12 ms·
Mozilla blogger bought 1 million Facebook entries (full name, e-mail) for $5
- Fightback 14y agoI laugh at the censor fail. See selected field.
- greenwalls 14y agoDoes anyone have any idea how the Facebook accounts were taken from the owners? Scary.
- duiker101 14y agodev make and app, user uses app by granting acces to basic infos, which every apps asks for. dev save details of each user in spreadsheet and sells it.
- thomaslutz 14y agoWhat do you mean by "taken"? I guess the Facebook application just used the privileges the users provided to it to compile this list.
- jvc26 14y agoI don't think the accounts were 'taken', I thought he just had some of their data ...
- tbassetto 14y agoI don't see how the fact that he's a Mozilla blogger is relevant. The file contains "just" full name, e-mail and URL. Thieves got the information thanks to their Facebook apps (no idea of its name), it could happen with any third-party app.
- jcromartie 14y agoI'd imagine you could scrape a million people's publicly available info, too.
- gailees 14y agoExactly what I'm saying....most of these people probably could care less whether their info is public or not. Many people talk about caring about their security in an almost idealistic view; few actually care in application.
- sneak 14y agoHave you ever tried scraping Facebook?
- Achshar 14y agoWhat should I expect?
- Permit 14y agoThey're pretty clever. When I started programming in 2009, I wrote a small scraper that would create accounts, friend people and steal their info if they accepted. (I never released it past my own friends list and never sold the data). There were the obvious checks for CAPTCHAs when too much activity was detected, but other subtleties as well. If you looked at too many people's profiles, emails wouldn't be displayed as text, but as images. A person would be unlikely to notice as the pages looked identical, but dynamic changes like that make it harder to scrape some things. Introducing even rudimentary OCR requirements is enough to turn away a lot of programmers. I'm not saying it's not possible to pull off. But Facebook has set it up so any money you might make this way will likely not be worth the development time required.
- pi18n 14y agoI think instead of having users agree to permissions on Facebook and Android apps, they should have to explicitly grant permissions to the app. Maybe by dragging an icon or something that represents "email address", "real name", and other concepts.
- slig 14y agoThis is FB we're talking about. They're not interested in any privacy awareness, that would only decrease the "engagement" and thus makes no sense to them.
- Mahn 14y agoThis would dramatically lower the conversion for developers, and unhappy developers make facebook unhappy. Facebook could make it way more obvious if they wanted to, but they just try to balance how much they screw users vs how much they screw developers.
- moeffju 14y agoHere's what I think is the offer on gigbucks: http://gigbucks.com/Social-Marketing/26055/instantly-give-you-an-email-list-of-11-million-valid-Facebook-users-with-name-last http://gigbucks.com/Social-Marketing/26055/instantly-give-yo...
- bogomil 14y agoYou don§t have to show the URL. Those guys have to be banished, not advertised.
- Spearchucker 14y agoThat's like saying "don't think of a camel". My immediate reaction to your comment was to click on the link - which I otherwise wouldn't have. This is not a criticism, just an observation.
- lysium 14y agoMaybe should have blurred out the edit line, too.
- tathagatadg 14y agoJust curious, is this illegal? What happens if the seller didn't disclose the method in which he aggregated the data or says I just stood in a shopping mall and asked people to voluntarily disclose these details? (Sure he'll have a hard time proving that) ....
- benjlang 14y agoAnd that's why I use the https://mypermissions.com https://mypermissions.com plugin, so my email doesn't end up in places like this.
- cs702 14y agoWow, five bucks. As the saying goes, if you're not paying for the product, you're the product. The new twist here is that the product (i.e., your FaceBook info) is now being sold in the open market for only $5.00/1,000,000, or $0.000005 per person. Prices normally go down only when supply exceeds demand, so the inescapable conclusion is that there's abundant oversupply of this product in the open market. Yikes!
- deleted 14y ago[deleted]
- dalore 14y agoA 'small' slice of your facebook info.
- rmc 14y agoYour implication is that Facebook themselves sold this data. The orignial article says that it was from apps that people isntalled from a 3rd party, not Facebook.
- tvladeck 14y agoDoesn't matter. The company that got the data then sold it on for $5, which gives us an indication of how much they had to pay [1] to get the data from FB in the first place. [1] I'm using "pay" loosely here. I have no idea what they had to give up or produce in order to get the data, but presumably FB received something of value.
- hkmurakami 14y agoI imagine this data came from the "allow this app to access XYZ of your information: YES/NO" thingy that pops up when authorizing apps on these social media platforms. The only payment to FB that I can think of would be in the form of marketing costs (or does FB have a developer membership cost like Apple?)
- 14y ago
- erjierjtjrej 14y agoWasn't there a massive dump of FB names paired with emails, released by lulzsec or some other 'Anonymous' organization last year? Could make this 'deal' quite useless.
- gondo 14y agowhat's so surprising about this? you can get list of valid emails and just run them through facebook search and you ll get names and profile URLs, both public information no matter what your security settings are. nothing special about this
- mapleoin 14y agoWhere do you get a list of 1 million valid emails?
- dangrossman 14y agoType "buy email lists" into Google and pick any ad. Even Salesforce appears to be selling 30 million e-mails.
- mapleoin 14y agoThat's what I'm saying...
- gondo 14y agoanywhere, but thats not my point. the point is, that its the same as getting list of email addresses. and no1 would be surprised if i would publish list of emails but this list is suddenly security issue
- cake 14y agoYou just crawl the web. I am not surprised either by this, I don't consider emails and first/last name as private data.
- stef25 14y agoFB emails are probably a bit "fresher" than ones found by randomly crawling the web.
- slig 14y agoI suppose you'd get rate limited.
- bergie 14y agoI don't see this as a particularly big deal. Databases of email addresses have been available for cheap for a long time, as is evident from the amount of spam we all get. This is after all why spam blockers are so important.
- ballstothewalls 14y agoThe email I used for facebook is facebook@mydomain.com. I have gotten several credit score emails sent to it... This started happening after I had deactivated my account. I never used apps that much, though I did sign up for them occasionally. I have never noticed this with any of my other unique emails, just the facebook one.
- theycallmemorty 14y agoIs that domain publicly accessible? Could facebook@(any domain you know exists).com be a reasonable shot in the dark?
- ballstothewalls 14y agoYes, but it doesnt go anywhere except a blank page with my name on it.
- Mahn 14y agoAccording to the link the data was collected through an app. This is not Facebook's fault, this is the developer being an idiot, because Facebook TOS are very clear when it comes to data; the developer is in big trouble if found.
- brianbreslin 14y agoExcuse my naïveté, but what could one use this list for? Aside from spam email blast?
- khill 14y agoYou could use it for phishing. It might make users more likely to click through and provide security information if you display their correct full name and even Facebook URL.
- jklio 14y agoThe OED confirms naivety is also an English word that's been around since at least the 1700s. I am not implying naïveté is wrong in English, just that there is a simpler option should you so choose.
- deleted 14y ago[deleted]
- brianbreslin 14y agoautocorrect on my ipad went with the more pompous version :-P
- didip 14y agoYou could start Groupon clone right away (presuming you have the deals).
- brianbreslin 14y agoWonder if you could just spam groupon deals with your affiliate link included?
- catshirt 14y ago1 million Facebook entries isn't cool. u know what's cool?
- deleted 14y ago[deleted]
- hcarvalhoalves 14y agoThe sheets are named "sayfa". That's a hint about who he bought the list from. Anyone knows which language is that?
- frkn 14y agoTurkish
- fatihdonmez 14y agoturkish
- justjohn 14y agoI wonder what other data the seller has. It seems likely that you could get more valuable data from the users of these facebook apps since people tend to says yes when apps ask for permission to access data.
- gailees 14y agoI'm sure much of this information is public on their profiles to begin with; with a simple web scraper, you can acquire information about millions of fb accounts and their respective email addresses. OFC there's an oversupply since they can give out an unlimited amount of copies of this same million FB entries. Big Data is great because it's super re-usable and can be purposed for anyone's specific need.
- seanlinehan 14y agoI actually did build an FB scraper about 2 years ago. If I'm remembering correctly, something like 1/2000 people have their e-mail address public. Name + URL is always available, but the e-mail is a bit more valuable.
- gailees 14y agoBTW, where can I find this deal? Would love to see this list in it's legitimate form if nothing else.
- bluetidepro 14y agoThe url is in a comment above. -- http://news.ycombinator.com/item?id=4687676 http://news.ycombinator.com/item?id=4687676
- lazyjones 14y agoHow is that news? Many of these names can be probed for using the public FB API, without being logged on and without access_token: e.g. try https://graph.facebook.com/1112112584 https://graph.facebook.com/1112112584 with curl or so ... (sorry random member from the published list) Some spammers have probably been harvesting that API for a long time ...
- negamax 14y agoBecause that list also has email addresses?
- Indyan 14y agoOne additional data that I see in the list he purchased is email address, which is probably what the spammers would value the most.
- rorrr 14y agoTry CURLing even a 100 of these URLs and see what happens. Also, this doesn't give you the email.
- mandeepj 14y agoI just checked facebook people search page does not show user's email address. http://www.facebook.com/directory/people http://www.facebook.com/directory/people
- unreal37 14y agoI suppose any 15 year old with programming skill can do this. Create an app (kill zombies!) and then when the popularity dies down, sell out your users info to the highest bidder. Kinda sensationalist at the end - "DO YOU STILL FEEL SECURE?" Uh yeah, I do. I get hundreds of spam a day that Google puts into a little folder for me to erase. Go ahead and email me, and join that exclusive folder right away. Oh you want to send me a private message on Facebook? Facebook is kind enough to put messages from non-friends in a special folder too, and I never check that. I feel secure.
- mandeepj 14y agoIf the sender adds the required headers into his email then it is very likely that google or any other email service provider will not consider the email as spam. Regarding facebook I partially agree with u. Sometimes the message from non-friends goes into other folder and sometimes I can see it in the regular mail folder.
- unreal37 14y agoDon't tell the spammers making millions of dollars about that header trick. Seriously though, I don't think a couple of headers will cause an email to become not spam. Google's filter is probably Bayesian, and considers the content of the message, the matching between the originating server and the reply-to address, the spam history of the originating server, any links in the message, how many times it sees the exact same message, how many people mark it as spam, etc. So maybe it will get through to the first few hundred people, and then they'll block it.
- jwegan 14y agoAdding the proper headers such as DKIM, SPF, etc., are used to make sure a spammer can't send mail pretending to be someone else. All spam systems still look at the content of the message plus the reputation of the IP/domain when determining if a message should be marked as spam or not.
- hkmurakami 14y agoDo you even need an app for this level of information? I feel like a crawler could look for this information for users with low privacy settings on their accounts by successively going through friends' friends' friends' ... about pages. edit: refuted by Permit's comment below: http://news.ycombinator.com/item?id=4688893 http://news.ycombinator.com/item?id=4688893
- windle 14y agoWhy is he called a Mozilla blogger? He doesn't work for Mozilla foundation or Mozilla corp as far as I can see (nor does he claim to). His linkedin states he associates with the "Mozilla community", but that's hardly an official representative of Mozilla as "Mozilla blogger" implies.
- nnethercote 14y agoHis blog is syndicated to planet.mozilla.org. It's hardly a high quality blog.
- livebeef 14y agoThat's hardly a deal, it is possible to scrape name, url, gender, locale and profile picture just by bruteforcing user ids: http://graph.facebook.com/4/ http://graph.facebook.com/4/ http://graph.facebook.com/4/picture http://graph.facebook.com/4/picture You don't get the email but that would be really bad.
- rburhum 14y agoand then, the data provider sells the credit card information you gave them to buy this list in another market... Do YOU feel safe?
- driverdan 14y agoThis is one of the reasons why I don't use FB apps. The privacy and security controls are far too loose and broad. It's never clear exactly how your data will be used. One of my clients has a FB app so work with this stuff daily. It's so easy to build a full profile of of an active user's life, their interests, their friends, their work and education history. Their geotagged photos and check-ins tell you exactly where they like to go. Pure gold for marketers / spammers. The information is just too accessible and valuable for people to not abuse it.
- wheelerwj 14y agoman that's nothing. You should see what I am able to get for free. although I did pay $15 for a list of 100m emails, most of which have phone numbers, names, addresses attached to them.
- code_duck 14y agoI'm quite skeptical of just about every offer to login with Facebook, or install an 'app' within the site, whether it's Apple, Etsy or some other dishonest corporation. Just about everyone wants mainly to gather your information for some other purpose. Unfortunately, as usual your average user thinks nothing of clicking through the permissions page on FB without reading or understanding what it says.
- diziet 14y agoOne million? Try 3.5 million: http://fiverr.com/palash1987/provide-3500000-facebook-emaii-iist-database-with-profile-link http://fiverr.com/palash1987/provide-3500000-facebook-emaii-...
- witoldc 14y agoSo what did he buy that he couldn't get free using Google search? Nothing? There are phone books out there that list more information that that. Do you feel secure?
- uggboot1 14y agoIt's a good blog, I like it.http://www.onlineuggbootssale.co.uk/ http://www.onlineuggbootssale.co.uk/
- mikeevans 14y agoLooks like Facebook isn't happy about it: http://talkweb.eu/openweb/1842 http://talkweb.eu/openweb/1842