6 ms·
"The Facebook spokesman said the social media company *was not confident it had full visibility on which users would need to be notified*." @Facebook here you
by rpastuszak 6y ago
"The Facebook spokesman said the social media company *was not confident it had full visibility on which users would need to be notified*."
@Facebook here you go: https://haveibeenpwned.com https://haveibeenpwned.com
- londons_explore 6y agoIf Facebook has since deleted some of those accounts or associated phone numbers, they may no longer have a way to contact those users. The GDPR in Europe would require them to delete that data in a bunch of circumstances.
- zachberger 6y agoThe beach has phone numbers and emails- why wouldn't they be able to contact those users with that information?
- londons_explore 6y agoFacebook can't use the breach itself to contact users, no. The data could have been tampered with, and besides, Facebook doesn't have permission to process the leaked data in that way.
- willcipriano 6y agoIf they find a match against the leaked data, that would validate it and prove it had not been tampered with and at least allow them to contact a subset of users. Why can't they do that at least?
- londons_explore 6y agoThey can do that. They probably won't because they'll argue it's all part of peoples public profiles and therefore published information rather than private information.
- Someone 6y agoThat distinction doesn’t matter for the GDPR. Publicly available information can be personal data, even if the entire world knows about it.
- ManlyBread 6y agoA company that employs dozes of data scientists and has petabytes of data is now supposedly unable to compare and match two datasets? Come on, this is beyond ridiculous.
- londons_explore 6y agoClearly they technically can. It's that the GDPR doesn't allow it. Think about it... If you asked a company to delete your data, are you giving them permission to go refind that data on the dark web, cross reference it with records they should have deleted, and use it to send you email? Clearly not.
- bogwog 6y agoI doubt Facebook gives a shit about the GDPR
- LocalH 6y agoIf GDPR prevents people from being notified that their data was breached, then the GDPR needs revision.
- Aeolos 6y agoGDPR mandates notifying affected users, so there's no reason to change it. Unfortunately there's a lot a misinformation around GDPR spreading online.
- LocalH 6y agoThe post I was replying to was claiming the GDPR prevented it. If that is incorrect, then so be it. I'm American, so it largely doesn't directly affect me.
- ric2b 6y ago> It's that the GDPR doesn't allow it. Source? Nothing prevents Facebook from making a public announcement that anyone that had an account on Facebook between dates X and Y might have been affected.
- deleted 6y ago[deleted]
- rank0 6y agoCan you clarify what you're talking about? I do not believe that GDPR regulations prevent Facebook from notifying their users about a data breach. I mean, GDPR is a joke but that would be absolutely nonsensical.
- CaptainZapp 6y ago> If Facebook has since deleted some of those accounts or associated phone numbers, they may no longer have a way to contact those users That would totally defy logic. I don't think that Facebook deletes anything ever.
- hansvm 6y agoI deleted my account a few months ago and was pleasantly surprised to find that it didn't surface in the breach. It could just be hiding in a different datastore of course, but it's definitely more fucks than I thought they gave.
- barbazoo 6y agoSame here, deleted about 6 months ago. Was just as surprised.
- flemhans 6y agoThe leak is from 2019 though
- hansvm 6y agoOh interesting; I thought I read somewhere it was recent.
- wutbrodo 6y agoI don't know that this follows, given that the prior probability that your info was leaked is pretty low. "Only" 20% of global accounts' info were leaked, and only 13% of US accts
- gridder 6y agowell i deleted mine in october 2019 and i’m in.....
- pilsetnieks 6y agoBecause they might have deleted some of the accounts they no longer have an obligation to notify the rest that they haven't deleted?
- haswell 6y agoWhile this may be true, this doesn’t have to be an all-or-nothing thing.
- pilsetnieks 6y agoIt isn't true, that was the point of my question. They could (and must) notify the ones they still have data about.
- haswell 6y agoThe way your comment is structured, it is not obvious that it is a question. > They could (and must) notify the ones they still have data about. I agree strongly. For what it's worth, this is absolutely not what I took away from your other comment.
- mmmmmbop 6y agoThe question mark at the end of their original comment is a strong indicator that it is indeed a question.
- haswell 6y ago> Because they might have deleted some of the accounts they no longer have an obligation to notify the rest that they haven't deleted? The sentence structure is a strong indicator that this is something other than a question. This could easily be interpreted as: "They no longer have an obligation to notify the rest, because they might have deleted some of the accounts...duh" The commenter's clarification removed the ambiguity, but let's not pretend the original statement was crystal clear. I think the difficulty interpreting the comment is also partially a result of just how passive-aggressive many comment threads have become. After clarification, I understand the original intent. Without that clarification, there are two interpretations. A different way to say this would be: > "Are you saying they no longer have an obligation to notify the rest just because some of the accounts might have been deleted?"
- guerrilla 6y agoHave another up of coffee, the data is in the leak.
- lm28469 6y agoMore than a year in and people still don't understand GDPR....
- Someone 6y agoI think Facebook (rightfully, IMO) would argue the existence of that data dump is no proof that data came from Facebook’s servers. They can’t assume that, or trolls or unscrupulous competitors would start creating ‘Facebook’ data dumps left and right. I do wonder what EU regulators will say about their viewpoint that they do not have to inform their users, though.
- ric2b 6y agoIf they can't measure the scope of the breach they must notify all customers that they might have been affected.
- worker767424 6y agoOne well-known company I worked had a data breach published online and reported on. I know people on the accounts team and security team and have seen the code for how passwords are hardened. No one internally who knew those systems thought it was a breach; it was more likely people reusing credentials that were breached elsewhere.
- eralps 6y agoWhile I get what you mean, data has the profile links too. Matching the data to real facebook profiles would be near? impossible if the source was not Facebook.
- s_dev 6y ago>I think Facebook (rightfully, IMO) would argue the existence of that data dump is no proof that data came from Facebook’s servers. Mark Zuckerbergs phone number was in the dataset. It came from Facebook.
- Someone 6y agoIt probably came from Facebook, but that doesn’t follow from the fact that Zuckerberg’s phone number is in the dump. I don’t see how, even before this dump was made public, Facebook could have been the only entity in the world to know that phone number.
- bsimpson 6y agoI use yourdomain@mydomain to sign up for accounts. name@mydomain is something I try to only give to friends. According to that site, my personal email has been leaked by Adobe, and by a bunch of shady database firms I've never heard of. (On further reflection, I probably used my Google account to log into Adobe, which leaks my personal email to the site I'm logging into.)
- ShakataGaNai 6y agoMost of those shady databases are data collectors. Sometimes I see those on domain wide reports for names even if the user never actually had that email address. Sometimes it's just a guess. Ex: You might see joe@mycompany.com in the report for those db, even though Joe Smith only ever had joe.smith@mycompany.com. And sometimes its legit scum collection. Some of the spam you get is just verify what email addresses work and what don't. If it doesn't bounce, you know you got a valid email address. Works for a lot of businesses (but not if you've got a personal catchall)