7 ms·
> "You can ask us to confirm whether we have your phone number or email address," the firm states. "If we do, you can request that we delete it from our address
by autoexec 4y ago
> "You can ask us to confirm whether we have your phone number or email address," the firm states. "If we do, you can request that we delete it from our address book database. To prevent it from being uploaded to this database again through someone's address book, we need to keep a copy in our block list."
I wouldn't doubt if they remove your information from their "address book database" and add it to one or more others where they keep it forever. There's zero oversight, and zero accountability. It makes no sense at all to just assume that facebook will do anything they aren't forced to when not doing that thing could make them money. Facebook doesn't care about you, your privacy, or even the law. Facebook cares only about facebook.
- ritzaco 4y agoOf course, it's not a technical problem. They could keep a hash instead of a copy. But I'm sure people who find the 'hidden tool' and request to have their information removed are interested in specific products, so a list of these people is very valuable to train machine learning models on..
- m463 4y agoI wonder what happens if someone blocks their phone number, then switches it. Will the re-used number be blacklisted forever with a hash scheme?
- robertlagrant 4y agoThat's my thought as well. Maybe they should just stop using phone numbers for discovery purposes.
- kadoban 4y agoHashes of phone numbers is unfortunately not actually useful in almost any circumstance. You can trivially reverse them by iterating through every phone number and computing the hash. Hashes of emails is not quite as useless, but not far off (consider 90+% of emails are at like ~3 domains, and also that lists of vaguely ~valid email addresses aren't hard to get).
- popcalc 4y agoThis is the same reason hashing a SSN is purely security through obscurity. Anyone with a couple GB of space to spare for a text file can easily perform a reverse lookup. https://gist.github.com/stouset/4322307 https://gist.github.com/stouset/4322307
- lotsofpulp 4y agoThis is why any business that uses SSN as authentication should be liable for any losses that result from fraudulent usage of the SSN, as opposed to the SSN’s owner being liable.
- addingadimensio 4y agoHash and salt
- galeaspablo 4y agoHow could I match an incoming unhashed value to an existing salted hash?
- m4jor 4y agohashcat
- ohbtvz 4y agoThere are only about 3 billion valid US phone numbers. How many hashes can your GPU compute per second?
- m4jor 4y agoMost people crack with multiple GPUs. For example, I have a 5 GPU (3080s) rig that I used for mining ETH but now can use to crack with hashcat. tl;dr crack fast af boiii.
- parker_mountain 4y ago
- krono 4y agoNot too dissimilar from Google Analytics official global opt-out browser extension. It injects a consistent/unchanging item into the global window scope of every single page you visit. https://tools.google.com/dlpage/gaoptout/index.html https://tools.google.com/dlpage/gaoptout/index.html License prohibits sharing its code so I won't - setting a good example for our artificially intelligent friends :)
- cyberphobe 4y agoI'm sure are artificially intelligent friends give precisely zero fucks what you do and will steal your shit with impunity. If you do crime on a large enough scale, it's called innovation.
- dataflow 4y ago> It injects a consistent/unchanging item into the global window scope of every single page you visit Confused, are you saying they inject a unique ID or something? Do you have an example of what they insert?
- easrng 4y agohttps://news.ycombinator.com/item?id=33430515 https://news.ycombinator.com/item?id=33430515
- easrng 4y ago
- SanjayMehta 4y agoThey used to backup to Blu-Ray, so there's that. http://www.businessinsider.com/facebook-uses-10000-blu-rays-for-backup-2014-1 http://www.businessinsider.com/facebook-uses-10000-blu-rays-...
- magic_hamster 4y agoThey also seem to care about fighting windmills in VR.
- jiveturkey 4y agoit's like cookies. to refuse cookies you "have to" accept a cookie saying you refuse the other cookies. the difference between the "address book" and the "block list" is that one can be used for marketing/targeting purpose. the other one presumably is on the other side of a chinese wall (could easily be so under FTC condition) where FB can't use it for said purpose. this would generally serve the intended purpose of "removing" your phone number. your other contacts that felt they should upload an address book in the first place may find surprise or random inconvenience that they can't upload your number.
- 1vuio0pswjnm7 4y agoChanges to the interpretation of Section 230 are coming. Deperately-needed, long overdue "regulation" will come in the form of liability for mega-sized websites like Facebook that choose to algorithmically curate and use other web users' content to generate profits. People who develop free, open source alternatives for communicating directly over the internet should be ready for a possible mass exodus away from using so-called social media websites for communication. The Twitter mess is only going to make it more clear to everyone, including Supreme Court justices, that "social media" is a moral hazard, not a legitimate business model. Granted, I could be wrong. Time will tell.
- ls15 4y ago> To prevent it from being uploaded to this database again through someone's address book, we need to keep a copy in our block list. Don't they know hashing at facebook?
- littlecranky67 4y agoTo be fair, hashing phone numbers is mostly pointless since the search space is too small.
- marginalia_nu 4y ago> we need to keep a copy in our block list. If only there was a function that was deterministic, but somehow incredibly difficult to invert, that would sure make a hash of this requirement to store things you're required not to store.
- noja 4y agoApple does this. It is even more frustrating! If you ever had two Apple accounts, and close one, you can _never_ add the e-mail from the deleted account as an alias to the remaining account. You can imagine the headaches this causes.
- deleted 4y ago[deleted]
- hashhar 4y agoI ran into this myself. It's even more frustrating that they don't warn you about it upfront when closing the account (at least they didn't back when I ran into this). I was hoping to start over with a fresh account and instead ended up having to create a new email alias in Outlook to use to create a new Apple account - luckily I used an alias the first time as well so the impact wasn't as bad.
- noja 4y agoApple support suggested I "simply change my e-mail address". Sure! I will just contact everyone I have ever known, and ask them to update it. Oh and every website I have ever created an account on! sigh
- Tepix 4y agoSure, there are hashing functions, but with a search space that is as small as a 10 digit phone number it is easy to create rainbow tables that covers them all. Signal has spent some time thinking about this problem, see https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- prima-facie 4y agoIt most probably flips a boolean flag in their db. is_hidden=True. Done.