Hacker News Reader

Comment by techntoke | Hacker News Reader

The amount of information leaked in this is so statistically significant that Facebook should be shutdown while they do an investigation. I currently get approx. 3 robocalls a day even though I'm in the Do Not Call Registry, and they are always from different numbers. They even know my name and address even though I don't publish it.

Having your information leaked like this has real consequences. After the issue with Cambridge Analytica, you are simply becoming a lab rat peasant for the oligarchy. Any autonomy that you may have had will soon fade away.

View on HN

Oh god, maybe this is why I've started getting a ridiculous number of spam phone calls every day over the past month. Shame on me for giving them my phone number for account security/verification way back ... turns out it wasn't worth it.

Did you get a security notice from Facebook regarding this issue?

I got a security notice and I've gotten one new phone call every day from the same number. Blocking it the other day seemed to have worked.

Nope. Would it be an email?

Not aware if there was an email, but I think there was a banner on the website that was shown to those potentially affected. If you didn't receive one then I presume you shouldn't have been affected.

Click https://www.facebook.com/help/securitynotice and scroll down

I see

>Is my Facebook account impacted by this security issue?

>Based on what we've learned so far, your Facebook account has not been impacted by this security incident. If we find more Facebook accounts were impacted, we will reset their access tokens and notify those accounts.

I also get about ten spam calls a day.

I'm not on Facebook at all, and my spam call rate has shot up too. I think it's just an increase in spam calls, not a result of Facebook hackery. Phone numbers are dense enough that if you know area codes and exchanges (readily available information), you can just dial through the remaining 10000 numbers pretty easily and get enough hits to be worth it, plus you only have to do that once per phone # to have a good idea of whether that's a hit.

For me, it's mostly been about student loans, which I have not had for several years now. It's not even targeted. It's just spam. Though anecdotally I've heard other people say they tend to get different calls, none of which seem particularly well targeted, so perhaps it's merely very very poorly targeted.

I'm not on Facebook at all, and my spam call rate has shot up too. I think it's just an increase in spam calls, not a result of Facebook hackery.

If anyone you know is on FB the chances are FB slurped up all your details from their address book.

Part of my point is that you don't need to "hack Facebook" to get basically every phone number. If you intend to indiscriminately spam everybody, you can just do that, you don't first have to "hack" anything. It's part of why robocalls are such a problem. The tech to do it is decades old; VOIP and later innovation certainly make it easier, but it's been possible and not that expensive for decades.

You only have to hack Facebook to improve your targeting or something, but as I said, I've seen at best no evidence, and really negative evidence, that the recent spate of calls is well-targeted.

> Phone numbers are dense enough ...

These guys know more than phone numbers.

They know names, spouses, children, employers and banking relationships.

Armed with this info they sound legit to even experienced and cynical infosec professionals

Why? There's no precedent. Equifax got away with far worse, and literally nothing came of it. Fair's fair.

I mean morally, yea, I'm with you, but from a legal standpoint, I'm not.

I'm in the same boat. About 3 robocalls each day. I have resorted to keeping my phone on a custom 'do not disturb' profile so that the phone only vibrates if someone in my contact list calls me.

I've been using nomorobo (app for $2 a month) that uses a massive blacklist to block robocalls. It works really well and you can share whatever calls sneak through to them to add to their blacklist.

It's better than the do not disturb option because it doesn't also block text notifications.

Really this would all be massively simpler if iOS allowed your contacts to act as a whitelist and just push all other callers straight to voicemail.

Also using an app (Hiya)

It's been a godsend.

I looked at Hiya, but ended up picking nomorobo because Hiya uploads your contact information to the cloud (rather than comparing locally for neighborhood spoofing). Hiya was also 'free' and it was unclear how they're monetizing your data.

Can you provide a source? According to https://hiya.com/privacy, contacts "don't leave your phone".

https://thesweetsetup.com/apps/best-spam-call-blocking-app-i...

"However, Hiya cannot send spam calls to voicemail without having your entire contact list on its servers. The app claims it needs contact access to avoid accidentally blocking people. As Nomorobo can do this without your contacts, this feels…sneaky."

Maybe this is incorrect or changed? It's possible they're just doing the comparison for neighborhood spoofing locally too.

Oh, I should have mentioned that texts from my contacts also vibrate my phone. All together: permitted calls, texts, and hangouts messages vibrate my phone, but otherwise the phone is silent. I don't use push notifications for anything else, not even email.

Really a good system for fighting robocalls and distraction.

Reply on news.ycombinator.com