Hacker News Reader

Comment by I_am_tiberius | Hacker News Reader

Would like to know if non Facebook users are included because Facebook has non Facebook user's phone numbers due to the fact that Whatsapp uploads the entire phonebook to Whatsapp. That means Facebook is likely to know your phone number although you don't use Facebook or Whatsapp.

View on HN

It goes so much further than this and it is absolutely frighting. The following sketched situations applies if you don't use Facebook at ALL.

99+% of every single person you meet has either FB, IG or WA installed on their phones and shares their phonebooks with them (assuming you live in [insert western country here]). There is also a very big chance at least some have your full name and address in their phonebook. Facebook not only knows who you are, but also who you are in contact with, when you meet new people and who they are. They also collect phone and text records with their apps so they also know the frequency that you have contact with them and they can even read the content of text messages (most people these permissions to the apps because it will automatically verify the associated phone number). Add all the location data, ssid/mac address collection and countless of other datapoints to it and they can draw out your entire life even when you don't use anything from facebook. There is no escape.

As a counterpoint I can think of dozens of personal acquaintances who are happily non-users and never interact with Facebook properties (retirees not into tech, busy executives, to cool for Facebook hipsters). If your country or social circle doesn't use WhatsApp, Facebook itself is already dying and Instagram is getting their lunch eaten by Tiktok.

FBs revenue growth doesn't agree with this perspective: https://twitter.com/JonErlichman/status/1354536238104064005

That is a very good point. But usually changes in revenue trail changes in adoption and/or engagement. Both when growing, and when slowing down.

> If your country or social circle doesn't use WhatsApp

Aside from China, Japan and Korea, do such countries exist?

The US is also pretty heavy on iMessage usage and FB messenger still dominates WhatsApp.

> 99+% of every single person you meet has either FB, IG or WA installed on their phones and shares their phonebooks with them

citation very much needed

This is why I don't use my real phone number with apps and HATE apps using phone numbers as a proxy for a user id.

Get a virtual phone number if any service requires a phone number from you. Don't submit to this nonsense.

It's not about the information you give, it's all those friends and family who signed up for it and uploaded their address book... They now have your phone number and email probably your date of birth, and even some photos of you.

They are like the credit companies, they have information on you whether you allow them to or not.

Exactly. People who save your details in their Address Book and click the "Sync your Contacts" when an app suggests it, are the loophole in privacy and security.

The only way is to have a separate set of email, phone numbers, for those family and friends who doesn't care about privacy and security, that way it is easy to dispose those information later.

Beyond that … if we truly want to avoid it … the only course of action is to not give them anything at all. Not a single email, not a single phone number, not even our home addresses.

That is exactly how I deal with it. I use a throwaway webmail address and a Google Voice number. No way they're getting my real email or phone number that I use for work and clients.

You're not avoiding having a shadow account created about you though, once I've upload my contact list and you're right there, Jim Wyclif, with your real phone number, and I've also tagged you in a photo we took together last year. And then there are all the other people who have your real phone number and who have been on Facebook, Messgenger, Instagram, or WhatsApp since they saved the number. And then there's even relatives and former classmates and co-workers who've looked up your name and typed in your town, school, and/or former company to find you. When I use Facebook, it still recommends former classmates and acquaintances who I literally looked up once ever. (As a side-note, Snapchat does the same type of things; people I've worked for in the past, as a tutor, are recommended to me on the "Add Friends" page.)

I wonder if there would be a market for a cloud-synced, client-side-encrypted address book app for say $1/month.

> it's all those friends and family who signed up for it and uploaded their address book

Hmm, not many of my friends have my phone number either. I don't usually use phone with friends. Come to think of it I almost never use phone, I always use FB, WeChat, LINE, Hangouts, etc. for voice calls, and sometimes just use a straight up WebRTC call.

I suppose one way to alleviate this for the masses is that when giving your number to a friend, have them use a pseudonym that is easy to remember for them and not use your real name.

Some more sophisticated services look up the provider and blacklist VOIP / virtual number listers.

I've found that VOIP numbers from certain countries and area codes can evade this problem. Not listing publicly, in case the idiots in charge of the system are prowling this site.

But I don't even understand why they're allowed to look up the provider, or why I can't define myself as a mobile operator.

I don’t use Facebook or their other apps (eg WhatsApp). Facebook has my email address as I used to get regular invites to sign up. Facebook also knows what I look like from friends tagging me in pictures, and seems knows my date of birth as people tell me that they were notified by Facebook. So even if you have avoided all their stuff, you aren’t immune.

https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

It's sick that they are allowed to get away with this. It's basically a botnet stealing information.

Every time someone argues that people can avoid the privacy problems of Facebook by simply not using it, I point out this issue (plus the shadow accounts).

I recently purchased a phone that had the Facebook app preinstalled. If I had to guess, the mere act of connecting to WiFi caused a whole slew of info to get sent.

I would think not, but my cluefulness regarding Android security/privacy is effectively nil.

I didn’t check what permissions it was given by default but hopefully not too many and with those not much spying. It would be nice to have a clear map of what data can be obtained with what permissions.

Actually Android devices (especially older ones) are known for in many cases sending extensive data to the manufacturer on network connect. See for example: https://www.nytimes.com/2016/11/16/us/politics/china-phones-..., https://balagetech.com/android-app-phones-home-china/

Obligatory mention: mbasic.facebook.com it's like a clean needle exchange for Facebook.

That's nice. I deleted my fb but sometimes groups will require it for events and discussion boards.

There was a dark phase when it looked as if the only way to sign up for various services was going to be Facebook. If memory serves, there was a time when Spotify sign up required Facebook.

The difference between malware and "legitimate" software is whether there's a "legitimate" company behind it and whether that company has a "legitimate" interest in the information. Sad but that's how it is. Just like how governments give themselves the right to crack computer security and surveil everyone but throw citizens in jail if they do the same thing.

Anecdata: I've never provided my phone number to FB, I provided it to Messenger App and Whatsapp, it's not on in the file for my country.

Yeah, I feel Messenger or WhatsApp doesn't really come into play here. Facebook has at least two different privacy settings when it comes to phone numbers and how it's shown to people:

1. At https://www.facebook.com/USERNAME/about_contact_and_basic_in... - there's a contact info section where one can fill in a phone number (among other details) and set the visibility to Public/Friends/Friends except <group>/Only me/Custom/custom lists.

2. And https://www.facebook.com/settings?tab=privacy - there's a "How people can find and contact you" section that covers "Who can look you up using the phone number you provided?" with options of Everyone/Friends of Friends/Friends/Only me. I imagine it'd be very easy to select the wrong thing during setup due to the overwhelming number of things to read and click.

I suspect those who have set the latter, or both options to "Everyone" will most likely be in the "free" data dump (except perhaps for most Australian Facebook users, for now).

I feel the second setting is riskier, especially if you don't want employers or colleagues to be able to simply look you up on Facebook by phone number. For example, I could hypothetically display my phone number to "Everyone" on an incognito profile and no one should be able to just wander by and spot my profile and immediately figure out who I am (assuming this profile doesn't somehow get suggested to "Friends you might know" - big assumption, yes; but this would depend on how I complete my profile). Regardless, either one or both set to "Everyone" is a recipe for disaster.

I believe more people would have allowed number searching compared to those who just have their phones displayed to everyone on their contact info sections. In effect, it's a bit of a reverse phone book, plus extra.

I have WhatsApp and you can deny access to your phonebook. Everything works just fine

Others can still allow access to their phone book and the information stored in them about you will be transmitted and saved at Facebook, won't it? Is there a way to disable that?

> Is there a way to disable that?

No.

Exactly this. I recently started a twitter for my academic career. Didn't share my contacts or anything (I only follow academic twitter too). I get tons of suggestions of people I know and several have followed me. The information is from their contact list because twitter knows my number and connected us. There's a clear benefit to this, but there's also privacy concerns too. The lack of control over this is what is concerning.

You need an account to ask FB to delete your data.

How are you able to send whatsapps to people you don't have a prior conversation with ?

I am doing the same boat...and was working fine until i lost & replaced my old phone. All conversations were lost, and this makes it challenging to use whatsapp for any non-group conversations (since I can't start any).

You can start a conversation with any WhatsApp number by opening the url wa.me/number. The number must include the country prefix.

There are also some apps and webpages that helps with this process (Disclaimer: I'm the author of one of them for Android [0])

[0] https://play.google.com/store/apps/details?id=com.trianguloy...

Last time I tried (a year ago or so) I couldn't add new people to chat to. They had to contact me first.

You can't start a group chat, only individual chats.

Without Contact access in iOS, WhatsApp blocks you from starting a group chat, but allows individual chats.

As I've seen on WhatsApp on every smartphone I've had: when you download WhatsApp and tap the "New chat" icon in the upper right corner, the app SHOWS YOU a list of everyone from your phone's contact list who has a WhatsApp account. They also show the list when you click "Chat" at the bottom and then "New Group."

it just occured to me that the data from the leak could be used to test if they are in compliance with the Gdpr, Now in the event that it turns out that they don't follow the rules, could this leak be used as evidence in court?

Whatsapp doesn't share phone book data with Facebook.

Yet.

And since it's a Facebook controlled company a leak like this happening again isn't that improbable.

Just like Kelly Loeffler didn't share any info with her portfolio manager

It claims not to, which isn't a guarantee. After all, they also claimed not to use phone numbers given to them for 2FA for anything else, and yet ended up using them for ad targeting.

Hi, how do you know? It is of personal interest to me as I don’t use FB but do use WhatsApp. It may also reduce the piling of downvoters.

Here's the source: https://www.spiegel.de/international/business/whatsapp-ceo-o...

Quote:

"Cathcart: It’s true that we do have some information about how people use WhatsApp and that we do know, for example, the device ID. We collect this only to secure our services and protect from attacks. When you use WhatsApp and allow access to your phone book, we only see the phone numbers, not the name.

DER SPIEGEL: Do you share these numbers with your parent company Facebook?

Cathcart: No, we don’t. The updated privacy policies will actually not change anything globally in our ability to share data with Facebook."

“The updated privacy policies will actually not change anything globally in our ability to share data with Facebook.”

I don’t see how that “globally” can be true. If one compares the WhatsApp terms of service in the EEA (https://www.whatsapp.com/legal/updates/terms-of-service-eea/...) with those elsewhere (https://www.whatsapp.com/legal/updates/terms-of-service/?lan...), you’ll see the latter adds:

Affiliated Companies. We are part of the Facebook Companies. As part of the Facebook Companies, WhatsApp receives information from, and shares information with, the Facebook Companies as described in WhatsApp's Privacy Policy, including to provide integrations which enable you to connect your WhatsApp experience with other Facebook Company Products; to ensure security, safety, and integrity across the Facebook Company Products; and to improve your ads and products experience across the Facebook Company Products. Learn more about the Facebook Companies and their terms and policies here.

AFAIK, that addition was what caused the uproar earlier this year.

(Also note the dark pattern in both terms of service that seed confusion as to which are the ones that apply to the EU. In the first sentence, “If you live in the European Region, WhatsApp Ireland Limited provides the Services to you under this Terms of Service and Privacy Policy.”, ‘this’ doesn’t refer to the text you’re reading, but to the texts behind the hyperlinks)

That doesn't seem to be correct, although what does 'phone numbers' mean in this context?

Quote: "WhatsApp, which was acquired by Facebook in 2014, does share some limited data with Facebook, including phone numbers. However, the firm has reassured users that messages will always be protected by end-t0-end encryption, which means neither WhatsApp or Facebook can see these private conversations"

Source: https://www.forbes.com/sites/carlypage/2021/01/15/whatsapp-d...

As always, the spying agencies are NOT particularly interested in your actual messages, but your metadata.

They want to know who talks to who. Limited data? What a bunch of horseshit.

"Limited" is a weasel word, as it can mean anything. e.g. a "limited time offer" can mean it lasts for 2 days or 2 years, because it is not unlimited.

Likewise, sharing a limited amount of information with Facebook simply means they don't hoover up every single bit. Perhaps Facebook is not interested in those automated texts you get confirming haircut appointments...

On the other hand, if you just got a haircut, then they know that you’ll be looking for another one in a set amount of time (based on your hairstyle, which they also know from photos), and they could advertise hairsalons to you then.

I’m not sure their algorithm is this refined, but it’s not impossible.

E2EE is indeed true with Whatsapp, but they can distribute the decryption key to anyone, including themselves.

These advertisements with half the information about the technology should be illegal.

That's what Facebook says.

But Facebook has no history of lying right? /s

Reply on news.ycombinator.com