20 ms·

Facebook does not plan to notify half-billion users affected by data leak

667 points by wdb 6y ago

wdb 6y ago
Guess it's too hard to notify users that their information got leaked. I hope they reported to all the different institutions in Europe though. The article suggests they didn't even report it to the Ireland one!
- jeltz 6y ago
  They general guideline in the GDPR is 72 hours. > In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
- alephu5 6y ago
  Are you seriously claiming it's too hard? They could send out emails, Facebook messages or show some banner in the profile page. This is Facebook ffs, they almost have a monopoly on communication.
  - fwn 6y ago
    Not our parent claims it's too hard to find the users affected by that breach, Facebook does. Curiously. Quote from the source article: > The Facebook spokesman said the social media company was not confident it had full visibility on which users would need to be notified.
    - varispeed 6y ago
      Did they not see the user ids in the leak? Just do facebook.com/user_id and you got the person...
  - dathinab 6y ago
    > too hard to notify users Legally seen. The way privacy protection laws are, especially in Germany, is kinda stupid. On one side they often doesn't protect you in practice, on the other side they effectively hinder and sometimes prevent reasonable usage. Just a view examples: - A local government couldn't properly inform elder people that they now can get Vaccinated for free because the interplay of various privacy protection law (and stupidity/inflexibility in other areas tbh.). - Germany has a privacy respecting anonymized blutooth based contact tracing app (wrt. Covid). But if you do a test you first have to physical sign of that other people are anonymized informed that someone they likely had contact with has covid, then when you get the result you still need to agree again to share this information. And even this was only possible after changing regulations. (I.e. why is one initial agreement not good enough?) - The government most likely not being able to inform the victims of such data breaches. - ...
    - disgu 6y ago
      > But if you do a test you first have to physical sign of that other people are anonymized informed that someone they likely had contact with has covid This is false. I've been tested about 15 times within the last year and none of the things I "signed" included any of that. I didn't have to physically sign ANYTHING at all. What are you talking about?? It's just a click field on the online application and that only says that you're okay with your data being shared with the lab that also sends you your test results. > then when you get the result you still need to agree again to share this information. This is also absolutely untrue as Covid, among others, is on the list of illnesses that the local Gesundheitsamt has to be notified of. It's not even optional. It's the law. https://www.gesetze-im-internet.de/ifsg/__6.html https://www.gesetze-im-internet.de/ifsg/__6.html Honestly curious where you got that information from?
      - dathinab 6y ago
        > I didn't have to physically sign ANYTHING at all. What are you talking about?? It's just a click field on the online application and that only says that you're okay with your data being shared with the lab that also sends you your test results. If you did register a test with the covid app you had got had to sign something when doing the (not "fast"/PCR) test. If not something was legally not quite right. Also maybe in recent month this might also have been changed but it's unlikely.. > This is also absolutely untrue as Covid, among others, is on the list of illnesses that the local Gesundheitsamt has to be notified of. It's not even optional. It's the law. https://www.gesetze-im-internet.de/ifsg/__6.html https://www.gesetze-im-internet.de/ifsg/__6.html I'm speaking about the covid app, not the health agency, which yes gets reporting always but also (at least at the being of Covid) had a completely inefficient procedure which made the German health agencies in most German states at least at the middle unable to process it anywhere close in time. Like they collecting "people you had been in contact with" 3! weeks after you where found to have covid was not uncommon. > Honestly curious where you got that information from? People officially working on the developen of the covid app (there is a ccc talk). And various other sources which also overlap with personal experiences (like yes I personally had to give agreement on paper so that I could use the covid app). Note that the physical confirmation is kinda hidden on a paper containing all kind of information, so meany people might not have been aware of it.
Ceezy 6y ago
So if I decide to fish the world with this database, am i really doing something wrong? Cause you would think if somebody steal from you at Wallmart and the cashier sees it. They would try to notify you. If everybody think it's ok, when does it start to be:" I just found this wallet full of cash and i'm not notifying the authority?"
pulkitsh1234 6y ago
I am surprised how the Facebook stock is pretty unaffected by all of this.
- deepstack 6y ago
  They are subsidized. Stock may not be best indication of the performance of the company.
  - strogonoff 6y ago
    That’s the problem with free ad-based media giants. For an individual, the deadly combination of the platform being large enough, free and closed (no APIs for feature-complete third-party cross-platform clients) means a huge barrier to switching over to a different social provider with better ethical, infosec and privacy track record—and all the while company’s interests are aligned with ones of the advertisers, the actual paying users. Stock performance, of course, reflects that.
- ZephyrBlu 6y ago
  It's priced in. /s of course, but maybe people really don't care because FB has been in so many of these types of controversies?
- apples_oranges 6y ago
  I own some of their stock and I keep buying more. Reason: FB is doing a great job with advertising and they are not just Facebook but also Instagram and other things.
  - sp332 6y ago
    Counterpoint: Facebook is taking your invested money and doing terrible things with it. Why fund that?
    - Dirlewanger 6y ago
      If the world's corporations are taking us to Hell, I want a piece of the action.
villgax 6y ago
It's from 2019 is the stupid excuse they have. The amount of laxity they have shown in this matter is appalling!!
- tareqak 6y ago
  Did they notify people about it 2019? Does GDPR, CCPA, and other similar privacy laws have a statute of limitations? [0], [1], [2] [0] https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en https://ec.europa.eu/info/law/law-topic/data-protection/data... [1] https://www.oag.ca.gov/privacy/ccpa https://www.oag.ca.gov/privacy/ccpa [2] https://en.wikipedia.org/wiki/Privacy_law https://en.wikipedia.org/wiki/Privacy_law
- mtgx 6y ago
  "The crime was already committed - what purpose does it serve to punish us for it now?"
- shatnersbassoon 6y ago
  If you change your DoB every year like I do, you'll be fine...
  - thih9 6y ago
    Assuming not sarcasm, how does that help? Do you do this for just Facebook or for multiple websites?
    - NavinF 6y ago
      I use a random DoB for every website. (The only exception is banks because it has to match what's on my ID and credit report)
    - shatnersbassoon 6y ago
      You assumed incorrectly :) I don't have an account, but I'm fairly sure Facebook doesn't let you edit it once you've given it.
  - 6y ago
hellbannedguy 6y ago
Zuck: I have over 4,000 emails, pictures, addresses, SNS [Redacted Friend's Name]: What? How'd you manage that one? Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb fucks.
- vntok 6y ago
  > hellbannedguy: something dumb 17 years ago Probably.
tuxone 6y ago
This huge leak has definitely killed the SMS text messaging service. Sender can be spoofed and spam/scam/phishing have reached an intolerable level. The fact that they can cross reference you and then produce a more personalized content is huge. Changing password is easy (ok less easy if you recycle it) but changing phone number is something that I am not even relaxed to do.
- blackoil 6y ago
  > Sender can be spoofed Is this worldwide or US? I for now trust the senderid and assume them to be valid if they are coming from bank etc. I also haven't heard of anyone spoofing SMS. Should I be more cautious?
  - Aaargh20318 6y ago
    > Is this worldwide or US? Worldwide. SMS is just like e-mail, you can put anything you want in the sender field. You should absolutely not trust SMS.
    - mrtksn 6y ago
      Any idea on the extra security measures? In Turkey for example, when you change your SIM card the 2FA from the banks will stop working and you need to call your bank to re-activate it. That of course seems like a measure to prevent SIM cloning but maybe there are some security protections against spoofing. In many places SMS is a popular way to do payments and 2FA for high security applications.
      - rincebrain 6y ago
        Where does SMS get used to do payments? (...and how?) SMS for 2FA is known to be a very bad idea, and some security experts have been shouting about the need to stop doing that for a while. I also can't see any country managing to implement more restrictions on SMS without either breaking a lot of "legitimate" sources of SMS or being ineffective outside of a very narrow window (e.g. only blocking forged SMS for numbers originating within one country)
YesThatTom2 6y ago
If you think it is important to notify the victims, why don’t you do it yourself? You have their contact info!
- bayindirh 6y ago
  That'd be a punishable offense. No, literally.
martini333 6y ago
That's is for Facebook in EU, I hope.
- deleted 6y ago
  [deleted]
PaulKeeble 6y ago
Zuckerberg is probably right in this one. Whatever fines might come out in the EU around this will be nothing compared to the cost of loosing the customers they notify and the cost of notifying them.
- La1n 6y ago
  "Right" to keep FB valuation, but that doesn't mean legally/morally/ethically right. I'd say Zuckerberg is in the wrong, but I also understand why he made the decision.
- bayindirh 6y ago
  > Zuckerberg is probably right in this one. Yes, for protecting his own interests. Users are just like cattle, playing farming simulations, feeding cattle. They needn't to know what's happening in real life.
- tomxor 6y ago
  > Whatever fines might come out in the EU around this will be nothing compared to the cost of loosing the customers they notify and the cost of notifying them. There is no mention of GDPR in the article, but in the worst case of not notifying _at all_, the GDPR fine should be $3.5B (4% of their global revenue). Is this quantity insignificant enough for them to ignore? (not rhetorical, i have no idea how much capital they are happy to burn). > Zuckerberg is probably right in this one. Right from an economic perspective perhaps, but not an ethical one...
  - Isinlor 6y ago
    EU legal system will not allow a company to trade infringement for a fine. If they had to do something, they will get a fine and they will be forced to do it anyway by the court. If they don't comply with court orders they will be fined separately with an accumulating sum until they do.
- dathinab 6y ago
  Utile the does the EU does notify them, which would be really funny tbh. Just imagine getting a SMS (chain): > You phone number and some of your data (<listed>) had been involved into a Facebook data breach. While Facebook is required by <insert law> to inform you about this breach they insists of not complying with the law and keeping they users in the dark. As such we <insert EU/local government agency> decided to do so. More information can be found here: <link to official EU site + link to local government sites with official translations>
pibefision 6y ago
This is one of the best cases to see if GDPR truly works in Europe
- Hamuko 6y ago
  It's kind of an edge case since the breach happened before GDPR enforcement started.
  - adav 6y ago
    GDPR was enforceable from 25th May 2018. Leak dates to 2019 from the news sources I've seen.
    - Hamuko 6y ago
      I could've sworn it became enforceable later but apparently I've lost all sense of time.
      - adav 6y ago
        We all have this year :)
progx 6y ago
Why notifiy? Victims got notified everyday with many spam-sms. Thanks Facebook!
- qwertox 6y ago
  Because I would really like to know if I'm affected. According to "Have I Been Pwned" my phone number is not in the list, but about one or two weeks ago I noticed that my spam folder was unusually full, which led me to believe that something new must have happened. Shortly thereafter Facebook's leak hit the news. From my point of view it is their obligation to notify all the affected users. It's morally the right thing to do, and legally, well, I don't know, but maybe the GDPR says that yes, that it's their obligation to do so. And with notification I mean to send a notification email, since I haven't logged in for months and don't intend to this year.
  - jaywalk 6y ago
    The leak did not include email addresses, so your email spam issue is unrelated.
    - wasmitnetzen 6y ago
      It did include email addresses in some cases, just not all of them.
    - markeganfuller 6y ago
      According to haveibeenpwned.com > whilst each record included phone, only 2.5 million contained an email address
    - pilsetnieks 6y ago
      Newer Android versions have an SMS spam folder as well, they might have been talking about that.
    - bogwog 6y ago
      That's not true, many of the accounts did have email addresses.
petemir 6y ago
@dang duplicate https://news.ycombinator.com/item?id=26729989 https://news.ycombinator.com/item?id=26729989
andyferris 6y ago
My understanding is they are wilfully violating Australian law too, not just the GDPR. I wonder how various countries will react?
- CaptainJustin 6y ago
  I hope the fines are enough for them to ensure this doesn't happen again. Personally I don't have a Facebook account because I don't trust them anyway but I think the people who have one probably didn't want this to happen.
cblconfederate 6y ago
The "real names" myth was the biggest scam played against people in the past 15 years. The media are also wholesale responsible for perpetuating that damaging trend. Historians of the future will look at the past 2 decades with disbelief.
- nickthemagicman 6y ago
  What's the 'real names' myth?
  - cblconfederate 6y ago
    The idea that using your state-given name online is beneficial.
    - eyjafjallajokul 6y ago
      What is a state-given name?
      - StavrosK 6y ago
        The thing on your birth certificate.
      - Karsteski 6y ago
        Presumably your birth name given to you by your parents. Describing it as "state given" seems intentionally misleading...
        lmilcin 6y ago
        It should be called "state-recognized". The state does not give you name, but it registers it and uses it to recognize you in various situations. Usually the name is not enough to identify a person (and fun/disaster ensues when this is attempted) so, usually, more information is needed to identify a person.
nickthemagicman 6y ago
Isn't it just scraped public data? Calling it a leak for data that's public seems odd.
- twobitshifter 6y ago
  The data isn’t public. It’s based on the friend finding feature. If you fill a contact list with phone numbers Facebook will automatically suggest the person with that number as your friend. So if you make a contact list with all possible phone numbers, you can know who they belong to.
trissylegs 6y ago
I suppose a well meaning spammer could just SMS everyone pretending to be Facebook.
- lucb1e 6y ago
  Let me just drop a note here that I happen to have two "unlimited" SMS subscriptions (i.e. could at least notify a few thousand people) in different European countries and that contact info is in my profile in case anyone has... ideas... :-)
  - deleted 6y ago
    [deleted]
  - lucb1e 6y ago
    Can't edit anymore, but this was not exactly an invitation to email me names and phone numbers to text. I don't know the legal implications of sending mass unsolicited messages to people whose phone number I obtained through downloading questionable data. If you really want to warn people and you have a plausible explanation for the legal basis on which we're doing this, then I would definitely be able to contribute resources to your cause. But also, frankly, they put this info there and configured it to be public themselves. Doesn't mean they don't need to be warned about this misconfiguration, but it's quite different from if there had been a data leak caused by facebook that facebook isn't telling the users about. I don't feel the need to drop what I'm doing and spend a couple days looking into the legal status, coming up with a good narrative / what to text them, gathering other people, figuring out how a regular human being can send hundreds of text messages without doing custom app development (if avoidable), dealing with the aftermath... TL;DR: if you cleared the list of todos in the previous sentence, then my resources you shall have.
arnaudsm 6y ago
This is probably illegal in Europe. They have 72h to notify their users after noticing a breach according to GDPR's article 33: https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/ Edit: My bad, only notify the authorities.
- jarym 6y ago
  Except they're not claiming 'breach' they're claiming 'scraping'. Not sure semantic acrobatics is going to fly with the regulator however.
  - p49k 6y ago
    They claim “scraping” in contexts where it benefits them to use that term (requirement to notify users) and “exploited vulnerability” when it benefits them in other contexts (answering to why private personal info was found online). Sometimes they even claim both in the same sentence: > A Facebook spokesperson told Insider that the data had been scraped because of a vulnerability that the company patched in 2019 They absolutely can’t have this both ways.
- Oras 6y ago
  > Notification of a personal data breach to the supervisory authority. Not users. FB had probably done that already.
- progval 6y ago
  Notification to users is required by article 34, not 33: https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/ There is no 72h requirement, but "the controller shall communicate the personal data breach to the data subject without undue delay"
rpastuszak 6y ago
"The Facebook spokesman said the social media company *was not confident it had full visibility on which users would need to be notified*." @Facebook here you go: https://haveibeenpwned.com https://haveibeenpwned.com
- londons_explore 6y ago
  If Facebook has since deleted some of those accounts or associated phone numbers, they may no longer have a way to contact those users. The GDPR in Europe would require them to delete that data in a bunch of circumstances.
  - zachberger 6y ago
    The beach has phone numbers and emails- why wouldn't they be able to contact those users with that information?
    - londons_explore 6y ago
      Facebook can't use the breach itself to contact users, no. The data could have been tampered with, and besides, Facebook doesn't have permission to process the leaked data in that way.
      - willcipriano 6y ago
        If they find a match against the leaked data, that would validate it and prove it had not been tampered with and at least allow them to contact a subset of users. Why can't they do that at least?
        londons_explore 6y ago
        They can do that. They probably won't because they'll argue it's all part of peoples public profiles and therefore published information rather than private information.
tacone 6y ago
For years companies have been steadily asking, mandating or even trickling users to give them their phone numbers under the excuse of security (while the real reasons were different), now what? How can they be trusted anymore? This also strikes a great point about the data sharing between Facebook and WhatsApp. Linking data between services augments the dangers and the consequences are not obvious to the end user. I think Facebook should offer their users the option to remove their phone numbers with a real deletion.
- gameswithgo 6y ago
  >How can they be trusted anymore? They never could be.
  - pyotr55 6y ago
    zuckerberg's infamous "dumb f**ks" quote comes to mind.
    - dijit 6y ago
      Zuck: Yeah so if you ever need info about anyone at Harvard Zuck: Just ask Zuck: I have over 4,000 emails, pictures, addresses, SNS [Redacted Friend's Name]: What? How'd you manage that one? Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb fucks Instant messages sent by Zuckerberg during Facebook's early days, reported by Business Insider (May 13, 2010): https://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5?r=US&IR=T https://www.businessinsider.com/well-these-new-zuckerberg-im...
      - iyt23 6y ago
        Given the number of times this quote has been dutifully typed in this thread, HN finally found its narwhal to bacon at data breach, it seems. It’s interesting to watch the competition between those flagging it off the site and those repeating it, apparently unaware it’s been flagged and removed already.
- 6y ago
geogra4 6y ago
Who's going to tell them otherwise?
- deleted 6y ago
  [deleted]
stiray 6y ago
Oh, facebook will pay for this breach. A lot. One thing is breach, the second part is hiding and not notifying "natural persons". They have basically violated (ignoring data collection methods etc.) what GDPR is about. But probably they wont notify non EU users. As they are not obliged so they don't care. Article 33. "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. 2Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay." https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/ Article 34: "When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay." https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/
- utf_8x 6y ago
  True in theory but Facebook is one big GDPR breach and nobody with the power to fine them seems to give a shit...
indigodaddy 6y ago
Stunningly negligent decision by Facebook. More evidence that FB is confident they can get away with most anything without significant consequential blowback on their bottom line at the end of the day.
fredgrott 6y ago
how is this even legal in the US?
brynjolf 6y ago
My twitter account got flagged as suspicious even though I haven't used it during the past few months and have a long random password. Now they want my mobile number to "verify" me in addition to a captcha. It is ridiculous and ovcoiolsly tech companies can't be trusted with personal data of that caliber. I have never used my real name with that twitter account and now they want to know it all, why? Greed is my guess.
- artificialLimbs 6y ago
  Discord asked for 'phone verification' yesterday after failing to sign in successfully a couple of times. If they didn't have my phone before, how will having it now verify anything? Nope. Account disbanded.
po1nter 6y ago
> Because the scraping took place prior to GDPR, Facebook chose not to notify this as a personal data breach under GDPR. From here https://www.dataprotection.ie/en/news-media/press-releases/dpc-statement-re-dataset-appearing-online https://www.dataprotection.ie/en/news-media/press-releases/d...
- Nemo_bis 6y ago
  Thanks for posting the only useful addition to the thread. :) So the authority is still looking into it. They could still reach an agreement with Facebook on what to do. Then Facebook would probably be shielded from whatever liability those actions would supposedly cause (their excuse "we might make mistakes"), because "we were told to".
bilekas 6y ago
Maybe its already been answered in the comments, but I cant seem to find it but isnt it required by law to notify the users ? At least for GDPR there is a requirement : > A controller is obliged to notify the DPC of any personal data breach that has occurred, unless they are able to demonstrate that the personal data breach is 'unlikely to result in a risk to the rights and freedoms of natural persons'.
Threeve303 6y ago
Someone should get the leaked data and notify everyone. It does contain contact information after all...
- Nemo_bis 6y ago
  If you mean by email, good luck not getting blacklisted as spammer everywhere. Maybe the likes of Microsoft and Google could bother to "notify" their users without such a fear. But there are other considerations.
heletoto 6y ago
Why should they notify us? They are stealing our data right under our noses. I hope that non-tech people would be aware of what's happening right now as they might have something to say about this.
long_warmup 6y ago
Years ago facebook kicked me out from their platform. After reading this article I feel I was right to keep it that way.
jamesrr39 6y ago
This should be fun. Looking forward to seeing the size of the GDPR fine!
rubyn00bie 6y ago
I’ve said it before and I’ll say it again, unless and until, companies like Facebook are fined appropriate amounts they’ll never stop. Quite literally, every business school on the fucking planet will tell you do something if it’s cheaper. It is cheaper for them to not give a fuck, than to give one. Unless they are fined upwards of $20-50bn it’ll never stop because it’s always going to benefit their bottom line. Full stop. If you don’t take 10-15% from a company they won’t ever be incentivized to stop. This 5% or less bullshit has to stop if folks want change. Edit: small grammar fix.
- dexen 6y ago
  You are advocating creating perverse incentives. A specific branch of government, a select agency, to become a profit center through continuous finding and fining of ever more wrongdoings. All morally excused because the victims are faceless multinational corps. We all know how badly that goes with speed traps and red light cameras - instead of improving, the road conditions and sometimes even local rules are tweaked to maintain steady cashflow. Say no to revolving doors of regulators, say no to moral hazard of what effectively amounts to vice tax. Apply criminal penalties when reasonable, don't make data leaks & privacy breaches just another cost of doing business. -edit- Clarification: a fine works well when it's expected to be a rare penatly enacted on a singular player - as it makes that player noncompetitive in the market. Conversely, when fines are expected to apply regularly and at proportional rate to most, or all, players in a market, the fine no longer makes the player noncompetitive - it merely shifts the market. Perhaps some alternative markets (print? radio & TV?) would pick up some of the advertising slack, but largely it'd be a regular money transfer from corps to the government. And a "vice tax" like that is a clear moral hazard, with no natural end in sight.
  - 6gvONxR4sf7o 6y ago
    They’re advocating the removing perverse incentives, so that data leaks and privacy breaches are not “just the cost of doing business.”
  - Bluestein 6y ago
    Fine. Slippery slope perhaps.- Make it a "third sector", properly audited NGO (watchdog, thinktank, foundation ...), with ties to some appropriate umbrella (UN, ICJ), that uses some sort of blockchain solution to fine as needed, and then allocate compensation from this to aggrieved parties, or social programs, compensating not only for loss of privacy, but for the other nasty effects (fake news, emotional distress, political polarization ...) that F'book is causing.- Otherwise, our souls are just another cost of doing business to them.-
offtop5 6y ago
I love how the reasons to delete social media keep on growing. With someone's number you can very easily get a rough idea of where they live. I can imagine the living hell this creates for Domestic Violence survivors and others escaping bad situations. On the flipside I plan on spending my weekends phone free, only carrying a small FM radio to play music.
- krapp 6y ago
  >With someone's number you can very easily get a rough idea of where they live. I can imagine the living hell this creates for Domestic Violence survivors and others escaping bad situations. Wait until you learn we used to collect everyone's name and phone number and often even their address in big books that just anyone could read. You could even have them delivered to your doorstep.
mettamage 6y ago
Question: is it legal to download these files to see what data is leaked about yourself? My issue with haveibeenpwned is that I don't know what's leaked. Note, I'm super happy with the fact that the service exist because I'm happy with the fact to know who of my social circle is in it, so I can notify them. But I don't know exactly what's leaked. Are passwords leaked, for example? What about my social info is on there?
- corobo 6y ago
  > Compromised data: Dates of birth, Email addresses, Employers, Genders, Geographic locations, Names, Phone numbers, Relationship statuses Assume these columns are compromised. As a general rule it probably doesn't hurt to change the password and any you've reused.
bogwog 6y ago
When will executives start going to prison for these types of things?
cortesoft 6y ago
It is a strange thing to consider how we view privacy these days. We share so many things and allow our privacy to be invaded in ways that would shock people 30 years ago. On the other hand, everyone used to get a book delivered to their house every year with the information that is contained in this leak. I remember when you were considered a bit of a crank if you had your number as unlisted in the phone book.
- deleted 6y ago
  [deleted]
bicepjai 6y ago
Can anyone with good conscious work at Facebook ? I would feel villainous working there.
elbasti 6y ago
This leak is putting people's lives at risk. What is truly damaging about this breach is that it allows for bidirectional mapping of phone ⭤ name (and often location, since the data can include town/employer). The risk is much bigger than "I'm going to get more phone spam." Examples: - An abusive ex/stalker type can now search by name and find his ex's phone number and maybe even city/town. - Have you ever dealt with an irate person via phone? (craigslist deal gone wrong/creepy, for example). This person can now know your name and even photo since the leak includes your fb id. I am certain that both of these things will happen in the next few months or years. If privacy changes are to happen at the legislative/personal responsibility level, it would behoove an organization like the EFF to find one such case and use it to sue the living daylights out of FB. I think it's also worth mentioning these sorts of risks instead of focusing on "spam". Unfortunately, even if that were to happen, we'd end up with a moral panic, which almost always ends up punishing the wrong people. What we really need is a change in the kinds of data that are allowed to be kept, and a change in data/identification infrastructure. Things like: - The creation of a standardized & subsidized token/OTP platform. In the US for example, you should be able to go to the post office and get a NIST approved token generator, which should be mandated to be used by all banks and replace SMS and SSN as authentication. - A pseudonimity middle-layer (ie, Stripe for Privacy). For example, when I buy a t-shirt online, I should be able to simply give the merchant my pseudonym, and they shouldn't store my actual name & address. If they want to store that there should be much much higher data protection requirements. This infrastructure should be free market but with a "public option" in order to prevent oligopolization of these services.
- thisismessedup 6y ago
  Seriously. I downloaded the leaks to see if any of my family members were included, so that I could alert them to watch out for targeted scams. But of course I couldn't resist grepping for a few other things. For example, there were about 25,000 phone numbers, emails, and names of single people in my home city. The same info is available for about 180,000 US-based people who list Facebook as their employer. I sure hope that nobody takes it into their head to complain about the breach to those people! It is hella creepy that anybody can search through such a vast quantity of extremely personal information so easily. But this is also a predictable late-stage result of mass-scale social media use.
quattrofan 6y ago
Begins with a C and ends with S
peter303 6y ago
Hopefully they will be fined the maximum $1500 per infraction by federal agencies
wyuenho 6y ago
The reaction here is why I start losing faith in humanity. This "leak", has been blown way out of proportion. This leak, if anyone has actually bothered to look into it, will tell you there's very little available of value. For instance, there's no password. There's about 2.5 mil emails that for all likelihood, it's already out in the wild. For the phone numbers, you can just robo-dial, (there aren't many to be found mind you). For everything else, they are data that the users have set public on their profiles, so they are meant to be seen, and you can readily search for them on Facebook already. ALL THE LEAKED DATA WAS PUBLIC. Do better HN.
mudoo786 6y ago
Doing so could cause Facebook to face legal action in several countries
DreamScatter 6y ago
Let's put a permanent tax on Facebook, they have too much money and they need to be fined.

667 points by wdb 6y ago

wdb 6y ago

Guess it's too hard to notify users that their information got leaked. I hope they reported to all the different institutions in Europe though. The article suggests they didn't even report it to the Ireland one!

jeltz 6y ago
They general guideline in the GDPR is 72 hours. > In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
alephu5 6y ago
Are you seriously claiming it's too hard? They could send out emails, Facebook messages or show some banner in the profile page. This is Facebook ffs, they almost have a monopoly on communication.
- fwn 6y ago
  Not our parent claims it's too hard to find the users affected by that breach, Facebook does. Curiously. Quote from the source article: > The Facebook spokesman said the social media company was not confident it had full visibility on which users would need to be notified.
  - varispeed 6y ago
    Did they not see the user ids in the leak? Just do facebook.com/user_id and you got the person...
- dathinab 6y ago
  > too hard to notify users Legally seen. The way privacy protection laws are, especially in Germany, is kinda stupid. On one side they often doesn't protect you in practice, on the other side they effectively hinder and sometimes prevent reasonable usage. Just a view examples: - A local government couldn't properly inform elder people that they now can get Vaccinated for free because the interplay of various privacy protection law (and stupidity/inflexibility in other areas tbh.). - Germany has a privacy respecting anonymized blutooth based contact tracing app (wrt. Covid). But if you do a test you first have to physical sign of that other people are anonymized informed that someone they likely had contact with has covid, then when you get the result you still need to agree again to share this information. And even this was only possible after changing regulations. (I.e. why is one initial agreement not good enough?) - The government most likely not being able to inform the victims of such data breaches. - ...
  - disgu 6y ago
    > But if you do a test you first have to physical sign of that other people are anonymized informed that someone they likely had contact with has covid This is false. I've been tested about 15 times within the last year and none of the things I "signed" included any of that. I didn't have to physically sign ANYTHING at all. What are you talking about?? It's just a click field on the online application and that only says that you're okay with your data being shared with the lab that also sends you your test results. > then when you get the result you still need to agree again to share this information. This is also absolutely untrue as Covid, among others, is on the list of illnesses that the local Gesundheitsamt has to be notified of. It's not even optional. It's the law. https://www.gesetze-im-internet.de/ifsg/__6.html https://www.gesetze-im-internet.de/ifsg/__6.html Honestly curious where you got that information from?
    - dathinab 6y ago
      > I didn't have to physically sign ANYTHING at all. What are you talking about?? It's just a click field on the online application and that only says that you're okay with your data being shared with the lab that also sends you your test results. If you did register a test with the covid app you had got had to sign something when doing the (not "fast"/PCR) test. If not something was legally not quite right. Also maybe in recent month this might also have been changed but it's unlikely.. > This is also absolutely untrue as Covid, among others, is on the list of illnesses that the local Gesundheitsamt has to be notified of. It's not even optional. It's the law. https://www.gesetze-im-internet.de/ifsg/__6.html https://www.gesetze-im-internet.de/ifsg/__6.html I'm speaking about the covid app, not the health agency, which yes gets reporting always but also (at least at the being of Covid) had a completely inefficient procedure which made the German health agencies in most German states at least at the middle unable to process it anywhere close in time. Like they collecting "people you had been in contact with" 3! weeks after you where found to have covid was not uncommon. > Honestly curious where you got that information from? People officially working on the developen of the covid app (there is a ccc talk). And various other sources which also overlap with personal experiences (like yes I personally had to give agreement on paper so that I could use the covid app). Note that the physical confirmation is kinda hidden on a paper containing all kind of information, so meany people might not have been aware of it.

Ceezy 6y ago

So if I decide to fish the world with this database, am i really doing something wrong? Cause you would think if somebody steal from you at Wallmart and the cashier sees it. They would try to notify you. If everybody think it's ok, when does it start to be:" I just found this wallet full of cash and i'm not notifying the authority?"

pulkitsh1234 6y ago

I am surprised how the Facebook stock is pretty unaffected by all of this.

deepstack 6y ago
They are subsidized. Stock may not be best indication of the performance of the company.
- strogonoff 6y ago
  That’s the problem with free ad-based media giants. For an individual, the deadly combination of the platform being large enough, free and closed (no APIs for feature-complete third-party cross-platform clients) means a huge barrier to switching over to a different social provider with better ethical, infosec and privacy track record—and all the while company’s interests are aligned with ones of the advertisers, the actual paying users. Stock performance, of course, reflects that.
ZephyrBlu 6y ago
It's priced in. /s of course, but maybe people really don't care because FB has been in so many of these types of controversies?
apples_oranges 6y ago
I own some of their stock and I keep buying more. Reason: FB is doing a great job with advertising and they are not just Facebook but also Instagram and other things.
- sp332 6y ago
  Counterpoint: Facebook is taking your invested money and doing terrible things with it. Why fund that?
  - Dirlewanger 6y ago
    If the world's corporations are taking us to Hell, I want a piece of the action.

villgax 6y ago

It's from 2019 is the stupid excuse they have. The amount of laxity they have shown in this matter is appalling!!

tareqak 6y ago
Did they notify people about it 2019? Does GDPR, CCPA, and other similar privacy laws have a statute of limitations? [0], [1], [2] [0] https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en https://ec.europa.eu/info/law/law-topic/data-protection/data... [1] https://www.oag.ca.gov/privacy/ccpa https://www.oag.ca.gov/privacy/ccpa [2] https://en.wikipedia.org/wiki/Privacy_law https://en.wikipedia.org/wiki/Privacy_law
mtgx 6y ago
"The crime was already committed - what purpose does it serve to punish us for it now?"
shatnersbassoon 6y ago
If you change your DoB every year like I do, you'll be fine...
- thih9 6y ago
  Assuming not sarcasm, how does that help? Do you do this for just Facebook or for multiple websites?
  - NavinF 6y ago
    I use a random DoB for every website. (The only exception is banks because it has to match what's on my ID and credit report)
  - shatnersbassoon 6y ago
    You assumed incorrectly :) I don't have an account, but I'm fairly sure Facebook doesn't let you edit it once you've given it.
- 6y ago

hellbannedguy 6y ago

Zuck: I have over 4,000 emails, pictures, addresses, SNS [Redacted Friend's Name]: What? How'd you manage that one? Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb fucks.

vntok 6y ago
> hellbannedguy: something dumb 17 years ago Probably.

tuxone 6y ago

This huge leak has definitely killed the SMS text messaging service. Sender can be spoofed and spam/scam/phishing have reached an intolerable level. The fact that they can cross reference you and then produce a more personalized content is huge. Changing password is easy (ok less easy if you recycle it) but changing phone number is something that I am not even relaxed to do.

blackoil 6y ago
> Sender can be spoofed Is this worldwide or US? I for now trust the senderid and assume them to be valid if they are coming from bank etc. I also haven't heard of anyone spoofing SMS. Should I be more cautious?
- Aaargh20318 6y ago
  > Is this worldwide or US? Worldwide. SMS is just like e-mail, you can put anything you want in the sender field. You should absolutely not trust SMS.
  - mrtksn 6y ago
    Any idea on the extra security measures? In Turkey for example, when you change your SIM card the 2FA from the banks will stop working and you need to call your bank to re-activate it. That of course seems like a measure to prevent SIM cloning but maybe there are some security protections against spoofing. In many places SMS is a popular way to do payments and 2FA for high security applications.
    - rincebrain 6y ago
      Where does SMS get used to do payments? (...and how?) SMS for 2FA is known to be a very bad idea, and some security experts have been shouting about the need to stop doing that for a while. I also can't see any country managing to implement more restrictions on SMS without either breaking a lot of "legitimate" sources of SMS or being ineffective outside of a very narrow window (e.g. only blocking forged SMS for numbers originating within one country)

YesThatTom2 6y ago

If you think it is important to notify the victims, why don’t you do it yourself? You have their contact info!

bayindirh 6y ago
That'd be a punishable offense. No, literally.

martini333 6y ago

That's is for Facebook in EU, I hope.

deleted 6y ago
[deleted]

PaulKeeble 6y ago

Zuckerberg is probably right in this one. Whatever fines might come out in the EU around this will be nothing compared to the cost of loosing the customers they notify and the cost of notifying them.

La1n 6y ago
"Right" to keep FB valuation, but that doesn't mean legally/morally/ethically right. I'd say Zuckerberg is in the wrong, but I also understand why he made the decision.
bayindirh 6y ago
> Zuckerberg is probably right in this one. Yes, for protecting his own interests. Users are just like cattle, playing farming simulations, feeding cattle. They needn't to know what's happening in real life.
tomxor 6y ago
> Whatever fines might come out in the EU around this will be nothing compared to the cost of loosing the customers they notify and the cost of notifying them. There is no mention of GDPR in the article, but in the worst case of not notifying _at all_, the GDPR fine should be $3.5B (4% of their global revenue). Is this quantity insignificant enough for them to ignore? (not rhetorical, i have no idea how much capital they are happy to burn). > Zuckerberg is probably right in this one. Right from an economic perspective perhaps, but not an ethical one...
- Isinlor 6y ago
  EU legal system will not allow a company to trade infringement for a fine. If they had to do something, they will get a fine and they will be forced to do it anyway by the court. If they don't comply with court orders they will be fined separately with an accumulating sum until they do.
dathinab 6y ago
Utile the does the EU does notify them, which would be really funny tbh. Just imagine getting a SMS (chain): > You phone number and some of your data (<listed>) had been involved into a Facebook data breach. While Facebook is required by <insert law> to inform you about this breach they insists of not complying with the law and keeping they users in the dark. As such we <insert EU/local government agency> decided to do so. More information can be found here: <link to official EU site + link to local government sites with official translations>

pibefision 6y ago

This is one of the best cases to see if GDPR truly works in Europe

Hamuko 6y ago
It's kind of an edge case since the breach happened before GDPR enforcement started.
- adav 6y ago
  GDPR was enforceable from 25th May 2018. Leak dates to 2019 from the news sources I've seen.
  - Hamuko 6y ago
    I could've sworn it became enforceable later but apparently I've lost all sense of time.
    - adav 6y ago
      We all have this year :)

progx 6y ago

Why notifiy? Victims got notified everyday with many spam-sms. Thanks Facebook!

qwertox 6y ago
Because I would really like to know if I'm affected. According to "Have I Been Pwned" my phone number is not in the list, but about one or two weeks ago I noticed that my spam folder was unusually full, which led me to believe that something new must have happened. Shortly thereafter Facebook's leak hit the news. From my point of view it is their obligation to notify all the affected users. It's morally the right thing to do, and legally, well, I don't know, but maybe the GDPR says that yes, that it's their obligation to do so. And with notification I mean to send a notification email, since I haven't logged in for months and don't intend to this year.
- jaywalk 6y ago
  The leak did not include email addresses, so your email spam issue is unrelated.
  - wasmitnetzen 6y ago
    It did include email addresses in some cases, just not all of them.
  - markeganfuller 6y ago
    According to haveibeenpwned.com > whilst each record included phone, only 2.5 million contained an email address
  - pilsetnieks 6y ago
    Newer Android versions have an SMS spam folder as well, they might have been talking about that.
  - bogwog 6y ago
    That's not true, many of the accounts did have email addresses.

petemir 6y ago

@dang duplicate https://news.ycombinator.com/item?id=26729989 https://news.ycombinator.com/item?id=26729989

andyferris 6y ago

My understanding is they are wilfully violating Australian law too, not just the GDPR. I wonder how various countries will react?

CaptainJustin 6y ago
I hope the fines are enough for them to ensure this doesn't happen again. Personally I don't have a Facebook account because I don't trust them anyway but I think the people who have one probably didn't want this to happen.

cblconfederate 6y ago

The "real names" myth was the biggest scam played against people in the past 15 years. The media are also wholesale responsible for perpetuating that damaging trend. Historians of the future will look at the past 2 decades with disbelief.

nickthemagicman 6y ago
What's the 'real names' myth?
- cblconfederate 6y ago
  The idea that using your state-given name online is beneficial.
  - eyjafjallajokul 6y ago
    What is a state-given name?
    - StavrosK 6y ago
      The thing on your birth certificate.
    - Karsteski 6y ago
      Presumably your birth name given to you by your parents. Describing it as "state given" seems intentionally misleading...
      - lmilcin 6y ago
        It should be called "state-recognized". The state does not give you name, but it registers it and uses it to recognize you in various situations. Usually the name is not enough to identify a person (and fun/disaster ensues when this is attempted) so, usually, more information is needed to identify a person.

nickthemagicman 6y ago

Isn't it just scraped public data? Calling it a leak for data that's public seems odd.

twobitshifter 6y ago
The data isn’t public. It’s based on the friend finding feature. If you fill a contact list with phone numbers Facebook will automatically suggest the person with that number as your friend. So if you make a contact list with all possible phone numbers, you can know who they belong to.

trissylegs 6y ago

I suppose a well meaning spammer could just SMS everyone pretending to be Facebook.

lucb1e 6y ago
Let me just drop a note here that I happen to have two "unlimited" SMS subscriptions (i.e. could at least notify a few thousand people) in different European countries and that contact info is in my profile in case anyone has... ideas... :-)
- deleted 6y ago
  [deleted]
- lucb1e 6y ago
  Can't edit anymore, but this was not exactly an invitation to email me names and phone numbers to text. I don't know the legal implications of sending mass unsolicited messages to people whose phone number I obtained through downloading questionable data. If you really want to warn people and you have a plausible explanation for the legal basis on which we're doing this, then I would definitely be able to contribute resources to your cause. But also, frankly, they put this info there and configured it to be public themselves. Doesn't mean they don't need to be warned about this misconfiguration, but it's quite different from if there had been a data leak caused by facebook that facebook isn't telling the users about. I don't feel the need to drop what I'm doing and spend a couple days looking into the legal status, coming up with a good narrative / what to text them, gathering other people, figuring out how a regular human being can send hundreds of text messages without doing custom app development (if avoidable), dealing with the aftermath... TL;DR: if you cleared the list of todos in the previous sentence, then my resources you shall have.

arnaudsm 6y ago

This is probably illegal in Europe. They have 72h to notify their users after noticing a breach according to GDPR's article 33: https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/ Edit: My bad, only notify the authorities.

jarym 6y ago
Except they're not claiming 'breach' they're claiming 'scraping'. Not sure semantic acrobatics is going to fly with the regulator however.
- p49k 6y ago
  They claim “scraping” in contexts where it benefits them to use that term (requirement to notify users) and “exploited vulnerability” when it benefits them in other contexts (answering to why private personal info was found online). Sometimes they even claim both in the same sentence: > A Facebook spokesperson told Insider that the data had been scraped because of a vulnerability that the company patched in 2019 They absolutely can’t have this both ways.
Oras 6y ago
> Notification of a personal data breach to the supervisory authority. Not users. FB had probably done that already.
progval 6y ago
Notification to users is required by article 34, not 33: https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/ There is no 72h requirement, but "the controller shall communicate the personal data breach to the data subject without undue delay"

rpastuszak 6y ago

"The Facebook spokesman said the social media company *was not confident it had full visibility on which users would need to be notified*." @Facebook here you go: https://haveibeenpwned.com https://haveibeenpwned.com

londons_explore 6y ago
If Facebook has since deleted some of those accounts or associated phone numbers, they may no longer have a way to contact those users. The GDPR in Europe would require them to delete that data in a bunch of circumstances.
- zachberger 6y ago
  The beach has phone numbers and emails- why wouldn't they be able to contact those users with that information?
  - londons_explore 6y ago
    Facebook can't use the breach itself to contact users, no. The data could have been tampered with, and besides, Facebook doesn't have permission to process the leaked data in that way.
    - willcipriano 6y ago
      If they find a match against the leaked data, that would validate it and prove it had not been tampered with and at least allow them to contact a subset of users. Why can't they do that at least?
      - londons_explore 6y ago
        They can do that. They probably won't because they'll argue it's all part of peoples public profiles and therefore published information rather than private information.

tacone 6y ago

For years companies have been steadily asking, mandating or even trickling users to give them their phone numbers under the excuse of security (while the real reasons were different), now what? How can they be trusted anymore? This also strikes a great point about the data sharing between Facebook and WhatsApp. Linking data between services augments the dangers and the consequences are not obvious to the end user. I think Facebook should offer their users the option to remove their phone numbers with a real deletion.

gameswithgo 6y ago
>How can they be trusted anymore? They never could be.
- pyotr55 6y ago
  zuckerberg's infamous "dumb f**ks" quote comes to mind.
  - dijit 6y ago
    Zuck: Yeah so if you ever need info about anyone at Harvard Zuck: Just ask Zuck: I have over 4,000 emails, pictures, addresses, SNS [Redacted Friend's Name]: What? How'd you manage that one? Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb fucks Instant messages sent by Zuckerberg during Facebook's early days, reported by Business Insider (May 13, 2010): https://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5?r=US&IR=T https://www.businessinsider.com/well-these-new-zuckerberg-im...
    - iyt23 6y ago
      Given the number of times this quote has been dutifully typed in this thread, HN finally found its narwhal to bacon at data breach, it seems. It’s interesting to watch the competition between those flagging it off the site and those repeating it, apparently unaware it’s been flagged and removed already.
6y ago

geogra4 6y ago

Who's going to tell them otherwise?

deleted 6y ago
[deleted]

stiray 6y ago

Oh, facebook will pay for this breach. A lot. One thing is breach, the second part is hiding and not notifying "natural persons". They have basically violated (ignoring data collection methods etc.) what GDPR is about. But probably they wont notify non EU users. As they are not obliged so they don't care. Article 33. "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. 2Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay." https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/ Article 34: "When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay." https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/

utf_8x 6y ago
True in theory but Facebook is one big GDPR breach and nobody with the power to fine them seems to give a shit...

indigodaddy 6y ago

Stunningly negligent decision by Facebook. More evidence that FB is confident they can get away with most anything without significant consequential blowback on their bottom line at the end of the day.

fredgrott 6y ago

how is this even legal in the US?

brynjolf 6y ago

My twitter account got flagged as suspicious even though I haven't used it during the past few months and have a long random password. Now they want my mobile number to "verify" me in addition to a captcha. It is ridiculous and ovcoiolsly tech companies can't be trusted with personal data of that caliber. I have never used my real name with that twitter account and now they want to know it all, why? Greed is my guess.

artificialLimbs 6y ago
Discord asked for 'phone verification' yesterday after failing to sign in successfully a couple of times. If they didn't have my phone before, how will having it now verify anything? Nope. Account disbanded.

po1nter 6y ago

> Because the scraping took place prior to GDPR, Facebook chose not to notify this as a personal data breach under GDPR. From here https://www.dataprotection.ie/en/news-media/press-releases/dpc-statement-re-dataset-appearing-online https://www.dataprotection.ie/en/news-media/press-releases/d...

Nemo_bis 6y ago
Thanks for posting the only useful addition to the thread. :) So the authority is still looking into it. They could still reach an agreement with Facebook on what to do. Then Facebook would probably be shielded from whatever liability those actions would supposedly cause (their excuse "we might make mistakes"), because "we were told to".

bilekas 6y ago

Maybe its already been answered in the comments, but I cant seem to find it but isnt it required by law to notify the users ? At least for GDPR there is a requirement : > A controller is obliged to notify the DPC of any personal data breach that has occurred, unless they are able to demonstrate that the personal data breach is 'unlikely to result in a risk to the rights and freedoms of natural persons'.

Threeve303 6y ago

Someone should get the leaked data and notify everyone. It does contain contact information after all...

Nemo_bis 6y ago
If you mean by email, good luck not getting blacklisted as spammer everywhere. Maybe the likes of Microsoft and Google could bother to "notify" their users without such a fear. But there are other considerations.

heletoto 6y ago

Why should they notify us? They are stealing our data right under our noses. I hope that non-tech people would be aware of what's happening right now as they might have something to say about this.

long_warmup 6y ago

Years ago facebook kicked me out from their platform. After reading this article I feel I was right to keep it that way.

jamesrr39 6y ago

This should be fun. Looking forward to seeing the size of the GDPR fine!

rubyn00bie 6y ago

I’ve said it before and I’ll say it again, unless and until, companies like Facebook are fined appropriate amounts they’ll never stop. Quite literally, every business school on the fucking planet will tell you do something if it’s cheaper. It is cheaper for them to not give a fuck, than to give one. Unless they are fined upwards of $20-50bn it’ll never stop because it’s always going to benefit their bottom line. Full stop. If you don’t take 10-15% from a company they won’t ever be incentivized to stop. This 5% or less bullshit has to stop if folks want change. Edit: small grammar fix.

dexen 6y ago
You are advocating creating perverse incentives. A specific branch of government, a select agency, to become a profit center through continuous finding and fining of ever more wrongdoings. All morally excused because the victims are faceless multinational corps. We all know how badly that goes with speed traps and red light cameras - instead of improving, the road conditions and sometimes even local rules are tweaked to maintain steady cashflow. Say no to revolving doors of regulators, say no to moral hazard of what effectively amounts to vice tax. Apply criminal penalties when reasonable, don't make data leaks & privacy breaches just another cost of doing business. -edit- Clarification: a fine works well when it's expected to be a rare penatly enacted on a singular player - as it makes that player noncompetitive in the market. Conversely, when fines are expected to apply regularly and at proportional rate to most, or all, players in a market, the fine no longer makes the player noncompetitive - it merely shifts the market. Perhaps some alternative markets (print? radio & TV?) would pick up some of the advertising slack, but largely it'd be a regular money transfer from corps to the government. And a "vice tax" like that is a clear moral hazard, with no natural end in sight.
- 6gvONxR4sf7o 6y ago
  They’re advocating the removing perverse incentives, so that data leaks and privacy breaches are not “just the cost of doing business.”
- Bluestein 6y ago
  Fine. Slippery slope perhaps.- Make it a "third sector", properly audited NGO (watchdog, thinktank, foundation ...), with ties to some appropriate umbrella (UN, ICJ), that uses some sort of blockchain solution to fine as needed, and then allocate compensation from this to aggrieved parties, or social programs, compensating not only for loss of privacy, but for the other nasty effects (fake news, emotional distress, political polarization ...) that F'book is causing.- Otherwise, our souls are just another cost of doing business to them.-

offtop5 6y ago

I love how the reasons to delete social media keep on growing. With someone's number you can very easily get a rough idea of where they live. I can imagine the living hell this creates for Domestic Violence survivors and others escaping bad situations. On the flipside I plan on spending my weekends phone free, only carrying a small FM radio to play music.

krapp 6y ago
>With someone's number you can very easily get a rough idea of where they live. I can imagine the living hell this creates for Domestic Violence survivors and others escaping bad situations. Wait until you learn we used to collect everyone's name and phone number and often even their address in big books that just anyone could read. You could even have them delivered to your doorstep.

mettamage 6y ago

Question: is it legal to download these files to see what data is leaked about yourself? My issue with haveibeenpwned is that I don't know what's leaked. Note, I'm super happy with the fact that the service exist because I'm happy with the fact to know who of my social circle is in it, so I can notify them. But I don't know exactly what's leaked. Are passwords leaked, for example? What about my social info is on there?

corobo 6y ago
> Compromised data: Dates of birth, Email addresses, Employers, Genders, Geographic locations, Names, Phone numbers, Relationship statuses Assume these columns are compromised. As a general rule it probably doesn't hurt to change the password and any you've reused.

bogwog 6y ago

When will executives start going to prison for these types of things?

cortesoft 6y ago

It is a strange thing to consider how we view privacy these days. We share so many things and allow our privacy to be invaded in ways that would shock people 30 years ago. On the other hand, everyone used to get a book delivered to their house every year with the information that is contained in this leak. I remember when you were considered a bit of a crank if you had your number as unlisted in the phone book.

deleted 6y ago
[deleted]

bicepjai 6y ago

Can anyone with good conscious work at Facebook ? I would feel villainous working there.

elbasti 6y ago

This leak is putting people's lives at risk. What is truly damaging about this breach is that it allows for bidirectional mapping of phone ⭤ name (and often location, since the data can include town/employer). The risk is much bigger than "I'm going to get more phone spam." Examples: - An abusive ex/stalker type can now search by name and find his ex's phone number and maybe even city/town. - Have you ever dealt with an irate person via phone? (craigslist deal gone wrong/creepy, for example). This person can now know your name and even photo since the leak includes your fb id. I am certain that both of these things will happen in the next few months or years. If privacy changes are to happen at the legislative/personal responsibility level, it would behoove an organization like the EFF to find one such case and use it to sue the living daylights out of FB. I think it's also worth mentioning these sorts of risks instead of focusing on "spam". Unfortunately, even if that were to happen, we'd end up with a moral panic, which almost always ends up punishing the wrong people. What we really need is a change in the kinds of data that are allowed to be kept, and a change in data/identification infrastructure. Things like: - The creation of a standardized & subsidized token/OTP platform. In the US for example, you should be able to go to the post office and get a NIST approved token generator, which should be mandated to be used by all banks and replace SMS and SSN as authentication. - A pseudonimity middle-layer (ie, Stripe for Privacy). For example, when I buy a t-shirt online, I should be able to simply give the merchant my pseudonym, and they shouldn't store my actual name & address. If they want to store that there should be much much higher data protection requirements. This infrastructure should be free market but with a "public option" in order to prevent oligopolization of these services.

thisismessedup 6y ago
Seriously. I downloaded the leaks to see if any of my family members were included, so that I could alert them to watch out for targeted scams. But of course I couldn't resist grepping for a few other things. For example, there were about 25,000 phone numbers, emails, and names of single people in my home city. The same info is available for about 180,000 US-based people who list Facebook as their employer. I sure hope that nobody takes it into their head to complain about the breach to those people! It is hella creepy that anybody can search through such a vast quantity of extremely personal information so easily. But this is also a predictable late-stage result of mass-scale social media use.

quattrofan 6y ago

Begins with a C and ends with S

peter303 6y ago

Hopefully they will be fined the maximum $1500 per infraction by federal agencies

wyuenho 6y ago

The reaction here is why I start losing faith in humanity. This "leak", has been blown way out of proportion. This leak, if anyone has actually bothered to look into it, will tell you there's very little available of value. For instance, there's no password. There's about 2.5 mil emails that for all likelihood, it's already out in the wild. For the phone numbers, you can just robo-dial, (there aren't many to be found mind you). For everything else, they are data that the users have set public on their profiles, so they are meant to be seen, and you can readily search for them on Facebook already. ALL THE LEAKED DATA WAS PUBLIC. Do better HN.

mudoo786 6y ago

Doing so could cause Facebook to face legal action in several countries

DreamScatter 6y ago

Let's put a permanent tax on Facebook, they have too much money and they need to be fined.