3 ms·

Facebook is saying the info was scraped, but I don't see my phone number publicly visible anywhere on Facebook, yet it's found by HIBP - any idea what they're r

Facebook is saying the info was scraped, but I don't see my phone number publicly visible anywhere on Facebook, yet it's found by HIBP - any idea what they're referring to?

deleted 6y ago
[deleted]
lolinder 6y ago
I believe the data was scraped from the API endpoint that allowed looking users up by their phone number--the bot just ran every possible phone number and got back everyone who had that feature enabled. They've locked that endpoint down, but this is the fallout from that initial failure to rate limit.
- jarenmf 6y ago
  One must be really dumb to allow a bot to make hundreds of millions of API requests and not noticing.
  - elwell 6y ago
    That's not that many API requests at Facebook's scale. Would be curious as to the rate that the requests were made; as well as how many IPs they were distributed over.
  - artificial 6y ago
    Considering in 2017 they were serving up 1.2 trillion API requests a day it's a drop in the bucket. [0] https://developers.facebook.com/blog/post/2017/04/18/graph-api-v2.9/ https://developers.facebook.com/blog/post/2017/04/18/graph-a...
  - atat7024 6y ago
    The Fappening was Find My iPhone API rate unlimited......
dkersten 6y ago
I've always double checked that my phone number was listed as private and yet they leaked that, so I don't buy their argument that it was scraped. I just double checked and its set to "only me", which is what its always been. (I think I only added it because the app wanted it, but its been years since I've used the app, so don't remember)
sairahul82 6y ago
The data is definitely not publicly scraped. I downloaded the data set. Phone number, location, date of birth etc were always private. It's possible that they have a private API that shares the data to advertisers and that might have been scraped. I created https://fbleak.com https://fbleak.com to show masked data to users to show the extent of the data leak.
- gregschlom 6y ago
  FYI, https://haveibeenpwned.com https://haveibeenpwned.com says my phone is in the FB leaks, but your site says it isn't.
  - sairahul82 6y ago
    That’s odd. Can you let me know which country you are from ?
- phs318u 6y ago
  Australia (+61), is not in the phone dropdown?
  - sairahul82 6y ago
    Actually Australia was not part of the breach.
ProtoAES256 6y ago
If you find discrepancies between those tools, you can go through the dataset by yourself since they are all over the internet now... I checked the set and didn't find myself in it but most if not all of my close-kin are in it.

Facebook is saying the info was scraped, but I don't see my phone number publicly visible anywhere on Facebook, yet it's found by HIBP - any idea what they're referring to?

deleted 6y ago

[deleted]

lolinder 6y ago

I believe the data was scraped from the API endpoint that allowed looking users up by their phone number--the bot just ran every possible phone number and got back everyone who had that feature enabled. They've locked that endpoint down, but this is the fallout from that initial failure to rate limit.

jarenmf 6y ago
One must be really dumb to allow a bot to make hundreds of millions of API requests and not noticing.
- elwell 6y ago
  That's not that many API requests at Facebook's scale. Would be curious as to the rate that the requests were made; as well as how many IPs they were distributed over.
- artificial 6y ago
  Considering in 2017 they were serving up 1.2 trillion API requests a day it's a drop in the bucket. [0] https://developers.facebook.com/blog/post/2017/04/18/graph-api-v2.9/ https://developers.facebook.com/blog/post/2017/04/18/graph-a...
- atat7024 6y ago
  The Fappening was Find My iPhone API rate unlimited......

dkersten 6y ago

I've always double checked that my phone number was listed as private and yet they leaked that, so I don't buy their argument that it was scraped. I just double checked and its set to "only me", which is what its always been. (I think I only added it because the app wanted it, but its been years since I've used the app, so don't remember)

sairahul82 6y ago

The data is definitely not publicly scraped. I downloaded the data set. Phone number, location, date of birth etc were always private. It's possible that they have a private API that shares the data to advertisers and that might have been scraped. I created https://fbleak.com https://fbleak.com to show masked data to users to show the extent of the data leak.

gregschlom 6y ago
FYI, https://haveibeenpwned.com https://haveibeenpwned.com says my phone is in the FB leaks, but your site says it isn't.
- sairahul82 6y ago
  That’s odd. Can you let me know which country you are from ?
phs318u 6y ago
Australia (+61), is not in the phone dropdown?
- sairahul82 6y ago
  Actually Australia was not part of the breach.

ProtoAES256 6y ago

If you find discrepancies between those tools, you can go through the dataset by yourself since they are all over the internet now... I checked the set and didn't find myself in it but most if not all of my close-kin are in it.