10 ms·
The creator of HaveIBeenPwned clarified on Twitter that there's no plans to add "search by phone number," so odds are that, if your data is in this leak, you wo
by akarma 6y ago
The creator of HaveIBeenPwned clarified on Twitter that there's no plans to add "search by phone number," so odds are that, if your data is in this leak, you won't see it through HaveIBeenPwned.
>500m Facebook records were leaked and <10m records have an email address — far more records are phone number but no email.
[1] https://twitter.com/troyhunt/status/1378463581604220931 https://twitter.com/troyhunt/status/1378463581604220931
- kace91 6y agoIs there any (legal) way to see the leak? or at least to know if your data is among the leaked set? No interest in seeing other people's info, but I want to know if I'm affected.
- edoceo 6y agoCan't you search the mentioned site? There were links to a ufile folder with all the zips on here yesterday. I took a peek, relieved I wasn't in there.
- gruez 6y ago>There were links to a ufile folder with all the zips on here yesterday. The pastebin with the links got taken down, although there's an archive.is mirror of it. The forum where it's from also has torrent magnet links. >I took a peek, relieved I wasn't in there. AFAIK it was publicly scraped data combined with the exploit to get phone numbers[1]. If you didn't have a public profile you're probably safe. [1] https://news.ycombinator.com/item?id=25624982 https://news.ycombinator.com/item?id=25624982
- tacker2000 6y agoSearch telegram for fbleaks
- helloworld11 6y agohow does one search telegram? Isn't it just a person to person messaging app?
- CompuHacker 6y agoI had a similar confusion; apparently you can form long-running, multi-thousand user, searchable chat rooms.
- denysvitali 6y agoThey're called channels (when it's X to many), or super groups (when you have more than N people talking with each other).
- saddlerustle 6y agoOnly public profile data was leaked, and your phone number if you've enabled looking up your profile by phone number. Facebook's privacy checkup flow will walk you through these settings: https://www.facebook.com/privacy/checkup https://www.facebook.com/privacy/checkup
- deleted 6y ago[deleted]
- Ovah 6y agoI'm pretty sure everybody was 'opted-in' to this feature by default. Afaik I have never actively enabled it and yet I'm in the leak. I provided FB my phone number for 2FA purposes. I'm dumbfounded if they actually allowed people to look up my profile with my 2FA info.
- freebuju 6y agoEvery privacy offending feature on FB is 100% by default opt-out. This is their ethos. When you gave them your number, you gave them a way to not only permanently & consistenly identify you but also let others "discover" you/r profile aka reason for this leak. Using your number as 2FA auth is just a side bonus.
- DaiPlusPlus 6y ago> Every privacy offending feature on FB is 100% by default opt-out Uh, what?
- DaiPlusPlus 6y agoTo clarify: my reading of the parent posting was that "by default opt-out" meaning the user is opted-out by default, which is contrary to my understanding privacy-eroding features of Facebook are turned-on (i.e. "default to opt-in").
- chrisweekly 6y ago
- Natsu 6y agoI found it on some sketchy download site that I had to use jdownloader for and solve many captchas based on a tip from a past HN story. After that, you'll find that the data is poorly and inconsistently encoded (lots of ugly BOMs), a bunch of files are split in weird ways (that I had to concatenate then give sensible names to). Figuring out what order they go in (they're not all split on a record boundary!) may take some translation, too. After that, a bunch of them have bad, broken CVS headers and you have to find something that can manage huge files to edit the first couple of lines. Then you find that all of them use different delimiters (colon or comma), some of them quote each entry, and they each have a different set of data that doesn't match up at all. I'm still trying to figure out what the data in each file is and see if it can be normalized into one schema. So it's about like downloading a phonebook for half the world with some extra mystery data that has no description where you have to guess what it even means. Interestingly, I checked for a family member who deleted their FB a few years ago and they're not in there. It'd be interesting to see if there are any accounts that deleted before 2019 in the data or not. I suspect not, but this isn't enough of a test to prove it.
- beowulfey 6y agoreally? i only checked one of the country zips but it was 6 colon-delimited txt files that were easy to grep to see if any numbers i knew were in there
- Natsu 6y agoThey're all over the place. There are several dozen files, each named after a country. Some contain a single text file that's normal, others have different delimiters, encodings and other nonsense. The last record of some of the split files is split across files, etc. This is not particularly high quality data, I'm sure a lot of people didn't look at the data very much and just ignored a few lines of errors on import or did simple greps as you say because it's a pain in the rear to find editors that even can handle multi-GB files, etc. Even good converters like iconv can bomb out on, I think it was Qatar (which was also little endian UTF-16 with a BOM), etc. But yes, it's all over the place. I love how one of them decided to number things 1, 2, III, 4, though maybe that was the translator, I dunno, I never learned to read Arabic letters...
- Black101 6y agois it illegal to download a leak? I don't think so which is why I downloaded many of them.
- 3np 6y agoDepends on your jurisdiction. Might be legal, might be a jailable offense.
- faeyanpiraat 6y agoHow can I check?
- Black101 6y agoYou can't check... just wait and see if they put you in jail. Unless you hire an attorney that knows these laws... because not even attorneys can know all laws.
- nhumrich 6y agoOn the flip side, this data is already public. (its a leak). And by HIBP exposing it, the cost of selling this data goes down, playing the long game to help us. By HIBP locking down this data, you get a false sense of security. (it is still public info, just only in sketchier places), and there becomes a higher market for selling it.
- vorpalhex 6y agoIt's floating around in the usual places, including bittorrent.
- ginko 6y agoLooks like he's considering adding phone number search. There's a poll further down in the thread.
- deleted 6y ago[deleted]
- arnaudsm 6y agoI'm working on exactly that, using k-anonymity too. I expect to release my tool within 24h
- LilBytes 6y agoLooking forward to the Show HN. Keep us posted.
- hugoromano 6y agowhere should we go for your tool?
- arnaudsm 6y agoIt's now live on https://fbleak.info/ https://fbleak.info/, and it's open-source !
- sagarm 6y agoHow could a tool that checks for a specific phone number be k-anonymous?
- Godel_unicode 6y agoIt can't. Or at least, not while remaining useful for the haveibeenpwned use case. It's also an interesting choice for a search tool for a quasi-public dataset.
- thamer 6y agoIndeed I found my name and phone number in the new Facebook leak, but my email address wasn't listed. I would recommend people check for themselves.
- Black101 6y agoHow easy would it be to implement a new field? very.
- davidjohnstone 6y agoI created https://www.thenewseachday.com/facebook-phone-numbers-us https://www.thenewseachday.com/facebook-phone-numbers-us and https://www.thenewseachday.com/facebook-phone-numbers-australia https://www.thenewseachday.com/facebook-phone-numbers-austra... to check if phone numbers are in the data. (The data is split by country and I've made them for the US and Australia so far.)
- vxNsr 6y agoWhile I appreciate what you did there by allowing search by phone number. The home page of that website is terrible, you claim to be a website for news but it’s really just far left propaganda, interspersed with communist agenda items, and a smattering of kinda center left articles.
- sn_master 6y agoIn this day and age, "news" and "propaganda" are interchangable.
- hh3k0 6y agoThey always have been. There's no mythical past in which the powers that be have not used it for their agenda.
- hh3k0 6y ago> The home page of that website is terrible, you claim to be a website for news but it’s really just far left propaganda, interspersed with communist agenda items Can you provide some examples?
- darcmage 6y agoThe majority of articles are from CNN, NYT and Politco.
- vxNsr 6y agoYes and? Anyone who has been paying attention would agree that CNN, NYT, and Politico are all far left or center left depending on the author of the piece in question. I’ve been watching WH press briefings since Obama and I had to stop for a few years of trump just bec of the vitriol that was hurled at the press secretary. Suddenly under Biden these same reporters have become as docile as sheep again despite the same scandals happening daily... I wonder why?
- stjohnswarts 6y agoIs there a problem with searching by email to confirm you're in the breach? It seemed to work for me.