18 ms·
Facebook won’t let you opt out of its phone number ‘look up’ setting
- bayesian_horse 8y agoI'm mostly for privacy laws and recognize the importance. But I am also a data scientist and I have been involved in corporate compliance to GDPR for relatively small businesses, and it is definitely a pain. Maybe even more so for those small businesses who perhaps just want to send out a newsletter. That compliance is pretty expensive, and it contributes only very little to the individual privacy. Again, I'm mostly in favor of privacy regulations, but gosh, it's annoying at times!
- microcolonel 8y agoI don't see what that has to do with this. They just need to not implement the feature this way. Don't put the 2FA number in the search index, just don't do it. By all means make it convenient to copy it there, but for the love of god do not put the 2FA number in the search index.
- snaily 8y agoHow is this related to an article that doesn't even mention GDPR?
- TwelveNights 8y agoWhether or not it's a pain for businesses to comply has nothing to do with the reason these types of laws are implemented. Regulation is a pain, but that doesn't mean that we shouldn't have it. Protecting personal data is the priority when it comes down to it.
- kpcyrd 8y agoI've designed an OSINT system with this specific feature in mind (it's on github since a few months). Basically being able to go from phonenumber->accounts is very powerful and works even more efficiently to identify a person than an email address or even a real name. The abuse potential of this is far greater than some people assume.
- whazor 8y agoPlus you can look up the phone provider which probably makes banning spam accounts a lot more easy.
- dpacmittal 8y agoCan you post the link to your project?
- plopz 8y agoMy guess is https://github.com/kpcyrd/sn0int https://github.com/kpcyrd/sn0int
- cmg 8y agoIt appears to be this: https://github.com/kpcyrd/sn0int https://github.com/kpcyrd/sn0int
- WrtCdEvrydy 8y agoIt's probably https://github.com/kpcyrd/sn0int https://github.com/kpcyrd/sn0int
- andreilys 8y agolink?
- snek 8y agodoes facebook support otp 2fa, or just sms
- sanxiyn 8y agoFacebook supports OTP 2FA. Use it.
- sanxiyn 8y agoJust delete the phone number. You can use two factor authentication with OTP, SMS part is unnecessary.
- StudentStuff 8y agoDeleting the data in your account settings isn't going to necessarily remove it from Facebook's database. Getting a vanity number that spells your first name or nickname would be a better workaround IMO, and you can set business hours and such to control your potential employer's access to you :P
- sanxiyn 8y agoI believe GDPR specifies right of erasure, and if Facebook doesn't delete the phone number you "deleted", Facebook will face much larger problems.
- StudentStuff 8y agoMy comment was fairly US-centric, as we don't have GDPR. In the EU that'd be much more useful, as the cost of phone numbers in Europe and calling rates vary wildly, and can be quite exorbitant in some countries.
- davegardner 8y agoFacebook still operates as a business in the EU and can therefore be fined there. As a similar example, Google was fined €50 million earlier this year as a result of a GDPR violation.
- StudentStuff 8y agoCan Facebook be fined by the EU for actions outside the EU that only affect users outside the EU? Sure, but it would likely create political waves and I'd doubt it'd happen. Global enforcement of GDPR isn't realistic, as the EU doesn't have worldwide jurisdiction.
- superkuh 8y agoThere is an easy way to opt-out. Stop using Facebook.
- 6nf 8y agoDo you know how I can tell that you didn't read the article?
- skilled 8y agoHow?
- deleted 8y ago[deleted]
- hopler 8y agoDeleting one's account does appear to be a mitigation
- superkuh 8y agoThese constant articles are like watching someone stick their hand on a hot stove and complain over and over that it hurts. But try suggesting they take their hand off the burner and nope, freak outs and/or insults. It really is an option. It really is the best option. It isn't flippant or sarcasm.
- tomhoward 8y agoIt may not be a great loss to you, but for many people, deleting Facebook would come at a great cost. Facebook has done a sufficiently good job of intertwining itself into people's lives, so that to abandon it would mean losing touch with family and friends, missing out on invitations to events, excluding one's self from valued discussion groups and more. What people resent is that Facebook seems to hold people to ransom like this, now they've made people so reliant on it. So, sure, people can just leave, fine. But don't diminish the fact that for many people, quitting Facebook would have serious drawbacks.
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- potatofarmer45 8y agoThis will make keeping your social media private during recruiting much much harder because rather than trying to search for your name on FB or your email, an interviewer can just search your listed contact number. Names are often not unique but phone numbers are. This matters because creating a new email account for recruiting is trivial, yet creating a new phone number for recruiting is not. Most phones are not dual sim, and you want to have a phone on you in case the recruiter or future employer calls. Hence the account id rate using a phone number should be much higher and makes it dramatically easier to find somebody. The nasty part is even if you rename your account to your "first-name middle-name" or an alias, you could be found out via phone number search. So simply renaming your account no longer ensures random recruiters can't just find your profile. Your FB name could be "giant blue monkey" which prevents a regular name search but would still be identifiable via phone number search.
- StudentStuff 8y agoI think VOIP has great untapped potential for this, having helped many people get vanity numbers with their name embedded. Once the job hunt is over, you can literally reject all calls, and build a caller ID blacklist of spammy companies and recruiters. Plus, numbers are 1/4th to 1/10th the cost of domains these days.
- TheSpiceIsLife 8y agoIt works the other way too. I keep blocking spammy numbers, and they keep creating new ones.
- sokoloff 8y agoAre they? I pay $1/mo for phone numbers, which is quite close to what I pay for most of my domains.
- disiplus 8y agophone numbers cost close to nothing to operators, but running a voip infrastructure hast its costs, and a lot of those costs come from protecting it from hacking attempts. They love open pbx boxes where they can generate a significant cost, or use to spam others. also compassion with domain is not exactly fair in this case, it would make more sense to compare it to ip address.
- sn_master 8y agoThis seems just as bad as the bug they had before, where if you entered your email but not password correctly it would show up your real name. The potential for abuse by spammers is too high. They not only would know who they're calling, but also all the public info on their Facebook profile and whatever else they can stitch it with.
- snarfy 8y agoGlad I never gave them my number.
- 6nf 8y agoDon't worry someone in your circle of friends already handed it over.
- pfarnsworth 8y agoExactly. It takes just one person who knows your phone number to upload their entire contact list and it's saved. The likelihood that Facebook doesn't have your phone number and name is 0% unless you don't have a phone number.
- SalimoS 8y agoCan’t understand the downvote as im thinking the same Anyone care to explain if it’s wrong how and/or why ?
- swish_bob 8y agoIt's worse than that. If you gave them your phone number, you can ask to see it and have them to erase it. If one of your contacts gave them your number, it's _their_ data, you cannot get Facebook to confirm they have it and you can't ask them to remove it ...
- jsemrau 8y ago'ye old 'sync your address-book' trick.
- wtmt 8y agoYou can't be sure that Facebook doesn't have your number unless you have never given your phone number to anyone who uses Facebook and has your name and phone number. They could be friends, co-workers, relatives, delivery people, cab drivers and many other service providers. One of them shares their address book with Facebook and it knows. A few of them share their address books with Facebook and it's reasonably sure what your number is (names can be fuzzy matched to your profile).
- Taniwha 8y agoA slightly off-topic question - how the hell do you contact Facebook if you don't have a Facebook account? Someone has registered a Facebook account using my email address (apparently they do no verification at all) and I can't stop the spam ....
- pfarnsworth 8y agoRequest an new password, and then change the password on the Facebook account. I've done that myself.
- Taniwha 8y agowell - I did that .... and changed the email address to a dummy account .... and still they send me almost weekly spam to the old address - "Why aren't you using FaceBook? here's a single link you can use to log on without a password" ... these bozos have no concept of security
- Taniwha 8y agoOr rather I should say "these bozos have no concept of their customer's security" .... but I guess we all knew that already
- ashelmire 8y agoBut at least they can solve graphing problems!
- geomark 8y agoSounds like what has been happening to me. Except when I try to login to nuke the thing I get some error message about a database error and can't login. So the Facebook spam about new friend suggestions etc keeps coming. But since I have always marked it as spam it usually goes straight to the spam box.
- pfarnsworth 8y ago
- Lewton 8y agoI refused the 2FA nag on Facebook because I didn’t want them to have my phone number Then after a while the nag started popping up with my phone number already filled out. Really fucking creepy and not okay.
- ladberg 8y agoSame here. I put my phone number in my Facebook profile when I first made it years ago and have since "removed" it. However, I'm pretty sure removing it does literally nothing because it will still pre-fill my phone number in that case and I'd bet money that advertisers targeting by phone number. Still, they're constantly nagging me to re-add it.
- skybrian 8y agoFor what it's worth, I just deleted my phone number and added Google Authenticator, and it seemed to work fine.
- Lewton 8y agoJust to be clear. My phone number is not tied to my account, Facebook got my phone number elsewhere and suggested that I tie it to my account
- kevin_b_er 8y agoFacebook got it from your own friends or associates. Such information gathering forms the "shadow profile" on Facebook.
- Daniel_sk 8y agoAdd an authenticator app and delete the phone number.
- C1sc0cat 8y agoMight be your browser doing that.
- wtmt 8y agoOk, so Facebook has yet another appalling practice that's been known for quite sometime (see the Telegraph article linked in this one). The percentage of users boycotting the company and its products don't seem to materially matter. Facebook is making more money now than before. Facebook will not behave well on its own. Regulation and really hefty fines running into a low double digit percentage of revenue (not profits) are the answers!
- deleted 8y ago[deleted]
- ru999gol 8y agohahaha thank you, the thought of republicans or democrats effectively regulating a predatory corporation for malicious business practices made me laugh out loud :D
- dandare 8y agoEU and GDPR.
- WrtCdEvrydy 8y agoI mean, Democrats have tried it in the past.
- dgellow 8y agoIsn’t it the same for Twitter? I tried recently to create a second account, it’s now impossible to do so without specifying a phone number during signup. And the mobile application was trying to access my contact list, which seems to be used to suggest people to follow by looking for their phone number (see https://help.twitter.com/en/using-twitter/upload-your-contacts-to-search-for-friends https://help.twitter.com/en/using-twitter/upload-your-contac...).
- Vinnl 8y agoI think there's a "Sign up with email" link on Twitter. Though of course, every time I created a new account there it was quickly blocked, only allowing me to unblock it by providing a phone number. That might have to do with a number of privacy-enhancing browser extensions I've got installed. That said, thanks to GDPR, I'm relatively confident that they've actually deleted my phone number when I asked them to after verification.
- dgellow 8y agoWhere do you find this “signup with email”? I don’t see it, but I may be looking at the incorrect place
- Quiark 8y agoHow do we coordinate outrage at facebook for this and many terrible things they've done?
- efiecho 8y agoWhy coordinate outrage? So they will "learn" and do better in the future, HAHAHA. Seriously, just delete your account, no one needs Facebook even those that make up ridiculous excuses for why the can't leave Facebook.
- logfromblammo 8y agoI don't trust them enough to just delete the account and leave it. I go on once every six months to delete everything I can reach with my name attached to it, that is older than six months, and leave a single "I'm still alive, but don't try contacting me via Facebook, as it will have up to six months latency" post. For a while, it was extra-creepy whenever I did a semiannual log in, because pop-ups would appear, and in a very distinctive "Audrey II" voice, scream "FEED ME [your data], SEYMOUR!" But the last time I tried it, I didn't see that. Can't tell whether they gave up, or already got the data from other people and just don't need me any more. Delete your history, starting from the oldest thing you can see. Un-like everything you liked. Un-tag everything you are tagged in. Remove your photos. Replace profile pic with a public domain image. When you finally get to zero, log out and delete all cookies and block all bugs and trackers. Then start increasing the time between log-ins. When you get the nag e-mails to come back, go on just long enough to turn off nag e-mails. Wean yourself off until you don't care about being on Facebook any more. Then you can use Facebook on infrequent occasions, to tell all your still-trapped friends about all the other ways to contact you that have lower latency, better signal-to-noise ratio, and more privacy. If you just delete, that leaves a you-shaped hole in Facebook that the company could fill with a placeholder. Your character might become an NPC that the game-master could control to manipulate the other players.
- ascorbic 8y agoThis is surely a breach of GDRP. One of the principles is that data must only be used for the purpose for which it was collected. Taking a number provided explicitly for 2FA and using it for search certainly sounds like a breach.
- dandare 8y agoI hope this will end up with a hefty penalty. At this point, I believe a strict regulation is the only way to tame the Facebook beast - the more so because I heavily really on FB to be in touch with my family and friends.
- koheripbal 8y agoIt might not given that the impetus of this change is to combat fake news and bot accounts from nation-states. ...so it might not be high on the target list for the EU since they are actively uncovering more influence operations. You have to realize that privacy is not a priority for most governments, so unless it's explicitly against the rules, I suspect they won't do much.
- breatheoften 8y agoWhat does GDPR say about using data about other people provided by a user (eg a Facebook user who shares their contact info — thus providing Facebook info on all their contacts). What is the “intended purpose” of sharing all your contact’s details ...?
- dwild 8y ago> What is the “intended purpose” of sharing all your contact’s details ...? That's Facebook job to make it clear when it happens. I don't know the actual text of law, but I guess even if you are friends with someone, you doesn't have any right over any of it personnal data, thus they wouldn't be able to use it except if you previously accepted that usage (being matched with someone you know using that phone number).
- rocqua 8y ago
- tobr 8y agoIf you are a Facebook employee, or are close to one, please help me understand. How does it feel to see reports like this being released almost weekly? I realize people are very good at dealing with moral dissonance when their paycheck depends on it, but surely you must be thinking, talking to your colleagues, about what your personal responsibility in this is?
- ahelwer 8y agoThey don't care. A job at Facebook is still considered prestigious by a large part of the tech community. They're starting to be grouped more with Palantir than Google, though.
- deleted 8y ago[deleted]
- justinclift 8y ago> They're starting to be grouped more with Palantir than Google, though. That's confusing. Is Palantir regarded as better or worse than Google?
- scottlocklin 8y agoI think most people consider google more prestigious. While they'll try to convince you otherwise, it's mostly because google pays better.
- TheKarateKid 8y agoPalantir is known to do lots of government contracting for US defense/anti-terrorism intelligence, so working there is viewed much like working for Lockheed Martin/Boeing/etc. where it is known the work you are doing could very well be involved in wars/military agendas. Your role in your job there could cross the line of what some people would as ethical to some people, and Facebook's malicious behavior is making employees who work there to be viewed in a similar light.
- bertil 8y ago
- iliketosleep 8y agoUsing security to further weaken privacy (quote from Zeynep Tufekci in the article) aptly sums up the method countless companies have been using to violate user privacy. It's essentially a form of fraud - obtaining private information on a false premise. It'll be a good test for GDRP - let's see if there's actually some accountability.
- bwann 8y agoYour friends already know what your phone number is
- virgakwolfw 8y agoThat's why I don't put it in there.
- Freak_NL 8y agoDon't worry, your friends will help Facebook fill in the blanks with their smartphone address books. There is bound to be some Facebook-connected app (WhatsApp perhaps?) they use that does link your Facebook identifier with your phone number.
- Tsubasachan 8y agoOkay so we finally killed off the telephone book and now Facebook reintroduces it? And you can't even opt out? My policy of never giving out my phone number to an American company proves wise once more.
- r3bl 8y ago> Facebook spokesperson Jay Nancarrow told TechCrunch that the settings “are not new,” adding that, “the setting applies to any phone numbers you added to your profile and isn’t specific to any feature.” They're not joking when they say this isn't new. I remember a situation while I was still in high school (2011-2012 maybe?) in which someone tried to prank me by sending me SMS from a number I didn't have. I figured out exactly who it was using a simple Facebook search. The best you could do even then was to set it to friends-only, and the prankster didn't do that.
- wisienkas 8y agoThis is going to be interesting in EU where this is not allowed in such way. I believe fines are given as percentage of overall turnover. meaning expensive no matter the size of the company.
- jamisteven 8y agoBeen warning people about this for years. Every major social media company has been pushing this shit as "security", when in reality its whats known in intelligence circles as "linkability". The more points of verification, the better a profile can be built to associate an actual identity with an email address, screen name, username, alias, etc. Snowden warned everyone about this, nobody listened.
- annadane 8y agoHow many other social media companies? Curious.
- kpcyrd 8y agotwitter also aggressively collects your phonenumber. Telegram is so aggressively anti privacy that I tried around 5 numbers I own and only 2 of them worked.
- vokep 8y agoWhile this is true, is 2FA not generally a good thing? SMS verification increases linkability maybe, but a yubikey or something similar?
- thisisit 8y agoThis article which is based on tweets by Jeremy Burge was posted earlier on HN: https://news.ycombinator.com/item?id=19291987 https://news.ycombinator.com/item?id=19291987 Surprisingly, it didn't generate discussion or upvotes like this particular submission.
- conmarap 8y agoIsn't this a violation of gdpr? And if it is, how have they not been sued yet?
- JustSomeNobody 8y agoGood thing I never gave them a phone number.
- Proven 8y agoYou can choose to not use FB. In case you can’t handle the way it works....
- cmsonger 8y agoFacebook doing something ethically questionable again. Must be a day ending in "Y".
- jplayer01 8y agoThey own WhatsApp, which is integral to having a social life in Germany. So they already have my phone number.
- assblaster 8y agoYou don't need WhatsApp to have a social life anywhere, even in Germany. There's something seriously wrong with society if an app owned by a malicious tech company is considered fundamental to the human experience.
- def_true_false 8y agoIt's only a problem when there is large enough majority of people that use the same network. It becomes easier to just not bother with reaching out to people on other networks, so then everyone has to use that one or be left out. In most countries it's Facebook (still), in a few it's Whatsapp or Telegram.
- jplayer01 8y agoTell that to everybody I know who uses WhatsApp to communicate and coordinate.
- maehwasu 8y agoOut of all possible choices, you can be sure FB will choose the worst one. I was a user since 2004, deleted last year, and never looked back.
- CamelCaseName 8y agoI'm a bit confused at the alarmist title. I just checked my FB settings, and the article is correct, the best you can restrict your phone number is to just friends. Why then are the top comments about the inescapablility of employers looking you up by phone number? Unless you have your employer as a friend on Facebook, just change the setting to friends only. My understanding is that on this setting, Facebook only allows someone to find your Facebook profile if they: 1. are your friend on FB and 2. have your phone number. That seems quite reasonable to me.
- hopler 8y agoThe article disagrees with your understanding. "Facebook’s default setting allows everyone — with or without an account — to look up a user profile based off the same phone number " For the vast majority of people who aren't on TC/HN, it's a surprise. Once info is leaked, it doesn't get unleaked. It's not just this once incident, it's a pattern of Facebook abusing user trust and chronically launching new features that leak private or semiprivate information by default and destroying the culture of security industry wide by showing users that account recovery phone numbers are not safe to use.
- SmellyGeekBoy 8y agoThis setting restricts the visibility on your profile page. The article claims that someone who already knows the number can type it into the search box and your profile will pop up. (No idea whether this is true either way and I'm no longer on Facebook to be able to check; just trying to clarify).
- dannykwells 8y agoI literally just had someone comment on a different post "There's nothing else shady happening at Facebook, we know it all now" - LOL. Facebook, and Facebook uniquely (although Google too), must be regulated by world governments, and citizens must be protected from it through GDPR like rules.
- Stubb 8y agoWho in their right mind would give Facebook their phone number in the first place? Seriously…did people not expect Facebook to sell it to anyone with two pennies to rub together?
- pier25 8y agoI seriously doubt the vast majority of Facebook users would think about that.
- Stubb 8y agoThe corporate motto for my next business is going to be: "People are not that bright."
- pier25 8y agoWhile I tend to agree... it's also fair to say most people won't care about stuff outside their area of interest. For example I know nothing and don't care about car stuff. I just leave the car at the mechanic, pay, and have to trust they did a good job.
- mrguyorama 8y ago"I have nothing to hide" is a stupidly strong public mindset
- jimsmart 8y agoI'm pretty sure initially they said the number was only used for two-factor authentication. Who in their right mind wouldn't want two-factor authentication? Particularly as other sites were offering it (and haven't changed their terms), and a significant portion of the tech press were saying it's a good idea — and it plainly is a good idea, of course.
- logfromblammo 8y agoI have been considering this off and on over many years, and I'm starting to think that others in this community may have done so as well: I want to ditch all my phone numbers, and replace them with addresses and identifiers that I can control myself. It seems as though if a group of people all had the same app installed on our phones--like Signal, or something similar--we could bypass the phone number system, and set up our own audio-chat sessions over the data connection. If anyone else wanted to talk, they would also need to have the same app, or use its API, and add my contact information. That would add quite a bit of friction to person-to-person communication, but I kind of want that now, as it would also add equal friction to robot-to-person communications. But it isn't exactly easy to get a mobile data network connection without also buying in to the phone network addressing system. Everywhere I look, in the realm of security breaches and vulnerabilities, a large number of exploits use the public switched telephone network, or its addresses, to compromise the security of the people forced to use them by network effects. Many of the others exploit email addresses on the large providers--apple.com, gmail.com, yahoo.com, hotmail.com--which are popular due to ease of use, and the difficulty involved in getting mail delivered from a private domain to someone using addresses from those providers. I get the impression that if I set up a phone to ring on a SIP request to 'myhomephone@mydomain.example.com' instead of something like '2125551212@voipprovider.example.com', it would never get robo-dialed calls. But it would also never get calls from people I might want to speak with, because their phones can only call phone numbers. What's the way out of this trap? How do we stop jackasses from jumping into the middle of any private communications we might wish to have, in a way that is also easy enough to use that nontechnical relative can use a prepackaged setup for it?
- rootusrootus 8y agoI don't recall giving them my cell phone number, though I do remember being nagged about it incessantly. Just went and looked and sure enough, they've got it. So I deleted it. The account, I mean, not the phone number. I haven't been active on FB in a while and it's no loss to me.
- poppy_h 8y agoIn 2013 (or 2014?) facebook had my cleaning lady's husband in my friend suggestions. I had never met the guy IRL, no friends in common, and had only spoken to him over text (from what I remember there was something about her not speaking English well so I'd coordinate with him instead). I remember being surprised at the time, but thinking, ok, so they are using phone numbers to link people. All that to say, doesn't sound like a new thing to me.
- daveheq 8y agoI added a fake number because they wouldn't stop asking me for it, and now it just occasionally asks for it. There's no reason they need it, and I don't even put my real name on there. If you wanna not hire me because of that, your loss.
- webninja 8y agoI wish there was a way to prevent Facebook from continually uploading every photo I have ever taken on my iPhone to Facebook’s servers.
- ListeningPie 8y agoThe article says you set the lookup to only work for friends. That means that no one that is not a friend can find you based on a phone number. Can someone explain why everyone is getting worked up? All the comments refer to being findable to strangers and stalkers by phone number but that’s not the case.
- GuillaumeBrdet 8y agoFacebook disappointment of 2019: #24 What will it be tomorrow? We should also make a list so someone can actually see the number of things they do within a year alone.