6 ms·

I'm looking forward to the sequel, "Have I Been 'Have I Been Facebooked'ed" when it turns out this is just a data harvesting operation. If you don't want your

I'm looking forward to the sequel, "Have I Been 'Have I Been Facebooked'ed" when it turns out this is just a data harvesting operation. If you don't want your phone number leaked don't hand it over to a random website that pinky swears it won't keep it. It's maybe not a scam, but still...

neogodless 6y ago
My phone number is a 10-digit number, the first 3 of which are an area code. It gets spam calls and texts (though that miraculously decreased on November 4th...) as it is. Now, combined with browser fingerprinting, perhaps this site can tie my specific 10-digit number to some other aspects of who I am, but I'll leave that part as an exercise for a willing volunteer. I'm not terribly concerned about entering my phone number, disconnected from other identifying information, into a random web site. Convince me why I should be!
- omgJustTest 6y ago
  TFA? If there is ever an exploit on phone codes, it will be massive. I removed my phone number as a TFA from most services within the last few days.
- deeblering4 6y ago
  2 factor sms authentication
  - GormHouj 6y ago
    The commenter is leery of entering their phone number into the article link.
  - peteretep 6y ago
    1 factor of 2 factor auth is completely useless without any identity to tie it to
    - deeblering4 6y ago
      we’re talking about the facebook data leak that associates a number to an identity.
      - peteretep 6y ago
        We’re talking about a website that allows you to enter a number to see if it’s in a leak. People are saying you shouldn’t put a number in there because if it’s not already in there, you are leaking some kind of privileged information. That’s not true.
        deeblering4 6y ago
        If that's the case then please go ahead and post a comment containing your full phone number
        peteretep 6y ago
        If I posted it as a comment, it would be tied to my identity.
        welder 5y ago
        It's super easy to find your identity from just your IP. I can't remember the service that does it... maybe drift.com? So putting your phone into a website also ties it to your identity.
  - imgabe 6y ago
    Knowing the phone number doesn't mean you can get the texts that are sent to it.
    - welder 6y ago
      Don't be so sure https://news.ycombinator.com/item?id=26468892 https://news.ycombinator.com/item?id=26468892
Syonyk 6y ago
> If you don't want your phone number leaked don't hand it over to a random website that pinky swears it won't keep it. What's the worst they can do with it? Call me all hours of the day trying to sell me an extended factory warranty for my free Medicare brace that, by the way, has a Security Number that is under arrest by the Security Administration because it made fraudulent IRS payments with iTunes gift cards to lower my student loan payments because I didn't listen when Microsoft called about my Windows Virus? Oh, wait, sorry, it hung up on me after dialing because their call center was full. Even if they answer, they just won't play anymore - as soon as they think you might be messing with them (or just aren't going to buy whatever they're selling), they hang up. Twenty years ago, you could have an hour long conversation with the credit card people if you were bored... Even with spam blockers in place, that sort of garbage is the bulk of the calls my phones get. At least for my personal phone, I live in a different area code from where the phone is (insert XKCD about your area code being where you lived in 2002), so anything that's my phone's area code and not in my contact list is clearly unwelcome. Phone numbers just aren't a large space to randomly dial looking for valid numbers if you're on a scum VOIP gateway, and clearly the scammers and spammers already have lists of what might be worth calling.
- watersb 6y ago
  "The worst that can happen"... In a world where your bank thinks that SMS is good enough for 2FA... phone number plus other info is good enough for credit reporting agencies to send out your complete file... Variations of this theme. Also, this dump is once more confirmation that Facebook owns lots of data about its users, and doesn't care to protect that data, or to give its users the ability to control personal information. Why should they care? They suffer no consequences for this lack.
  - Syonyk 6y ago
    I've had my phone number for... oh, 18-19 years. I assume it's utterly trivial for anyone who cares to find it, if they care to. I know it is, because I've had the occasional random call from people who wanted to give me a call for one reason or another. And, certainly, Facebook suffers no consequences. A while back, some people noticed that if a company was in the news for a catastrophic data breech, their stock tended to climb immediately afterwards. No such thing as bad press coverage, at least in the age of the trading algorithms!
skinnymuch 6y ago
Any one can enter any phone number. What does leaking a phone number without any ties except an IP mean?
- dylan604 6y ago
  You look up my number, and then I'll look up your number. Now, we're anonymized as the tracking codes that could be employed will associate my number with you, and vice versa. no problemo
tonymet 6y ago
exactly! They should be testing a hash of your phone number, not the number itself. Amateur hour here.
- davidjohnstone 6y ago
  I don't think that helps, because the address space of numbers is too small so anything is reversible. My solution to this was to generate 99 extra random numbers that start with the same digits as the real one and send them all to the server. The front-end then shows just the result the user cares about but the back-end doesn't know which is which. https://www.thenewseachday.com/private-facebook-phone-numbers-us https://www.thenewseachday.com/private-facebook-phone-number...
- sneak 6y ago
  There is a movie from the 80s called Wargames that you might enjoy.
renewiltord 6y ago
My phone number is my username. It’s not a password. It’s public.
baby 6y ago
I already get daily spam and robocalls on my phone number anyway...

neogodless 6y ago

My phone number is a 10-digit number, the first 3 of which are an area code. It gets spam calls and texts (though that miraculously decreased on November 4th...) as it is. Now, combined with browser fingerprinting, perhaps this site can tie my specific 10-digit number to some other aspects of who I am, but I'll leave that part as an exercise for a willing volunteer. I'm not terribly concerned about entering my phone number, disconnected from other identifying information, into a random web site. Convince me why I should be!

omgJustTest 6y ago
TFA? If there is ever an exploit on phone codes, it will be massive. I removed my phone number as a TFA from most services within the last few days.
deeblering4 6y ago
2 factor sms authentication
- GormHouj 6y ago
  The commenter is leery of entering their phone number into the article link.
- peteretep 6y ago
  1 factor of 2 factor auth is completely useless without any identity to tie it to
  - deeblering4 6y ago
    we’re talking about the facebook data leak that associates a number to an identity.
    - peteretep 6y ago
      We’re talking about a website that allows you to enter a number to see if it’s in a leak. People are saying you shouldn’t put a number in there because if it’s not already in there, you are leaking some kind of privileged information. That’s not true.
      - deeblering4 6y ago
        If that's the case then please go ahead and post a comment containing your full phone number
        peteretep 6y ago
        If I posted it as a comment, it would be tied to my identity.
        welder 5y ago
        It's super easy to find your identity from just your IP. I can't remember the service that does it... maybe drift.com? So putting your phone into a website also ties it to your identity.
- imgabe 6y ago
  Knowing the phone number doesn't mean you can get the texts that are sent to it.
  - welder 6y ago
    Don't be so sure https://news.ycombinator.com/item?id=26468892 https://news.ycombinator.com/item?id=26468892

Syonyk 6y ago

> If you don't want your phone number leaked don't hand it over to a random website that pinky swears it won't keep it. What's the worst they can do with it? Call me all hours of the day trying to sell me an extended factory warranty for my free Medicare brace that, by the way, has a Security Number that is under arrest by the Security Administration because it made fraudulent IRS payments with iTunes gift cards to lower my student loan payments because I didn't listen when Microsoft called about my Windows Virus? Oh, wait, sorry, it hung up on me after dialing because their call center was full. Even if they answer, they just won't play anymore - as soon as they think you might be messing with them (or just aren't going to buy whatever they're selling), they hang up. Twenty years ago, you could have an hour long conversation with the credit card people if you were bored... Even with spam blockers in place, that sort of garbage is the bulk of the calls my phones get. At least for my personal phone, I live in a different area code from where the phone is (insert XKCD about your area code being where you lived in 2002), so anything that's my phone's area code and not in my contact list is clearly unwelcome. Phone numbers just aren't a large space to randomly dial looking for valid numbers if you're on a scum VOIP gateway, and clearly the scammers and spammers already have lists of what might be worth calling.

watersb 6y ago
"The worst that can happen"... In a world where your bank thinks that SMS is good enough for 2FA... phone number plus other info is good enough for credit reporting agencies to send out your complete file... Variations of this theme. Also, this dump is once more confirmation that Facebook owns lots of data about its users, and doesn't care to protect that data, or to give its users the ability to control personal information. Why should they care? They suffer no consequences for this lack.
- Syonyk 6y ago
  I've had my phone number for... oh, 18-19 years. I assume it's utterly trivial for anyone who cares to find it, if they care to. I know it is, because I've had the occasional random call from people who wanted to give me a call for one reason or another. And, certainly, Facebook suffers no consequences. A while back, some people noticed that if a company was in the news for a catastrophic data breech, their stock tended to climb immediately afterwards. No such thing as bad press coverage, at least in the age of the trading algorithms!

skinnymuch 6y ago

Any one can enter any phone number. What does leaking a phone number without any ties except an IP mean?

dylan604 6y ago
You look up my number, and then I'll look up your number. Now, we're anonymized as the tracking codes that could be employed will associate my number with you, and vice versa. no problemo

tonymet 6y ago

exactly! They should be testing a hash of your phone number, not the number itself. Amateur hour here.

davidjohnstone 6y ago
I don't think that helps, because the address space of numbers is too small so anything is reversible. My solution to this was to generate 99 extra random numbers that start with the same digits as the real one and send them all to the server. The front-end then shows just the result the user cares about but the back-end doesn't know which is which. https://www.thenewseachday.com/private-facebook-phone-numbers-us https://www.thenewseachday.com/private-facebook-phone-number...
sneak 6y ago
There is a movie from the 80s called Wargames that you might enjoy.

renewiltord 6y ago

My phone number is my username. It’s not a password. It’s public.

baby 6y ago

I already get daily spam and robocalls on my phone number anyway...