59 ms·
533M Facebook users' phone numbers and personal data have been leaked online
- baybal2 6y agoThis does not look like scraping. A prima fascie database leak, and an invalidation of Facebook's claims of them not using your phone number past the validation, as well as them claiming using encryption at rest.
- Tenoke 6y agoAs far as I can tell it's a combination of the 2020 phone number exploit linked to scraped data for public accounts (likely using the public id).
- spicybright 6y agoThe phone number point may still be true though, they have to store the phone number somewhere.
- noxer 6y agoThey could store a salted hash instead for almost everything except using the number as actual phone number (call/SMS)
- xyzzy123 6y agoYou need to do a bit more than that; a one-way transform with no secrets isn't good enough for easily brute-forceable data like phone numbers, SSNs, passport numbers, credit card numbers etc. There's just not enough entropy in the data. There are ways to do these things though so the spirit of your comment is correct.
- zepto 6y agoThis seems like it would not be obvious to many people here, and so is a very salient comment. Do you have a link to anything that explains why, and what the ways are to do these things?
- mikeiz404 6y agoWhat are some of the ways? I’d assume encryption wouldn’t help much since wouldn’t the key most likely be available if the database was compromised? I would have thought hashing would work if it’s made more expensive such as by choosing an expensive hash function and increasing the number of rounds. Edit: Would first encrypting the value with the salt and then hashing the encrypted value and salt add more entropy and make hash collisions less revealing?
- xyzzy123 6y agoTo protect "sensitive, low-entropy data", the main things I've seen people do are encryption, tokenizing, or anchored hashing. I'm certain there's a bunch of academic work out there I'm not across so I'm writing from the limited perspective of "things I've seen people do in industry". The best thing to do tends to depend on how you need to use the data, exactly. With hashing alone there's just no reasonable cost function that will provide (say) 1 year of security in the event of database exfil, but also not DoS your service computing it :/ The problem is being offline-attackable. Encryption is one possible answer and I think most HNers understand the tradeoffs. Generally the less transparent it is, the more effective it is. Volume encryption or transparent database encryption are good to turn on, but don't protect you much. Keys available at application level only (let's say some fields are KMS'd) are better and will be of use under common failure scenarios (SQLi / DB exfil). You still have to get key management and application security right though and it turns out those are hard to do at scale. Your encrypted fields will also not be efficiently searchable unless you are using deterministic encryption. The tokenize pattern replaces sensitive data with a random value which is mastered in a centralised, controlled service. This really only makes sense if you can set things up so that almost all operations can be performed using the token.If you allow too many things to do token -> value lookups then it's pointless. Also all your eggs are now in basket so you have to watch that basket. Operations look like: - Exchange sensitive value for token - Compare tokens for equality (optional, but usually handy) - "Domain operations on token". For credit card, "bill the user", for phone numbers your domain operations might be "send SMS" or "robocall". - Exchange token for value (controls go here; limit access to customer service staff only, auditing, rate limits etc. The value should ideally only come out if a human has to look at it, and you should be able to definitely say who looked at what). This is a general technique, mostly used for credit cards. There's a whole industry around it. https://en.wikipedia.org/wiki/Tokenization_(data_security) https://en.wikipedia.org/wiki/Tokenization_(data_security) Anchored hashing uses a secret value in your "hash" operation. Keeping this value actually secret is hard, so an "industrial strength" implementation will use an HSM or other hardware to do the operation. This means any brute-forcing has to happen inside your network where you can see it. You ideally want a bit more entropy than with tokenization to make this work, but with appropriate rate-limits against attack from inside your infrastructure, it has legs. It's hashing, so works well for "have I seen this sensitive data before". The main advantage of this pattern is that it doesn't have to keep state. A decent write up of "anchoring" is here: https://diogomonica.com/2017/10/08/crypto-anchors-exfiltration-resistant-infrastructure/ https://diogomonica.com/2017/10/08/crypto-anchors-exfiltrati...
- emayljames 6y agoAmalgamation of data before encryption?, encrypt full rows of data? etc.
- noxer 6y agoYou can not prevent the phone number form being found eventually but that's not the goal you just need to make it more expensive than a phone number could ever be worth to someone. If you use a secret you have the same problem as before the legit system need to have access to the secret but an attacker should never get it. So if an attacker gets hashes and the secret(s) he has everything.
- jpeter 6y agoMaybe it's from whatsapp
- mhh__ 6y agoI've had a play with the data for a few people whose phone numbers I actually know, and they all seem old enough users that they just have the number on the account anyway. I could be wrong but I haven't found anyone my age who's number I can confirm.
- lordnacho 6y agoDoes anyone know if there's a GDPR fine on its way?
- Nextgrid 6y agoFacebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely. (before you post a link to enforcementtracker.com please first compare the fine amounts with Facebook's revenue)
- pixelpoet 6y agoGreat, so we get the worst of both worlds: outrageously obnoxious opt-out games (which, if skipped, implies free rein) and non-compliance as a cost of doing business. Wonderful.
- Nextgrid 6y agoThe obnoxious opt-outs are actually in breach of the GDPR as well, but are allowed to proliferate due to the lack of enforcement.
- deckard1 6y agoGDPR/CCPA were always a way to punish the many (i.e. us) for the sins of the few (Facebook and Google). And, I might add, it's to their benefit. What we're entering is a future where only Amazon, Google, Facebook, and Apple can handle data. You see this constantly on HN. "Don't handle your own auth, just let Firebase do it!" People are against anyone other than AWS touching their data. And, well, we're getting the dystopia we deserve. What else can I say.
- yokaze 6y ago> Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely. Not having the data encrypted at rest seems to me a different infraction than the previous ones. The scale also matters, and that it isn't the first infraction. And as I read it, not encrypting at rest is a breach of Article 6 and fined under Article 83 (5) (https://www.privacy-regulation.eu/en/article-83-general-conditions-for-imposing-administrative-fines-GDPR.htm https://www.privacy-regulation.eu/en/article-83-general-cond...), which puts the fine limit at 4% of the annual turn-over. Yes, it doesn't mean they have to fine as much, but the point remains, that this is in the category of the most severe infractions.
- bitcharmer 6y agoThese events are not a matter of if but when. And since the overwhelming majority of the people in my social circles has zero understanding of the real nature of the relationship between them - FB users and FB I just hope this will become increasingly frequent and painful experience for them. As in: I really hope this will get FB users in trouble as a result of identity theft etc. This may sound extremely cynical but at this point it's the only way for the non-technical folk to understand the implications of giving away your privacy so that you can share cat pictures with other people.
- asdfasgasdgasdg 6y ago> people in my social circles ... I just hope this will become increasingly frequent and painful experience for them. Very strange to wish harm upon your friends with the hope that that will convince them to join your side in a political fight! I would suggest instead that you only wish that if it becomes a painful experience, they would realize why and renegotiate their relationship with FB. Typically wishing pain on your friends is not a good stance.
- brettermeier 6y agotrue
- sidlls 6y agoNot that strange. The whole "rock bottom" concept for addicts is similar, right? Sometimes you have to see a friend or family member truly experience real pain to get them to want to change. People are like that.
- nonbirithm 6y agoThe sad fact is that as much as I wanted to believe that positive reinforcement was "better" for me because it was supposedly "better" for people in general, in practice it's only ever been negative reinforcement that has enacted any change in my life. Trying to deny that fact for so long only accomplished setting my life back by several years. Even the simplest things like dental hygiene only became habits because I suffered catastrophic losses from neglecting them. I think it's because my imagination of the failing scenario will never compare to the experience of the failure itself. Whereas if there's no singular point at which the failure becomes obvious and decidedly life-changing, then...
- rikkipitt 6y agoI’ve been getting a lot of automated/unsolicited calls recently. Begs the question if this might be the source of my woes. Is there a trustworthy phone number version of https://haveibeenpwned.com https://haveibeenpwned.com?
- spicyramen 6y agoSame here, i started recieving both calls and SMS which the last i find more annoying. I do use Android and these ones haven't been able to be detected as spam
- rikkipitt 6y agoI’m on iOS and don’t think there’s a way of blocking unsolicited calls until after the fact... I hope to be proven wrong though! The odd thing is, the calls often come through having a caller ID very similar to my own number.
- coldcode 6y agoThose are usually generated, they call numbers in area code/exchange randomly, assuming you will pick up something that seems familiar. Jokes on them, I moved to another state, easy for me to tell.
- JoshTko 6y agoon iOS there is a lifesaving phone setting of sending unknown callers straight to voicemail.
- ve55 6y agoThis could be the first large breach we've seen from FB like this. Most past breaches were of a much different and smaller nature (scraping or API access abuse), and seeing a real leak like this could change the landscape for FB quite a bit, since historically companies like Facebook and Google have been very good with preventing them. I don't know a ton about FB's specifics, but there's a chance this data could be 'public' from people with the given privacy settings, if perhaps 25% of users have that turned on. If that is not the case though, then this would be the first serious breach from FB imo. Either way at this point I operate under the expectation that most information I input into a database may be leaked at some point. This is particularly rough for services that demand and track a lot of things, but it cannot be helped.
- I_am_tiberius 6y agoWould like to know if non Facebook users are included because Facebook has non Facebook user's phone numbers due to the fact that Whatsapp uploads the entire phonebook to Whatsapp. That means Facebook is likely to know your phone number although you don't use Facebook or Whatsapp.
- hourislate 6y agoIt's sick that they are allowed to get away with this. It's basically a botnet stealing information.
- macintux 6y agoEvery time someone argues that people can avoid the privacy problems of Facebook by simply not using it, I point out this issue (plus the shadow accounts).
- Guest42 6y agoI recently purchased a phone that had the Facebook app preinstalled. If I had to guess, the mere act of connecting to WiFi caused a whole slew of info to get sent.
- reddotX 6y agoFFFFFFFFFFFFFUUUUUUUUUUUUUUUUUUUUU
- macintux 6y agoI would think not, but my cluefulness regarding Android security/privacy is effectively nil.
- Guest42 6y agoI didn’t check what permissions it was given by default but hopefully not too many and with those not much spying. It would be nice to have a clear map of what data can be obtained with what permissions.
- uniqueid 6y agoWe should start thinking of these breaches in terms of their accumulated impact. It's not the 1990s anymore, where data is difficult to store and networking too slow to move it. We should assume the leaked data doesn't go away; that instead people out there are consolidating Equifax data with Vastaamo data, adding data from Exchange hacks and the Accellion hack, to cross-reference with data from Facebook... it's like water flooding a levee now, instead of evaporating. Not the first time I've harped here about this (ie: https://news.ycombinator.com/item?id=26604753 https://news.ycombinator.com/item?id=26604753, https://news.ycombinator.com/item?id=24586258 https://news.ycombinator.com/item?id=24586258), but I hope we start planning for that kind of future.
- uyt 6y agoHonestly sounds like a fun job for future historians. By aggregating all the leaks over a long period, how much of a person can you reconstruct? For example even though I am using a throwaway account, HN's logs might one day get compromised. So now they can join the IP address to other compromised sites that I was logged into using my usual email. And from my email they already have my name, SSN, address, phone number, usernames, passwords, etc, exposed from prior breaches. But now they know about my shitposts too.
- Scoundreller 6y ago> logged into using my usual email It's risky if things go sideways, but HN doesn't require an email address for an account.
- uyt 6y agoThat's exactly my point. I think I am safe on HN because I'm using a random user name with no email attached. But their logs definitely have my ip address and that ip address will be common across other compromised logs on other sites, some of which I might be logged into with a real email (this is true regardless of incognito mode since it's the same computer).
- 6y ago
- throwawaybchr 6y agoIs Mark Zuckerberg's number one of them?
- londons_explore 6y agoLooks like this is the "To match users to their friends by phone number, you need an API which can take as input a phone number, and return information about if that number has an associated account" problem. There is no way to let a user find their friends on a service without such an API. Yet if you have such an API, someone can simply brute force all phone numbers worldwide (there are only 10^10), and now they have a database of all users... Rate limits can help defend, but considering many users might have 1000 phone numbers in their address book, you can't set the rate limit very low without impacting user experience. Attackers can reduce the search space dramatically by only checking phone numbers that resolve to an active line (using VoIP stuff to test a number). The only real solution is for your app not to have a "Here is a list of your friends already in the app" screen... But as you can imagine that means you won't get any user growth or VC funding...
- Scoundreller 6y agoAnd now you know how those cell phone farming programs were able to pay people a couple bucks a month to run crap on arrays of dozens of phones.
- amluto 6y agoThis is the same fallacy that leads to apps asking for permission to access your whole picture library. Facebook could have an API by which an app can prompt its user to show a list of all of that user’s friends who have the app installed. The app would only learn the identities of people whom the user explicitly selects, and phone numbers would not be part of that identity.
- progval 6y agoIt works for photos because the threat model is about protecting local files against malicious apps. But for phone numbers, you about protecting Facebook API (which is publicly available via the internet) against arbitrary devices, which Facebook has no way to tell from legitimate ones
- 6y ago
- timdaub 6y agoGreat, and while you can get sued into oblivion for downloading a Metallica album, all our personal data is downloadable from a public website for 3€. Like for real, it took me 2mins to find the leak myself...
- cblconfederate 6y agoAt this point i don't see why only facebook and the thieves should have access to this data. If the data is public it loses its value
- skizm 6y agoWhy would the data being public stop robo-callers from using the list?
- somethingwitty1 6y agoWhat about this data being public causes it to lose value? It seems like it would be a boon for lots of companies even if every other company has it.
- Moeancurly 6y agoI believe they mean it can't effectively be sold if everyone has it. It loses value as a commodity if anyone can access it, but the value of the data is still in tact.
- kabes 6y agoBut facebook is not in the business of selling your data. It's in the business of selling your attention and it uses data to do so. There's nothing about this leak that changes Facebook's position in this market in this regard.
- lostlogin 6y ago> But facebook is not in the business of selling your data. There are an awful lot of arguments against this stance and the argument supporting the claim appear to split hairs in a very convenient manner.
- ruph123 6y agoDoes anyone know if there is a way to check if one's data is included in that leak, à la haveibeenpwned?
- mhh__ 6y agogrep the download? Search for :YourFirstName:YourLastName:YourGender
- gpm 6y ago1/16th the worlds population, assuming no duplication.
- impostervt 6y agohttps://haveibeenpwned.com/ https://haveibeenpwned.com/ I've been pwned 33 times. At this point, it's just noise. My passwords are all unique (password manager). Honest question - What should I worry about?
- prophesi 6y agoIt's much more of a threat to those who don't use cryptographic randomly generated passwords. And if you add PII to your accounts.
- newman8r 6y agowell it might be embarrassing if someone found out you used facebook. I guess I could envision a scenario where you're being investigated, and these leaks provide a roadmap of services to subpoena.
- retox 6y agoYou should work about being a smug cunt.
- dang 6y agoPosting like this will get you banned on HN, regardless of who or what you're replying to. Could you please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules? We'd appreciate it.
- codethief 6y agoMaybe your phone number, relationship status or Facebook bio?
- HNfriend234 6y agoIdentity theft and harassment. If you say anything politically that other people don't agree with then you could become a victim of violence.
- neither_color 6y agoBecause of this I use fastmail or Apple sign-in to make a new email for every online service I register for, and when it's a username I pull random words together from a dictionary. I also avoid using my real name as much as possible.
- offtop5 6y agoI would love this to spur some serious regulation of social media. The cats sorta out of the bag, but one can dream.
- anticristi 6y agoLet's start by classifying them properly: FB is an ad network.
- kwertyoowiyop 6y agoDon’t worry, Facebook will soon put out a press release including the phrase “we need to do better.”
- mrweasel 6y agoThat kinda sad, because that is what’s going to happen and then we’ll nothing more. At this point I’m not really sure what it will take for companies, like Facebook, to understand that you need to not fuck around with peoples private data.
- BoiledCabbage 6y agoPut a monetary cost of holding user data, and a steep monetary cost on losing user data. Ex, pay x amount per month in perpetuity for each piece of information about a user your keep. And have to pay the "net present value" of those payments if you lose the data. Having to pay for hoarding user personal data changes the incentives from gobble up as much as possible, to instead only pay for a users data that is worth the cost to your business. And as an extra incentive to not hold unneeded user data, know the costs you'd pay if it was breached.
- mrweasel 6y agoWho would get this money? I agree that it needs to be some solution involving a cost, given that most of these companies have shown multiple times that profit isn’t just their main concern, it’s the only concern.
- gpm 6y agoThe government typically... who might in turn do something like a tax rebate (write a check to everyone, ontario has been doing with the carbon tax) or just stick it into the general pool of taxes (reducing everyone's taxes).
- 29083011397778 6y ago
- kristianc 6y agoInterested to know the GDPR implications of this for Facebook. This seems like one of those occasions where the regulator might be tempted to impose the maximum fine…
- Nextgrid 6y agoSee my other comments on this thread about Facebook's situation with the GDPR: https://news.ycombinator.com/item?id=26682200 https://news.ycombinator.com/item?id=26682200 Long story short, regulators already have more than enough evidence about Facebook's lack of GDPR compliance so they could've already imposed large fines if they wanted to. The fact that it hasn't happened yet shows there's no motivation to actually enforce the regulation.
- donalhunt 6y agoI believe there are still open investigations. But Facebook have enough money and lawyers to ensure a plea deal is agreed. We work out as nothing more than a slap on the wrist. All the big tech companies budget for these fines. You'll often see it called out at earnings where they allocate funds for a particular fine in a given quarter even though the investigation isn't finalised.
- anticristi 6y agoI wish I were Irish. Imagine 3 billion dollars extra taxes! It's like a second COVID-19 relief package.
- villgax 6y agoCan't have shit on the Internet
- FukHN 6y agoBe careful HN will shadow ban you.. HN loves FB
- retox 6y agoWill the EU impose a fine per person? Maybe we'll see in 8 years time.
- 533_bot 6y agoHow to buy the leaked data? Please share telegram bot link or raid website link
- anonymousiam 6y agoThe root of the problem is not the privacy policy or the system security. The root of the problem is the collection itself. All large businesses, health care providers, and governments maintain databases. Every one of them will eventually be leaked. All it takes is a corruptible trusted insider.
- HenryKissinger 6y ago> Every one of them will eventually be leaked. [X] Doubt
- HighlandSpring 6y agoOn a long enough timeline everything and everyone can be compromised (or the institution fails before then)
- hobs 6y agoExactly - either the data is basically not valuable at all (the category for which PII rarely fits) or else when the company collapses or is bought, the data moves too. There's always an incentive to steal or leak it to other companies for money; so as long as the incentives are aligned with GATHER ALL DATA and KEEP IT FOREVER then yes, it will just be a matter of a time before each data store is compromised by mistake or purposefully.
- BobbyJo 6y agoI doubt the claim, but the sentiment I think is valid. If you think about what data these entities are holding, it's not unique to a single database or entity. Your name/address/phone/ssn/etc. Is likely stored in so many places that the probability it gets leaked from at least one eventually I'd say is very nearly, if not 100%.
- allworknoplay 6y agoWhy on earth did you pick this username
- 6y ago
- tnolet 6y agoInteresting numbers in the linked tweet in the article. 5M accounts for the Netherlands exposed. Almost 1/3 of the population. Compared to Germany where “only” 6M are leaked, not even 10%.
- djokkataja 6y agoThey've also got Tunisia in the list twice, and the number for the first instance is 39.5M, when the population of Tunisia is not even 12M.
- bellyfullofbac 6y agoI wonder if Tunisia is famous for FB click farms? A quick google indicates "maybe": https://about.fb.com/news/2020/06/may-cib-report/ https://about.fb.com/news/2020/06/may-cib-report/
- deleted 6y ago[deleted]
- mgerullis 6y agoWasn't Facebook just trying to lecture apple about privacy?
- annadane 6y agoRight? They're masters at adopting the (supposedly) moral high ground and acting all hurt when others criticize them - you'll hear 'we need to be better' but there's this overriding sense of, how dare people differ from what we feel is best?
- onetimemanytime 6y agoI still go with the assumption that everything that is sitting somewhere in some server will be leaked. Having unnecessary data is the problem
- doubler 6y agoThis news is from jan29 https://www.theverge.com/platform/amp/2021/1/25/22249571/facebook-phone-number-hack-telegram-bot https://www.theverge.com/platform/amp/2021/1/25/22249571/fac...
- doubler 6y agoThis is from jan29 https://www.theverge.com/platform/amp/2021/1/25/22249571/facebook-phone-number-hack-telegram-bot https://www.theverge.com/platform/amp/2021/1/25/22249571/fac...
- dan-robertson 6y agoObviously it is bad if your personal data is compromised after you (or some else) upload it to an online service like Facebook. But in this case, it’s important to remember that phone companies used to regularly leak most of their customer’s phone numbers (and names) in the form of a telephone directory. So a question to consider is: suppose that the white pages were still commonly produced and contained most people’s numbers. How would you then feel about something like this. Personally I feel like the problem with phone numbers being leaked is mostly the epidemic of spam calls (especially in the US) rather than some particular breach of privacy. Aside: I think it is good to consider these counterfactuals in general for questions about information privacy, for example how would you feel if everyone’s tax returns were published publicly like they are in Sweden?
- joshspankit 6y agoI agree, but also we’ve made it more complicated by using phone numbers as 2FA credentials. Now suddenly a “white pages of cell numbers” becomes a very convenient tool for getting in to people’s accounts.
- ajross 6y agoOnly if you can hijack their number. Knowing a phone number seems like by far the easiest part of breaking SMS 2FA...
- eightysixfour 6y agoThe "new" risk with phone numbers is the overreliance on them for login and 2fa and the relative easy of taking one over. I use security keys but still have accounts I can't remove the phone 2fa from despite having two keys tied in.
- whichquestion 6y agoIf you can avoid it, simply don’t give anyone your phone number. Then you can use security keys, hardware keys and recovery codes. Obviously some places require a phone number, but for those that don’t, avoid giving them one.
- gpm 6y agoIs it possible to download this without giving money to criminals? (The article says free, but my 2 minutes of googling hasn't found it, somewhat unsurprisingly). Is doing so legal? If the answer to both of those questions are yes... I'd like to take a peak. Mostly to check whether or not some numbers I know haven't been directly give to fb are there.
- megous 6y agoI'm also wondering if number I asked them to delete 5 years ago is in this 2019 leak. :)
- mhh__ 6y agoYes. Legal? no idea.
- emayljames 6y agohttps://t.me/freedomf0x/12553 https://t.me/freedomf0x/12553 Is the download link in the channel. Has all files by country, zipped in .txt files.
- Mengkudulangsat 6y agoI have to say; the backyard Big Data analyst in me is salivating.
- antibland 6y agoI’m curious about the pool of Facebook users who seldom use the product, retaining it solely for groups and to keep in touch with family. Will this event loosen that final brick and drive these users to delete their accounts?
- flas9sd 6y ago"keep in touch with family" can be subsumed by chat apps. But for discussion groups and special interests, facebook is still the most accessible site to run (small) groups in, or am I mistaken?
- nonameiguess 6y agoIf you have some need to know the people, maybe, but if not, hobbyist subreddits are better for discussion groups and special interests. The only thing I can't see leaving Facebook is some group that requires real-world interaction like a buy nothing group, but there are neighborhood specific platforms popping up that would enable applications like that without having to use Facebook.
- jrnichols 6y agoin my case, no, because I still need to occasionally keep in touch with those people. I use Facebook a LOT less nowadays though. Here's what I do: - removed all of the apps from my mobile devices. - only check it on VPN, with Firefox, using Facebook Containers. - log out each time and do not use the "save this browser" feature. - unlock origin & pihole are active on the VPN too. I have managed to completely ruin its targeted ads for me. It's been an amusing experiment. I still use it less because it is a HUGE memory & resource hog and eventually makes my browser window slow to a crawl.
- gregmac 6y agoAre there immediate actions people should be taking at this point? A lot of password reset flows work via username + SMS using "we've sent a code to your phone number (xxx) xxx-xx12". This database unmasks that phone number, so my assumption is this makes sms hijacking more viable, but perhaps someone more knowledgeable can weigh in. Does Facebook allow password resets like this, and can that be disabled?
- rpastuszak 6y agoI don’t have FB or or WhatsApp but my Insta account (using a separate email address and no personal details) keeps recommending my therapist to me. How are we still ok with this shit? The sooner we get rid of the cancer that FB is, the better. I didn’t share my contact book with FB apps either. It was probably her—a person in her 70s, not necessarily experienced with tech. The main reason this company exists, or that ad tech can maintain a facade of not being a mainly bullshit industry with made up metrics, is the lack of informed consent. It’s almost funny how we accept the current situation as normal. Because, I think that we’ll look back at these times with disbelief of reckless we were and how cheap we’d sell ourselves.
- yoaviram 6y agoSuggest you send Facebook a CCPA or GDPR data deletion request (even if you don't live in California or the EU) for your real identity. Cases like yours is why we created https://yourdigitalrights.org/d/facebook.com https://yourdigitalrights.org/d/facebook.com, which makes its dead simple to send such requests. Free & open source.
- Nextgrid 6y agoNote that Facebook happily ignores Subject Access Requests with complete impunity: https://ruben.verborgh.org/facebook/ https://ruben.verborgh.org/facebook/
- throw14082020 6y agoYes, I submitted GDPR (Article 17) right to erasure requests, and I got utter garbage (please use the UI) Facebook: > Thank you for contacting Facebook. We have reviewed your report and it appears you would like to delete your Facebook account. > > Please note, for security reasons, we are unable to delete accounts on behalf of users so you will need to log into your account and delete it yourself. We have put in place a very quick and easy process for people to schedule the permanent deletion of their Facebook account. > > Before permanently deleting your account, you may want to log in and download a copy of your information from Facebook. Once your account has been deleted, it cannot be recovered. However, after back and forth with them for a few weeks, I got this: Hi, Thank you for contacting Facebook. Based on the information you've provided, it looks like you're trying to request the erasure of certain personal data under Article 17 of the General Data Protection Regulation (GDPR). If you wish to ask for personal data relating to you to be erased in accordance with the GDPR, please use the following form: https://www.facebook.com/help/contact/259518714718624?ref=cr https://www.facebook.com/help/contact/259518714718624?ref=cr Additionally, as per your request, your account has been scheduled to be deleted. Please keep in mind that you have up to 30 days to cancel the deletion. Once your account has been processed for deletion, it may take up to 90 days for all of your information to be permanently deleted. For more details, please visit the Help Center article below: https://www.facebook.com/help/224562897555674 https://www.facebook.com/help/224562897555674 We store data until it is no longer necessary to provide our services and Facebook Products, or until your account is deleted, whichever comes first. This is a case-by-case determination that depends on things like the nature of the data, why it is collected and processed, and relevant legal or operational retention needs. For example, when you search for something on Facebook, you can access and delete that query from within your search history at any time, but the log of that search is deleted after 6 months. If you submit a copy of your government-issued ID for account verification purposes, we delete that copy 30 days after submission. Learn more about deletion of content you have shared (https://www.facebook.com/help/356107851084108?ref=cr https://www.facebook.com/help/356107851084108?ref=cr) and cookie data obtained through social plugins (https://www.facebook.com/help/206635839404055?ref=cr https://www.facebook.com/help/206635839404055?ref=cr). When you delete your account, we delete things you have posted, such as your photos and status updates, and you won't be able to recover that information later. Information that others have shared about you isn't part of your account and won't be deleted. If you have another question or concern, please visit Privacy Basics (https://www.facebook.com/about/basics?ref=cr https://www.facebook.com/about/basics?ref=cr) or our Help Center (https://www.facebook.com/help?ref=cr https://www.facebook.com/help?ref=cr) for additional information.If you have more questions about our Data Policy (https://www.facebook.com/policy.php?ref=cr https://www.facebook.com/policy.php?ref=cr), please reply to this message. Thanks, Privacy Operations
- r721 6y agoLiz Bourgeois, @Facebook comms: >This is old data that was previously reported on in 2019. We found and fixed this issue in August 2019. https://twitter.com/Liz_Shepherd/status/1378398011747938305 https://twitter.com/Liz_Shepherd/status/1378398011747938305
- DyslexicAtheist 6y agoIt's not "old data" it's our data and Liz is a fucking idiot. They lost a total of 533 Million peoples. The company should be shut down and management yeeted into the sun.
- riphdd2020 6y agoSomebody needs to start contacting the US politicians whose private numbers are in this leak. There must be a few?
- throwaway29303 6y agoInteresting. Every time Facebook is hacked I remember this Anonymous' threat[0]. [0] - https://venturebeat.com/2011/08/09/hacker-group-anonymous-threatens-to-destroy-facebook-nov-5/ https://venturebeat.com/2011/08/09/hacker-group-anonymous-th...
- hn_throwaway_99 6y agoI mean, at this point I think everyone should just accept that at the very least their name, age, address(es), email(s), phone number(s) and screen name(s) have been fully leaked if you have ever had any kind of online presence. Not saying that's right or good, but at this point it's just a fact. So if that's the case, I think we should move beyond really even trying to think of this info as private or a marker of identity, and we need to move everyone to more secure forms of identity verification. As has been pointed out on HN before, "identity theft" is a made-up concept to make it seem as if you had something stolen from you, when the real problem is banks and other service providers do an absolute shit job of identity verification. They're the ones at fault, and they try to shift the onus onto you to fix things when they screw up. Indeed, a social security number is pretty much the only additional piece of data to the stuff above that one would need to open up a bank account in someone else's name, and those have been leaked plenty of times too. The government needs to make harsher penalties for banks and others that can ruin your credit, etc. because they accept all this leaked info as "proof" of identity.
- anticristi 6y agoLike really? Don't you have to walk to a bank or show some ID? I live in the EU and I do operate under the assumption that banks take reasonable measures to ensure an account is linked to a legal identity.
- hn_throwaway_99 6y agoNo. Many online services will let you open a bank account with name, address, phone, DOB and social security number.
- iso1210 6y agoWithout sending a confirmation letter to the address and SMS to the phone?
- brendoelfrendo 6y ago
- AlphaWeaver 6y agoHas this breach made it onto HIBP yet?
- banana_giraffe 6y agoDunno, but if the US dataset is anything to go on, an import into HIBP won't catch much. Less than 1% of the entries have an email address.
- Jan454 6y agoI really hope they now have to pay that 4% ransom due to violation of the GDPR .. for each stolen account of course ;-)
- xyst 6y agoI removed my phone number from Facebook when it was reported that Facebook used this as some sort of tracking mechanism across third party vendors - specifically with purchases from merchants - in order to serve more "relevant ads". From what I recall, if the merchant is somehow hooked up into FB APIs then regardless of whether you signed up for their rewards program using an e-mail + password or via FB SSO, then they would send back "anonymized" data back to FB for each purchase(s). I wonder if my phone number still persists (aka "soft delete")
- bartread 6y agoWhen did you remove your phone number? Looks like this relates to a vulnerability that was patched in 2019. I'm slightly concerned about this myself. I'm also seriously ticked off with Zuckerberg and co. I can tolerate the fact that internally they do scumbaggy things with my data. I tend to have less forbearance when they let my data out into the wild.
- egberts 6y agoThat’s why you never use your real name nor birthdate ... on social media.
- canada_dry 6y agoExcept... that's only the tip of the iceberg. Facebook/Google (et al) farms data from everyone! There really is no escaping it in today's unregulated privacy free-for-all. Friends/family/associates will provide your personal info in their contact/meta data. Companies (and their 3rd parties) you've done business with willingly sell/provide your personal info.
- saos 6y agoHa and WhatsApp want me to accept their new policy. Absolutely not
- throwawinsider 6y agoRussians are doing god's work hacking and leaking proprietary data
- rvz 6y agoSo when are we going to stop companies from accessing your address book and 'uploading it' as part of the sign up process? Or even using Facebook and its services in general. Well the biggest offender now has leaked the data of hundreds of millions of users who have attached their phone numbers and full names. Now let's see if the users REALLY care this time that when they signed up to Mark Zuckerbergs website, it wasn't a good idea to sign up with a phone number in order to 'stop bots'. They did not learn with the Cambridge Analytica scandal, are they finally going to learn?
- iso1210 6y agoIs Zuck's number there? How about Bezos? Biden? Putin?
- zlib 6y agoSo, how do I see if my data is in this?
- mensetmanusman 6y agoMy actual phone number has net negative value. I mostly only get scam texts and phone calls. Everyone I know uses messaging apps and contacts me that way. I can’t believe Apple hasn’t offered a way to white list when your phone rings.
- jdjdjdjdjd 6y agoThey have. Settings > Phone > Silence Unknown Callers
- mensetmanusman 6y agoThis option still causes the call/sms to show a notification bubble... which is annoying since you can’t ignore it if you rely on notification bubbles to know if someone you know has messaged you.
- loicd 6y agoNice option, but whitelisting is a bit much for me. Amazingly, the iphone still does not have an option to automatically block anonymous calls (those that hide their numbers) and only them.
- ipnon 6y agoAnd yet it is still considered audaciously paranoid among the general public to protect your privacy by not having a Facebook/LinkedIn/Google/... account.
- permo-w 6y agoI've noticed that some people who don't have personalised social media seem to assume that other people do because they're mentally deficient or ignorant. It's the same as how unsympathetic people ask why fat people don't just stop eating, or drug users stop getting high, or the cyberbullied don't just turn off their phone. It's a lot more complicated than "just don't use facebook".
- sachdevap 6y agoBut parent is not talking about calling out people for having social media accounts. He/She is talking about those having a social media account judging those not having one as paranoid. You've just propped up a straw man here without addressing the point the parent comment made.
- bellyfullofbac 6y agoLast night I was browsing Facebook, and all of a sudden, it said there's been suspicious activity and I've been locked out of my account. To unlock it, I had to review the email address and phone number I associated with my account (in case the hijacker added their own contact info), but all it had were my info that I added in 2011 (before I knew what a piece of shit Zuck was). Then it asked me to change my super-complicated password because it said the password is no longer secure. So, can I assume this leak is related to this strange event?
- i_have_an_idea 6y agoHighly unlikely to be related. It's not a password leak. It's also not really a leak, someone scraped some public profile info and then used the phone number lookup feature to match up the two.
- yalogin 6y agoHow is it a leak? There is no information how the data leaked. My bet would be that it’s hoarded through FB api and passed around. Nothing new happened here is my guess
- idlewords 6y agoShould make it easier to jump-start a competitor!
- xupybd 6y agoAny tools around to search this database? I'm keen to find out if I've had data leaked.
- Daviey 6y agoSomewhat ironically, Mark Zuckerberg (and 2 other FB founders) are in the dataset - along with phone numbers. Hopefully this disaster will be the catalyst for better data privacy controls.
- nly 6y agoWhat Facebook user id is Mark? Is it #1?
- Daviey 6y agoNo, nobody has 1-3. It starts at 4,5 & 6 who are the founders: - Mark Zuckerberg is 4: https://www.facebook.com/profile.php?id=4 - Chris Hughes is 5: https://www.facebook.com/profile.php?id=5 - Dustin Moskovitz is 6: https://www.facebook.com/profile.php?id=6 More info: https://tomanagle.medium.com/why-4-0-will-show-mark-zuckerbergs-name-on-facebook-6a82e38695d3 https://tomanagle.medium.com/why-4-0-will-show-mark-zuckerbe...
- thinkingemote 6y agoI'd bet that 1-3 were some variants of "test" "test1" "first"
- sachdevap 6y agoCan someone please guide me on how to check this leak to verify if my info was leaked?
- i_have_an_idea 6y agoThere's not much to see here. Someone scraped some public profiles. Someone then brute forced a poorly implemented "look up by phone number" feature. They linked the two datasets on the unique facebook user id. Leaking data that is or was in the public domain is not much of a leak. The only noteworthy thing would be the leak of the non-public phone number, however that vulnerability has been widely known since 2019 (and has been resolved by Facebook), so there's nothing new here?
- QUFB 6y agoNot much to see? Not noteworthy? Where could I, or any Internet user, trivially download these details on 533M Facebook users prior to this dump? If nothing else, it seems extremely noteworthy that someone was not only able to obtain the data through scraping or some attack, but has shared with the world.
- i_have_an_idea 6y ago> Where could I, or any Internet user, trivially download these details on 533M Facebook users prior to this dump? On Facebook. Literally. You can scrape any public profile info. It's against ToS, but it's not illegal (some caveats apply, see the hiQ Labs v. LinkedIn case for more info). The only noteworthy thing is the phone number vuln. Except that's been known since 2019, so it's certainly not news.
- azeirah 6y agoThere's a difference between programming a scraper capable of scraping 500 million records, running it and storing the results without getting caught by Facebook and downloading a file.
- prox 6y agoHow hard is it to change phone numbers? So say I release my old number and take a new one, how do I make sure I am not forgetting any 2FA services I signed up for?
- 0x_rs 6y agoPersonally, I wish Facebook would finally get slammed with the long overdue consequences of questionable practices when it comes to data handling and transparency, let alone minuscule control users have on own account and PII. This leak may have been preventable for a vast number of individuals. I suppose many are familiar with the old account "deletion" process that would — years later, too — prove itself not to be a real removal, but a mere deactivation, waiting to return from their graveyard whenever pinged by the simplest of login attemps by bots or ill intentioned individuals. At this point in time, considering the sheer amount of I believe accounts struck in a limbo, a dedicated fast track deletion process should be enforced on Facebook. I have, in my little knowledge, not found any case of GDPR requests granting one's wishes to see old accounts (that did not accept their newer ToS and cannot be authenticated in any possible manner permitted currently, in which registration and connected e-mails are not) be permanently removed from their systems. My attemps, at least, have come short.
- one2three4 6y ago(Apologies if the link is in the commends already. I can't seem to locate it.) Where is the list?
- banana_giraffe 6y agoLooking at the leak others have pointed to, there are a surprising number of people working in a particular imaginary company: sqlite> select company, count(*) as c from usa where length(company) > 0 group by company order by c desc limit 10; company c ---------------------------------------- ---------- Self-Employed 459119 Facebook 181013 Retired 71210 The Krusty Krab 61550 Hollister Co. 42304 U.S. Army 39682 Stay-at-home parent 33095 Walmart 31600 McDonald's 30792 Student 25326
- kaminar 6y agoHow is it that NOBODY mentions suing FB for this, the single largest data breach/leak in history? Are they to be let off with zero accountability? Nerds and geeks of ycombinator, pls let us know how you feel.
- edoceo 6y agoCouldadone w/o the name calling. Generally frowned upon, site guidelines and all
- CRConrad 6y agoProbably used more as an honorific.
- 2bitencryption 6y ago> the single largest data breach/leak in history? if something sounds like a hyperbole, it probably is. In this case I believe you are mistaken, and the Yahoo breach of 2013 was the largest, with data leaked from over 3 billion accounts. [0] https://www.nytimes.com/2017/10/03/technology/yahoo-hack-3-billion-users.html https://www.nytimes.com/2017/10/03/technology/yahoo-hack-3-b...
- 6y ago
- russdpale 6y agoI guess if you use facebook you just deserve all the shit you get. What sucks is that the rest of us have to live with it too. I suppose we shall just keeping waiting for that darn market to correct itself!
- maxc01 6y agoBefore a leak: xxx is a shit company and is notorious for how it treating user's data. Everyone, stop using its app now. After a leak: ok that's life
- cpv 6y agoTried to lookup some info, but it's not there. Maybe it's from some web scrapper which collected public info, or other means (some ambiguous mobile app which had access to contacts?). Or the leaked files are incomplete.
- varispeed 6y agoAt this point Facebook should be closed down immediately, only leaving an option to download your own personal data. I think they shouldn't be able to reopen until the whole thing is regulated, severe fine applied and damages to all affected users paid.
- diogenescynic 6y agoI hope the class action bankrupts Facebook, but I know it won't/
- amelius 6y agoCan we take away the incentive and just ban online targeted ads already?
- afinlayson 6y agoWhy can't we have a private/public key phone number ... that'd fix this problem... We gotta stop using integers to identify people.
- nly 6y agoFound myself in the data set, but didn't find several people I expected to find. Seems to be only those who added their mobile number (I did so for account recovery purposes only).
- leke 6y agoIs there a way I can search to see if I am affected by this leak?
- exabrial 6y ago$50 fine per number needed
- pmorici 6y agoIs this data that was in profiles that they scraped or did they get access to things that weren’t being intentionally shared?
- strooper 6y agoI wonder why India with population 1.3bn has only 145MB zipped footprint when USA with population a quarter of that has almost 1 GB? AFAIK, FB is huge in India.
- deleted 6y ago[deleted]
- barrkel 6y agoUsed to be phone books filled with people's phone numbers, names and addresses. In that light, this leak isn't too bad. Not great, but not that bad. (Easy enough for me to say, I never gave FB my phone number in the first place, I've never logged into FB on my phone, and I'm not in any of these files.)
- busymom0 6y agoIt's mind boggling how absolutely unaccountable these big tech companies - especially Facebook have become. I think we hear about such massive leaks at least once a year. And nothing ever gets done to prevent this from future and even the fines if any imposed are chump change for the companies.
- mgraczyk 6y agoFYI, the source of this data existed until April 2018, when FB disabled it: https://about.fb.com/news/2018/04/restricting-data-access/ https://about.fb.com/news/2018/04/restricting-data-access/
- nikolay 6y agoIt looks like they abused the old feature to locate user by phone number and just bruteforced all numbers in a country. This feature is no longer available.
- victorantos 6y agoI've deleted my Facebook last year, after being on Facebook for 10+ years. I guess I am not affected. update: oh no, "...the data was scraped due to a vulnerability that the company patched in 2019."
- flas9sd 6y agofacebook should be obligated by law to use this leaked dataset and notice the individual user that if the data is still valid, it is now widely distributed. There are risks: stalking, sim-swapping and phishing via company info.
- rodjons 6y agoIn my opinion, I think everyone should accept the fact that some of your personal information have been leaked online. But to think that every user's phone numbers are bind to other sensitive information is quite scary.
- codeecan 6y agoYou can check if your data is included here: https://codeeverywhere.ca/apps/fb_data https://codeeverywhere.ca/apps/fb_data