Hacker News Reader

Comment by jxramos | Hacker News Reader

I forget what the text looks like in your second link when you're not logged in but after I logged in the verification text appears as follows:

""" Is my Facebook account impacted by this security issue? Based on what we've learned so far, your Facebook account has not been impacted by this security incident. If we find more Facebook accounts were impacted, we will reset their access tokens and notify those accounts. """

View on HN

I'm curious did they reset everyone's tokens? I remember the day when I was meeting friends for dinner and all or just got logged out of fb at the same time.

I get the same message that I'm not likely impacted

Same, I think, I commented to my wife something like "that's worrying I've been logged out, sometimes that means your account is compromised", but I get the "you're not affected" message too.

IIRC that was on Facebook Lite on Android. I don't know my password so didn't log in at the time, but it just worked the next time I tried.

Might be unrelated.

I see the same thing. Wonder if anyone was informed that actually had been affected.

I have been affected, quoting text:

Is my Facebook account impacted by this security issue?

Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information:

    Name.
    Email addresses.
    Phone number.

Based on what we've learned so far in our investigation, the attackers did not gain access to certain information, such as:

    Account passwords.
    Payment card or credit card information.

Mine continues:

Additionally, the attackers also accessed other account information, including:

- The following information associated with your Facebook account:

    - Username.
    - Date of birth.
    - Gender.

 - Types of the devices you've used to access Facebook.
 - The language you choose to use Facebook in.

 - If you previously added this specific information to your Facebook account, it was also accessed:

    - Relationship status.
    - Religion.
    - Hometown.
    - Current city.
    - Work.
    - Education.
    - Website.

 - The 10 most recent locations you've checked in to or been tagged in. These locations are determined by the places named in the posts, such as a landmark or restaurant, not location data from a device.

 - The 15 most recent searches you've entered into the Facebook search bar.

 - People or Pages you follow on Facebook.

Had the same list as you, I was just happy it did not mention Messenger since that would be accessing truly private data.

The data you listed is semi-public in my case.

There's lots of "verification" data there, and lots of info to make convincing phishing attempts. That's serious juju.

Like if I say "I'm calling from Samsung about your SMA500FU, phone number #####, ..." that gives me a lot of trust for a phish.

I wonder, say, how many phones I could get by mailing people an envelope saying their phone was at risk of exploding, sending corresponding texts, etc..

I also got an alert in my feed. I stopped using Facebook 2 years ago... I didnt delete my account. But this incident highlights the latent risk our data poses across hundreds of websites...

Is my Facebook account impacted by this security issue?

Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information:

  Name.
  Email addresses.
  Phone number.

Based on what we've learned so far in our investigation, the attackers did not gain access to certain information, such as:

  Account passwords.
  Payment card or credit card information.

Reply on news.ycombinator.com