4 ms·

Facebook Says It’s Your Fault That Hackers Got Half a Billion User Phone Numbers

63 points by notRobot 6y ago

notRobot 6y ago
> And, the company hasn’t explained why a number of users who have deleted their accounts long before 2018 have seen their phone numbers turn up in this database. Everything about this pisses me off. But this thing in particular... Why was my data accessible through a "feature designed to find friends" if I'd deleted my account years ago?
- jsilence 6y ago
  Hope some European ex customers sue FB based on GDPR.
goatinaboat 6y ago
In Ireland, the Data Protection Commissioner (DPC)—which has the power to levy a fine of up to 4% of global turnover or around $3.5 billion—has slammed the company for failing to inform it of the breach. In the words of a famous Irishman "they'll do nothing".
high_byte 6y ago
sorry, I hate Facebook, and their statement is Facebookish as always but I don't like this twist of words "it's your fault". it was really scraped, not "hacked"
- dexen 6y ago
  Thank you for the explainer.
- boublepop 6y ago
  I guess it depends on how you draw the line between scraping and hacking. We can probably agree that if you publish a list of Marvel superheroes and I download it, that is scraping. If you put it behind password protection and I find an error and get it, then it’s hacking. Now let’s assume you make a quiz which uses the list as answers, taking the quiz is just normal behavior, automating taking the quiz in order to extract the whole list is somewhere between hacking and scraping to me. It’s not “just scraping content” but it’s also not using a security exploit to gain unauthorized access, it’s abusing the systems intended functionality to expose content that was not intended to be published and then collecting it. Obviously someone should’ve be able to get a Facebook account id just by providing a phone number in the first place, but if used as intended the feature is harmless, but if we want to claim this is “just scraping” then Facebook would also be claiming that the there was absolutely not issue in publishing a list of all user accounts and phone numbers in the first place.
- sdfhbdf 6y ago
  But these people's number were not published. They were scraped from vulnerable "cloud server" - from what I gather some endpoint for Find My Friends feature was not secured. They blame shifting on fb is really unacceptable.
- goatinaboat 6y ago
  it was really scraped, not "hacked" It was really a spraying attack, which counts as "hacking".
swiley 6y ago
It looks like mine somehow wasn't leaked. I never enabled 2fa (sms 2fa is worse than nothing) and didn't use whatsapp (which I guess didn't scrape my friends contacts as aggressively as I expected?)
bezoz 6y ago
I am confused, where exactly does their statement say it is our fault?

63 points by notRobot 6y ago

> And, the company hasn’t explained why a number of users who have deleted their accounts long before 2018 have seen their phone numbers turn up in this database. Everything about this pisses me off. But this thing in particular... Why was my data accessible through a "feature designed to find friends" if I'd deleted my account years ago?

jsilence 6y ago
Hope some European ex customers sue FB based on GDPR.

goatinaboat 6y ago

In Ireland, the Data Protection Commissioner (DPC)—which has the power to levy a fine of up to 4% of global turnover or around $3.5 billion—has slammed the company for failing to inform it of the breach. In the words of a famous Irishman "they'll do nothing".

high_byte 6y ago

sorry, I hate Facebook, and their statement is Facebookish as always but I don't like this twist of words "it's your fault". it was really scraped, not "hacked"

dexen 6y ago
Thank you for the explainer.
boublepop 6y ago
I guess it depends on how you draw the line between scraping and hacking. We can probably agree that if you publish a list of Marvel superheroes and I download it, that is scraping. If you put it behind password protection and I find an error and get it, then it’s hacking. Now let’s assume you make a quiz which uses the list as answers, taking the quiz is just normal behavior, automating taking the quiz in order to extract the whole list is somewhere between hacking and scraping to me. It’s not “just scraping content” but it’s also not using a security exploit to gain unauthorized access, it’s abusing the systems intended functionality to expose content that was not intended to be published and then collecting it. Obviously someone should’ve be able to get a Facebook account id just by providing a phone number in the first place, but if used as intended the feature is harmless, but if we want to claim this is “just scraping” then Facebook would also be claiming that the there was absolutely not issue in publishing a list of all user accounts and phone numbers in the first place.
sdfhbdf 6y ago
But these people's number were not published. They were scraped from vulnerable "cloud server" - from what I gather some endpoint for Find My Friends feature was not secured. They blame shifting on fb is really unacceptable.
goatinaboat 6y ago
it was really scraped, not "hacked" It was really a spraying attack, which counts as "hacking".

swiley 6y ago

It looks like mine somehow wasn't leaked. I never enabled 2fa (sms 2fa is worse than nothing) and didn't use whatsapp (which I guess didn't scrape my friends contacts as aggressively as I expected?)

bezoz 6y ago

I am confused, where exactly does their statement say it is our fault?