7 ms·
You can use Facebook to identify people by their email or phone number
- mikeyouse 13y agoPair this with the Snapchat leak, so you can go from: Snapchat Username --> Snapchat Phone Number --> Facebook Account I hope people are behaving.
- jamdavswim 13y agoFacebook profile photo -> google image search -> address or other accounts to attack
- cdcarter 13y agoI am intrigued about situations in which you would have someone's Snapchat username, but so little of an idea of their name/network that you couldn't find them on Facebook with graph search.
- mikeyouse 13y agoA few months ago, I was trying to figure out what this Snapchat was all about, so I signed up with a fairly common username. Sure enough, in a few days, I received several topless pictures from a random account. The girl typed in a name which she thought belonged to her friend, but instead entered my new profile name. I thought this was hilarious, my girlfriend however, didn't. Just one random situation.
- majormajor 13y agoThe contacts app on the iPhone does something like that last jump, where having a phone number + first name is enough for it to sometimes find the full FB profile and update the pic associated with the contact on the phone. I assume/hope it only works when they have their phone number public on their profile, though.
- vidyesh 13y agoI guess for that to work you need to sync your Facebook Account and will only update/find full FB profile if they are in your friend list. It doesn't do a common FB database wide search just from your contacts/FB friends.
- gtufano 13y agoWell, no. I have some fb profile (with photo) in my phone contacts of people that it's not in my friend list, but (probably) it's in my "friends of friends" list. So probably the latter is enough.
- jamdavswim 13y agoIt definitely gives you much more information than you had when you started... It really shouldn't display name/photo. An example of a poor trade for experience vs security.
- dubfan 13y agoIt depends on the privacy settings of the user. I just tried this on myself and it did not show my name or photo. The most conspicuous thing it showed was a starred-out version of my old university email address, but that's my own fault for leaving it there.
- gergles 13y agoI have my settings as restrictively-set as possible, and it showed my name, photo, and 'primary network'.
- nhm 13y agoFacebook has an explanation on that page: > You can see your name and profile picture because you're using a computer network you've logged in on before. At least, that's what I saw when I did it on myself in an incognito tab.
- gergles 13y agoThat explanation does not inspire confidence -- I was able to retrieve the profile picture, name, networks, and barely-obfuscated email addresses of several contacts for whom it is impossible they have logged in from my network (on a VPN to the office) or my computer.
- jkrems 13y agoAre they "associated" with you? E.g. are they people Facebook could know you are friends with etc.?
- eridius 13y agoThis URL now redirects to the root of facebook.com, so I guess they've already disabled it.
- obblekk 13y agoStill working for me.
- welder 13y agoFirst logout from Facebook, then re-visit the url.
- cheeseprocedure 13y agoOr use an Incognito window.
- obblekk 13y agoIs this legal? Did I give consent to Facebook publicly associating this information in ToS?
- dreamdu5t 13y agoWhat part of the Facebook ToS do you think this violates? What law do you think this violates?
- gtufano 13y agoEU privacy laws explicitly forbids exposing photos (linked to personally identifiable information) without explicit consent, especially for people of minor age (the specific country laws may change a little, but the general sense is clear).
- corobo 13y agoSurely agreeing to their ToS and proceeding past the point of agreeing to it explicit consents to anything that they put in there?
- collingreene 13y agoI work at facebook on the security team. This is an account recovery endpoint used if your account was hacked for example. Your name, profile picture and a few other things are considered public information so there is no security issue displaying them. See: https://www.facebook.com/help/167709519956542 https://www.facebook.com/help/167709519956542
- altrego99 13y agoYes, but the email address or phone number, is not. I would argue therefore, the information that the email or phone connects to the public information, is not.
- supersystem 13y agoNo, personally identifiable information isn't public information. What's exposed here is still personal information that you decided to make public, but presumably with the users consent.
- diminoten 13y ago> No, personally identifiable information isn't public information. It can be, for a plurality of reasons. Phone books, court records, etc.
- mrverde 13y agoOn Facebook, there are granular privacy settings to control who can search for you by email/phone number if you choose to use them. They're accessed by going to facebook.com/settings (dropdown arrow @ top right), then "Privacy", then "Who can look me up?" ...the analogy would be opting to have an unlisted phone number in the white pages back when they were printed on paper and arrived on your front doorstep.
- cma 13y agoThen why isn't there search by private email address or private phone number functionality exposed for everyone to use and know about?
- pyvpx 13y agoprivacy is dead. if you're going to do something that might raise the ire of someone sophisticated, don't do it online with your true and/or trusted persona. now if you're complaining the waterline for "sophisticated" is getting lower...well...welcome to technology :)
- RKearney 13y agoIt appears this only works if you're using an account that you've already logged into from that IP address. If you try someone else's phone number, it has a placeholder profile picture, says "Facebook User", and has censored out email addresses to send a recovery email too. I'm guessing everyone here is using their own phone number to test with which yields a lot more information than if you were to try it with a phone number of a friend whose never logged into Facebook from your network.
- talentless 13y agoThis is not accurate. I was able to see the picture, name, and a partially censored email address for several contacts. I have no facebook account and I am certain none of those contacts have ever accessed the internet from this IP.
- deleted 13y ago[deleted]
- Lobita 13y agoThis discussion overlooks proxies, macchangers, firewalls, browsers, and pseudo identity...
- amaks 13y agoI'll probably end up deleting my facebook account. Wait, is it even possible to do?
- InclinedPlane 13y agoYes. You mark it for deletion and then don't log in for like 30 days and then it's actually deleted.
- vidyesh 13y agoSomewhat. Disable it for really long time and then delete I guess. https://www.facebook.com/help/delete_account https://www.facebook.com/help/delete_account
- anmalhot 13y agoI had reported this to FB security last year when I found it was trivial to find partially masked email ids & phone numbers of anyone behind my Uni's gateway. I was informed that this was a design decision since previously used IPs are more trustworthy than any new IP. I considered this a design flaw and reported since large institutions are typically behind a NAT and they become susceptible to targeted attacks.