Hacker News Reader

Comment by sleavey | Hacker News Reader

Heads up: when Facebook asks you to give them your phone number to "prevent you getting locked out of your account", they really just want it so they can identify your other profiles in datasets they've bought/own (e.g. WhatsApp). If you've ever given the service your number, you should consider your real identity linked to it.

View on HN

> If you've ever given the service your number, you should consider your real identity linked to it.

I have a feeling it's worse than that. (I haven't rigorously perused the ToS, if I'm wrong please lmk.)

Let's say your friend John has an iPhone and saves your name and # in their contacts. One day John installs the Facebook app & opens it. John is not technical and when the app requests permissions he taps 'Allow'. At that point AFAICT there's nothing stopping Facebook from snagging your name & number and populating a ghost profile, or corroborating a real one.

In other words, if you've ever shared your phone number to someone who uses the Facebook app who doesn't dutifully and consistently reject permissions prompts, it's probably already too late.

Your feeling is correct. It's been shown by researchers (incl. me) and confirmed by Facebook that they're doing that: https://gizmodo.com/facebook-is-giving-advertisers-access-to...

I’ve confirmed this same type of behavior in several of Google’s products as well, as part of an experiment a couple friends and I ran a several months back, using fake personas, to see how feasible it’d be for one to simply exist w/o creating a digital footprint (let’s just say that our overall conclusions left me feeling very sad).

Facebook frequently suggested my own mobile number to add it to my account when after I logged into the mobile webpage via phone (I never used any Facebook apps).

My only explanation for that was exactly that it had been farmed from a friends contact list.

Would rather not share the details here, but I know of one instance of a person having been found on Facebook via her phone number even though she never provided it - just one imprudent person who has your number associated with your real full name is enough for this to happen.

It’s like when you upload a photo with your friend (who doesn’t use Facebook) and it pops up ‘Did you want to tag [friend]?’

> ‘Did you want to tag [friend]?

You can tag someone that isn't on Facebook? I'm pretty sure the box use Facebook accounts...

Admittedly I didn't actually try it but I'm pretty sure said friend didn't have Facebook at the time (although they did get it, years later).

This is despicable.

You're exactly right. Add in the fact that Facebook can pose this as a puzzle to be solved, and attract a steady stream of sharp young people who can solve the puzzle without being bothered too much by the ethical consequences of solving the puzzle.

I've also definitely received "friend" suggestions for business contacts who I've had a phone number/email address stored in my phone.

There are no mutual friends or any other link it could make apart from linking my contact list with their number.

Facebook does indeed do that. One of the big reason of paying 22B for whatsapp is so that they could retrieve the entire friend graph of WhatsApp and use that to drive Facebook + Instagram MAUs.

The bigger the network, the more value a user gets, and the deeper the lock in.

It has been shown over and over again that both Facebook and Google will go to extreme lengths to know about their users’ lives and target them with precision ads. They are advertising companies foremost.

It would be interesting to see if there are ghost account numbers in the dataset. Depending on the country or region, would there be grounds for litigation if there were?

This is the entire business model of TrueCaller, and the reason they have a very accurate phone nbr lookup function

> you should consider your real identity linked to it

What is the point of these products if not linked to my real identity? That’s the whole idea of them. I use Facebook and WhatsApp to talk to people who know me. That’s why they want to talk to me. If they didn’t know my identity they would want to talk to me.

Of course your real identity is probably involved somewhere. It's just that I, and many others like me, don't think a third party should know what my real identity is. It's not their business.

Edit: Unfortunately it probably is their business. A poor choice of words.

Aren’t we already at a tipping point where your FB identity effectively is your real identity?

For many purposes the companies don’t have to care your ”real” identity

No, not really. I don't apply for jobs, book flights or vote with my Facebook account. I'm not concerned with what kind of insights that Facebook can infer from a fake Mickey Mouse account. I'm concerned about the possibility of being discriminated against in the real world based upon data gleamed from my online interactions.

You can get discriminated when booking flights though and you get selective propaganda through your FB account though... so you individually may not be affected but your group, whatever that is, may be.

Network graphs.

Off the top example: If four of your friends are buying gifts for your baby shower, this is a signal that your other friends have the intent to buy baby gifts and could be marketed to.

WhatsApp was specifically designed to be encrypted and private. Facebook, however, seems to play fast and loose with data. Sure you can talk to John Doe, but you might hope no one else knows that you're talking to John or what you're talking about. Useful, for example, to report a government conspiracy to a reporter.

That's not the only reason. They also allow advertisers to target based on specific phone numbers. It's one of the creepiest features, along with targeting based on e-mail.

What's targeting by specific phone numbers? Area code as a proxy for geo location, or something more sophisticated?

OC is likely referring to Custom Audiences. Facebook let you hash a list of emails or phone number, share it with them, so they can compare with their own. It allows businesses to target their customers or prospects separately.

When you go shopping the casier asks your your home address and phone number, for invoice/bill. Then they upload your phone number to Facebook and advertise based on your purchasing history with them.

You upload a list of your customers' phones or emails and Facebook or Google allow you to show ads only to those users.

Brings to mind a question, I've got a throwaway google voice number for precisely this reason, some services will let me use it, others (even Google-tried using a GVoice number as a recovery phone number for a gmail account for my grandmother, nothing doing) wont, few just throw back a generic error, others will say they don't allow virtual DIDs.

Someone's going to say that's to cut down on fraud/increase security, right? Yet these services are going to (against many in the InfoSec world who are screaming "STOP DOING THAT") use SMS as a means of 2FA...

I'm a bit confused where the value add is for account security in making virtual telephone numbers such a hit or miss.

Real security is picking a unique password and not forgetting it. Letting someone handle your security by giving them your phone number in case you can't handle it was never a good idea.

Get a password safe, and don't forget your complex passwords.

2FA (through an third-party like an email provider or, even, dare I say it, an SMS provider; not TOTP) continues to protect you when your password is compromised by a backend-side database breach. They might get your password; they might get your TOTP token seed; but there's nothing in the DB that will allow them to receive an email as you and then click the link in said email.

Yes, allowing someone to reset their password through a second factor is bad; but that's not 2FA, that's two independent 1FAs.

This is a good distinction and absolutely right. The problem comes when people substitute good passwords for 2fa resets via phone. The problem with that is that the majority of usage now comes from the phone, so it's not really a second factor if you lose your phone. It's a complex problem that depends on the situation and really too complex to make a matrix of when it's ok for your average Joe. Passwords suck, and we still use them, because as a general rule, it's the best thing we have.

For iOS, it seems easier to just make Facebook and WhatsApp use the same app group.

Reply on news.ycombinator.com