was such giant that noone could touch it. But since then the cost of Cloud-computing and serving millions of connections per hour went drastically down, and its never been a rocket science to design and program basic social network. I just wonder if we already have such network and I just happened not to hear about it yet :)
- spurcell93 9y ago
  Literally the "walking dead" of internet products
_Microft 9y ago
Facebook has been asking me to add my mobile number to secure my account. It even prepopulated the input field with my mobile number that I never shared with them! My best guess is that their app farmed it out of the phone adress book of one of my friends. Either way, they definitely overstepped the mark here, in my opinion.
- exhilaration 9y ago
  Do you use Whatsapp? Unless you opted out during the short window they offered during the summer, Facebook got all your Whatsapp contacts and data, and that of course includes your phone number: https://www.cnet.com/how-to/how-to-stop-whatsapp-from-sharing-your-information-with-facebook/ https://www.cnet.com/how-to/how-to-stop-whatsapp-from-sharin...
  - _Microft 9y ago
    I do not but a number of my friends are using the Facebook Messenger, Facebook App and Whatsapp.
  - netsharc 9y ago
    It'd be very easy for Facebook to cross-reference multiple address books (even 1 would be enough) and create "virtual profiles". E.g. if Alice is not part of the Facebook/Whatsapp ecosystem but Bob, Charlie and Donna are, and they all have Alice's phone number (unique identifier!) on their phone. If all 4 hang out together a lot and Bob, Charlie and Donna upload a lot of pictures of all of them, and they diligently tag people who have accounts, then Facebook can probably figure out the 4th person (which face they've stored for their recognition engine) is probably Alice. And if Alice, like the poster, never gave Facebook her phone number, but Bob, Charlie and Donna have it under "Alice Lastname", and they're all friends with Alice Lastname on Facebook, Facebook can probably be certain to say "Store your phone number, we think this is it.". Or to word that properly, "Confirm your number, although we already know this is it."
dboreham 9y ago
Slightly related peeve: if you enable 2FA on Facebook they will never expire any existing browser cookie or mobile app token. Thus whoever gets their hands on your desktop or a device, even months into the future, will bypass 2FA.
- gfosco 9y ago
  That's not true, you have the ability in settings to see all old sessions and revoke device approvals. It's pretty easy to clear out your old machines.
  - deleted 9y ago
    [deleted]
  - mattmanser 9y ago
    If you remember and know where to look. Google eventually asked if I wanted to remove a phone I'd stopped using 2 years ago the other day.
    - JustSomeNobody 9y ago
      Google's is pretty easy: https://myaccount.google.com/ https://myaccount.google.com/ Under Device activity
      - dx034 9y ago
        Google also reminds me regularly to review app passwords. Facebook has never asked me to review a list of apps that I allowed to authenticate with.
  - dboreham 9y ago
    True, because removal of _all_ existing sessions and tokens should be automatic when 2FA is enabled (you're saying to FB: I only want to be using FB if I've completed 2FA). Under what circumstances would the user want existing sessions to live forever on old devices? (I can answer that : they would want that when they were making their money from advertising "engagement").
wlesieutre 9y ago
Not as egregious, but Twitter last week started spamming my email once a day with a “HEY YOU SHOULD SIGN IN AND CHECK OUT YOUR NOTIFICATIONS” message. After 5 days of that I finally bothered to look. The notifications were about someone mentioning me in December. https://i.imgur.com/MaH7EcW.png https://i.imgur.com/MaH7EcW.png How about not doing that?
- ninkendo 9y ago
  The same thing happened to me a few weeks back when I got an email about my “twitter birthday” and how I should post something. I just deleted my account instead. I had the same thing happen with Facebook texting me to post after I turned all notifications off in settings, which was the final straw that got me to delete my FB account too. Now it’s a pattern I repeat everywhere: if your site emails me, I always will click unsubscribe, and go through every possible setting you have to stop you. If you email me again, I delete my account.
joewee 9y ago
Problem is Facebook is still using the original revenue model that has made it rich, which requires engagement. Unfortunately they encourage engagement using the techniques that initially made it grow, which the market is now tired of. Facebook needs to diversify. Take a note from amazon, Netflix.
- cwkoss 9y ago
  Engage on every sponsored post... but engage with it in a way that the advertisers will dislike. ex. Health product -> "I heard this product causes cancer."
  - dang 9y ago
    I know you meant well, but please don't duplicate comments on HN. I'm sure that's why they were flagged. The idea behind this site is intellectual curiosity. That shrivels under repetition. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
chrisseldo 9y ago
I find it dissuading to read an article when the actual article itself is confined to <1/2 of the browser screen.
3pt14159 9y ago
Just get multiple phone numbers. It's easy these days and totally worth it. They're only $1 / month and being able to keep your real number separate from all these BS sites is great. Plus, for 2FA social engineers aren't going to get you just by working your network.
- reaperducer 9y ago
  Why exactly should I spend my money because Facebook can't behave itself? I'm not the problem; Facebook is.
- fright01 9y ago
  Google voice is a free phone number ;) I have a couple for 2fa if i ever truly want it. The danger of 2FA is that you are trusting your phone service provider. A semi-common hack is to socially engineer a phone provider into transferring the target's phone number from their service to your service provider under a false or stolen identity. Now you can control the phone number, tie it to your own device, and recieve the 2fa sms at your own device.
reaperducer 9y ago
Things like this are the reason that when a company starts spamming me, I update my account with the company's own information. I started when no matter how many times I tried to unsubscribe, Walgreens kept using my phone number (which is supposed to be used to verify that the right person is getting the prescription) to spam me flu shot notices, auto-refill offers, and more. So now those robocalls go to Walgreens HQ. Most companies list an email address and phone number for their PR departments on their web sites, so these are what I use since they're not hidden and go to real people. I know this doesn't work for 2FA, but it's certainly satisfying in other scenarios.
- Faaak 9y ago
  I do the same with B2B email spam. Just give another spammer's info, so company A spams company B, B spams C, etc. I've got a small list with CEOs emails, numbers, etc. Not legal, but I like it
  - JankySolutions 9y ago
    It's not legal? What part is illegal?
    - Faaak 9y ago
      When a website offers you a quote about water fountains/new printers/whatever, I doub't it's legal to say that you're company X and that you'd be interested in this particular quote.
      - JankySolutions 9y ago
        I'd be interested in seeing a specific law or case where that sort of thing was illegal. Lying by itself isn't illegal (in the United States at least, i dunno about elsewhere)
  - realusername 9y ago
    I generally use webmaster@[their domain] so they get the SPAM instead of me.
K0nserv 9y ago
Reposting my comment from the other thread: I’ve always been suspicious of services that use SMS as the primary 2FA mechanism. TOTP is more secure and convenient, but it doesn’t allow the service to collect and extra datapoint. Using a communication channel intended for security as a method to boost falling engagement is as shady as it gets. Matthew Green’s twitter thread[0] on this is an interesting read. 0: https://twitter.com/matthew_d_green/status/963766661466787840 https://twitter.com/matthew_d_green/status/96376666146678784...
SilasX 9y ago
Using 2FA number for ads? Are they doing it in Europe too? (Where there are harsh laws against using data for a purpose it wasn't collected for.)
davesque 9y ago
This happened to me a while back. So I disabled 2FA on Facebook.
crawfordcomeaux 9y ago
A platform created to addict people is now beginning to act like an addict begging for a fix? Can't wait to see what their rock-bottom looks like.
- akvadrako 9y ago
  MySpace, tumbler and digg are probably good examples.
azifali 9y ago
Someone added my phone numbers on 2FA and now I am able to login to their account, without a password.
- jobigoud 9y ago
  It's not really 2FA if you can login with just the one factor of the phone… Maybe you unconsciously reset the password to your own at some point and it's saved?
  - azifali 9y ago
    Agreed. But its not even my account. I have similar things happening to me, except those messages are linked to my google voice number with someone else's account. One click and I am able to login. I had to block that number from receiving facebook updates.
deevolution 9y ago
Just reading this may have just pushed me over the edge to delete my account... except i need it to use tinder and bumble. I already havent signed in for months and i feel great. I only use messenger, but now im starting to see annoying ads polluting my messenger list.
- cwkoss 9y ago
  Whenever you see a sponsored post, engage with it in a way that the advertisers will dislike. ex. Health product -> "I heard this product causes cancer."
- Impl0x 9y ago
  Tinder no longer requires Facebook, I believe.
- dx034 9y ago
  You don't need to use your account. Not viewing ads hurts them enough and if you don't login they can't count you as an active user. The overall number of users is unimportant anyway and they won't delete your data, so no reason to deactivate the account.
AhtiK 9y ago
To break away from the newsfeed for good the most effective method is to just start unfollowing everyone and everything who appears in your feed. After a few days of satisfaction from clicking, the wall becomes 100% empty and stays so. Much more effective than deleting your account or exercising any other kind of self-control. Good luck with having the determination to start following everyone once again -- not going to happen.
- 0x00000000 9y ago
  It used to be if you get a notification you could go into settings and "disable this type of notification". But they removed that screen and you still get shit even with EVERYTHING disabled. I really hope they get what's coming to them soon
fortylove 9y ago
As this stream of negative facebook articles continue, I can't help but feel duped about my experiences with it. I've quit fb since new years, but I can't help but wonder if I was played the whole time. I feel like they advertised fb as an altruistic platform, when in reality, I was just a means to marketing dollars and they fed whatever altruistic lines they wanted to keep me coming back. Serious question: does fb purely exist as a company in order to sell our information? Do developers at fb believe they're making the world a better place? I'm not saying developers _need_ to make their career about making the world a better place. I do, however, feel like that's the line fb was feeding about their company culture.
- b3lvedere 9y ago
  Take a real good long look in the eyes of Mark Zuckerberg. Take any picture or video you want. Just take a good look. Do you trust him?
- gowld 9y ago
  Every company exists to make money.
- thephyber 9y ago
  > I feel like they advertised fb as an altruistic platform Zuck's "Facebook's mission is to give people the power to build community and bring the world closer together" always felt like a stretch. If they were altruistic, they would be a B corp or a non-profit, not a Delaware-based C corp. Never forget that companies are run by Boards and that your data can be reappropriated if the company is merged with another. Hell, even Enron's mission statement was: > We treat others as we would like to be treated ourselves....We do not tolerate abusive or disrespectful treatment. Ruthlessness, callousness and arrogance don't belong here[1] > when in reality, I was just a means to marketing dollars and they fed whatever altruistic lines they wanted to keep me coming back. Meh. It's marketing. You typically don't tell the most attractive person your worst qualities when they first see you. You try to make a good impression by highlighting your more attractive qualities and staying quiet about the others. The NSA doesn't tell you it's watching all of your internet activity and correlating it to build profiles on you and your 6 billion fellow great apes. The NSA's marketing is to try and make you forget that it's there, one of the reasons it was dubbed "No Such Agency". When the CIA and the NSA do make their rare public statement, they talk about themselves as the "intelligence community". BP doesn't advertise itself as a cost-cutting, Deepwater Horizon spilling, exploding rig megacorp. They advertise themselves as the company that saved the Gulf Coast from near permanent economic collapse. VW doesn't advertise itself as a lying, massively polluting company that makes more cars than any other. They advertise themselves as the "people's car" that is small and cute and sleek. Oh, and they lied that one time, but they learned from their mistakes and they are making amends. [1] http://www.nytimes.com/2002/01/19/opinion/enron-s-vision-and-values-thing.html http://www.nytimes.com/2002/01/19/opinion/enron-s-vision-and...
riyakhanna1983 9y ago
I removed my number from my Facebook account when I realized that FB was linking my WhatsApp conversations to my FB account using my phone number and displaying ADs on my FB feed based on my WhatsApp conversations. What a desperate move by FB! losers! lol
danbruc 9y ago
The social media behemoth has seen a decline in traffic in recent weeks along with millions of users leaving its platform [...] Two years ago I said that Facebook will be dead by 2020 [1] and that line made me check the current situation, we are right on track and linear extrapolation still hits zero in mid 2020 [2]. As mentioned in the original thread, don't get fooled by the normalized numbers, the search traffic for Facebook is enormous and chances are good that any search term you consider popular will be indistinguishable from the horizontal axis if you add it for comparison. But »facebook« is already down from ten to four times »porn«. And yes, the trend can and possibly is at least partly due to other factors, some are also discussed in the original thread. [1] https://news.ycombinator.com/item?id=11442935 https://news.ycombinator.com/item?id=11442935 [2] https://trends.google.com/trends/explore?date=all&q=facebook https://trends.google.com/trends/explore?date=all&q=facebook
- eterm 9y ago
  Are you sure about that? https://trends.google.com/trends/explore?date=all&q=facebook,twitter,instagram,whatsapp,LinkedIn https://trends.google.com/trends/explore?date=all&q=facebook... and https://trends.google.com/trends/explore?date=all&q=facebook,google https://trends.google.com/trends/explore?date=all&q=facebook... Those graphs suggest that while the trajectory is bad on this graph, any other site doesn't come close.
  - danbruc 9y ago
    Sure, the search traffic is huge but so is the rate it is falling at. If it stopped right now, it would still be a very huge site, but are there any indications that it does? Are there good alternative explanations for the decline in search traffic that would not indicate a decline in popularity of Facebook, for example can the decline be matched with users migrating from browser to app? I failed to find a satisfying alternative explanation. Besides that, I noticed a decline of the popularity of Facebook among the people I know at least about 5 years ago. I only looked at the search traffic for confirmation years later when that trend was pretty obvious from personal experience because I was interested whether that was a general trend or only due to me and the people I know becoming older or something like that. Add to that that I talked to some young teenagers last year that somewhat proudly told me that they don't have and never had Facebook profiles and for all I know Facebook really is on the way down. Whether everyone just moves over to Instagram and WhatsApp and what all that implies for the company Facebook is of course also a different matter.
horsecaptin 9y ago
Good time to remind everyone: If you are not the customer, then you are the product!!
Mc_Big_G 9y ago
Delete your facebook/instagram/whatsapp/<facebook owned> account asap. The sooner the better.
- cwkoss 9y ago
  Whenever you see a sponsored post, engage with it in a way that the advertisers will dislike. ex. Health product -> "I heard this product causes cancer."
- dx034 9y ago
  No reason to delete it. They won't delete your data anyway and they only count active users. Just not logging in hurts them as much as deleting the account.
shivamd 9y ago
I still get this, such a pain. I thought it would go away. But 3 months later, nope.
wand3r 9y ago
This is terrible and totally shit. FB had opt in by default spam notifications when I provided my number and as I stopped using the service regularly spammed my number. I turned off notifications and then the password reset link didnt work via phone. Also, the random intentional "security" interruption to force you to send a selfie to train their AI model.
jmcgough 9y ago
I experienced this a few months ago and it was the last straw for me - it really feels like they're willing to do anything to drive engagement and ramp up addiction. This was after I'd removed messenger and facebook from my phone (having them really push hard for me to use messenger creeped me out; it's obviously in order for them to track my location). I've crippled facebook via chrome extensions to the point that it's only a place for me to check messages and keep in touch with local groups/events, and I'm slowly moving off of it entirely.
- thisacctforreal 9y ago
  Consider trying https://mbasic.facebook.com/ https://mbasic.facebook.com/ It's a JavaScript-free version :) Also works with the Tor hidden service https://mbasic.facebookcorewwwi.onion/ https://mbasic.facebookcorewwwi.onion/
terlisimo 9y ago
I just remembered that I got an "password reset" email from facebook like a month ago? I didn't log in to my FB account since 2008 or so. For a minute I was baffled and thought someone might be trying to hack my defunct profile (but why?) and my instinctive reaction was to log in and reset the password but gave up and forgot about it. But now that people keep mentioning shady "come back, come back, to Mordor we'll take you" tactics, this sure smells fishy. Anyone else got an unsolicited PW reset email after not using FB for a long time?
- bprasanna 9y ago
  Yes, this follows the same strategy. All they want is to lure the user back. Either message will say reset password, or trouble logging in.
zodPod 9y ago
Seriously! It always drove me nuts that they sent emails when you didn't check your facebook regularly too. I used to get so many damn emails. "This person shared this." "This person liked this" etc and I didn't give a shit that's why I didn't check Facebook in the first place. So why the hell would I want a message about it? This is so much worse. I'm not checking facebook why the hell would I want a text about it?
beedogs 9y ago
A good way to avoid this is to stop using Facebook. I wish everyone would abide by this.
visualword 9y ago
Tangentially related, make sure to remove any phone numbers you no longer use. I started receiving sms FB notifications for another person's account (I'm guessing they switched numbers). The link in the message logged me directly into their account. I reported it, but they said this was expected behavior.
JustSomeNobody 9y ago
Between this and Onavo, I think FB need to check themselves. I only keep an FB account so I can check in on people easily, but I'm borderline tempted to just clear out of there and bring as many people as I can with me.
Feniks 9y ago
GDPR is looking better every day isn't it? Honestly I wouldn't trust Facebook with my cat's name.
booleandilemma 9y ago
How do I make it stop? They’re texting me updates about people I haven’t spoken to in years.
vadimberman 9y ago
OK, so my hunch was right. It's not only Facebook, BTW. Whenever you provide those "additional details" to "secure" your account, be sure there's a high probability they will be used elsewhere. In my case, I provided a personal email address to Azure as an alternative email. That email address had an Azure account associated with it. Microsoft merged the two accounts without me asking for it and (not very surprising) it caused some issues displaying the subscriptions properly to the point that their support asked me to create an empty subscription with a brand new email address.
ianamartin 9y ago
No fucking way. A company whose revenue absolutely depends on user engagement is coercing users into engaging with the platform. I'm shocked. Shocked to hear about this. I can't possibly imagine how this could've happened. It's time to rethink everything we know, rewrite C in rust, and put the social back in media.
- dx034 9y ago
  Misusing 2FA for "engagement" is indeed more than you should expect from any company. That looks very desperate and I haven't heard of other companies using these tactics.
cmurf 9y ago
I don't understand why they require your phone number to do 2FA, and prefer it over any OTP app like Google Authenticator. It's 2018 Facebook.
- a_imho 9y ago
  Maybe they like phone numbers. Nevertheless Google Authenticator's permissions are in another league completely and one should probably be as suspicious of Google as Facebook. Version 5.00 can access: Camera take pictures and videos Other create accounts and set passwords full network access control Near Field Communication use accounts on the device control vibration
  - dx034 9y ago
    I guess it needs camera access to use QR codes? Maybe NFC falls in the same category. Not sure about the others though.
roadbeats 9y ago
The best decision I made in 2018 was to start a new year without Facebook. I deleted my account permanently.
creator_lol 9y ago
Facebook Insider: That is nothing compared to how Facebook uses your phone number on a another persons contact list then aligns that with cookie activity on your computer to get friend recommendations to other accounts that are unrelated to your phone number. The use of your personal phone number internally at Facebook is perverse.
- perfectstorm 9y ago
  If you block Contacts access on your phone (iOS/Android) can Faceboook still access your contacts ? Are you aware of any loopholes that lets Facebook access someone's contacts ?
  - mukundmr 9y ago
    WhatsApp says hello!
  - jobigoud 9y ago
    If some of your contacts have this enabled then they can rebuild the network. There was a case not so long ago where unrelated patients of a psychiatrist were suggested as friend to each other. The only possible link is that they all had the psychiatrist in their contact or vice-versa. The friending suggestion by itself was an outing of private medical information.
    - DoubleGlazing 9y ago
      My wife is a private practice speech therapist. She goes to great lengths to separate her personal social media from work social media. She has separate work and personal accounts for Facebook, Google, WhatsApp etc. Still she gets friend suggestions for her clients on her personal accounts. And it's not just once or twice, usually her suggested friends list is almost the exact same as her current client list. Its creepy, and slightly disturbing to realise just how much effort they are putting in to mapping out your life and acquaintances even when you try to prevent it.
    - perfectstorm 9y ago
freyir 9y ago
It’s a good thing they have Instagram and WhatsApp, because their flagship property seems like it’s going down the tubes. Those acquisitions were in 2012 and 2014 though. Wondering what’s next.
codemusings 9y ago
I think it's worth pointing out that all the screenshots I've seen so far are from iMessage. I too have 2FA activated but never got spam like this via text (I have an Android phone and no FB app installed, only Messenger). So I wonder whether it's specific to an iMessage plugin or something similar? EDIT: Apparently this is US specific.
modi15 9y ago
I suspect facebook is doing an even sinister version of this in India. It runs what is called an free mobile authentication service for startup called Account kit. A lot of apps use it to authenticate mobile numbers because it s free. However, I suspect that facebooks intention behind this are not charitable at all. With this service facebook is able to get your phone number even if you dont give it to it. As long as you have installed any app on your mobile phone which uses Account kit to authenticate, facebook will be able to get your phone number and associate with your facebook account. We talk about how Uber has lost the way, but somehow Facebook escapes all criticism. I think facebook is so lost at this point that they might as well shut the company down and go home.
skc 9y ago
Ahh, I got a friendly SMS "reminder" to log back into Facebook when I got a new phone. Haven't logged back into Facebook since I got the new device, primarily because I don't use Facebook all that often. But despite the outrage here, I can see the vast majority of Facebook users finding this sort of thing useful. I know it seems counter-intuitive but there are A LOT of people that use and like Facebook.
Sylos 9y ago
What's the legal situation for this in the US? Pretty sure, this is illegal in most of the EU already, but the GDPR will definitely prohibit it on the basis of the data clearly not being used for the originally specified purpose.
- kbart 9y ago
  I can't wait for GDPR to take effect and I won't be lazy to go through every f*ckin option on my Windows PC, Android phone, Google account etc. and report every bit that violates it. I see it as a revenge for all these years of dark UI patterns.
baybal2 9y ago
Have anybody believed to their pledge "to never spam you and only use it for ensuring your account security?"
- dx034 9y ago
  I did because other companies respect that. This is the first time I hear 2FA misused for marketing/engagement. I use my phone with Google, Dropbox and others and never received unsolicited text messages.

550 points by pinewurst 9y ago

FB (among other web sites) continually asks for my phone number. I continually ignore their entreaties. I always suspected they could not resist the temptation to use it like this. I really expected them to sell it to telemarketers.

eterm 9y ago
Not only asks but I've had it display what it thinks is my number and asked, "is this your number?". I've consistently denied telling it my phone number. Of course it has it via whatsapp now but I've repeatedly made clear I don't want it associated with my facebook account. Reading this news I'm very glad I've put up with its demands and not linked it just for 2fa.
- D-Coder 9y ago
  Call the President. PHONE NUMBERS: Comments: 202-456-1111. Switchboard: 202-456-1414.
jnbiche 9y ago
> I really expected them to sell it to telemarketers. reply I doubt they'd sell it to telemarketers, but they'll use it for every dark pattern under the sun to increase your engagement. Frankly, your engagement is much more profitable to them than a one-time sale of an email list.
- HankB99 9y ago
  They're not mutually exclusive.
  - dx034 9y ago
    Yes, because having exclusive access to that breadth of data makes it valuable. Once they share all their data it's not worth much anymore.
kaybe 9y ago
Did they stop asking for email login passwords? (I haven't been there in a while, this being just one of the last straws.)

stratelogical 9y ago

Unbelievable. When signing up for 2FA, FB never said what else it would be used for. From a legal standpoint, aren’t companies are supposed to say what the phone number will be used for when asking for phone number? Somebody from FB - please tell us this is a bug.

moonka 9y ago
Judging by how the response has been to companies leaking and abusing our data, I don't know that it will make a difference if it's a bug or intentional.
deleted 9y ago
[deleted]
GCU-Empiricist 9y ago
Sounds like a good reason to send the spam text message filing report. How much is the fine per incident?
- txsh 9y ago
  $0 if you own enough lobbyists and congressmen.
  - Slansitartop 9y ago
    That kind of response is too cynical, and just discouragement from actually trying to fight the problem.
    - deleted 9y ago
      [deleted]
    - twothamendment 9y ago
      Cynical? I'd call it realistic. If anyone wants to fight the problem, delete your account. That is the only value that you can take away from that company.

SamLevin88 9y ago

Finally, somewhere I can appropriately vent about this. About TWO years ago I was constantly annoyed by the 'secure your account: add your phone number here' banner frequently displayed at the top of the page upon loading FB, so I input my number to make it disappear for good. (Also, they kept hiding the 'x' (close) icon in different spots, making the banner difficult to dismiss.) A few days later I got a text message containing a Facebook notification. I was flabbergasted. What an EGREGIOUS misuse of personal information. Completely under the guise of account security... Facebook had in reality acquired another way to keep their brand under my nose. Naturally I was livid so I spent the better portion of the day scrubbing whatever sensitive information I could. Sure enough, the banner came back a few days later. And here we are. I realize that the proper solution is to terminate my account and never attempt to log back in.... but I've had my account since 2006 and despite the company's terrible practices, I'm really not interested in disconnecting for good at this time

mintplant 9y ago
I had a similar experience around a year ago, with Facebook texting me a notification out of the blue to the number I had set up for 2FA. In a show of futile-yet-satisfying passive aggression, I texted back "go away" to the robot... which promptly posted it as a status update on my timeline, to the confusion and concern of my friends until I noticed and took it down.
- RikNieu 9y ago
  What a brilliant dark pattern! Make people's assumed private snotty replies to them public and visible to their peers. They out passive aggressived you like a ninja.
  - code_duck 9y ago
    They have the advantage in the power balance of the relationship.
ASalazarMX 9y ago
> I realize that the proper solution is to terminate my account and never attempt to log back in I've had a "terminated" account that occasionally gets emails inviting me to "Log back in with one click". When I originally tried to delete the account, it told me it would be actually erased a month after. That was 6 years ago.

tomc1985 9y ago

Seriously, why do the rank-and-file of Facebook engineering allow this to happen? Does anyone stand up to their employers anymore? Or does everyone just drink the koolaid and ask no questions?

dizzystar 9y ago
If you personally won't do it, the person next you, or your replacement, may. Toeing the party line sucks at any job, but it's part and parcel to receiving a paycheck assuming you aren't doing something downright illegal.
- tomc1985 9y ago
  Used to be SWEs were so powerful that we could by virtue of the fact that replacing one costed so much But now, where juniors are hired by the dozen and internships are now a seeming requirement (internships being a worker's first -- and now mandatory, it would seem -- induction into drinking the techbiz koolaid), where lifers are getting more and more scarce... I guess you're right :/
a-priori 9y ago
These things are never spelled out in any plans. They're done piecemeal, by separate teams, incrementally over long development cycles. One team implements 2FA, and they add a way for users to enter their phone numbers as a second factor. The engineers are fine with this because it's for the users' benefit, so they can secure their account. Another team implements the mobile notifications, which a user has to turn on explicitly. The engineers there do this for the users' benefit, for those users that want notifications by phone. They're opting in, after all. Sometime in here, the fact that the phone numbers are being collected for 2FA gets forgotten. This sets the stage for a third team, who is tasked with improving engagement numbers. They see that lots of inactive users have phone numbers associated with their accounts. Maybe they might be interested in something their friends are doing? So they try an experiment where they send a notification to these users, and a large percentage of them engage with it! That must mean that the users were interested in the notification right? After all, they opened the link or replied. So they roll it out to a wider audience, and the engagement numbers go up. Awesome! Pats on the back all around. To be clear, I have no idea about how this actually happened, or if this is the right chronology, or anything else. It really doesn't matter, my point is that this is how this sort of thing happens in large organizations. No one has the whole picture, and in their own world view everyone thinks they're doing something good for their users. But if you put them all together, and sprinkle in a little willful ignorance, you get Facebook spamming their users on their 2FA numbers.

drpgq 9y ago

Facebook becomes LinkedIn

simonswords82 9y ago
I think you'll find LinkedIn is actually becoming Facebook.

davidbiehl 9y ago

I found a similar thing with email notifications. If you regularly login to FB and look at your feed they will leave you alone. Delete the app from your phone or neglect logging in and you’ll start to get email notifications about the silliest things. Of course they don’t contain much more than “so and so shared a link” without any description of what was shared (trying to get you to login and look.) Not quite as bad as 2FA number, but irritating nonetheless.

Slansitartop 9y ago
Facebook has been steadily decreasing the usefulness of its email notifications in order to push more use of its app and website. The old notifications used to give you the content and allow you to reply through email, but not anymore. The notifications are also dark-pattern hard to manage. If you don't want a type, you have to wait to receive an example of it to unsubscribe. Their central notification page only allows you to re-enable particular notifications, but give no way to disable them individually. Facebook is a terrible product that can't die fast enough.
- newscracker 9y ago
  > Facebook is a terrible product that can't die fast enough. For the sake of humankind, I'd rephrase it as "Facebook is a terrible company that can't die fast enough."
mintplant 9y ago
Back when I had the Facebook app installed on my phone, if I didn't open it for a long period the "so-and-so posted an update" push notifications would eventually slow to a trickle and ultimately peter out altogether. But if I so much as touched Facebook, the floodgates would re-open and I'd be spammed with them throughout the day, until the process repeated and they died away again. In a weird way Facebook ended up conditioning me to avoid using it.
tankenmate 9y ago
I have blocked all of FB's allocated networks worldwide on my machine (via a look up of allocated IP space and fed into iptables / ipset).[0] So FB doesn't even get "phantom" traffic from me (indirect traffic from FB logos / js on random websites). I only log into FB a few times a year and only via a temporary VPS in another country and using an incognito browser tab. So now FB has taken to emailing me complaining that they are missing me and that I should log in. :) WAYNE: I don't own A gun let alone many guns that would necessitate an entire rack. STACEY: You know Wayne if you're not careful you're gonna lose me. [0] https://news.ycombinator.com/item?id=15222936 https://news.ycombinator.com/item?id=15222936 EDIT: fixed link to go direct to the comment

loorinm 9y ago

This happened to me too. The value of being on facebook is an illusion. In person relationships are vastly more rewarding, both emotionally and financially.

endless1234 9y ago
Is that really something people do - substitute in person relationships for Facebook ones? "I could hang out with my SO today, but I guess I'll just go on FB instead"
- akvadrako 9y ago
  Many people do this habitually, though not so explicitly.
- loorinm 9y ago
  Well, every time you choose to do one thing, you also choose to not do a million other things. A lot of people are experiencing real harm to their mental state from habitual social media use.
davidcbc 9y ago
In person relationships being more rewarding doesn't mean that Facebook has no value. I personally get a lot of value out of being on Facebook
onychomys 9y ago
Many of us have family spread all over the country. I can keep in contact with them all via a facebook group instead of one at a time over the phone or group text (...not that my mother would understand how to do that) or the like. Even if you don't appreciate how it connects you to your friends (if it even does), surely you can appreciate how it can connect you to your family.
- Caveman_Coder 9y ago
  I completely agree. I don't use FB for anything other than keeping up with my family that live in different states. I don't have any casual friends on FB, and especially not co-workers. For seeing pictures of my nieces and nephews and various family gatherings that I can't be a part of FB works fine. But I don't follow any brands or willingly subject myself to advertising...all the stuff that FB wants you on their platform for I willingly ignore.

jeffdavis 9y ago

Network effects work both ways. Can cause a meteoric rise, or a dramtic decline.

ceejayoz 9y ago

If they're not processing STOP as an opt-out, they're in major violation of the CTIA's rules on short codes.

kelnos 9y ago
If you send a STOP, though, won't that cause you to stop getting 2FA codes as well?
- ceejayoz 9y ago
  I'm not sure if the rules carve out an exemption for that. If they don't, polluting the 2FA short code with other types of messages is doubly bad.
Meph504 9y ago
these aren't marketing campaigns and a part of your subscribed service, they aren't violating anything, and aren't required to process short codes in this case.
- ceejayoz 9y ago
  It's my understanding that any short code must respect the STOP wording as an opt-out.
politician 9y ago
They are also at risk of a TCPA violation for sending unwanted communications without consent.

duncan_bayne 9y ago

I really hope this is a sign of the end times for Facebook. I genuinely believe that the world will be better off without it, and its effect on culture, mental health, work habits, and socialisation. _Especially_ for young people.

darkstar999 9y ago
We might be seeing the (slow) decline of Facebook, but in no way will we see the decline of social media that causes those bad effects.
- duncan_bayne 9y ago
  Unless there is a sufficient cultural backlash for social media _in general_ to become 'uncool'. "Look at that loser. Spends all his time checking Instagram." Is it Machiavellian to wonder how we could memetically inoculate children against social media?
  - egypturnash 9y ago
    No. Not at all. We teach kids about a lot of dangers already. Some are real, some are highly exaggerated. For-profit social media is a thing we’re starting to realize may be a complicated, subtle danger. Maybe all social media. Maybe just corporate-owned social media.
    - duncan_bayne 9y ago
      Yeah, that's what I meant :) I run my own Mattermost server for friends and family.
  - ldiracdelta 9y ago
    It could become a low class thing like consuming soda.

jzl 9y ago

It's pretty clear from some simple googling that he ended up somehow activating a feature called "Facebook Texts" (the key giveaway -- that replying to the texts posted to his wall): https://www.facebook.com/help/130694300342171?helpref=faq_content https://www.facebook.com/help/130694300342171?helpref=faq_co... I believe that he didn't set this up intentionally and it may very well be a bug that caused him to be signed up, but as bad as Facebook is I'll eat my shoe if they signed up every single person who gave a 2FA phone number to this service. Not to detract from the fact that Facebook's nagging is indeed a huge problem.

deleted 9y ago
[deleted]
reaperducer 9y ago
> I'll eat my shoe if they signed up every single person who gave a 2FA phone number to this service. Facebook doesn't have to sign up every 2FA person. It can pick a few hundred or thousand and see what happens. If engagement increases, then more 2FA people are brought on board. If this isn't widespread, it may not be the user's fault. It may just be the camel's nose under the tent.
- akvadrako 9y ago
  The evil of unrestrained A/B testing.
  - throwaway2048 9y ago
    I've heard engagement increases if you give the impression a family member is going through a personal crisis, perhaps facebook ought to look into the technique, seems excellent for the metrics.
deleted 9y ago
[deleted]
skue 9y ago
No. Look at the following tweet. He explicitly says that he hasn’t enabled this and posted a screenshot of his settings: https://mobile.twitter.com/Gabriel__Lewis/status/963121814166630400 https://mobile.twitter.com/Gabriel__Lewis/status/96312181416... Update: Matthew Green just experienced the same thing, in the midst of tweeting about the security implications of abusing 2FA phone numbers this way: https://mobile.twitter.com/matthew_d_green/status/963766661466787840 https://mobile.twitter.com/matthew_d_green/status/9637666614...

Panino 9y ago

> Importantly, Lewis isn't the only person who claims this happened to him. One Facebook user says he accidentally told "friends and family to go [to] hell" when he "replied to the spam." Wow. I deleted my FB acct. 8 or 9 years ago because it kept getting worse and worse. It's just sad to read about it now. From my POV, Facebook is like a TV series that had an incredible first few episodes but quickly grew progressively and irreversibly worse, with a large percentage of its users only hanging on now with grim determination.

Caveman_Coder 9y ago
We've probably hit peak FB...or perhaps FB has jumped-the-shark using your TV series comparison...either way, any news about the decline of FB is good in my book.
- tomc1985 9y ago
  Like most products it started as something pure and simple, but once all the various business strategy dips got a chance to put their hands on it, it was ruined. Like so many things. It is so saddening that we nerds do this to ourselves, allowing the wonderful things we build to be ruined by foolish idiots, time and time again
- joering2 9y ago
  I believe we just getting into a period of social networks phenomena, where everyone is sick and tired of the big Facebook, and soon a fresh new thing will pop-up... This network will be smoother, nicer and smarter approach to social networks than Facebook is and will serve same users, just more mature. Sure few years ago FB was such giant that noone could touch it. But since then the cost of Cloud-computing and serving millions of connections per hour went drastically down, and its never been a rocket science to design and program basic social network. I just wonder if we already have such network and I just happened not to hear about it yet :)
spurcell93 9y ago
Literally the "walking dead" of internet products

_Microft 9y ago

Facebook has been asking me to add my mobile number to secure my account. It even prepopulated the input field with my mobile number that I never shared with them! My best guess is that their app farmed it out of the phone adress book of one of my friends. Either way, they definitely overstepped the mark here, in my opinion.

exhilaration 9y ago
Do you use Whatsapp? Unless you opted out during the short window they offered during the summer, Facebook got all your Whatsapp contacts and data, and that of course includes your phone number: https://www.cnet.com/how-to/how-to-stop-whatsapp-from-sharing-your-information-with-facebook/ https://www.cnet.com/how-to/how-to-stop-whatsapp-from-sharin...
- _Microft 9y ago
  I do not but a number of my friends are using the Facebook Messenger, Facebook App and Whatsapp.
- netsharc 9y ago
  It'd be very easy for Facebook to cross-reference multiple address books (even 1 would be enough) and create "virtual profiles". E.g. if Alice is not part of the Facebook/Whatsapp ecosystem but Bob, Charlie and Donna are, and they all have Alice's phone number (unique identifier!) on their phone. If all 4 hang out together a lot and Bob, Charlie and Donna upload a lot of pictures of all of them, and they diligently tag people who have accounts, then Facebook can probably figure out the 4th person (which face they've stored for their recognition engine) is probably Alice. And if Alice, like the poster, never gave Facebook her phone number, but Bob, Charlie and Donna have it under "Alice Lastname", and they're all friends with Alice Lastname on Facebook, Facebook can probably be certain to say "Store your phone number, we think this is it.". Or to word that properly, "Confirm your number, although we already know this is it."

dboreham 9y ago

Slightly related peeve: if you enable 2FA on Facebook they will never expire any existing browser cookie or mobile app token. Thus whoever gets their hands on your desktop or a device, even months into the future, will bypass 2FA.

gfosco 9y ago
That's not true, you have the ability in settings to see all old sessions and revoke device approvals. It's pretty easy to clear out your old machines.
- deleted 9y ago
  [deleted]
- mattmanser 9y ago
  If you remember and know where to look. Google eventually asked if I wanted to remove a phone I'd stopped using 2 years ago the other day.
  - JustSomeNobody 9y ago
    Google's is pretty easy: https://myaccount.google.com/ https://myaccount.google.com/ Under Device activity
    - dx034 9y ago
      Google also reminds me regularly to review app passwords. Facebook has never asked me to review a list of apps that I allowed to authenticate with.
- dboreham 9y ago
  True, because removal of _all_ existing sessions and tokens should be automatic when 2FA is enabled (you're saying to FB: I only want to be using FB if I've completed 2FA). Under what circumstances would the user want existing sessions to live forever on old devices? (I can answer that : they would want that when they were making their money from advertising "engagement").

wlesieutre 9y ago

Not as egregious, but Twitter last week started spamming my email once a day with a “HEY YOU SHOULD SIGN IN AND CHECK OUT YOUR NOTIFICATIONS” message. After 5 days of that I finally bothered to look. The notifications were about someone mentioning me in December. https://i.imgur.com/MaH7EcW.png https://i.imgur.com/MaH7EcW.png How about not doing that?

ninkendo 9y ago
The same thing happened to me a few weeks back when I got an email about my “twitter birthday” and how I should post something. I just deleted my account instead. I had the same thing happen with Facebook texting me to post after I turned all notifications off in settings, which was the final straw that got me to delete my FB account too. Now it’s a pattern I repeat everywhere: if your site emails me, I always will click unsubscribe, and go through every possible setting you have to stop you. If you email me again, I delete my account.

joewee 9y ago

Problem is Facebook is still using the original revenue model that has made it rich, which requires engagement. Unfortunately they encourage engagement using the techniques that initially made it grow, which the market is now tired of. Facebook needs to diversify. Take a note from amazon, Netflix.

cwkoss 9y ago
Engage on every sponsored post... but engage with it in a way that the advertisers will dislike. ex. Health product -> "I heard this product causes cancer."
- dang 9y ago
  I know you meant well, but please don't duplicate comments on HN. I'm sure that's why they were flagged. The idea behind this site is intellectual curiosity. That shrivels under repetition. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

chrisseldo 9y ago

I find it dissuading to read an article when the actual article itself is confined to <1/2 of the browser screen.

3pt14159 9y ago

Just get multiple phone numbers. It's easy these days and totally worth it. They're only $1 / month and being able to keep your real number separate from all these BS sites is great. Plus, for 2FA social engineers aren't going to get you just by working your network.

reaperducer 9y ago
Why exactly should I spend my money because Facebook can't behave itself? I'm not the problem; Facebook is.
fright01 9y ago
Google voice is a free phone number ;) I have a couple for 2fa if i ever truly want it. The danger of 2FA is that you are trusting your phone service provider. A semi-common hack is to socially engineer a phone provider into transferring the target's phone number from their service to your service provider under a false or stolen identity. Now you can control the phone number, tie it to your own device, and recieve the 2fa sms at your own device.

reaperducer 9y ago

Things like this are the reason that when a company starts spamming me, I update my account with the company's own information. I started when no matter how many times I tried to unsubscribe, Walgreens kept using my phone number (which is supposed to be used to verify that the right person is getting the prescription) to spam me flu shot notices, auto-refill offers, and more. So now those robocalls go to Walgreens HQ. Most companies list an email address and phone number for their PR departments on their web sites, so these are what I use since they're not hidden and go to real people. I know this doesn't work for 2FA, but it's certainly satisfying in other scenarios.

Faaak 9y ago
I do the same with B2B email spam. Just give another spammer's info, so company A spams company B, B spams C, etc. I've got a small list with CEOs emails, numbers, etc. Not legal, but I like it
- JankySolutions 9y ago
  It's not legal? What part is illegal?
  - Faaak 9y ago
    When a website offers you a quote about water fountains/new printers/whatever, I doub't it's legal to say that you're company X and that you'd be interested in this particular quote.
    - JankySolutions 9y ago
      I'd be interested in seeing a specific law or case where that sort of thing was illegal. Lying by itself isn't illegal (in the United States at least, i dunno about elsewhere)
- realusername 9y ago
  I generally use webmaster@[their domain] so they get the SPAM instead of me.

K0nserv 9y ago

Reposting my comment from the other thread: I’ve always been suspicious of services that use SMS as the primary 2FA mechanism. TOTP is more secure and convenient, but it doesn’t allow the service to collect and extra datapoint. Using a communication channel intended for security as a method to boost falling engagement is as shady as it gets. Matthew Green’s twitter thread[0] on this is an interesting read. 0: https://twitter.com/matthew_d_green/status/963766661466787840 https://twitter.com/matthew_d_green/status/96376666146678784...

SilasX 9y ago

Using 2FA number for ads? Are they doing it in Europe too? (Where there are harsh laws against using data for a purpose it wasn't collected for.)

davesque 9y ago

This happened to me a while back. So I disabled 2FA on Facebook.

crawfordcomeaux 9y ago

A platform created to addict people is now beginning to act like an addict begging for a fix? Can't wait to see what their rock-bottom looks like.

akvadrako 9y ago
MySpace, tumbler and digg are probably good examples.

azifali 9y ago

Someone added my phone numbers on 2FA and now I am able to login to their account, without a password.

jobigoud 9y ago
It's not really 2FA if you can login with just the one factor of the phone… Maybe you unconsciously reset the password to your own at some point and it's saved?
- azifali 9y ago
  Agreed. But its not even my account. I have similar things happening to me, except those messages are linked to my google voice number with someone else's account. One click and I am able to login. I had to block that number from receiving facebook updates.

deevolution 9y ago

Just reading this may have just pushed me over the edge to delete my account... except i need it to use tinder and bumble. I already havent signed in for months and i feel great. I only use messenger, but now im starting to see annoying ads polluting my messenger list.

cwkoss 9y ago
Whenever you see a sponsored post, engage with it in a way that the advertisers will dislike. ex. Health product -> "I heard this product causes cancer."
Impl0x 9y ago
Tinder no longer requires Facebook, I believe.
dx034 9y ago
You don't need to use your account. Not viewing ads hurts them enough and if you don't login they can't count you as an active user. The overall number of users is unimportant anyway and they won't delete your data, so no reason to deactivate the account.

AhtiK 9y ago

To break away from the newsfeed for good the most effective method is to just start unfollowing everyone and everything who appears in your feed. After a few days of satisfaction from clicking, the wall becomes 100% empty and stays so. Much more effective than deleting your account or exercising any other kind of self-control. Good luck with having the determination to start following everyone once again -- not going to happen.

0x00000000 9y ago
It used to be if you get a notification you could go into settings and "disable this type of notification". But they removed that screen and you still get shit even with EVERYTHING disabled. I really hope they get what's coming to them soon

fortylove 9y ago

As this stream of negative facebook articles continue, I can't help but feel duped about my experiences with it. I've quit fb since new years, but I can't help but wonder if I was played the whole time. I feel like they advertised fb as an altruistic platform, when in reality, I was just a means to marketing dollars and they fed whatever altruistic lines they wanted to keep me coming back. Serious question: does fb purely exist as a company in order to sell our information? Do developers at fb believe they're making the world a better place? I'm not saying developers _need_ to make their career about making the world a better place. I do, however, feel like that's the line fb was feeding about their company culture.

b3lvedere 9y ago
Take a real good long look in the eyes of Mark Zuckerberg. Take any picture or video you want. Just take a good look. Do you trust him?
gowld 9y ago
Every company exists to make money.
thephyber 9y ago
> I feel like they advertised fb as an altruistic platform Zuck's "Facebook's mission is to give people the power to build community and bring the world closer together" always felt like a stretch. If they were altruistic, they would be a B corp or a non-profit, not a Delaware-based C corp. Never forget that companies are run by Boards and that your data can be reappropriated if the company is merged with another. Hell, even Enron's mission statement was: > We treat others as we would like to be treated ourselves....We do not tolerate abusive or disrespectful treatment. Ruthlessness, callousness and arrogance don't belong here[1] > when in reality, I was just a means to marketing dollars and they fed whatever altruistic lines they wanted to keep me coming back. Meh. It's marketing. You typically don't tell the most attractive person your worst qualities when they first see you. You try to make a good impression by highlighting your more attractive qualities and staying quiet about the others. The NSA doesn't tell you it's watching all of your internet activity and correlating it to build profiles on you and your 6 billion fellow great apes. The NSA's marketing is to try and make you forget that it's there, one of the reasons it was dubbed "No Such Agency". When the CIA and the NSA do make their rare public statement, they talk about themselves as the "intelligence community". BP doesn't advertise itself as a cost-cutting, Deepwater Horizon spilling, exploding rig megacorp. They advertise themselves as the company that saved the Gulf Coast from near permanent economic collapse. VW doesn't advertise itself as a lying, massively polluting company that makes more cars than any other. They advertise themselves as the "people's car" that is small and cute and sleek. Oh, and they lied that one time, but they learned from their mistakes and they are making amends. [1] http://www.nytimes.com/2002/01/19/opinion/enron-s-vision-and-values-thing.html http://www.nytimes.com/2002/01/19/opinion/enron-s-vision-and...

riyakhanna1983 9y ago

I removed my number from my Facebook account when I realized that FB was linking my WhatsApp conversations to my FB account using my phone number and displaying ADs on my FB feed based on my WhatsApp conversations. What a desperate move by FB! losers! lol

danbruc 9y ago

The social media behemoth has seen a decline in traffic in recent weeks along with millions of users leaving its platform [...] Two years ago I said that Facebook will be dead by 2020 [1] and that line made me check the current situation, we are right on track and linear extrapolation still hits zero in mid 2020 [2]. As mentioned in the original thread, don't get fooled by the normalized numbers, the search traffic for Facebook is enormous and chances are good that any search term you consider popular will be indistinguishable from the horizontal axis if you add it for comparison. But »facebook« is already down from ten to four times »porn«. And yes, the trend can and possibly is at least partly due to other factors, some are also discussed in the original thread. [1] https://news.ycombinator.com/item?id=11442935 https://news.ycombinator.com/item?id=11442935 [2] https://trends.google.com/trends/explore?date=all&q=facebook https://trends.google.com/trends/explore?date=all&q=facebook

eterm 9y ago
Are you sure about that? https://trends.google.com/trends/explore?date=all&q=facebook,twitter,instagram,whatsapp,LinkedIn https://trends.google.com/trends/explore?date=all&q=facebook... and https://trends.google.com/trends/explore?date=all&q=facebook,google https://trends.google.com/trends/explore?date=all&q=facebook... Those graphs suggest that while the trajectory is bad on this graph, any other site doesn't come close.
- danbruc 9y ago
  Sure, the search traffic is huge but so is the rate it is falling at. If it stopped right now, it would still be a very huge site, but are there any indications that it does? Are there good alternative explanations for the decline in search traffic that would not indicate a decline in popularity of Facebook, for example can the decline be matched with users migrating from browser to app? I failed to find a satisfying alternative explanation. Besides that, I noticed a decline of the popularity of Facebook among the people I know at least about 5 years ago. I only looked at the search traffic for confirmation years later when that trend was pretty obvious from personal experience because I was interested whether that was a general trend or only due to me and the people I know becoming older or something like that. Add to that that I talked to some young teenagers last year that somewhat proudly told me that they don't have and never had Facebook profiles and for all I know Facebook really is on the way down. Whether everyone just moves over to Instagram and WhatsApp and what all that implies for the company Facebook is of course also a different matter.

horsecaptin 9y ago

Good time to remind everyone: If you are not the customer, then you are the product!!

Mc_Big_G 9y ago

Delete your facebook/instagram/whatsapp/<facebook owned> account asap. The sooner the better.

cwkoss 9y ago
Whenever you see a sponsored post, engage with it in a way that the advertisers will dislike. ex. Health product -> "I heard this product causes cancer."
dx034 9y ago
No reason to delete it. They won't delete your data anyway and they only count active users. Just not logging in hurts them as much as deleting the account.

shivamd 9y ago

I still get this, such a pain. I thought it would go away. But 3 months later, nope.

wand3r 9y ago

This is terrible and totally shit. FB had opt in by default spam notifications when I provided my number and as I stopped using the service regularly spammed my number. I turned off notifications and then the password reset link didnt work via phone. Also, the random intentional "security" interruption to force you to send a selfie to train their AI model.

jmcgough 9y ago

I experienced this a few months ago and it was the last straw for me - it really feels like they're willing to do anything to drive engagement and ramp up addiction. This was after I'd removed messenger and facebook from my phone (having them really push hard for me to use messenger creeped me out; it's obviously in order for them to track my location). I've crippled facebook via chrome extensions to the point that it's only a place for me to check messages and keep in touch with local groups/events, and I'm slowly moving off of it entirely.

thisacctforreal 9y ago
Consider trying https://mbasic.facebook.com/ https://mbasic.facebook.com/ It's a JavaScript-free version :) Also works with the Tor hidden service https://mbasic.facebookcorewwwi.onion/ https://mbasic.facebookcorewwwi.onion/

terlisimo 9y ago

I just remembered that I got an "password reset" email from facebook like a month ago? I didn't log in to my FB account since 2008 or so. For a minute I was baffled and thought someone might be trying to hack my defunct profile (but why?) and my instinctive reaction was to log in and reset the password but gave up and forgot about it. But now that people keep mentioning shady "come back, come back, to Mordor we'll take you" tactics, this sure smells fishy. Anyone else got an unsolicited PW reset email after not using FB for a long time?

bprasanna 9y ago
Yes, this follows the same strategy. All they want is to lure the user back. Either message will say reset password, or trouble logging in.

zodPod 9y ago

Seriously! It always drove me nuts that they sent emails when you didn't check your facebook regularly too. I used to get so many damn emails. "This person shared this." "This person liked this" etc and I didn't give a shit that's why I didn't check Facebook in the first place. So why the hell would I want a message about it? This is so much worse. I'm not checking facebook why the hell would I want a text about it?

beedogs 9y ago

A good way to avoid this is to stop using Facebook. I wish everyone would abide by this.

visualword 9y ago

Tangentially related, make sure to remove any phone numbers you no longer use. I started receiving sms FB notifications for another person's account (I'm guessing they switched numbers). The link in the message logged me directly into their account. I reported it, but they said this was expected behavior.

JustSomeNobody 9y ago

Between this and Onavo, I think FB need to check themselves. I only keep an FB account so I can check in on people easily, but I'm borderline tempted to just clear out of there and bring as many people as I can with me.

Feniks 9y ago

GDPR is looking better every day isn't it? Honestly I wouldn't trust Facebook with my cat's name.

booleandilemma 9y ago

How do I make it stop? They’re texting me updates about people I haven’t spoken to in years.

vadimberman 9y ago

OK, so my hunch was right. It's not only Facebook, BTW. Whenever you provide those "additional details" to "secure" your account, be sure there's a high probability they will be used elsewhere. In my case, I provided a personal email address to Azure as an alternative email. That email address had an Azure account associated with it. Microsoft merged the two accounts without me asking for it and (not very surprising) it caused some issues displaying the subscriptions properly to the point that their support asked me to create an empty subscription with a brand new email address.

ianamartin 9y ago

No fucking way. A company whose revenue absolutely depends on user engagement is coercing users into engaging with the platform. I'm shocked. Shocked to hear about this. I can't possibly imagine how this could've happened. It's time to rethink everything we know, rewrite C in rust, and put the social back in media.

dx034 9y ago
Misusing 2FA for "engagement" is indeed more than you should expect from any company. That looks very desperate and I haven't heard of other companies using these tactics.

cmurf 9y ago

I don't understand why they require your phone number to do 2FA, and prefer it over any OTP app like Google Authenticator. It's 2018 Facebook.

a_imho 9y ago
Maybe they like phone numbers. Nevertheless Google Authenticator's permissions are in another league completely and one should probably be as suspicious of Google as Facebook. Version 5.00 can access: Camera take pictures and videos Other create accounts and set passwords full network access control Near Field Communication use accounts on the device control vibration
- dx034 9y ago
  I guess it needs camera access to use QR codes? Maybe NFC falls in the same category. Not sure about the others though.

roadbeats 9y ago

The best decision I made in 2018 was to start a new year without Facebook. I deleted my account permanently.

creator_lol 9y ago

Facebook Insider: That is nothing compared to how Facebook uses your phone number on a another persons contact list then aligns that with cookie activity on your computer to get friend recommendations to other accounts that are unrelated to your phone number. The use of your personal phone number internally at Facebook is perverse.

perfectstorm 9y ago
If you block Contacts access on your phone (iOS/Android) can Faceboook still access your contacts ? Are you aware of any loopholes that lets Facebook access someone's contacts ?
- mukundmr 9y ago
  WhatsApp says hello!
- jobigoud 9y ago
  If some of your contacts have this enabled then they can rebuild the network. There was a case not so long ago where unrelated patients of a psychiatrist were suggested as friend to each other. The only possible link is that they all had the psychiatrist in their contact or vice-versa. The friending suggestion by itself was an outing of private medical information.
  - DoubleGlazing 9y ago
    My wife is a private practice speech therapist. She goes to great lengths to separate her personal social media from work social media. She has separate work and personal accounts for Facebook, Google, WhatsApp etc. Still she gets friend suggestions for her clients on her personal accounts. And it's not just once or twice, usually her suggested friends list is almost the exact same as her current client list. Its creepy, and slightly disturbing to realise just how much effort they are putting in to mapping out your life and acquaintances even when you try to prevent it.
  - perfectstorm 9y ago

freyir 9y ago

It’s a good thing they have Instagram and WhatsApp, because their flagship property seems like it’s going down the tubes. Those acquisitions were in 2012 and 2014 though. Wondering what’s next.

codemusings 9y ago

I think it's worth pointing out that all the screenshots I've seen so far are from iMessage. I too have 2FA activated but never got spam like this via text (I have an Android phone and no FB app installed, only Messenger). So I wonder whether it's specific to an iMessage plugin or something similar? EDIT: Apparently this is US specific.

modi15 9y ago

I suspect facebook is doing an even sinister version of this in India. It runs what is called an free mobile authentication service for startup called Account kit. A lot of apps use it to authenticate mobile numbers because it s free. However, I suspect that facebooks intention behind this are not charitable at all. With this service facebook is able to get your phone number even if you dont give it to it. As long as you have installed any app on your mobile phone which uses Account kit to authenticate, facebook will be able to get your phone number and associate with your facebook account. We talk about how Uber has lost the way, but somehow Facebook escapes all criticism. I think facebook is so lost at this point that they might as well shut the company down and go home.

skc 9y ago

Ahh, I got a friendly SMS "reminder" to log back into Facebook when I got a new phone. Haven't logged back into Facebook since I got the new device, primarily because I don't use Facebook all that often. But despite the outrage here, I can see the vast majority of Facebook users finding this sort of thing useful. I know it seems counter-intuitive but there are A LOT of people that use and like Facebook.

Sylos 9y ago

What's the legal situation for this in the US? Pretty sure, this is illegal in most of the EU already, but the GDPR will definitely prohibit it on the basis of the data clearly not being used for the originally specified purpose.

kbart 9y ago
I can't wait for GDPR to take effect and I won't be lazy to go through every f*ckin option on my Windows PC, Android phone, Google account etc. and report every bit that violates it. I see it as a revenge for all these years of dark UI patterns.

baybal2 9y ago

Have anybody believed to their pledge "to never spam you and only use it for ensuring your account security?"

dx034 9y ago
I did because other companies respect that. This is the first time I hear 2FA misused for marketing/engagement. I use my phone with Google, Dropbox and others and never received unsolicited text messages.