4 ms·

The article mentioned ClearBit, which does a clever (too clever?) way of showing you the Facebook profile, Linkedin profiles, etc given just an email address.

The article mentioned ClearBit, which does a clever (too clever?) way of showing you the Facebook profile, Linkedin profiles, etc given just an email address. I've tried it with an email address I've never publicly disclosed anywhere, and amazingly it works. It found the FB profile linked to that email. I always wondered how ClearBit knew that information. Were they the "malicious actors" Facebook was referring to in their announcement last month?[1] [1] "Malicious actors have also abused these features to scrape public profile information by submitting phone numbers or email addresses they already have through search and account recovery": https://newsroom.fb.com/news/2018/04/restricting-data-access/ https://newsroom.fb.com/news/2018/04/restricting-data-access...

deleted 9y ago
[deleted]
ikeboy 9y ago
If you do it on demand instead of in bulk it isn't abuse. I could take your email and search Facebook myself, or could have before they removed the feature anyway
- AznHisoka 9y ago
  What if you do it on demand, and in an automated manner? I submit 1000 emails to Clearbit and they do 1000 automated lookups in FB. Is that abuse?
deleted 9y ago
[deleted]
nl 9y ago
Have you ever sent or received an email using that address? If so the person on the other end may have given access to their address book/contacts.
- AznHisoka 9y ago
  But how would Clearbit know the Facebook profile linked to that email address? The only way is: 1) Scraping Facebook by automating the process of searching for FB profiles based by email (most likely) 2) Having access to the same API Cambridge had years ago, where it's possible they downloaded the data from someone that had me in their friend's list (unlikely, this profile has ZERO friends :) Of course if you ask Clearbit this, they'll hide behind the guise that they just look at publicly available data, or they bought it from a "trusted 3rd party". Where does the rabbit hole lead?
- pc86 9y ago
  That doesn't explain the link to Facebook at all though.

deleted 9y ago

[deleted]

ikeboy 9y ago

If you do it on demand instead of in bulk it isn't abuse. I could take your email and search Facebook myself, or could have before they removed the feature anyway

AznHisoka 9y ago
What if you do it on demand, and in an automated manner? I submit 1000 emails to Clearbit and they do 1000 automated lookups in FB. Is that abuse?

deleted 9y ago

[deleted]

nl 9y ago

Have you ever sent or received an email using that address? If so the person on the other end may have given access to their address book/contacts.

AznHisoka 9y ago
But how would Clearbit know the Facebook profile linked to that email address? The only way is: 1) Scraping Facebook by automating the process of searching for FB profiles based by email (most likely) 2) Having access to the same API Cambridge had years ago, where it's possible they downloaded the data from someone that had me in their friend's list (unlikely, this profile has ZERO friends :) Of course if you ask Clearbit this, they'll hide behind the guise that they just look at publicly available data, or they bought it from a "trusted 3rd party". Where does the rabbit hole lead?
pc86 9y ago
That doesn't explain the link to Facebook at all though.