533M Facebook users' phone numbers and personal data have been leaked online | Hacker News Reader

533M Facebook users' phone numbers and personal data have been leaked online

businessinsider.com

1,296 pointscjbprime496 comments

I mean, at this point I think everyone should just accept that at the very least their name, age, address(es), email(s), phone number(s) and screen name(s) have been fully leaked if you have ever had any kind of online presence. Not saying that's right or good, but at this point it's just a fact.

So if that's the case, I think we should move beyond really even trying to think of this info as private or a marker of identity, and we need to move everyone to more secure forms of identity verification.

As has been pointed out on HN before, "identity theft" is a made-up concept to make it seem as if you had something stolen from you, when the real problem is banks and other service providers do an absolute shit job of identity verification. They're the ones at fault, and they try to shift the onus onto you to fix things when they screw up.

Indeed, a social security number is pretty much the only additional piece of data to the stuff above that one would need to open up a bank account in someone else's name, and those have been leaked plenty of times too.

The government needs to make harsher penalties for banks and others that can ruin your credit, etc. because they accept all this leaked info as "proof" of identity.

The problem is completely the opposite. The flaw is the existence of social security numbers. Prohibit them from being used for anything but social security.

Then there is no "your social security number" or "your identity" for someone to open a bank account against. You open a bank account and they give you a bank card and you set an address and phone number. The day you open it, they shouldn't need to know who you are, because it's a new account with $0 in it. After that, the owner of the account is the person with that bank card who can be reached at the address and phone number given when the account was created.

Get rid of centralized identity and there is no centralized identity to steal.

Money-laundering rules make it illegal for banks not to know who the customer is. Also various anti-bribery and sanctions rules.

None of those rules are worth the cost. Identity theft, created by the concept of centralized identity, costs billions of dollars. Investigations of those other crimes are still possible without government-mandated privacy invasions by banks, and the privacy invasions are a huge cost in themselves.

KYC laws and governments desire to have silent complete financial surveillance stops banks from acting that way too.

Why not FIX how an SSN can be used? It was not created for this purpose but that doesn't mean how we use it can't be fixed.

Any time someone attempts to use your SSN to identify themselves as you, you should be notified and your authorization should be required for that use to be allowed.

And the higher the value of the authorization, the more care should be required.

Companies are able to do this already with 2 factor authentication. And I think we SORT of have that for change of address, as the Post Office both requires ID and notifies you by mail. Maybe that's really just one factor.

Allow people to require as many additional factors as they want. Confirming my identity in 6 ways when I decide to sell my house sounds good. 4 ways when I buy a car. One or none is fine when I make a $10 purchase. Let me decide.

And let them CHOOSE what organization manages authentication. A private company might do the job a lot more effectively than the Post Office.

Add human methods too. A call from a sibling or child might be one people could set up. Require validation by a notary public.

> Any time someone attempts to use your SSN to identify themselves as you, you should be notified and your authorization should be required for that use to be allowed.

So now the government needs a way of contacting you. Suppose they have your address and phone number on file.

Then you lose your way a while and become homeless for two years. You can't afford a phone and no longer have the same address, and have lost your ID or it expired. You finally start to turn it around and go to open a bank account. The government contacts you how? How do they know it's you?

The answer is that it's a new account and you're not trying to prove anything about whether you're the same person who lived at the old address, so you shouldn't have to.

And once you have a bank account or a mortgage or such, you and the bank can arrange for any form(s) of authentication you like. It shouldn't have anything to do with the government, and it definitely shouldn't have anything to do with how you authenticate yourself to your job or your wireless carrier.

I stand by your SSN only for social security point.

But the rest sounds plain wrong to me.

Your phone might get stolen, your name might change due to marriage, your address might change because you moved/got evicted. What now?

Your phone gets stolen so you use your bank card and password to set a new phone number on your account. Your bank card gets stolen so you use your phone and password to get a new bank card.

If someone steals your phone and password and bank card and ability to receive mail at your home address all at once then you're pretty screwed, but you're pretty screwed then regardless, right? That's the level of screwed where somebody else can also get a government ID in your name.

I use a slightly different address with every business I give my address to.

For example

123 Main St. Apt 45-WXYZ

Where "WXYZ" is different for each business, to pollute any data mining algorithms trying to collate my address across sites. In some cases when they use address resolving functions, it also helps to spell out your address e.g.

123 Main St. Apt FOURTY_FIVE WXYZ

SSN is used as taxpayer ID, that is why it is needed.

Now, there is absolutely no reason it could not be OTP'd (or uniquely derived for each account).

The scary thing is how much ones phone number (a somewhat ephemeral thing) is actually bound to your IDENTITY.

Considering your phone number is more and more being used in 2FA ... if you were to ever change your number and someone else got it, this would pose a serious security risk if you failed to change over ALL of your internet accounts 2FA to the new number.

I've always thought the most scary thing about this practice is that your (unique) phone number is a powerful "foreign key" which could potentially join data from many other leaked databases, forming an even larger dataset on you.

There are plently of other places we give our phone numbers to, which might not have anywhere near the protections that Facebook say they provide.

Absolutely, and e-mail or Paypal account name too. Neither of them are trivial to change. If you try to create a new account for each thing at a generic mail provider such as Gmail, your accounts will be shut down by automatic abuse filters. If you roll your own domain, then, well... the domain becomes the foreign key.

> more and more being used in 2FA

Lesson: Don't use your phone number for 2FA. Get a bunch of virtual numbers and redirect their SMS to your e-mail.

If U2F or TOTP is an option, use it. And use a physical key for TOTP, not some Google or Microsoft authenticator.

Like really? Don't you have to walk to a bank or show some ID?

I live in the EU and I do operate under the assumption that banks take reasonable measures to ensure an account is linked to a legal identity.

No in the Us you can easily open one online just by answering a few questions and giving your SSN. Sometimes they will ask you to upload an ID. But that could also have been leaked.

No. Many online services will let you open a bank account with name, address, phone, DOB and social security number.

Without sending a confirmation letter to the address and SMS to the phone?

Well, I think at this point we can conclude that companies will not be good shepherds of our should-be-private data if we don't incentivize them to. Who'd have guessed?

I appreciate the pragmatic stance you take, and we should definitely move to more robust identification methods.

But making this case for better ID tech should IMHO not be confused with giving facebook and the others a pass. This should never have happened, and the very fact that we have a data trove this big is already a problem. That they don't seem to even attempt to protect that data is another one.

Close that shop up. The fines for this kind of stuff (and the other stunts they've pulled) should make it economically no longer viable to keep it open, really. The first time you fuck up this hard, the fines should hurt. This is not their first time.

Companies effectively run the government, via the 2 party system and the back and forth of high level corporate execs back and forth into gov't. They don't want to rock the boat once that bountiful position is achieved. That said, how to get the government to regulate corporations who regulate the government. Maybe I'm becoming too cynical, but there has to be an externality like the great depression in order for The People to take back the reigns of power (at least in the US).

Wont happen. All the politicians world over have been trained like Pavlovs dogs to chase Likes as a route to power. So its like asking addicts to not just give up their drugs but to take down the cartels.

The time to shutdown Facebook has past. Now we just have to suck it up and endure them and their effects like we do Cancer.

Again, I get the sentiment, but I disagree.

> Indeed, a social security number is pretty much the only additional piece of data to the stuff above that one would need to open up a bank account in someone else's name

I am not from the US, but is this really all you need to "proof" your identity?

The most common thing I have seen in the EU when companies have a KYC requirement is that during the sign up process you will have a quick video call where you have show your ID card while they verify that your ID is legit.

"I mean, at this point I think everyone should just accept that at the very least their name, age, address(es), email(s), phone number(s) and screen name(s) have"

Yes. I think the scary part is WHAT these identifiers are connected to. EG. your email being linked to a private antifa community, pro-Taiwan communities, adulteration meetups, etc.

s/if you have ever had any kind of online presence./if you, your friends, your family, your cleaning lady etc. has ever had any kind of online presence.

> So if that's the case, I think we should move beyond really even trying to think of this info as private or a marker of identity, and we need to move everyone to more secure forms of identity verification.

Even if this info wouldn't be good enough to sign for official stuff it's still private and unique enough to target you though.

We should start thinking of these breaches in terms of their accumulated impact. It's not the 1990s anymore, where data is difficult to store and networking too slow to move it.

We should assume the leaked data doesn't go away; that instead people out there are consolidating Equifax data with Vastaamo data, adding data from Exchange hacks and the Accellion hack, to cross-reference with data from Facebook... it's like water flooding a levee now, instead of evaporating.

Not the first time I've harped here about this (ie: https://news.ycombinator.com/item?id=26604753, https://news.ycombinator.com/item?id=24586258), but I hope we start planning for that kind of future.

Honestly sounds like a fun job for future historians. By aggregating all the leaks over a long period, how much of a person can you reconstruct?

For example even though I am using a throwaway account, HN's logs might one day get compromised. So now they can join the IP address to other compromised sites that I was logged into using my usual email. And from my email they already have my name, SSN, address, phone number, usernames, passwords, etc, exposed from prior breaches. But now they know about my shitposts too.

> logged into using my usual email

It's risky if things go sideways, but HN doesn't require an email address for an account.

That's exactly my point. I think I am safe on HN because I'm using a random user name with no email attached. But their logs definitely have my ip address and that ip address will be common across other compromised logs on other sites, some of which I might be logged into with a real email (this is true regardless of incognito mode since it's the same computer).

Yes. Why can't you delete your HN account again?

The root of the problem is not the privacy policy or the system security. The root of the problem is the collection itself. All large businesses, health care providers, and governments maintain databases. Every one of them will eventually be leaked. All it takes is a corruptible trusted insider.

This.

I don't trust in the government, but I think digital "personal data" should be only available for "confirmation" to companies that need it. Say, a government entity could have an API that allow you to send hashed personal data that they can verify is right. This way companies will ask the user for their data and hash it client-side. Then they can send the hashes (hashed with a custom provided salt to the entity (government, maybe private) who will basically reply with a True or False on the verification of the different data.

It may even be an interesting use case for a public blockcahin, where your personal data is stored in a Merkle Tree type of data structure, so that one can verify that certain pesonal data of a person is true, without disclosing the data.

It's probably not implemented as closely as what you described but check out Europe, this small continent across the pond and the tech scene in the smaller countries.

For example Estonia has had famously and online identity stuff linked via a federal ID (in europe there are more republics then federations so it's easier to manage country-wise) [0] [1]

Or more familiar to me with a bigger sample is a movement in Poland which is gaining popularity - mojeID (myID) which is a Single Sign On system with major banks as providers (they really regligiously check the identities when you open a bank account) or the statebacked login.gov. The mojeID system allows other entities to use your actual identity as an authentication factor without having to keep that much data and pose risks - for example an online alcohol shop can verify the age. [2] [3]

[0]: https://en.wikipedia.org/wiki/Estonian_identity_card

[1]: https://e-estonia.com/solutions/e-identity/id-card/

[2]: https://www.kir.pl/en/administration/mojeid/

[3]: https://www.mojeid.pl/#zastosowanie

For many reasons, good or bad, the idea of mandated federal ID or national ID isn't quite accepted in the US.

Italy use a similar system, it's called SPID (Italian acronym for Public System for Digital Identity)

https://www.spid.gov.it

Wouldn't this fall down as soon as someone enters your details with the wrong casing or uses a +country code rather than a localised phone number and so on?

Humans will error and enter data incorrectly so the hash would be different every time potentially despite being "correct" to a human at a glance?

You could standardise everything (lowercase etc) but I imagine there are country and regional edge cases such as capitalisation having meaning in a given language (I can imagine it being a thing but I don't know it for sure)

There could be instructions in place to specify only all lowercase or just use .toLowercase() when sending. Also there could be a specified format for phone numbers or a function that turns all input into the desired format by stripping all special characters. Possibly only hashing the last 9 digits of the phone number for non mission critical applications instead of the full 10 digits.

This sounds like a good use case for short brief documentation.

> Every one of them will eventually be leaked.

Equifax has more at stake than most. And they've been hacked. Repeatedly. The government has been hacked. Yahoo was COMPLETELY owned. I mean, if someone would put together a list, it would make for shocking reading. It's become so common, that we go, "Oh no! Anyway."

Yeah, both my health insurance company and the company that eventually bought my mortgage have both sent me letters. And this point I just dump them in a folder in the filing cabinet with the rest.

Google has a huge number of activist (and surely some corruptible) employees, and yet the incidents of users data getting out are very close to zero.

I think this demonstrates that user data can be managed safely and effectively.

Usually the incidents reports on user data leaks show that the company seemed to barely be trying - We need laws that force them (even small companies) to put serious effort into it.

You don't know that. While the publicly available data leaks are indeed rare, you cannot know if they don't use the data for trading or other purposes for their personal gain without disclosing it to the public.

Sure, but if you have no evidence of it happening you have a fairly weak argument.

There are infinite things we can't know - opening the discussion up to that really makes anything possible, but the discussion wasn't even about what they might do with the data beyond leaking or selling it.

> Google has a huge number of activist (and surely some corruptible) employees, and yet the incidents of users data getting out are very close to zero

Am I reading this wrong, or are you saying that activists would be more likely to leak data? Then I would wonder what kind of activists you have in mind.

Agreed that yes indeed it seems possible to build a security serious company, and that Google is (seems to be) a good example. (Now, there are other things I don't like about Google but I guess that's of topic.)

Surely they would. We already learned that members of their own security team don't seem to see any problems with employees abusing privileged access to mandatory Chrome extensions to agitate for unionisation (at Google of all places!!). Twitter employees screwed with the account of the president of the United States.

Ideological employees of big tech firms taking a sudden disliking to someone or some group and abusing privileged access is certainly a threat that ever larger numbers of people are talking seriously. In particular, it is a concern for industries that do things activists don't like, such as working with immigration control (though perhaps that's no longer an issue now Trump is gone).

I mean, yes, but.. what's the solution? Never collect data? In at least some of those cases (and arguably all), that data does need to be collected and stored. What is the government going to do, not maintain birth registries, tax registries, land owner registries etc? What is a big business like a bank going to do, not collect customer data like your name and address?

I have a different view: it’s not the collection that’s the problem, it’s the firehose attached to the database. For the applications you mention, make aggregation over all records prohibitively expensive by design.

A good idea, but again, there are plenty of cases where that fails (depending on what you mean by "aggregate").

- "How much money is currently owed in taxes to the government?"

- "Can't tell you that, we're not allowed to aggregate data".

Looks like this is the "To match users to their friends by phone number, you need an API which can take as input a phone number, and return information about if that number has an associated account" problem.

There is no way to let a user find their friends on a service without such an API. Yet if you have such an API, someone can simply brute force all phone numbers worldwide (there are only 10^10), and now they have a database of all users...

Rate limits can help defend, but considering many users might have 1000 phone numbers in their address book, you can't set the rate limit very low without impacting user experience. Attackers can reduce the search space dramatically by only checking phone numbers that resolve to an active line (using VoIP stuff to test a number).

The only real solution is for your app not to have a "Here is a list of your friends already in the app" screen... But as you can imagine that means you won't get any user growth or VC funding...

I think there are way more than 10^10 phone numbers in the world. I think there are 10^10 combinations in the USA alone (filtering by unused area code, etc will decrease that number, but even then https://www.ck12.org/c/probability/permutation/rwa/Wrong-Num... says almost 8×10⁹ remain)

Also, at least some countries have longer phone numbers (Germany, the UK and China have 11-digit ones, for example), and the international public telecommunication numbering plan says plan-conforming numbers are limited to a maximum of 15 digits, excluding the international call prefix (https://en.wikipedia.org/wiki/E.164), so the search space, potentially, is a lot larger.

> I think there are 10^10 combinations in the USA alone

Canada and USA share the same numbering plan and that's sometimes overlooked.

I always "press 1" to interact with the 'your social has been criminally suspended blah blah' or 'card-services' robo-calls.

When I have time I share circular stories about my grand-kids that don't visit me anymore, but when I don't, I just respond in French with something like "Je pense vous etes une pamplemousse."

Most recently, one responded with "NO HABLOS ESPANOL". lordy lordy...

This is the same fallacy that leads to apps asking for permission to access your whole picture library.

Facebook could have an API by which an app can prompt its user to show a list of all of that user’s friends who have the app installed. The app would only learn the identities of people whom the user explicitly selects, and phone numbers would not be part of that identity.

It works for photos because the threat model is about protecting local files against malicious apps.

But for phone numbers, you about protecting Facebook API (which is publicly available via the internet) against arbitrary devices, which Facebook has no way to tell from legitimate ones

Telegram had this issue too and they made a setting "who can find me by my number" you set it to "my contacts" so only mutual contacts can find each other.

This is a genius fix because in order to enforce your own privacy you must betray the privacy of n+ friends. Awesome.

And now you know how those cell phone farming programs were able to pay people a couple bucks a month to run crap on arrays of dozens of phones.

Obviously it is bad if your personal data is compromised after you (or some else) upload it to an online service like Facebook.

But in this case, it’s important to remember that phone companies used to regularly leak most of their customer’s phone numbers (and names) in the form of a telephone directory. So a question to consider is: suppose that the white pages were still commonly produced and contained most people’s numbers. How would you then feel about something like this.

Personally I feel like the problem with phone numbers being leaked is mostly the epidemic of spam calls (especially in the US) rather than some particular breach of privacy.

Aside: I think it is good to consider these counterfactuals in general for questions about information privacy, for example how would you feel if everyone’s tax returns were published publicly like they are in Sweden?

The "new" risk with phone numbers is the overreliance on them for login and 2fa and the relative easy of taking one over. I use security keys but still have accounts I can't remove the phone 2fa from despite having two keys tied in.

If you can avoid it, simply don’t give anyone your phone number. Then you can use security keys, hardware keys and recovery codes. Obviously some places require a phone number, but for those that don’t, avoid giving them one.

Spam calls are likely not even affected by leaked numbers. Source of suspicion: My partner and I have phone numbers in close numeric vicinity, and deliberately use one for public purposes and the other one is not known outside of a very close circle of family.

We still get spam on both numbers within short time frames - so I'd say it's likely spammers just auto-dial through.

That's been going on for many years. Brute force calling costs nothing. I've always wondered if charging 5 cents per call would stop them cold, but I am sure no one wants to implement that now.

As far as I can remember, the white pages don't include "biographical information". The kind of details used for idiotic "security questions" on websites too lazy to implement 2FA (your mom's maiden name, your first school, the name of your first pet, etc).

As for public tax returns in Scandinavia, first of all it has guardrails - searches are recorded with your information when you lookup someone - and second, countries have different culture and History for a reason.

Finnish income for those earning 100k and over is bulk downloadable as a csv/json with full names, birth years and provinces, along with taxable salary, capital gains, etc.

You can't compare that at all! They leaked IDs and from that you can go to user profile and learn more about them. You cannot do that from a phone company leak.

Before the Internet, all you could do with a person's phone number is call them. But now, with PeopleSearchNow.com (the ultimate free source of personal info--feel free to look up your own real phone number in it, assuming you're American) and with Google and the MULTIPLE social networks that virtually everyone between the ages of 20 and 45 has been on now--typically using the same username on most or all of them--you can find out way more in a matter of a few MINUTES than a 1980s private investigator ever could in a span of a month. I can look up your number on PeopleSearchNow and then, if I can't find YOU on Facebook, I'm confident I can find one of your relatives (several of whom will be listed on PeopleSearchNow), and get to you from there--meaning find your other online profiles, thanks to those Facebook friends who know you.

Phone companies didn’t leak phone numbers in the conventional sense of the word. I used it to try to draw a comparison. Phone numbers used to be printed in big books and you could usually look someone’s phone number up if you knew their name and rough location. That is, phone numbers were not considered to be particularly private information at all.

I think the comments I most agree with talk about the different security threats people face today with current usage of phones.

The issue of having someone's phone number is completely different these days; in 1985, I couldn't find out your age and your previous addresses and then find dozens or even hundreds of photographs of you alone and/or with your relatives and friends, as I can now - see my other comment:

https://news.ycombinator.com/item?id=26687321

I agree, but also we’ve made it more complicated by using phone numbers as 2FA credentials.

Now suddenly a “white pages of cell numbers” becomes a very convenient tool for getting in to people’s accounts.

Only if you can hijack their number. Knowing a phone number seems like by far the easiest part of breaking SMS 2FA...

This is insane. Phone companies published numbers because it was generally considered helpful and the costs of unsolicited calling were relatively high. By the 70s delisting was an option, and by the late 90s it was very common (in the US). The internet made this a no-brainer, and to suggest that it’s somehow ok just because it used to be (in a totally different world) is beyond ridiculous.

We don’t have the option here — people provide their number to a service to be able to use it, and the numbers are then compromised, in breach of that contract and because of the service’s failures.

The two are not remotely alike, what the fuck are you even talking about.

Please make your substantive points without name-calling and swipes. Those are against the site guidelines and we ban accounts that post that way—it's because we're trying for a different fate than internet-default here, or at least to stave it off a while longer.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and sticking to the rules when posting here, we'd be grateful.

Don’t worry, Facebook will soon put out a press release including the phrase “we need to do better.”

I work in the security field and let me tell you something I realized: nobody cares about security. If someone cares about security, it's because they've had many many incidents in the past. We humans are not a species that is good at preventing, we are good at reacting.

the security handbook[^1] has a chapter on that actually, and they basically say that role playing is the only way of not getting burned. Humans are excellent at role playing, and it can help you prevent a lot of catastrophe without having experienced them before.

[^1]: https://securityhandbook.io/

I think part of the problem is that many orgs see security as an overhead that engineers do to sleep well at night. A few more breaches, a few more fines and it will finally be seen as a feature to keep the CEO out of jail.

The problem is that companies don't care about securing their data, because the data is not theirs, it is about their users.

Mark Zuckerberg probably spends more on personal and family security and privacy than Facebook spends on their users' security.

That site is a scam. The listed email address does not exist and I have not received a book.

"This is old data that was previously reported on in 2019. We found and fixed this issue in August 2019."

https://twitter.com/Liz_Shepherd/status/1378398417450377222

What a pathetic response. Does it mean users changed where they live? Change their names? Deleted and started a new account so the ID is different?

That kinda sad, because that is what’s going to happen and then we’ll nothing more.

At this point I’m not really sure what it will take for companies, like Facebook, to understand that you need to not fuck around with peoples private data.

Put a monetary cost of holding user data, and a steep monetary cost on losing user data.

Ex, pay x amount per month in perpetuity for each piece of information about a user your keep. And have to pay the "net present value" of those payments if you lose the data.

Having to pay for hoarding user personal data changes the incentives from gobble up as much as possible, to instead only pay for a users data that is worth the cost to your business.

And as an extra incentive to not hold unneeded user data, know the costs you'd pay if it was breached.

I’ve been getting a lot of automated/unsolicited calls recently. Begs the question if this might be the source of my woes.

Is there a trustworthy phone number version of https://haveibeenpwned.com?

"Is there a trustworthy phone number version of https://haveibeenpwned.com?"

An "exact" google search excluding adjacent phone numbers seems to work well for my numbers, and culls a lot (not all) of the autogen pages. So if your number was 212-555-1239, search Google with these strings:

  "(212)555-1239" -1240 -1238

  "212-555-1239" -1240 -1238

Dear god, fastpeoplesearch.com is a horribly obnoxious treasure trove of information.

Good idea, I’ll give that a whirl later. Great tip to filter out those auto-generated list sites. Thanks.

you genius

Not really an answer to your question, but one partial solution to the problem of having your number leaked or sold is to setup a service like Twilio to act like a phone proxy. You can have Twilio forward calls it receives on a different number ("spam number") to your actual phone number ("real number"). You provide spam number to anyone who isn't a business or personal contact. Every few months, you rotate spam number. If your spam number is leaked, you don't care because its only a transient number which isn't more permanently associated with you.

You can also have more permanent proxy numbers for services or people that may need to get in touch with you long term.

It's what I have done for years. Only costs $1/mo for the number and a couple hours learning their API.

Your existing cell number can be ported over to Twilio if you are patient.

The only problem is trying to use the number for 2fa. A growing number of banks (like Capital One) block Twilio services from recieving their SMS.

Is this available to people outside of the US as well and is there a guide for setting this up? Last time I used twilio for a basic sms gateway there was a lot of clicking and typing.

I've been getting a lot more recently as well and I figured it was due to the phone companies promising to get rid of caller id spoofing this year so scammers are working overtime until they can't anymore.

Oh, is that a real thing that's happening? Caller ID spoofing is the main reason I hold onto my phone number from [small town] Texas, since only my immediate family ever calls me from there, so I somewhat reliably know anything else from that area code is a scammer.

intelx.io

Can't say too much about trustworthyness though.

U could also just download the set from e.g. raid forum to check for yourself.

Might have to I think.

European here. What are these bot calls exactly? Never had one as I guess it’s forbidden where I live.

I recall there were a ton of them in France. Usually pretending to be DHL or another courier asking about a package. Nobody I knew interacted much with the calls.

If you're in Europe, but don't share a language with a much poorer country, you're safe from these.

Telemarketing or political campaigns. Check out the Robocall article on wiki. In Europe it depends on the country. In Poland I receive a few calls daily but they are people calling me, not bots. Never received a robocall here.

Same here, i started recieving both calls and SMS which the last i find more annoying. I do use Android and these ones haven't been able to be detected as spam

I’m on iOS and don’t think there’s a way of blocking unsolicited calls until after the fact... I hope to be proven wrong though!

The odd thing is, the calls often come through having a caller ID very similar to my own number.

This also started a few weeks back for me, more unsolicited calls/texts.

This could be the first large breach we've seen from FB like this. Most past breaches were of a much different and smaller nature (scraping or API access abuse), and seeing a real leak like this could change the landscape for FB quite a bit, since historically companies like Facebook and Google have been very good with preventing them. I don't know a ton about FB's specifics, but there's a chance this data could be 'public' from people with the given privacy settings, if perhaps 25% of users have that turned on. If that is not the case though, then this would be the first serious breach from FB imo.

Either way at this point I operate under the expectation that most information I input into a database may be leaked at some point. This is particularly rough for services that demand and track a lot of things, but it cannot be helped.

Looking at the leak others have pointed to, there are a surprising number of people working in a particular imaginary company:

    sqlite> select company, count(*) as c from usa where length(company) > 0 group by company order by c desc limit 10;
    company                                   c
    ----------------------------------------  ----------
    Self-Employed                             459119
    Facebook                                  181013
    Retired                                   71210
    The Krusty Krab                           61550
    Hollister Co.                             42304
    U.S. Army                                 39682
    Stay-at-home parent                       33095
    Walmart                                   31600
    McDonald's                                30792
    Student                                   25326

Before I deleted my Facebook account, it said I was chief sciolist at the Theodore J. Kaczynski Institute of Technology.

There is a particular scene in the movie America's Sweethearts that you would enjoy. I would post a link but I haven't been able to find on youtube.

edit: found it :) >> https://www.youtube.com/watch?v=q7Ufkf0YVAk&t=290s

Teens like to say they work at the Krusty Krab for some reason. No clue why but when I had Facebook I saw it a lot on peers' accounts.

https://en.wikipedia.org/wiki/Krusty_Krab

Probably SpongeBob fans.

I associate "The Krusty Krab" to fake/secondary/tertiary/spam profiles. People I know personally and those I was able to confirm as legitimate profiles doesn't use that or any other fake information (or just leave it empty most of the time). I only see such fake information in accounts used to advertise their business in someone else's threads.

I definitely know real people (especially highschoolers or college students) who put fictional jobs in their profile. Also common is using some fake name, like that of a fictional character.

Fake name, of course.

I deleted my account when Facebook started asking for is verification of my name, that was absolutely unacceptable.

Can you link me to where you found the data?

https://news.ycombinator.com/item?id=26682774

Could you please tell me how did you convert it to sqlite? I've got a huge 1 GB txt file that crashes my comp every time I try to search for myself there :( Thank you!

Super hacky python script I used to turn the text files into a sqlite database:

https://pastebin.com/gBWhCVGz

I suggest using a shell program like grep (or even the search feature of less), as shell programs are notoriously good at lazily seeking through files to keep memory use low.

Firstly don’t do something like open it in notepad. 1GB text files are not exactly difficult to work with once you use a proper text editor or parsing tools.

Does it open with Geany?

https://www.geany.org/

It's FLOSS. Available on Windows, Mac and Linux.

I used to use Borland's Brief to edit large files. But it is commercial. There is a free version in beta here https://sourceforge.net/projects/grief/ Grief. It pages the file in and out of memory to save space.

Try Ultra Edit, free trial. It can read and search massive text files without crashing. Quite responsive.on 10GB files.

You can use `awk` for any sql like operations on file.

sqlight can ".read" a number of formats. It's one of the more convenient ways to do joins on ugly tables.

What's the count of people who elected not to enter their company?

    sqlite> select count(*) from usa where length(company) = 0;
    22209703
    sqlite> select count(*) from usa;
    32315270

May be test users. Iirc, the Flinstones were common test users.

How is it that NOBODY mentions suing FB for this, the single largest data breach/leak in history? Are they to be let off with zero accountability? Nerds and geeks of ycombinator, pls let us know how you feel.

> the single largest data breach/leak in history?

if something sounds like a hyperbole, it probably is. In this case I believe you are mistaken, and the Yahoo breach of 2013 was the largest, with data leaked from over 3 billion accounts.

[0] https://www.nytimes.com/2017/10/03/technology/yahoo-hack-3-b...

Couldadone w/o the name calling. Generally frowned upon, site guidelines and all

This does not look like scraping. A prima fascie database leak, and an invalidation of Facebook's claims of them not using your phone number past the validation, as well as them claiming using encryption at rest.

As far as I can tell it's a combination of the 2020 phone number exploit linked to scraped data for public accounts (likely using the public id).

I've had a play with the data for a few people whose phone numbers I actually know, and they all seem old enough users that they just have the number on the account anyway. I could be wrong but I haven't found anyone my age who's number I can confirm.

The phone number point may still be true though, they have to store the phone number somewhere.

They could store a salted hash instead for almost everything except using the number as actual phone number (call/SMS)

Maybe it's from whatsapp

Would like to know if non Facebook users are included because Facebook has non Facebook user's phone numbers due to the fact that Whatsapp uploads the entire phonebook to Whatsapp. That means Facebook is likely to know your phone number although you don't use Facebook or Whatsapp.

It goes so much further than this and it is absolutely frighting. The following sketched situations applies if you don't use Facebook at ALL.

99+% of every single person you meet has either FB, IG or WA installed on their phones and shares their phonebooks with them (assuming you live in [insert western country here]). There is also a very big chance at least some have your full name and address in their phonebook. Facebook not only knows who you are, but also who you are in contact with, when you meet new people and who they are. They also collect phone and text records with their apps so they also know the frequency that you have contact with them and they can even read the content of text messages (most people these permissions to the apps because it will automatically verify the associated phone number). Add all the location data, ssid/mac address collection and countless of other datapoints to it and they can draw out your entire life even when you don't use anything from facebook. There is no escape.

As a counterpoint I can think of dozens of personal acquaintances who are happily non-users and never interact with Facebook properties (retirees not into tech, busy executives, to cool for Facebook hipsters). If your country or social circle doesn't use WhatsApp, Facebook itself is already dying and Instagram is getting their lunch eaten by Tiktok.

> 99+% of every single person you meet has either FB, IG or WA installed on their phones and shares their phonebooks with them

citation very much needed

This is why I don't use my real phone number with apps and HATE apps using phone numbers as a proxy for a user id.

Get a virtual phone number if any service requires a phone number from you. Don't submit to this nonsense.

It's not about the information you give, it's all those friends and family who signed up for it and uploaded their address book... They now have your phone number and email probably your date of birth, and even some photos of you.

They are like the credit companies, they have information on you whether you allow them to or not.

Some more sophisticated services look up the provider and blacklist VOIP / virtual number listers.

I don’t use Facebook or their other apps (eg WhatsApp). Facebook has my email address as I used to get regular invites to sign up. Facebook also knows what I look like from friends tagging me in pictures, and seems knows my date of birth as people tell me that they were notified by Facebook. So even if you have avoided all their stuff, you aren’t immune.

https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

It's sick that they are allowed to get away with this. It's basically a botnet stealing information.

Every time someone argues that people can avoid the privacy problems of Facebook by simply not using it, I point out this issue (plus the shadow accounts).

The difference between malware and "legitimate" software is whether there's a "legitimate" company behind it and whether that company has a "legitimate" interest in the information. Sad but that's how it is. Just like how governments give themselves the right to crack computer security and surveil everyone but throw citizens in jail if they do the same thing.

Anecdata: I've never provided my phone number to FB, I provided it to Messenger App and Whatsapp, it's not on in the file for my country.

Yeah, I feel Messenger or WhatsApp doesn't really come into play here. Facebook has at least two different privacy settings when it comes to phone numbers and how it's shown to people:

1. At https://www.facebook.com/USERNAME/about_contact_and_basic_in... - there's a contact info section where one can fill in a phone number (among other details) and set the visibility to Public/Friends/Friends except <group>/Only me/Custom/custom lists.

2. And https://www.facebook.com/settings?tab=privacy - there's a "How people can find and contact you" section that covers "Who can look you up using the phone number you provided?" with options of Everyone/Friends of Friends/Friends/Only me. I imagine it'd be very easy to select the wrong thing during setup due to the overwhelming number of things to read and click.

I suspect those who have set the latter, or both options to "Everyone" will most likely be in the "free" data dump (except perhaps for most Australian Facebook users, for now).

I feel the second setting is riskier, especially if you don't want employers or colleagues to be able to simply look you up on Facebook by phone number. For example, I could hypothetically display my phone number to "Everyone" on an incognito profile and no one should be able to just wander by and spot my profile and immediately figure out who I am (assuming this profile doesn't somehow get suggested to "Friends you might know" - big assumption, yes; but this would depend on how I complete my profile). Regardless, either one or both set to "Everyone" is a recipe for disaster.

I believe more people would have allowed number searching compared to those who just have their phones displayed to everyone on their contact info sections. In effect, it's a bit of a reverse phone book, plus extra.

I have WhatsApp and you can deny access to your phonebook. Everything works just fine

How are you able to send whatsapps to people you don't have a prior conversation with ?

I am doing the same boat...and was working fine until i lost & replaced my old phone. All conversations were lost, and this makes it challenging to use whatsapp for any non-group conversations (since I can't start any).

Others can still allow access to their phone book and the information stored in them about you will be transmitted and saved at Facebook, won't it? Is there a way to disable that?

Last time I tried (a year ago or so) I couldn't add new people to chat to. They had to contact me first.

As I've seen on WhatsApp on every smartphone I've had: when you download WhatsApp and tap the "New chat" icon in the upper right corner, the app SHOWS YOU a list of everyone from your phone's contact list who has a WhatsApp account. They also show the list when you click "Chat" at the bottom and then "New Group."

Without Contact access in iOS, WhatsApp blocks you from starting a group chat, but allows individual chats.

You can't start a group chat, only individual chats.

it just occured to me that the data from the leak could be used to test if they are in compliance with the Gdpr, Now in the event that it turns out that they don't follow the rules, could this leak be used as evidence in court?

Whatsapp doesn't share phone book data with Facebook.

That doesn't seem to be correct, although what does 'phone numbers' mean in this context?

Quote: "WhatsApp, which was acquired by Facebook in 2014, does share some limited data with Facebook, including phone numbers. However, the firm has reassured users that messages will always be protected by end-t0-end encryption, which means neither WhatsApp or Facebook can see these private conversations"

Source: https://www.forbes.com/sites/carlypage/2021/01/15/whatsapp-d...

It claims not to, which isn't a guarantee. After all, they also claimed not to use phone numbers given to them for 2FA for anything else, and yet ended up using them for ad targeting.

Just like Kelly Loeffler didn't share any info with her portfolio manager

Yet.

And since it's a Facebook controlled company a leak like this happening again isn't that improbable.

Hi, how do you know? It is of personal interest to me as I don’t use FB but do use WhatsApp. It may also reduce the piling of downvoters.

That's what Facebook says.

But Facebook has no history of lying right? /s

There's not much to see here.

Someone scraped some public profiles. Someone then brute forced a poorly implemented "look up by phone number" feature. They linked the two datasets on the unique facebook user id.

Leaking data that is or was in the public domain is not much of a leak. The only noteworthy thing would be the leak of the non-public phone number, however that vulnerability has been widely known since 2019 (and has been resolved by Facebook), so there's nothing new here?

Not much to see? Not noteworthy?

Where could I, or any Internet user, trivially download these details on 533M Facebook users prior to this dump? If nothing else, it seems extremely noteworthy that someone was not only able to obtain the data through scraping or some attack, but has shared with the world.

> Where could I, or any Internet user, trivially download these details on 533M Facebook users prior to this dump?

On Facebook. Literally. You can scrape any public profile info. It's against ToS, but it's not illegal (some caveats apply, see the hiQ Labs v. LinkedIn case for more info).

The only noteworthy thing is the phone number vuln. Except that's been known since 2019, so it's certainly not news.

How hard is it to change phone numbers? So say I release my old number and take a new one, how do I make sure I am not forgetting any 2FA services I signed up for?

This news is from jan29 https://www.theverge.com/platform/amp/2021/1/25/22249571/fac...

Liz Bourgeois, @Facebook comms:

>This is old data that was previously reported on in 2019. We found and fixed this issue in August 2019.

https://twitter.com/Liz_Shepherd/status/1378398011747938305

https://haveibeenpwned.com/

I've been pwned 33 times. At this point, it's just noise. My passwords are all unique (password manager). Honest question - What should I worry about?

It's much more of a threat to those who don't use cryptographic randomly generated passwords. And if you add PII to your accounts.

Because of this I use fastmail or Apple sign-in to make a new email for every online service I register for, and when it's a username I pull random words together from a dictionary. I also avoid using my real name as much as possible.

Identity theft and harassment. If you say anything politically that other people don't agree with then you could become a victim of violence.

well it might be embarrassing if someone found out you used facebook.

I guess I could envision a scenario where you're being investigated, and these leaks provide a roadmap of services to subpoena.

Maybe your phone number, relationship status or Facebook bio?

Somewhat ironically, Mark Zuckerberg (and 2 other FB founders) are in the dataset - along with phone numbers.

Hopefully this disaster will be the catalyst for better data privacy controls.

What Facebook user id is Mark? Is it #1?

Is it possible to download this without giving money to criminals? (The article says free, but my 2 minutes of googling hasn't found it, somewhat unsurprisingly).

Is doing so legal?

If the answer to both of those questions are yes... I'd like to take a peak. Mostly to check whether or not some numbers I know haven't been directly give to fb are there.

https://t.me/freedomf0x/12553 Is the download link in the channel. Has all files by country, zipped in .txt files.

I'm also wondering if number I asked them to delete 5 years ago is in this 2019 leak. :)

I have to say; the backyard Big Data analyst in me is salivating.

Yes. Legal? no idea.

Last night I was browsing Facebook, and all of a sudden, it said there's been suspicious activity and I've been locked out of my account. To unlock it, I had to review the email address and phone number I associated with my account (in case the hijacker added their own contact info), but all it had were my info that I added in 2011 (before I knew what a piece of shit Zuck was). Then it asked me to change my super-complicated password because it said the password is no longer secure.

So, can I assume this leak is related to this strange event?

Highly unlikely to be related. It's not a password leak. It's also not really a leak, someone scraped some public profile info and then used the phone number lookup feature to match up the two.

This is from jan29 https://www.theverge.com/platform/amp/2021/1/25/22249571/fac...

Does anyone know if there is a way to check if one's data is included in that leak, à la haveibeenpwned?

grep the download?

Search for :YourFirstName:YourLastName:YourGender

Will the EU impose a fine per person? Maybe we'll see in 8 years time.

And yet it is still considered audaciously paranoid among the general public to protect your privacy by not having a Facebook/LinkedIn/Google/... account.

I've noticed that some people who don't have personalised social media seem to assume that other people do because they're mentally deficient or ignorant.

It's the same as how unsympathetic people ask why fat people don't just stop eating, or drug users stop getting high, or the cyberbullied don't just turn off their phone.

It's a lot more complicated than "just don't use facebook".

But parent is not talking about calling out people for having social media accounts. He/She is talking about those having a social media account judging those not having one as paranoid. You've just propped up a straw man here without addressing the point the parent comment made.

1/16th the worlds population, assuming no duplication.

FYI, the source of this data existed until April 2018, when FB disabled it:

https://about.fb.com/news/2018/04/restricting-data-access/

I removed my phone number from Facebook when it was reported that Facebook used this as some sort of tracking mechanism across third party vendors - specifically with purchases from merchants - in order to serve more "relevant ads". From what I recall, if the merchant is somehow hooked up into FB APIs then regardless of whether you signed up for their rewards program using an e-mail + password or via FB SSO, then they would send back "anonymized" data back to FB for each purchase(s).

I wonder if my phone number still persists (aka "soft delete")

When did you remove your phone number? Looks like this relates to a vulnerability that was patched in 2019.

I'm slightly concerned about this myself. I'm also seriously ticked off with Zuckerberg and co. I can tolerate the fact that internally they do scumbaggy things with my data. I tend to have less forbearance when they let my data out into the wild.

I guess if you use facebook you just deserve all the shit you get. What sucks is that the rest of us have to live with it too. I suppose we shall just keeping waiting for that darn market to correct itself!

So when are we going to stop companies from accessing your address book and 'uploading it' as part of the sign up process? Or even using Facebook and its services in general.

Well the biggest offender now has leaked the data of hundreds of millions of users who have attached their phone numbers and full names.

Now let's see if the users REALLY care this time that when they signed up to Mark Zuckerbergs website, it wasn't a good idea to sign up with a phone number in order to 'stop bots'. They did not learn with the Cambridge Analytica scandal, are they finally going to learn?

How is it a leak? There is no information how the data leaked. My bet would be that it’s hoarded through FB api and passed around. Nothing new happened here is my guess

Why can't we have a private/public key phone number ... that'd fix this problem... We gotta stop using integers to identify people.

Are there immediate actions people should be taking at this point?

A lot of password reset flows work via username + SMS using "we've sent a code to your phone number (xxx) xxx-xx12". This database unmasks that phone number, so my assumption is this makes sms hijacking more viable, but perhaps someone more knowledgeable can weigh in.

Does Facebook allow password resets like this, and can that be disabled?

Ha and WhatsApp want me to accept their new policy.

Absolutely not

$50 fine per number needed

Interesting. Every time Facebook is hacked I remember this Anonymous' threat[0].

[0] - https://venturebeat.com/2011/08/09/hacker-group-anonymous-th...

Used to be phone books filled with people's phone numbers, names and addresses. In that light, this leak isn't too bad. Not great, but not that bad.

(Easy enough for me to say, I never gave FB my phone number in the first place, I've never logged into FB on my phone, and I'm not in any of these files.)

It's mind boggling how absolutely unaccountable these big tech companies - especially Facebook have become. I think we hear about such massive leaks at least once a year. And nothing ever gets done to prevent this from future and even the fines if any imposed are chump change for the companies.

I would love this to spur some serious regulation of social media.

The cats sorta out of the bag, but one can dream.

Let's start by classifying them properly: FB is an ad network.

Any tools around to search this database? I'm keen to find out if I've had data leaked.

Interested to know the GDPR implications of this for Facebook. This seems like one of those occasions where the regulator might be tempted to impose the maximum fine…

See my other comments on this thread about Facebook's situation with the GDPR: https://news.ycombinator.com/item?id=26682200

Long story short, regulators already have more than enough evidence about Facebook's lack of GDPR compliance so they could've already imposed large fines if they wanted to. The fact that it hasn't happened yet shows there's no motivation to actually enforce the regulation.

I believe there are still open investigations.

But Facebook have enough money and lawyers to ensure a plea deal is agreed. We work out as nothing more than a slap on the wrist.

All the big tech companies budget for these fines. You'll often see it called out at earnings where they allocate funds for a particular fine in a given quarter even though the investigation isn't finalised.

I wish I were Irish. Imagine 3 billion dollars extra taxes! It's like a second COVID-19 relief package.

Can someone please guide me on how to check this leak to verify if my info was leaked?

Tried to lookup some info, but it's not there. Maybe it's from some web scrapper which collected public info, or other means (some ambiguous mobile app which had access to contacts?). Or the leaked files are incomplete.

I’m curious about the pool of Facebook users who seldom use the product, retaining it solely for groups and to keep in touch with family. Will this event loosen that final brick and drive these users to delete their accounts?

in my case, no, because I still need to occasionally keep in touch with those people.

I use Facebook a LOT less nowadays though. Here's what I do:

- removed all of the apps from my mobile devices. - only check it on VPN, with Firefox, using Facebook Containers. - log out each time and do not use the "save this browser" feature. - unlock origin & pihole are active on the VPN too.

I have managed to completely ruin its targeted ads for me. It's been an amusing experiment.

I still use it less because it is a HUGE memory & resource hog and eventually makes my browser window slow to a crawl.

"keep in touch with family" can be subsumed by chat apps. But for discussion groups and special interests, facebook is still the most accessible site to run (small) groups in, or am I mistaken?

If you have some need to know the people, maybe, but if not, hobbyist subreddits are better for discussion groups and special interests. The only thing I can't see leaving Facebook is some group that requires real-world interaction like a buy nothing group, but there are neighborhood specific platforms popping up that would enable applications like that without having to use Facebook.

That’s why you never use your real name nor birthdate ... on social media.

Except... that's only the tip of the iceberg.

Facebook/Google (et al) farms data from everyone! There really is no escaping it in today's unregulated privacy free-for-all.

Friends/family/associates will provide your personal info in their contact/meta data.

Companies (and their 3rd parties) you've done business with willingly sell/provide your personal info.

My actual phone number has net negative value. I mostly only get scam texts and phone calls.

Everyone I know uses messaging apps and contacts me that way.

I can’t believe Apple hasn’t offered a way to white list when your phone rings.

They have. Settings > Phone > Silence Unknown Callers

This option still causes the call/sms to show a notification bubble... which is annoying since you can’t ignore it if you rely on notification bubbles to know if someone you know has messaged you.

Nice option, but whitelisting is a bit much for me. Amazingly, the iphone still does not have an option to automatically block anonymous calls (those that hide their numbers) and only them.

I've deleted my Facebook last year, after being on Facebook for 10+ years. I guess I am not affected.

update: oh no, "...the data was scraped due to a vulnerability that the company patched in 2019."

Can we take away the incentive and just ban online targeted ads already?

You can check if your data is included here: https://codeeverywhere.ca/apps/fb_data

Interesting numbers in the linked tweet in the article. 5M accounts for the Netherlands exposed. Almost 1/3 of the population. Compared to Germany where “only” 6M are leaked, not even 10%.

They've also got Tunisia in the list twice, and the number for the first instance is 39.5M, when the population of Tunisia is not even 12M.

I wonder if Tunisia is famous for FB click farms?

A quick google indicates "maybe": https://about.fb.com/news/2020/06/may-cib-report/

Found myself in the data set, but didn't find several people I expected to find. Seems to be only those who added their mobile number (I did so for account recovery purposes only).

Great, and while you can get sued into oblivion for downloading a Metallica album, all our personal data is downloadable from a public website for 3€.

Like for real, it took me 2mins to find the leak myself...

Where did you get the data leak, I want to check too.

https://t.me/freedomf0x/12553

I haven't checked the content myself, but this tg channel is usually legit

From the initial tweet the source is this:

https://raidforums.com/Thread-SELLING-Free-FaceBook-533M-rec...

However, the comments in that forum suggest that it's not "free" and/or not there.

Can you link it? I'd like to check if I am affected.

Regrettably, I was forced to create a FB account for work.

At this point i don't see why only facebook and the thieves should have access to this data. If the data is public it loses its value

What about this data being public causes it to lose value? It seems like it would be a boon for lots of companies even if every other company has it.

Why would the data being public stop robo-callers from using the list?

The only way the data can lose value is when everyone in the list change their numbers. If making it public drives them to do that, then good, but the inertia to do that is so big that I doubt most would. Spammers and marketers don't care if the list is being used by competitors, so the value of the data as spam target is also not reduced by making it public.

Value to whom?

Source?

I wonder why India with population 1.3bn has only 145MB zipped footprint when USA with population a quarter of that has almost 1 GB? AFAIK, FB is huge in India.

It looks like they abused the old feature to locate user by phone number and just bruteforced all numbers in a country. This feature is no longer available.

I still go with the assumption that everything that is sitting somewhere in some server will be leaked. Having unnecessary data is the problem

Before a leak: xxx is a shit company and is notorious for how it treating user's data. Everyone, stop using its app now.

After a leak: ok that's life

Should make it easier to jump-start a competitor!

Is this data that was in profiles that they scraped or did they get access to things that weren’t being intentionally shared?

So, how do I see if my data is in this?

Has this breach made it onto HIBP yet?

Dunno, but if the US dataset is anything to go on, an import into HIBP won't catch much. Less than 1% of the entries have an email address.

(Apologies if the link is in the commends already. I can't seem to locate it.) Where is the list?

Personally, I wish Facebook would finally get slammed with the long overdue consequences of questionable practices when it comes to data handling and transparency, let alone minuscule control users have on own account and PII. This leak may have been preventable for a vast number of individuals. I suppose many are familiar with the old account "deletion" process that would — years later, too — prove itself not to be a real removal, but a mere deactivation, waiting to return from their graveyard whenever pinged by the simplest of login attemps by bots or ill intentioned individuals. At this point in time, considering the sheer amount of I believe accounts struck in a limbo, a dedicated fast track deletion process should be enforced on Facebook. I have, in my little knowledge, not found any case of GDPR requests granting one's wishes to see old accounts (that did not accept their newer ToS and cannot be authenticated in any possible manner permitted currently, in which registration and connected e-mails are not) be permanently removed from their systems. My attemps, at least, have come short.

facebook should be obligated by law to use this leaked dataset and notice the individual user that if the data is still valid, it is now widely distributed.

There are risks: stalking, sim-swapping and phishing via company info.

I hope the class action bankrupts Facebook, but I know it won't/

Is there a way I can search to see if I am affected by this leak?

Wasn't Facebook just trying to lecture apple about privacy?

Right? They're masters at adopting the (supposedly) moral high ground and acting all hurt when others criticize them - you'll hear 'we need to be better' but there's this overriding sense of, how dare people differ from what we feel is best?

Does anyone know if there's a GDPR fine on its way?

Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely.

(before you post a link to enforcementtracker.com please first compare the fine amounts with Facebook's revenue)

Great, so we get the worst of both worlds: outrageously obnoxious opt-out games (which, if skipped, implies free rein) and non-compliance as a cost of doing business. Wonderful.

> Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely.

Not having the data encrypted at rest seems to me a different infraction than the previous ones. The scale also matters, and that it isn't the first infraction.

And as I read it, not encrypting at rest is a breach of Article 6 and fined under Article 83 (5) (https://www.privacy-regulation.eu/en/article-83-general-cond...), which puts the fine limit at 4% of the annual turn-over.

Yes, it doesn't mean they have to fine as much, but the point remains, that this is in the category of the most severe infractions.

I really hope they now have to pay that 4% ransom due to violation of the GDPR .. for each stolen account of course ;-)

Is Zuck's number there? How about Bezos? Biden? Putin?

I don’t have FB or or WhatsApp but my Insta account (using a separate email address and no personal details) keeps recommending my therapist to me. How are we still ok with this shit?

The sooner we get rid of the cancer that FB is, the better. I didn’t share my contact book with FB apps either. It was probably her—a person in her 70s, not necessarily experienced with tech.

The main reason this company exists, or that ad tech can maintain a facade of not being a mainly bullshit industry with made up metrics, is the lack of informed consent.

It’s almost funny how we accept the current situation as normal. Because, I think that we’ll look back at these times with disbelief of reckless we were and how cheap we’d sell ourselves.

You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola!

I wouldn't throw the elder person under the bus on this one, the tactics are sophisticated, and honestly, just a precursor to what will happen with AR.

To give a bit more of how it's implemented (at least how I would propose it in iOS), Insta/FB/Whats queries available wifi SSIDs as a background process (or whatever they have for notifications/networking etc), and does the same to your therapist since you both have insta / fb / whats ... and based on the signal strength, can say with confidence you two were in the same room because XYZ Wifi strength is -Xdb just like yours (walls are strong signal augmenters), and you are both there for some time based on the background thread timestamp.

> is the lack of informed consent.

what's making it possible is the lack of privacy regulation. People by and large don't care enough about privacy,it's too diffuse, too complicated, the damage to oneself and others is too intangible etc.

Only way to end this is to destroy the business models that make it possible. What stands in the way of it is the mindset that this somehow harms innovation. (Innovating who can drive the titanic faster into the iceberg isn't innovation), that the government has no right to regulate private companies, and so on. The main problem is that people are trying to incrementally fix a broken thing, as Peter Ducker said

"There’s a difference between doing things right and doing the right thing. Doing the right thing is wisdom, and effectiveness. Doing things right is efficiency. The curious thing is the righter you do the wrong thing the wronger you become. If you’re doing the wrong thing and you make a mistake and correct it you become wronger. So it’s better to do the right thing wrong than the wrong thing right. Almost every major social problem that confronts us today is a consequence of trying to do the wrong things righter"

There should be informed consent and there should also be revokable consent

There should also be transparency of who has the consent right (data licensee and sublicensee)

And there should be a way to make easy consequences for people not having it

Release forms and licenses are used this way, data should inherit that. (Both systems should be better)

> my Insta account (using a separate email address and no personal details) keeps recommending my therapist to me

What about your phone number? Does your therapist have it? Maybe your therapist granted Instagram/Facebook access to her contacts?

Or maybe you yourself granted Instagram access and your therapist is in your phone's contact list?

The metastasis is companies and organizations that have FB groups and insist that’s the only way to get data or collaborate with them and their members or customers.

The reason we are here is because the one subset of the population which can do something about it has sold out. Is it the congressmen? No, it is us. Also the professors that taught us and the departments that accredited us. Either we did nothing to fight back or we are ourselves complicit and helped them build this world we live in.

What's being sold as convenience is really just creepy spying

> I don’t have FB or or WhatsApp but my Insta account (using a separate email address and no personal details) keeps recommending my therapist to me. How are we still ok with this shit?

I'm no attorney, but isn't there a doctor-patient confidentiality breach (in the U.S.) if a psychologist/iatrist's rolodex gets Facebooked out to the ad tech bidding systems?

> The main reason this company exists, or that ad tech can maintain a facade of not being a mainly bullshit industry with made up metrics, is the lack of informed consent.

Exactly, the industry is built on a foundation of obfuscating the myriad ways in which they are using people's personal data. Uninformed consent is the cornerstone of their business model.

The technology is just creepy. I recently experienced a wtf moment the other day when a friend stopped by and her new bf was in the car. We said hello and they soon left (I sell eggs). Later that day he is being suggested as a possible friend. I have my location services off but Facebook knew somehow.

I'm not happy with ANY of it which is why I have no social media accounts and I've been seriously considering a "dumb phone" to replace my smart phone. I simply don't use most of the features and it's a security/surveillance threat anyway.

I had the same problem but figured it out at last. The Instagram recommendations are based on who is on your phone contacts. Anytime I add a new contact number, they show up on my Instagram recommendations even if we never interacted in anyway not even by the phone.

Once people accept that there’s no such thing as a free (as in beer) app or service. In addition to there needs to be serious laws put in place that gives users control of their data. And they should be getting paid for facebooks profits—not the share holders.

Stop use any social networks from Facebook Inc.?

I know it’s not easy if you are addicted to it but it’s doable.

Suggest you send Facebook a CCPA or GDPR data deletion request (even if you don't live in California or the EU) for your real identity.

Cases like yours is why we created https://yourdigitalrights.org/d/facebook.com, which makes its dead simple to send such requests. Free & open source.

> I don’t have FB or or WhatsApp but my Insta account (using a separate email address and no personal details) keeps recommending my therapist to me.

So what? What's the harm?

People sure like to write emotionally charged posts arguing for privacy, but they're always suspiciously low on details on what bad things (actually) happened.

Even in this case with phone numbers and other data leaked, so what? What harm do data leaks cause?

Seems like making a fuss about nothing.

> How are we still ok with this shit?

We're ok with a lot of shit. I think if we were to make a list of shit this would rank pretty low.

Can't have shit on the Internet

These events are not a matter of if but when. And since the overwhelming majority of the people in my social circles has zero understanding of the real nature of the relationship between them - FB users and FB I just hope this will become increasingly frequent and painful experience for them. As in: I really hope this will get FB users in trouble as a result of identity theft etc.

This may sound extremely cynical but at this point it's the only way for the non-technical folk to understand the implications of giving away your privacy so that you can share cat pictures with other people.

> people in my social circles ... I just hope this will become increasingly frequent and painful experience for them.

Very strange to wish harm upon your friends with the hope that that will convince them to join your side in a political fight! I would suggest instead that you only wish that if it becomes a painful experience, they would realize why and renegotiate their relationship with FB. Typically wishing pain on your friends is not a good stance.

I think it would take more than this to be leaked, particularly if users had their 'private' messages on services leaked, then they would start to realize it.

I think most normal people acknowledge that so many companies know their phone number and name that they may be past caring.

It became necessary to destroy the town to save it?

Reply on news.ycombinator.com