How did Facebook guess my email address? | Hacker News Reader

How did Facebook guess my email address?

reddit.com

126 pointsiamdave58 comments

I've written about this in the past: http://blog.jgc.org/2009/12/facebooks-creepy-privacy.html

And, not mentioned in that post, is that fact that that email was sent to an address that Facebook does not have. They sent it to a valid email address for me, but not one I had told Facebook about.

Interesting blog post, actually because it gives us a glimpse into exactly how serendipitous Facebook is with your data. I remember someone making a comment in another FB thread here on HN to the effect of "I might opt-out of the social graph, and lock my profile down, but my data would still leak out of the cloud because of ONE photo a friend tagged me in".

I think it's time for me to alert my closest contacts and let them know where I'll be. Facebook and I are done.

let them know where I'll be

Where are you going after Facebook? I'm interested in this because there is a nice opening niche to attract all the Facebook emigrants. Do you have a specific place in mind that you will join, or are you open to join a new social network startup built by HN members for example?

Well, I was thinking of spending more time with Jerry, George, Elaine and Kramer, and going back to email and text messaging but if you've got something planned I'd love to hear about it.

I'm currently working with another HN member to develop a startup based around doing things in real life with your real life friends. It is planned to be exact opposite of Facebook. Whereas Facebook is about playing Farmville, and other virtual distractions, our startup is aimed at helping you coordinate real life offline activities and events with your real life friends. Where Facebook harvests your info and violates your privacy, our startup will allow you to have complete privacy, and choose which info you want to share with your friends and which you want to share with the rest of the world.

The code is only about 25% percent done (I'm working on this in my spare time around college classes and freelance web design work) but I hope to get it done within about a months time. I'll definitely be posting it here on HN for you and others to review and join if you desire.

This sounds interesting, but explain it to me using terminology other than contrasting it against Facebook, and tell me what it actually does.

We don't want to give away our entire idea plan before we even release the first version, but I'll explain some of the details. ;)

The startup is based on the idea of events. It is designed so that extended groups of people who know each other in real life can post event or activity suggestions, either visible just to their friends, or visible to the general public. These events could be anything from a party, where numerous people are invited, to a date, where one person is invited, to a business meet up. For events where multiple people are invited and required to bring something (for example for a party) it will help coordinate people bringing items, by providing a check list that each person can volunteer to fulfill items from.

There are other ideas that we are tying in one at a time, some planned for future releases as well, but that is our basic model, a social network which allows traditional digital association, but heavily encourages offline interaction.

Awesome. I have been working on a very similar product and have been looking for people to bounce ideas off and possibly work with. I think there is a big opportunity to provide an easy way to discover and organize events nearby. It solves a real problem (what's going on around me?). Drop me a note if you want to chat.

It doesn't look like your profile has any way to contact you. If you want to contact me then stop by http://experimentgarden.blogspot.com and use the contact form.

One feature I've pondered is some kind of location based phone thing.

IE you tell it things like "I like to go down the pub with this group of people", and it'll automatically suggest that as an activity to you all if you're in a suitably small area and have the time free on your calendar.

Two pieces of advice:

1) plan to never monetize via ads, if you don't want to turn evil.

2) plan to gain traction in universities.

Good advice. These two points are already in our startup plan.

I often wonder how well ads work for social networks in general. I don't have problem with ads like facebook,twitter uses - promoting the apps on their platform.

Yeah, but if someone intends to monetize using ads, which are out of context or just plain annoying, probably just to get better CPI, that seems evil enough for me not to use the website.

Facebook ads are usually creepily relevant because they feed off keywords in your chat logs and interests.

Even if they are creepily relevant most users ignore them. I got some ads for something that was only mentioned in my Facebook chat with another person, not posted on a wall or anywhere public.

It annoyed me that they were scrapping my Facebook chats for keywords in an attempt to get me to click on their advertisements.

I've had better results with Facebook Ads than with Google AdWords... but that could be due to any number of things.

Get in touch with the guys who were working on imthere.com. Similar idea, the site was very nice. It seems to be on hiatus, though. You might want to find out why.

Sounds interesting. I'm sure many of us here in HN would love a well built alternative where we are actually in control of our personal data.

Youth frequently use Facebook as a way to gauge a person's social "status" or popularity. Email me if you want to hear more about that aspect of it.

<a href="http://www.peuplade.fr>; Peuplade</a> is a site in France for organizing social activities around your geographical location. It's great to meet people in your neighborhood! I found it an excellent opposite to Facebook, which keeps you in touch with people far away (that was my original perception, at least).

I find the "neighborhood" approach much more interesting for a social site than "real-life friends". Another interesting use of social networks is <a href="http://www.couchsurfing.com>CouchSurfing</a>

Peuplade is a site in France for organizing social activities around your geographical location. It's great to meet people in your neighborhood! I found it an excellent opposite to Facebook, which keeps you in touch with people far away (that was my original perception, at least).

I find the "neighborhood" approach much more interesting for a social site than "real-life friends". Another interesting use of social networks is http://www.couchsurfing.com

I was in a team that actually built something similar at a startup weekend last year, but decided not to follow-up when plancast launched a week later. I've picked up a few relevant domains at the time which are unused now, so if you're still looking for a domain feel free to ping me.

We already have a name and domain name, but thank you anyway.

Have you heard of Boston based Sponty? http://www.thesponty.com

Our original idea was exactly what you describe: organize casual events with friends. But that didn't gain traction.

What we've empirically verified, is that this is not a big enough pain point to get people to ditch the default position. The default position being: 1. SMS or 2. Facebook status updates. Not even structured events, even though Facebook just made creating the latter much easier.

So we pivoted. The new incarnation was: Discover events through taste makers.

This -we thought- allowed us to short circuit the "I don't have enough friends on the service" argument. So now you can follow people who share your cultural interests and discover events through them so that you can drag your friends along.

This newest incarnation is too hard to distribute. By distribution I mean: user acquisition. We had/have an awesome website, a native iPhone app, cool graphics and even a gaming element.

You need to convince enough people to post events, and then convince others to follow them and like/attend those events.

So my 2.0 cents: 1. Think about distribution: How are you going to get users? 2. Is this a big enough pain point to convince people to ditch the default? (I don't believe so, and I brought a similar product to market).

EDIT: Sponty is still running and we do have users. But we've moved on and are now working on social games.

Cheers, M

I had the idea to explore a similar concept, based on shared events instead of a friend list. The objective was avoiding the degradation I had seen on other social networks. Hi5 and Orkut were the experiences where I based this reasoning. This was 3-4 years ago, I still hadn't used facebook.

One of my ideas was to give users access to sponsored SMS's. They could send a SMS and would have to choose some sponsor to that SMS, in the bottom of the SMS it would be included a slogan of the sponsor (20-40 characters). This could also work as user acquisition by sponsoring the platform itself. <evil> The friends contact information could also be used somehow </user>

The strong points for this idea was that the profiles of users would have been richer to the advertisers allowing better targeting. Consumer brands are strongly tied to events, and I suppose this would facilitate getting advertisers. It would also enable to give brands opportunities to sponsor smaller events (long tail on the event advertising market).

Ads targeting is in a whole new level nowadays and I don't believe it would be a real competitive advantage, but maybe it could be sold as so. The success of this idea also depends a lot on how much people value free SMS's. Here in Portugal SMS's are free inside the same operator but I see younger people doing big gimmicks to get free SMS's to other operators. The effort people are willing to put to achieve that is crucial, I don't know how well that applies in other contexts.

Could we see something similar on Twitter? Instead of a sponsored SMS, a sponsored Tweet? If they give me the possibility of tweeting from my cell phone for free in exchange of a few characters and ads noise I would do it.

If Divvyshot had held out another couple months, I feel like there would have been a major opportunity to expand their services into a more private style FB. The opportunity would have been ripe in these past couple months of FB announcements/changes/infringements. I personally use FB mainly to see photos of my close friends. I might occasionally send a message or write a wall-post, but for the most part, I use gchat, email, texting, and phone as my main methods of communication. Granted, I'm not a FB power user, but I also think these last couple months have made even the power users reexamine how they use FB.

Quitting is too easy. I've changed my profile pic to contain a visual clue, and plan on staying. Here is how it looks like: http://www.facebook.com/photo.php?pid=31350767&l=c685419...

With 300+ friends, this should make more impact than me just pulling the plug on FB (if my friends do not put me on ignore because of the eye pain caused by the red dot).

I'm just wondering do people apply the same rigid privacy protections offline? If so how? If not then why? Assuming you have to deal with people offline who are either not your friends or strangers doesn't leaving the house itself become a major privacy violation if you apply the same standards offline? I admit having the data online is potentially more far reaching. I'm just curious how people reconcile online/offline privacy concerns.

I admit having the data online is potentially more far reaching.

Much, much, much, much more far reaching. Isn’t that exactly the problem?

The answer is simple. When someone creates a new account, Facebook offers to find friends that are in their contact list. If the user wants to do this, they can put in the userid and password of their (say) gmail address. Then Facebook downloads the contact list from that user's email account. If your previously-unknown-to-Facebook email address is in the user's contact list, Facebook now has it. No guessing needed. Note that the "user" I'm talking about in the above scenario is not you; it is someone else who has one of your email addresses in their contacts info.

Exactly. This isn't a new or even particularly cunning trick, and -- contrary to lots of comments in this thread -- it won't die off if people leave Facebook, because it's not something you have any control over. If someone else has the address, they can give it out, and if it's the only address they have for you and they're using something which scans an address book or lets you look up potential contacts by email address, well, that's that.

The only way to avoid this is not to have an email address in the first place.

Someone in that reddit thread brought up this particular startup that Facebook acquired in February

http://techcrunch.com/2010/02/19/octazen-what-the-heck-did-f...

Yep. Octazen make a great scraper at a good price. However, unlike Rapleaf's product (which goes through their servers and they admit they keep a copy of everything), you at least get standalone code that keeps the data on your servers. So I'm not sure they actually gained any new data from Octazen, just a smart team well-versed in scraping.

It seems like Facebook is a real-life implementation of the Six Degrees of Separation. Their graph algorithms must be running on insane hardware.

http://en.wikipedia.org/wiki/SixDegrees.com

You need insane hardware to do a reverse lookup in someone else's address book?

Possibly. I think Facebook is doing at least 2-degrees or even 3-degrees of separation matching.

Somewhat. Many of these graph problems with millions of points do get rather complex as each one adds to the complexity.

On a related note; Facebook seems to use all manner of metrics to suggest friends. Here's a view I have been able to pin down:

- common IP addresses (this occurred after about a week of common IP address between two accounts)

- constant geolocation commonality (as above, two accounts with no links, two different IP addresses but geolocated to the same place)

- having a certain number of groups in common (unsure of this one, but it is the only link I can make for one suggestion)

I know facebook tracks how users browse their site and which profiles they look at, how often and how long (from articles facebook staff were interviewed in). I wonder if they have starting using that data to recommend friends? If someone is searching for a particular person frequently enough, or regularly visiting the public parts of their profile, they probably know each other.

I'm not saying it's appropriate.

Several weeks back, Facebook started suggesting a few people from a mailing list I've lurked on for years. I've never posted to this list. I get how they'd suggest people with whom I've been in contact, even indirectly (e.g., via a mailing list); I want to know how they're suggesting people with whom I've never interacted in any fashion, that I happen to know (or at least know of).

I once had Facebook suggest a former freelance client as "someone you may know". I found him over an online job board (Elance, I think), did a job, and hadn't heard from him in about 6 months. He lives on the other side of the continent and has no common connections.

How the devil did Facebook know I knew him? To this day I'm creeped out by that.

I had the same thing. And funnily enough it doesn't make me think "wow facebook is awesome, thanks for suggesting them". It makes me think about closing my account or using a throwaway email address for it at least.

I'm assuming the 'other party' imported contacts from their email, and facebook noticed that I have the same email address as one in their address book, and so suggests them to me. I don't like that.

You're in his address book. He let facebook have access to his address book. He skipped sending you a friend request, but facebook is giving you the option to do it in reverse.

to add my own creepy connection story I discovered today that FB will suggest that I add the friends of anybody who invites me to become their friend, whether or not I am connected with any of the other people

If you use the iPhone app, it can sync your friend's pictures on Facebook with the corresponding contact in your address book. How does it do this? By having you upload all contacts to Facebook including their name, email address and phone number.

Your privacy is at the whim of those who you choose to communicate with, online or off.

Note - they are addressing this in iPhone OS 4.0 - but the security on contacts given to iPhone native apps is non-existent. Any app has full access.

That's nothing! Soon enough, Facebook will be capable to infer one's secret lovers. A great opportunity to monetize for sure.

This can occur when somebody tries to invite their friend but they type the address wrong. I get lots of emails that were intended for somebody else and 100% of the time it is because they left a character out of the email address. I've received 2 facebook invites in the last 2 months from people who thought I was this other person.

Not my submission mind you, but it would appear that the FB privacy debacles are extending far beyond the OpenGraph, unless someone actually knows an answer to this.

This is relevant to my interests because something very similar happened with one of my throw away emails that's never been used/published.

Didn't Facebook recently acquire some Malaysian company that specializes in screen-scraping data?

I'm guessing they have put them to good use.

From the thread:

"I was trying to figure this out earlier last week. You see, Facebook recommended six people that I should become friends with, six people who I have no other friends in common with. Six people I have never worked with. One guy is a guy I play TF2 with who lives in Alaska, and another guy is a guy I rented an apartment from. It was the apartment guy that clued me into how Facebook made those recommendations. It got them from gmail. Which baffled me, I never authorized Facebook to look at my gmail for friends I might want to add, not once. Turns out, I wasn't the only person who had their contacts list scraped by Facebook. I deactivated and started the pending process for account deletion immediately."

Uggg, sounds like Buzz all over again.

I think that they use the social graph linking you with your friend's accounts, and the information they get when your friends give FB access to their GMail account. Makes sense, right?

Even that bugs me out. It's like in school where you'd do anything to get Cute Cassie's phone number, including asking her best friend what it was because you'll be damned if Cassie gave it to your herself, and then running around to all your buddies telling them you finally got the golden nugget.

They do this for Yahoo as well. In addition, they go by IP or session or something of that nature---someone who created a profile on my laptop found many of my friends recommended.

I've observed the same behaviour in LinkedIn. It recommends connections to me based on one-time e-mail conversations I've had.

they bought a site/piece of software a few months back that enables all of this.

Eerie.

Reply on news.ycombinator.com