Facebook Doubles Down on Misusing Your Phone Number | Hacker News Reader

Facebook Doubles Down on Misusing Your Phone Number

eff.org

157 pointspanarky39 comments

Discussed earlier:

https://news.ycombinator.com/item?id=19298692

The other day I logged out of Instagram on my phone, created a totally new account (for our dog), cleared all the cache and it STILL found my coworkers.

I didn't want my coworkers to see my dog account because I act silly and want to be professional.

I'm CERTAIN they just sent data I didn't agree to send (phone number, etc).

They didn't re-prompt to access my contacts so I assume they think that since the APP has permission every account I create ALSO has permission to access my contacts.

Fuck facebook!

Might be the wifi network if you logged in while at work...

So the only way to keep your number from being searchable on FB is by not having 2fa?

Which do you prefer: privacy or security? Because you can't get both.

EDIT: you can do 2fa without SMS: https://thenextweb.com/facebook/2019/03/04/psa-dont-give-out...

Sure you can. Just go back in time and have the foresight never to sign up for Facebook.

It’s weird to have spent almost a decade with people on and offline scoffing at everyone who never signed up for FaceBook. Now it’s a case for time travel. I’d argue that with only a modicum or foresight it was possible to see that FB was to be avoided, but the hard part is withstanding the peer pressure.

I’m glad that I did.

I am too. The unstated sales job that has been so effective for hooking and keeping so many is fear-based, specifically the fear of missing out. I don't think I've missed anything at all important by never having had Facebook. But every time the discussion is had, a high percentage who say they wish they didn't have it also hang onto it with "it's how I stay in touch with people." My counter argument is, Delete it and find out who really wants to stay in touch with you.

Or use non-SMS 2FA, which is a good idea anyway (not that I'm defending FB for a second here)

Or by not having a facebook, obviously. If you have one, you're part of the problem :)

not having an account won't prevent fb from creating one for you and storing your phone number when one of your contacts uploads their address book

True :(

Here's an idea. Use a service that generates phone numbers that redirect to your actual phone number. Maybe Twilio. Just as some do with email addresses.

Create a new number for each use. For each family member and friend. For each site registration. For each whatever.

Have an app that searches periodically online for all of those numbers. If any of them show up linked to Facebook, or whatever else concerns you, nuke them. And maybe ping whoever/whatever got that number with an admonition, saying that they're no longer a trusted contact.

That would be extreme, I know. And you'd need to cut some slack for close family, your employer, etc.

But would it be doable?

You can use OTP 2FA with Facebook.

Is there any other authentication method like google authenticator for 2fa to use facebook?

https://www.facebook.com/help/www/358336074294704

I can’t see this site because I use Pihole and this: https://github.com/jmdugan/blocklists/blob/master/corporatio...

In that case, a help article on FB isn't going to be very helpful for you anyways

Don’t get him wound up, or he’ll start in on how he doesn’t even own a TV, err, I mean have a FB account.

Facebook supports U2F security keys for 2 factor auth [1].

[1] https://m.facebook.com/notes/facebook-security/security-key-...

The UX I'd say is following dark patterns for this.

You cannot enable U2F without first enabling SMS Auth and or OTP Auth. Once u2f enabled if you delete both SMS Auth and OTP auth it disables 2 factor auth and takes you to a welcome screen to get started enabling it again with the only 2 options SMS / OTP, once enabling one of them you can add U2F again.

Also I have "security.webauth.u2f" enabled in Firefox but Facebook is the only U2F service I use that doesn't work in Firefox so it falls back to the SMS / OTP methods on login.

> Also I have "security.webauth.u2f" enabled in Firefox but Facebook is the only U2F service I use that doesn't work in Firefox so it falls back to the SMS / OTP methods on login.

I noticed this as well. I was able to add my security key via Firefox, but for some reason Facebook decided that you need Chrome to use U2F when logging in.

Yes, you can use Google Authenticator for Facebook 2FA.

People say things like "what do you want, privacy or security?, you can't have both".

But something I always think about, we're talking about Facebook here. It's a social media platform with pretty pictures and comments. What's the big deal?

It's not like we're talking about your online backing or medical records. Why does the "security" of something as unimportant as Facebook really matter enough to require 2FA?

To boogy-man "Security" has escalated so much it's like everyone wants it everywhere, no matter the cost.

Facebook is one of the main identity providers on the internet, next to Google and Apple. Access to facebook can imply access to a wealth of other apps.

Reply on news.ycombinator.com