5 ms·

I just logged in to Facebook for the first time in years to check the data it has on me. Luckily I never added my phone number or address, so should hopefully b

I just logged in to Facebook for the first time in years to check the data it has on me. Luckily I never added my phone number or address, so should hopefully be in the clear.

Macha 6y ago
Did you ever set up SMS 2fa? Did any of your contacts use the Facebook app to sync their contacts (at least at one point a default behaviour)? Then Facebook has your number. I remember when I still used it being promoted by a bar at the top of the web UI "Is this your number?" With my actual number suggesting I add it to my profile, so I know they have mine.
- antegamisou 6y ago
  I have had the exact same experience. Interestingly, it took them a few tries to get to my actual number and they still carried on throwing other random phone numbers I did not recognize.
- jtylr 6y ago
  Despite using 2FA and listing my number on my profile - albeit restricted to "just me", I don't appear in the data. It's not as simple as they just having a record of it somewhere.
  - wccrawford 6y ago
    I'm in the same situation and very surprised. I've sat here wondering if I'm entering my numbers wrong, or if I'm really not in it. I've read the blog post and I'm entering the 1 in front of my 10 digits, because I'm in the USA. My wife's number isn't in there, either. I'm just really surprised, because I checked facebook the other day and it said I was searchable by email and phone number. I even searched my email address, and a lot of other breaches show, but not Facebook. I guess I got lucky?
    - ricardobayes 6y ago
      US numbers are not uploaded yet
      - wccrawford 6y ago
        Ah, that makes sense then. I assumed they were because the instructions showed the US style specifically. Thanks!
  - Etheryte 6y ago
    Likewise, it seems there's more nuance to this leak. I checked the data out and a large number of my contacts have correct numbers in it. At the same time, numerous people don't appear in it, even if they do have a phone number on their profile.
- vmception 6y ago
  I've been intentionally breaking my social graph since at least 2012. Looks like its worked here. When I make a Facebook account, usually for my living complex's community or a bunch of Gen-Xer's doing a burning man thing, I use a new email or new phone number for signup and one time passwords. I don't let it get access to my contacts, assuming I inadvertently installed the Facebook app on a phone. Doesn't look like they meaningfully go deeper than that. I find the social graph to be very fungible, so if I really ever want to recreate it I can just add my phone number or give any app access to my contacts. This knowledge also lets me not be married to any of these services. I'm very content downloading the account data and then deleting the account.
freebuju 6y ago
Try creating a new facebook account today. The site won't let you do that without verifying a phone number. The difficulty level increases if you try doing so behind a vpn. Same goes for other SM sites like Twitter.
- mimimi31 6y ago
  I don't think that's true. I created a Facebook account a few weeks ago and a Twitter account just yesterday, both without needing a phone number.
  - teddyh 6y ago
    By all accounts, anyone can create an account, but then the account invariably quickly gets suspended, requiring a phone number for “verification”.
- durnygbur 6y ago
  Don't they have a "real person" policy now? ie. not only phone number but as well a requirement to upload a passport style photo. Concidentally on entrance to US a camera makes a high resolution photo of every traveller during passport control.
  - nonameiguess 6y ago
    I believe they have always had this policy, though it wasn't particularly well enforced when they opened up the platform to all comers. I actually had a Facebook account before I even first got a mobile phone at all, back in 2004 when you needed a .edu email address to sign up, which just meant they were delegating identity verification to the university. I think people were fairly comfortable with it back then because the only other users who could see you were people from the same school and it just mimicked the physical "facebook" that universities already published and made available to everyone with directory listings including your official photo and the phone number and room number of your dorm if you lived on campus. There was no open network. You could only even search for people from your own school. Obviously, the platform has radically changed since then, but they have gotten a lot of mileage out of the illusion that you could freely share what you wanted because the only people who were going to see it were people who already knew you anyway, which was at least somewhat true at first.
layoutIfNeeded 6y ago
Haha, no. It’s enough if one of your friends/relatives/etc. had allowed Facebook/Instagram/WhatsApp/etc. to scan their contact list. Your phone number is in there, just not shown, trust me. In fact Facebook used to show creepy suggestions when such cross-pollination of data occured, like “Click here to confirm that XXXXXX is your phone number!”, but they stopped doing that a few years ago.

I just logged in to Facebook for the first time in years to check the data it has on me. Luckily I never added my phone number or address, so should hopefully be in the clear.

Macha 6y ago

Did you ever set up SMS 2fa? Did any of your contacts use the Facebook app to sync their contacts (at least at one point a default behaviour)? Then Facebook has your number. I remember when I still used it being promoted by a bar at the top of the web UI "Is this your number?" With my actual number suggesting I add it to my profile, so I know they have mine.

antegamisou 6y ago
I have had the exact same experience. Interestingly, it took them a few tries to get to my actual number and they still carried on throwing other random phone numbers I did not recognize.
jtylr 6y ago
Despite using 2FA and listing my number on my profile - albeit restricted to "just me", I don't appear in the data. It's not as simple as they just having a record of it somewhere.
- wccrawford 6y ago
  I'm in the same situation and very surprised. I've sat here wondering if I'm entering my numbers wrong, or if I'm really not in it. I've read the blog post and I'm entering the 1 in front of my 10 digits, because I'm in the USA. My wife's number isn't in there, either. I'm just really surprised, because I checked facebook the other day and it said I was searchable by email and phone number. I even searched my email address, and a lot of other breaches show, but not Facebook. I guess I got lucky?
  - ricardobayes 6y ago
    US numbers are not uploaded yet
    - wccrawford 6y ago
      Ah, that makes sense then. I assumed they were because the instructions showed the US style specifically. Thanks!
- Etheryte 6y ago
  Likewise, it seems there's more nuance to this leak. I checked the data out and a large number of my contacts have correct numbers in it. At the same time, numerous people don't appear in it, even if they do have a phone number on their profile.
vmception 6y ago
I've been intentionally breaking my social graph since at least 2012. Looks like its worked here. When I make a Facebook account, usually for my living complex's community or a bunch of Gen-Xer's doing a burning man thing, I use a new email or new phone number for signup and one time passwords. I don't let it get access to my contacts, assuming I inadvertently installed the Facebook app on a phone. Doesn't look like they meaningfully go deeper than that. I find the social graph to be very fungible, so if I really ever want to recreate it I can just add my phone number or give any app access to my contacts. This knowledge also lets me not be married to any of these services. I'm very content downloading the account data and then deleting the account.

freebuju 6y ago

Try creating a new facebook account today. The site won't let you do that without verifying a phone number. The difficulty level increases if you try doing so behind a vpn. Same goes for other SM sites like Twitter.

mimimi31 6y ago
I don't think that's true. I created a Facebook account a few weeks ago and a Twitter account just yesterday, both without needing a phone number.
- teddyh 6y ago
  By all accounts, anyone can create an account, but then the account invariably quickly gets suspended, requiring a phone number for “verification”.
durnygbur 6y ago
Don't they have a "real person" policy now? ie. not only phone number but as well a requirement to upload a passport style photo. Concidentally on entrance to US a camera makes a high resolution photo of every traveller during passport control.
- nonameiguess 6y ago
  I believe they have always had this policy, though it wasn't particularly well enforced when they opened up the platform to all comers. I actually had a Facebook account before I even first got a mobile phone at all, back in 2004 when you needed a .edu email address to sign up, which just meant they were delegating identity verification to the university. I think people were fairly comfortable with it back then because the only other users who could see you were people from the same school and it just mimicked the physical "facebook" that universities already published and made available to everyone with directory listings including your official photo and the phone number and room number of your dorm if you lived on campus. There was no open network. You could only even search for people from your own school. Obviously, the platform has radically changed since then, but they have gotten a lot of mileage out of the illusion that you could freely share what you wanted because the only people who were going to see it were people who already knew you anyway, which was at least somewhat true at first.

layoutIfNeeded 6y ago

Haha, no. It’s enough if one of your friends/relatives/etc. had allowed Facebook/Instagram/WhatsApp/etc. to scan their contact list. Your phone number is in there, just not shown, trust me. In fact Facebook used to show creepy suggestions when such cross-pollination of data occured, like “Click here to confirm that XXXXXX is your phone number!”, but they stopped doing that a few years ago.