6 ms·

Heads up: when Facebook asks you to give them your phone number to "prevent you getting locked out of your account", they really just want it so they can identi

Heads up: when Facebook asks you to give them your phone number to "prevent you getting locked out of your account", they really just want it so they can identify your other profiles in datasets they've bought/own (e.g. WhatsApp). If you've ever given the service your number, you should consider your real identity linked to it.

dvtrn 7y ago
Brings to mind a question, I've got a throwaway google voice number for precisely this reason, some services will let me use it, others (even Google-tried using a GVoice number as a recovery phone number for a gmail account for my grandmother, nothing doing) wont, few just throw back a generic error, others will say they don't allow virtual DIDs. Someone's going to say that's to cut down on fraud/increase security, right? Yet these services are going to (against many in the InfoSec world who are screaming "STOP DOING THAT") use SMS as a means of 2FA... I'm a bit confused where the value add is for account security in making virtual telephone numbers such a hit or miss.
- jethro_tell 7y ago
  Real security is picking a unique password and not forgetting it. Letting someone handle your security by giving them your phone number in case you can't handle it was never a good idea. Get a password safe, and don't forget your complex passwords.
  - derefr 7y ago
    2FA (through an third-party like an email provider or, even, dare I say it, an SMS provider; not TOTP) continues to protect you when your password is compromised by a backend-side database breach. They might get your password; they might get your TOTP token seed; but there's nothing in the DB that will allow them to receive an email as you and then click the link in said email. Yes, allowing someone to reset their password through a second factor is bad; but that's not 2FA, that's two independent 1FAs.
    - jethro_tell 7y ago
      This is a good distinction and absolutely right. The problem comes when people substitute good passwords for 2fa resets via phone. The problem with that is that the majority of usage now comes from the phone, so it's not really a second factor if you lose your phone. It's a complex problem that depends on the situation and really too complex to make a matrix of when it's ok for your average Joe. Passwords suck, and we still use them, because as a general rule, it's the best thing we have.
chrisseaton 7y ago
> you should consider your real identity linked to it What is the point of these products if not linked to my real identity? That’s the whole idea of them. I use Facebook and WhatsApp to talk to people who know me. That’s why they want to talk to me. If they didn’t know my identity they would want to talk to me.
- codazoda 7y ago
  WhatsApp was specifically designed to be encrypted and private. Facebook, however, seems to play fast and loose with data. Sure you can talk to John Doe, but you might hope no one else knows that you're talking to John or what you're talking about. Useful, for example, to report a government conspiracy to a reporter.
- ajxs 7y ago
  Of course your real identity is probably involved somewhere. It's just that I, and many others like me, don't think a third party should know what my real identity is. It's not their business. Edit: Unfortunately it probably is their business. A poor choice of words.
  - jacobush 7y ago
    Aren’t we already at a tipping point where your FB identity effectively is your real identity? For many purposes the companies don’t have to care your ”real” identity
    - ajxs 7y ago
      No, not really. I don't apply for jobs, book flights or vote with my Facebook account. I'm not concerned with what kind of insights that Facebook can infer from a fake Mickey Mouse account. I'm concerned about the possibility of being discriminated against in the real world based upon data gleamed from my online interactions.
      - jacobush 7y ago
elorant 7y ago
That's not the only reason. They also allow advertisers to target based on specific phone numbers. It's one of the creepiest features, along with targeting based on e-mail.
- ineedasername 7y ago
  What's targeting by specific phone numbers? Area code as a proxy for geo location, or something more sophisticated?
  - darkhorn 7y ago
    When you go shopping the casier asks your your home address and phone number, for invoice/bill. Then they upload your phone number to Facebook and advertise based on your purchasing history with them.
  - bertil 7y ago
    OC is likely referring to Custom Audiences. Facebook let you hash a list of emails or phone number, share it with them, so they can compare with their own. It allows businesses to target their customers or prospects separately.
  - codedokode 7y ago
    You upload a list of your customers' phones or emails and Facebook or Google allow you to show ads only to those users.
paws 7y ago
> If you've ever given the service your number, you should consider your real identity linked to it. I have a feeling it's worse than that. (I haven't rigorously perused the ToS, if I'm wrong please lmk.) Let's say your friend John has an iPhone and saves your name and # in their contacts. One day John installs the Facebook app & opens it. John is not technical and when the app requests permissions he taps 'Allow'. At that point AFAICT there's nothing stopping Facebook from snagging your name & number and populating a ghost profile, or corroborating a real one. In other words, if you've ever shared your phone number to someone who uses the Facebook app who doesn't dutifully and consistently reject permissions prompts, it's probably already too late.
- dmit 7y ago
  You're exactly right. Add in the fact that Facebook can pose this as a puzzle to be solved, and attract a steady stream of sharp young people who can solve the puzzle without being bothered too much by the ethical consequences of solving the puzzle.
- _Microft 7y ago
  Facebook frequently suggested my own mobile number to add it to my account when after I logged into the mobile webpage via phone (I never used any Facebook apps). My only explanation for that was exactly that it had been farmed from a friends contact list.
- Tade0 7y ago
  Would rather not share the details here, but I know of one instance of a person having been found on Facebook via her phone number even though she never provided it - just one imprudent person who has your number associated with your real full name is enough for this to happen.
  - Yhippa 7y ago
    This is despicable.
  - taneq 7y ago
    It’s like when you upload a photo with your friend (who doesn’t use Facebook) and it pops up ‘Did you want to tag [friend]?’
dehrmann 7y ago
For iOS, it seems easier to just make Facebook and WhatsApp use the same app group.

dvtrn 7y ago

Brings to mind a question, I've got a throwaway google voice number for precisely this reason, some services will let me use it, others (even Google-tried using a GVoice number as a recovery phone number for a gmail account for my grandmother, nothing doing) wont, few just throw back a generic error, others will say they don't allow virtual DIDs. Someone's going to say that's to cut down on fraud/increase security, right? Yet these services are going to (against many in the InfoSec world who are screaming "STOP DOING THAT") use SMS as a means of 2FA... I'm a bit confused where the value add is for account security in making virtual telephone numbers such a hit or miss.

jethro_tell 7y ago
Real security is picking a unique password and not forgetting it. Letting someone handle your security by giving them your phone number in case you can't handle it was never a good idea. Get a password safe, and don't forget your complex passwords.
- derefr 7y ago
  2FA (through an third-party like an email provider or, even, dare I say it, an SMS provider; not TOTP) continues to protect you when your password is compromised by a backend-side database breach. They might get your password; they might get your TOTP token seed; but there's nothing in the DB that will allow them to receive an email as you and then click the link in said email. Yes, allowing someone to reset their password through a second factor is bad; but that's not 2FA, that's two independent 1FAs.
  - jethro_tell 7y ago
    This is a good distinction and absolutely right. The problem comes when people substitute good passwords for 2fa resets via phone. The problem with that is that the majority of usage now comes from the phone, so it's not really a second factor if you lose your phone. It's a complex problem that depends on the situation and really too complex to make a matrix of when it's ok for your average Joe. Passwords suck, and we still use them, because as a general rule, it's the best thing we have.

chrisseaton 7y ago

> you should consider your real identity linked to it What is the point of these products if not linked to my real identity? That’s the whole idea of them. I use Facebook and WhatsApp to talk to people who know me. That’s why they want to talk to me. If they didn’t know my identity they would want to talk to me.

codazoda 7y ago
WhatsApp was specifically designed to be encrypted and private. Facebook, however, seems to play fast and loose with data. Sure you can talk to John Doe, but you might hope no one else knows that you're talking to John or what you're talking about. Useful, for example, to report a government conspiracy to a reporter.
ajxs 7y ago
Of course your real identity is probably involved somewhere. It's just that I, and many others like me, don't think a third party should know what my real identity is. It's not their business. Edit: Unfortunately it probably is their business. A poor choice of words.
- jacobush 7y ago
  Aren’t we already at a tipping point where your FB identity effectively is your real identity? For many purposes the companies don’t have to care your ”real” identity
  - ajxs 7y ago
    No, not really. I don't apply for jobs, book flights or vote with my Facebook account. I'm not concerned with what kind of insights that Facebook can infer from a fake Mickey Mouse account. I'm concerned about the possibility of being discriminated against in the real world based upon data gleamed from my online interactions.
    - jacobush 7y ago

elorant 7y ago

That's not the only reason. They also allow advertisers to target based on specific phone numbers. It's one of the creepiest features, along with targeting based on e-mail.

ineedasername 7y ago
What's targeting by specific phone numbers? Area code as a proxy for geo location, or something more sophisticated?
- darkhorn 7y ago
  When you go shopping the casier asks your your home address and phone number, for invoice/bill. Then they upload your phone number to Facebook and advertise based on your purchasing history with them.
- bertil 7y ago
  OC is likely referring to Custom Audiences. Facebook let you hash a list of emails or phone number, share it with them, so they can compare with their own. It allows businesses to target their customers or prospects separately.
- codedokode 7y ago
  You upload a list of your customers' phones or emails and Facebook or Google allow you to show ads only to those users.

paws 7y ago

> If you've ever given the service your number, you should consider your real identity linked to it. I have a feeling it's worse than that. (I haven't rigorously perused the ToS, if I'm wrong please lmk.) Let's say your friend John has an iPhone and saves your name and # in their contacts. One day John installs the Facebook app & opens it. John is not technical and when the app requests permissions he taps 'Allow'. At that point AFAICT there's nothing stopping Facebook from snagging your name & number and populating a ghost profile, or corroborating a real one. In other words, if you've ever shared your phone number to someone who uses the Facebook app who doesn't dutifully and consistently reject permissions prompts, it's probably already too late.

dmit 7y ago
You're exactly right. Add in the fact that Facebook can pose this as a puzzle to be solved, and attract a steady stream of sharp young people who can solve the puzzle without being bothered too much by the ethical consequences of solving the puzzle.
_Microft 7y ago
Facebook frequently suggested my own mobile number to add it to my account when after I logged into the mobile webpage via phone (I never used any Facebook apps). My only explanation for that was exactly that it had been farmed from a friends contact list.
Tade0 7y ago
Would rather not share the details here, but I know of one instance of a person having been found on Facebook via her phone number even though she never provided it - just one imprudent person who has your number associated with your real full name is enough for this to happen.
- Yhippa 7y ago
  This is despicable.
- taneq 7y ago
  It’s like when you upload a photo with your friend (who doesn’t use Facebook) and it pops up ‘Did you want to tag [friend]?’

dehrmann 7y ago

For iOS, it seems easier to just make Facebook and WhatsApp use the same app group.