Mark Zuckerberg's phone number appeared among the leaked data of Facebook users | Hacker News Reader

Mark Zuckerberg's phone number appeared among the leaked data of Facebook users

businessinsider.com

486 pointsseesawtron228 comments

I've never been an FB "person", but maybe 6-7 years ago the local running club moved to scheduling everything on FB. For a while, the page was "public", but then you had to have an account (which required a phone number) to see anything other than the club's "landing page". So I ended up making an FB account which I've only ever used to be able to see the club pages (I haven't ever posted anything!) -- dumb of me I know, but FB had almost become a requirement to participate in life.

However recently, I've noticed that I now get a couple of junk text every day or two whereas up until a few weeks ago, I don't think I'd ever had a single junk text.

I wonder if this is why.

You should disable apps api on your profile.

> However recently, I've noticed that I now get a couple of junk text every day or two whereas up until a few weeks ago, I don't think I'd ever had a single junk text.

I think this is a symptom of living in the US. Been receiving robocalls and text messages all the time since I moved here.

You also have to consider that someone somewhere probably had your phone number before you did. There's no telling what the previous person did with that number.

> I think this is a symptom of living in the US. Been receiving robocalls and text messages all the time since I moved here.

Consider signing up for the Do Not Call registry. Does not do much against the scammers but you will receive significantly fewer telemarketing calls.

https://www.donotcall.gov/

I can tell you why. It's because you gave FB your personal phone number, while any number would work, e.g. a prepaid sim card (a one time 15 bucks expense).

I did some research and it seemed as though the companies would auto-renew and make it incredibly tough to close the accounts. I wouldn’t be surprised if some went so far as to send people to collections for “fees”.

You don't need to give your ID or sign up for auto renewal.

There’s no auto renewal, contract, or collections for a prepaid sim. In most states you don’t even show ID to get one. Just give whatever name you’d like on the caller ID and pay the first month.

Can you show me an example of one that can be purchased online? I didn't notice any on Amazon when I looked. (for curiosity's sake)

I’m not sure about online, but I know you can walk into a T-mobile store with $15 cash and walk out with a SIM card.

Used that method as my primary cell phone contract for many years.

I haven't looked into it recently, but it must be easy. Many games have SMS verification for accounts, and it seems that every person that streams those games has like 10 accounts.

Or a Walmart. Years ago, before Google Voice, I got one because I needed a local area code number for my apartment's buzzer. Mainly to see that if I could do it, I did things as anonymously as possible: bought a Tracphone at Walmart with cash. Turns out you needed an existing phone number to activate it, so I used the payphone that was outside a nearby gas station.

Or better yet, have someone else walk into the brick&mortar store to buy it for you

With the amount of facial recognition going on at large stores....probably a good bet. I'm not so concerned with the privacy as the ability to cancel without repeated 30 minute phonecalls to customer service.

Interesting, didn't know this can differ based on the state. Which ones do/don't let you do this?

Please be aware that this is not true for all countries. I can, for example, not get a SIM without submitting ID and proof of residence (if not already covered by ID).

but more likely, someone else uploaded their own entire contact book which included your number and likely email at one point

I signed up before Facebook ever required phone numbers.

I never gave Facebook my phone number.

I never had a Facebook app on any Android device, ever.

When I use Facebook, it's in a sandboxed browser that I never log into any other site with.

Facebook, for a time, started autofilling a prompt with my phone number, asking me to complete my account setup.

When Facebook has an app and all the people you know send their contacts to it, they don't need you to give them your phone number for them to have it.

In my case it's even worse - someone else signed up with my email address ...

Ebay recently got my number too, not sure how. PayPal perhaps.

The cost of sending texts has gone to effectively zero, so there's no barrier to someone sending one to all the numbers in sequence. At least, until the phone company catches on and blocks you.

The one I got late last night was pretending to be from the US Postal Service, prompting me to click on an anonymous link in order to "rescedule delivery"

Going to get worse SCOTUS just ruled saying a very strict reading definition on robocall to be only random or sequential numbers. So if you already have a list say bought from a 3rd party company of all the phones in the US sounds like you can bulk send now no repercussions.

In my field - politics - campaigns use tools like Hustle which are basically mechanical turk clickers to get around these rules. I'm thinking personally this will change...

Have you actually read the whole SCOTUS decision? Because that's not at all what it said.

I haven’t seen a clear analysis of the decision’s impact. I’ve read it, it’s quite brief. As I understand it, this decision essentially guts the blanket prohibition on spam text messages to cell phones. The rest of the law refers to restrictions on calls to “residential” phone lines, which does not include cell phones, so it’s not clear that there are any other limitations on texts to cell phones - do you see it differently?

This brings up the side issue that the act doesn’t ever mention text messages at all ... everyone has interpreted them to be covered as if they were phone calls, but that’s never been tested at the Supreme Court level.

The decision was unanimous and is really the only possible conclusion from a plain reading of the law. The court didn’t “gut” anything, it’s just a bad law. It’s up to Congress to enact a law that says what they actually want the law to do.

That's because Congress has abdicated its role and we live in a appartjik state where the executive appoints the judicial body and the judicial body legislates from the bench while the admin creates executive actions or has agencies create rules that have the weight of laws.

The system will continue to not work when Congress does not do it's job.

It gutted it, in the sense that we've been operating under an interpretation of the law for the past 20 years and this ruling changes that interpretation dramatically. The law wasn't so much badly written, as technology has completely changed in the time since then.

As an example, if this law were written today, I'm not sure that cell phones would get special status. They were put in the same category as medical emergency lines, because "radiotelephones" were very rare and expensive to operate, whereas today every 12 year old has one.

No, the law was badly written, at least if the goal is to limit all robocalling and not just robocalling using sequential or randomized numbers.

The law essentially says "it is illegal to call someone using an autodialer, where an autodialer is a device that makes calls to phone numbers using a sequential or randomized algorithm." It's pretty clear then that automatically dialing from a prepared list of actual phone numbers is not against this law. If they wanted it to cover the latter case, they could have easily included that in the law, even 20+ years ago.

I read scotusblog and an excerpt i think kagan in axios? what am I misunderstanding?

Can Congress use their franking privilege to send texts?

https://en.wikipedia.org/wiki/Franking#Franking_privilege

That particular privilege only exists for the postal service, not the 'ma bell' telecommunications network.

edit: but now I'm curious if franking privileges were ever extended to telegrams.

That's interesting. SMS wholesale prices in my part of the world (Western Europe) are still at around $0.07. This seems to indicate some kind of market failure. But whatever it is, it's fine by me, as I can still count the number of spam/scam text message I ever received on one hand.

So how can we cause the email market to fail in a similar way? ;-)

> That's interesting. SMS wholesale prices in my part of the world (Western Europe) are still at around $0.07.

Isn't it rather they was it is supposed to be? - "Everybody" uses messengers for communication. SMS has lost that battle. Whoever uses SMS does so due to a need.

That's interesting. Where I live I have unlimited text messages and minutes for €5/month. So whenever I want to text someone, I just use SMS - I don't have to think if they use Whatsapp, Messenger or something else. (Apple hijacks them but is doing so more or less transparently, so I don't mind.)

Is that true tho? Me and my friends use SMS a lot. But maybe other people don't?

I don't remember when I last sent an SMS. 99% of my SMS messages are various notifications, reminders, and 2fa codes. The remaining 1% is spam.

In the US, pretty much everyone I know uses SMS/iMessage (in addition to the use of SMS for verification, appointment reminders, etc.) The main exception is Google Chat at work because we use GSuite. Sometimes Twitter DM if I don't have someone's email handy. But I have a total of 1 friend in Europe who I use Facebook Messenger with.

I've known about this for awhile now but having only lived in countries where absolutely everyone uses a messaging app (particular app differing per country) it still baffles me every single time I hear about it.

How do you handle group chats? Especially with more than a couple of people? Is sending pictures and videos included with your plans too? If not how do you handle those? How about video calling? Sending a file e.g. an Excel file?

Let alone features like easily creating a vote/poll, a calendar event, a banner notification..

I get that most of these features may not be useful to everyone but surely they are to groups of teens and college students, demographics that have shown to often drive growth in communication apps.

We'll sometimes do SMS group chats with a small number of people. For videos, other files, scheduling video calls, etc. we mostly just use email. For video calling, we use Zoom, Google Meet, etc. I'm not sure I've ever seen someone doing a poll outside of Twitter.

For one-on-one messaging, SMS is still very alive.

No, many of my peers (30somethings in midwestern US) default to SMS. The only platforms you can guarantee everyone in a group can be expected to have are email, SMS, or phone calls, so for informal social stuff we end up in a text message thread.

Probably 80% have Facebook, 50% iMessage, 30% Discord 20% Twitter/Signal/Telegram/Whatsapp (pre-FB).

What messenger app can you depend on everyone having if not one of those three federated platforms?

You can explain to your friends that group text messages are horrible, and there are far better ways of having daily conversations with separate threads.

Nearly all of my 40 something friends from the Midwest have both telegram and discord, however telegram is primarily used as its just better on mobile. We have groups for all kinds of topics, cars, garden, tv, movies, sports, politics (ewww), etc. If you aren't interested in lawncare simply leave or mute the group in remain in touch via other mutual groups. The only guy not in the group is someone who still prefers phone calls.

I've yet to not be able to convince someone that separate threads/groups is way better than a bulk text group.

I’m not sure spammers pay wholesale rates. Pretty sure they purchase the cheapest SIM cards with unlimited texts and put them in gsm modems which spam out texts.

In Australia a SIM card can be purchased retail, with unlimited texts for $5.

At 750~ texts sent you’ve already beat that wholesale rate. That’s approximately one an hour, over the month. I’d be surprised if they couldn’t pump much larger volumes.

Wouldn't they block you or something if you send hundreds of thousands of texts to random numbers? It can't be that there isn't some kind of a monitoring system on the consumer SIM cards.

How many obvious spam text messages have you received? And how many have you reported to your telco provider....

You’re putting a lot of faith in telcos to care enough to put systems in place.

And spammers will burn through sims. They are looking for the most lax network for sending. Presumably the receiving network can block texts arriving, but wouldn’t actually stop a number on a competing network from being able to send messages (but would likely flag it to them).

And then there’s the time delay to be exploited. If it takes 3 days for a number to get blocked, can you send enough messages in that period to make it worthwhile?

> How many obvious spam text messages have you received?

Barely any, tho I get tons of "SSN been hacked" and "Lower your car insurance" scams, sometimes more than once a day.

I think the opposite is true: still quite high costs are the cause of SMS spam. If the carriers did not profit from this, they would have destroyed SMS spam as a phenomenon on the same day.

AT&T, Verizon, US Cellular and T-Mobile have all imposed fees on Application to Person SMSes, so they definitely are making more money off this: https://www.plivo.com/blog/a2p-10dlc/

For whatever reason, I find it creepy to read about other people having received the same spam that I did.

I get an infinite amount of spam texts and I don't have a Facebook account. (I did have one in college when it first came out, but I don't think I gave them my phone number, and if I did, that phone number is no longer in use. I switch phone numbers every time I switch cell providers.)

Facebook still may have your phone number if a business uploaded your phone number for targeting.

I'm sure they have plenty of information on me. I doubt that it is the primary source of spam texts, that's all I'm saying.

Many of my spam texts seem to know what state I'm in despite my area code being assigned to a different state, so I'm guessing they get them from voter records, political donations, that sort of thing.

Using WhatsApp?

Nope. It's not really a thing in the US.

I have been getting a lot of spam texts and also an unusually large spam calls from the social security administration. I tell teh guy/gal on the line every time to quit calling me because they are wasting their time and i know it's a scam, they keep calling...

I don't think the little guy that's calling you cares that much, or that the organization that runs the call center is organizaed well enough to receive a piece of information from the bottom end employee and act on it.

I feel your pain. Getting announcements from my local skating club is the only reason why I keep my FB account. :(

Why are so many HN users against Facebook, and quick to reassure others that they only signed up out of necessity? FB & Instagram present a perfectly acceptable entertainment vs privacy trade off. Sure, it’s also a waste of time, but so is everything else you don’t like.

This is a valid contrarian take.

Facebook knows where you live, where you shop, who you meet, what you say, what you buy, where you go – perhaps when you wake and sleep –… and in exchange, you get some chat rooms, a MySpace page, advertised at, and to be a non-consensual subject in psychological experiments. (Libel notice: they might not do the last one much any more.)

Most of this happens if you 1) sign up for FB 2) install their app. If you don't do both of these things they can't track you, right?

Unfortunately this is not true.

Just loading a page that has the embedded Facebook Like button generates data points on you regarding your browsing and purchase history. I'm not sure if they can/do read the contents of a checkout form, but it would be simple to infer coarse location and strong identity from that.

You don't need to read the contents of a checkout form when the company just gives you the data. (Companies upload their customer lists, so Facebook can compute “conversions”. But, of course, Facebook doesn't let companies download the data Facebook has, and compare on their end… that would be a violation of privacy!)

Even you don't sign up for FB, they keep a shadow profile on you from activity from people searching for you.

Even if you don't sign up for FB, they get your contact information from your friends. (That might just be WhatsApp, but at least one of the two gives people the "opportunity" to upload their contact list to find matches.)

Sure, FB knows a lot less about me than they could, but keeping off their radar entirely is effectively impossible.

False.

See Facebook "shadow profiles", data collected on persons either through third-party activity (though the profiled individual is on Facebook), OR on persons not using Facebook at all.

https://theconversation.com/shadow-profiles-facebook-knows-a...

https://www.dailydot.com/unclick/facebook-shadow-profiles-pr...

https://en.wikipedia.org/wiki/Shadow_profile

> ... be a non-consensual subject in psychological experiments.

This makes me think of this one fascinating/frightening prospect I sense in respect to the vast collections of data of human behaviour which the big tech corporations have: The data that Google and Facebook posess are so rich that they'd allow very insightful analyses of human behaviour. I recon there are so many small questions about why people do what they do, how their whole personalities are wired, how they influence each other through internet/analog interactions, how societies develop dynamically through which mechanisms.

Many of these questions are being studied by scientists at universities but they usually don't have the same huge/rich data sets that the internet giants have.

So Facebook & Co have a huge advantage in understanding all these things about humans over public research. But whenever they actually do some analysis and get answers, the result is by default internal knowledge that remains unknown to the public. Also, most of their analyses will be driven by commercial interest, rather than seeking anwers to philosophical questions that don't promise financial returns.

There are many questions about our world that could have been answered since years, using all this data ... but they haven't been and might never be.

Letting some big company have the power of understanding how people tick better than any other agent in the world. A thrilling prospect.

> FB & Instagram present a perfectly acceptable entertainment vs privacy trade off.

I'm glad you're here to establish this objective fact for those of us who didn't know ;-)

perfectly acceptable /s

Because the network effect reduces choice and competition. I don’t get to vote with my wallet with Facebook. I can participate in society or not have Facebook.

My mom was recently told by a state elected representative that she would have to contact them through Facebook to provide feedback on legislation. This is not a “valid tradeoff” nor does it have to do with “entertainment”.

Because this morning I tried to post a link to a Social science podcast from sage publishing and it was blocked because it violated community standards.. The topic, Unobtrusive resistance of people without formal power.. (and meanwhile on the FB watch video tab that no one asked for, "he thought she put the whole think up there XD. for entertainment only."(lady standing over coke bottle))

I deleted my Facebook after Cambridge Analytica. How is this "perfectly acceptable" in your mind? Are you not aware of the severity of this leak?

CA was a 3rd party developer that misused data users authorized them to use and it happened 10 years ago when FB was still essentially a startup. They’ve come a very long way.

Indeed - they've increased the scale of their atrocities against their own users quite a bit since then.

It’s antisocial to demand someone submit to surveillance capitalism to participate in a club or a friendship.

Complain loudly, and delete your fb account. Be a nuisance about it at club meetups.

Caving just makes it worse for the next guy.

I have also noticed this the past couple weeks. I don’t think it’s related to Facebook- I deleted my Facebook account before 2019. However, I’ve also recently had discussions with Twilio (all of the below is non-confidential information according to our conversation):

The carriers are cracking down on sms spam. They are going to force registration of all businesses sending texts, not just with services like Twilio, but with them. And prices / rent-seeking from the carriers is going up - they are going to charge for each campaign/brand you run. So in the end you’ll see less spam, but texting will also cost more for companies that send them.

The initial rollout by AT&T was supposed to start 5/1, though that’s now been pushed back. Spammers are likely in their death throes, trying to get their last spam out before they get shut down or priced out.

To get an account on Facebook, one can use an email address to sign up (no phone number), and if the email address later becomes invalid, the Facebook account still remains viable. As such, a "disposable" email address should work for the purpose of obtaining a Facebook account. One need never log in to the "throwaway" email account ever again after the Facebook account is established.

If one really wanted to use a phone number for sign up, a disposable number such as a "burner" phone should work.

Prepaid burner numbers don't work, only postpaid.

What does the email-only flow look like? Every time I've tried that I've been redirected to various kinds of "additional authorization" or "proof of identity" barriers and haven't been able to find a flow around them.

Not sure what the sign up flow looks like today. What I know is that in the past students created Facebook accounts^1 using their student email accounts. They graduated, the student email accounts were deleted, but their Facebook accounts continue to work today, even though they never updated their email addresses with Facebook or added phone numbers.

1. The website was originally created for students and sign up used to require a university email address.

There's a good discussion on this by Troy Hunt[1].

> But for spam based on using phone number alone, it's gold. Not just SMS, there are heaps of services that just require a phone number these days and now there's hundreds of millions of them conveniently categorised by country with nice mail merge fields like name and gender.[2]

> Another general observation on this incident: I'm seeing extensive sharing of the data, both the entire corpus of countries and individual country files. Not just in hacking circles, but very broadly on social media too. This data is everywhere already.[3]

> New breach: Facebook had 2.5M addresses exposed in an incident that impacted 533M subscribers' phone numbers. Most records contained name and gender, many also included DoB, location, relationship status and employer. 65% were already in @haveibeenpwned[4]

> If we look at the data, email is rare, DoB is rare so the greatest impact here is the phone numbers. Even though it’s “only” 20% of FB users, the number is obviously substantial thus so is the impact[5]

[1]: https://twitter.com/troyhunt

[2]: https://twitter.com/troyhunt/status/1378485999781613569

[3]: https://twitter.com/troyhunt/status/1378513457209696256

[4]: https://twitter.com/haveibeenpwned/status/137855490210063565...

[5]: https://twitter.com/troyhunt/status/1378474534760685568

Anyone know if Haveibeenpwned will have this type of info? I'm super curious to search my name, warn people i know, etc - but i'm not sure i want to search for and/or download the data.

What's a good way to know if myself or my loved ones are in it?

https://twitter.com/troyhunt/status/1378463581604220931

"I’ve had a heap of queries about this. I’m looking into it and yes, if it’s legit and suitable for @haveibeenpwned it’ll be searchable there shortly."

I'm sure it will be.

Seems he'll only add the records with email addresses and not phone numbers:

> And no, I have no intention of adding phone number search in the foreseeable future. There's a User Voice suggestion for that and a comment from me which boils down to "much higher work and much lower value"

Not sure how this is too much work unless everything is tightly coupled with relating an email address to everything in their database and not a keyword to search for.

Impossible to have an informed opinion while lacking all information about how the back end is designed and what the author does with their time.

Everyone likes to be an armchair architect.

just like an armchair activist as well who takes a genuine question and makes another one a villian

Was there a question? I only read assumptions

Seems the difficult work is normalizing all of the data and making it easily searchable for all:

> I also can’t parse the, out with a regex like I can an email address as they don’t adhere to a consistent format. Further, the inconsistencies in format make searching difficult as they’d have to be “normalised” and that’s something that’s very country (and even region) specific.

https://haveibeenpwned.uservoice.com/forums/275398-general/s...

https://haveibeenpwned.com/PwnedWebsites#Facebook

I created https://www.thenewseachday.com/facebook-phone-numbers-us and https://www.thenewseachday.com/facebook-phone-numbers-austra... to check if phone numbers are in the data. So far I've only made them for US and Australian numbers.

Thank you very much for this. Confirmed my number wasn't leaked. I appreciate the peace of mind.

Or this is a honeypot for phone numbers .. hmm

that's a very nice tool... would it be possible to provide details how you did this tool? (i'd like to implement the same to my country)

> Another general observation on this incident: I'm seeing extensive sharing of the data, both the entire corpus of countries and individual country files. Not just in hacking circles, but very broadly on social media too.

I made a Google search 8 hours ago. There were 10 pages hits of link spammers where you have won an Iphone, but they don't have the data. So, yes public interest seems big. I wonder why Google cannot catch those, after opening the first one I could recognize the rest from the address and the snippet. Google did not have a correct link that still had the data. Maybe they are not publishing those, getting bad reputation to big data is not exactly in their interest.

Maybe in the dark net? Anyone check this?

https://news.ycombinator.com/item?id=26682774

>65% were already in @haveibeenpwned

So is this breach related to reusing or having a weak password?

Or is it completely independent?

From my read of it, it's completely independent. The same passwords frequently show up in other breaches.

To put this in perspective, Faceboook just leaked information about, at most, 1 in every 15 people, in the world.

(Less, depending on the number of folks with multiple accounts, which FB seems to try to prevent?)

Not sure if you're trying to minimize the impact or draw attention to its severity but that is a colossal number.

This post is a nice way to put this number into perspective.

https://www.reddit.com/r/dataisbeautiful/comments/mjufnx/if_...

Not just Zuckerberg's, but Dustin Moskovitz and Chris Hughes are there as well. Interesting to see who has low user IDs in the dump.

Also mildly entertaining to see some names that are probably test accounts now associated with Facebook people in Google as people try to see who they are.

See https://twitter.com/mikko/status/1378701810815352833

Maybe 1 was an admin account and 2 & 3 were for Winkelvii.

According to this tweet, this shows the Zuck himself uses Signal: https://twitter.com/michilehr/status/1378666681451569153

Yes, that is totally Mark Zuckerberg

You must observe the competition and maybe he doesn't want his employees to be able to see what he is doing :-D

What a useless screenshot. Sure if we believe him then he actually added Zuck's number into his address book and he got this notification from Signal. But if I want to doctor a screenshot like this, I can rename my non-Signal-using friend in my address book to "Zuck", and make my friend install Signal, and voila, "Zuck is now using Signal"...

Karma?

"People just submitted it. I don't know why. They 'trust me'. Dumb f*cks."

karma for who? The people who trusted FB?

I feel for the person who gets that number next once it's recycled.

I’ll take it. “Thank you for calling the executive office complaint line. To file a priority incident at the cost of $99, enter your visa/MasterCard number now”

I look forward to your medium post about what it is like in prison.

You can’t stop someone that wants to pay to file a complaint.

Pretty sure you’ll get shut down by the networks due to chargebacks… unless you have a quick “press 9 for a refund…”

Iunno, someone that thinks they’re getting somewhere by calling Zuck directly may not know what a chargeback is.

I know Congress has tried calling upon him and just gave up.

He is providing a service to pass complaints on to Facebook. Consideration for value received. What’s illegal about that?

It's fraud.

Saying "the executive office complaint line" isn't implying it's Facebook's complaint line. There is no legal obligation for the person on the other end of a call to be who you expect.

Who would even assume that such a thing would not be outsourced if it were affiliated?

And "a priority incident" can't be a misrepresentation inasmuch as "priority" is inherently relative.

As a matter of "legal realism" people might be right that it would land you in prison if you are just Joe/Jane Schmoe. But I see absolutely no logical justification for that when companies do things at least as shady all the time without serious consequences.

I would take it and just automatically send all calls to voicemail and archive the text messages.

It will be a more modern '867-5309', however instead of people searching for love it will be a consolidation of the collective hate for a single entity/person.

Is the phone number really that big an issue? I mean here phone numbers are 8 digits, randomly guess a phone number will almost certainly result in a working number.

The spam I see and hear about is just random dialing from Albanian numbers, hoping that you’ll call back.

I've gotten a new phone number and given it back because of the amount of calls it was getting.

sure any random phone number will connect. the point is that you know WHO the number belongs to. lots and lots and lots of places use phone number for auth. as a trivial example, calling to activate a new credit card.

Isn’t that mostly you calling in and not the other way around?

It might depend on your country, but I can’t think of a single service where you’re required to make a call anymore, it’s all online. There might be a few services for the elderly and handicaped, but again that’s you calling in.

Good comment. Why do people care if their phone number gets leaked? There use to be a yellow page book with everybody’s phone number. Also, phone numbers are not identities. I change phone number every year on average.

Many people never change phone numbers. I've had the same cell phone number since I was a teenager, and I suspect I will have it until I die.

It's the most identifiable thing about me other than my social security number. Even my driver's license number has changed more than my cell phone, and I don't always have a valid passport.

Typically don't just contain phone number or email, but also some other pieces of personal information. For example in this case it included at least the Facebook user id. This can give other tidbits of info like when you established you account, about your education, about your age etc.

Determined person can use the various leaks and other data sources to collect more detailed profile of you (and millions of others). This will eventually allow them to setup more targeted and personalized spam or phishing campaigns.

This is why I call for zero-knowledge information exchange, decentralization, and genuine end-to-end encryption. The most secure data is data you don't have, and any company which claims to store data "securely" is grossly irresponsible. Even the world's largest tech companies with access to truly staggering engineering budgets can and will leak your data. It's not if: it's when.

We need to regulate this.

I’m curious to see if existing regulation in this regard has been effective. I know there is HIPAA, but does it actually reduce data leaks in the Health Care field?

You can find him on Signal now https://mobile.twitter.com/Daviey/status/1378645798439768064

I don't much care about my phone-number being leaked. Why because I don't answer my phone, unless I know who is calling. I do get lots of spam calls every day but thanks to my smart-phone spam-calls can be blocked. And if the hackers want to steal my identity, they cannot answer my phone and thus pretend to be me, can they?

Remember all phone-numbers used to be in a public book called "Phone Book".

> they cannot answer my phone and thus pretend to be me, can they?

Yes they can, they can totally do that and if they do you're screwed. https://www.theverge.com/2021/3/15/22332315/sms-redirect-fla...

Interesting. But isn't this more like something (re-routing of text-messages) that happens inside compromised telecom service-provider? If they can hack the telecom-provider they don't need to get my phone-number from Facebook.

I haven't read the article in detail, but I think the point is some versions of this attack can be carried out by pure social engineering. Go into a store, claim to be you, talk your way out of giving ID, then get a new SIM card associated with your number and walk out with it. In this case, name+number is indeed helpful info for the attack since it doesn't involve any actual "hacking" in the computer security sense.

Just putting this out there - I still haven't received any kind of message from Facebook about the breach... I'm pretty sure in some Countries they have an obligation to notify users.

in the EU, you have to notify your users about their data being compromised, otherwise you risk being sued for a LOT. Not facebook-hurting amounts, but not nothing.

I'm not on Facebook for 2years, but I'm thinking about downloading the database just to see If I'm in it. I don't care about other records. Or do I have other options to figure it out?

Edit: I forgot about haveibeenpwned.com. Any info about when they will add this leak?

Edit2: Haveibeenpwned added 2.5 million email addresses. But it's possible that my record doesn't have email.

I deactivated my FB account 3-4 years ago, not deleted. For some reason I am not in this leak. At least not in the USA file.

Thanks. I just found my backup file(exported from Facebook when I deleted the account) and it's dated September 2016, so it's actually 4.5 years. Time flies and I don't regret that decision at all!

There is a torrent you can download, I used jackett to find it

Thanks to your comment I installed jackett! Pretty interesting. I only use private trackers, can you recommend a public one to add to search for this?

I just added all public trackers

Madlad. Thanks I'll give it a go.

The 10 digit number space is completely filled up, so you can just call/text numbers at random and be almost sure it reaches someone.

So I think it's time to use UUIDs instead. They're hard to type, but you hardly ever need that.

What am I missing?

WW91IGFyZW4ndCBtaXNzaW5nIGFueXRoaW5nLiBJdHMg cGVyZmVjdGx5IG5vcm1hbCBmb3IgaWRlbnRpZmllcnMg d2hpY2ggbWF5IG5lZWQgdG8gYmUgcmVhZC93cml0dGVuI HRvIGxvb2sgbGlrZSBnaWJiZXJpc2gu

UUIDs are horrible. While a computer doesn't really care about the way an identifier looks, humans sometimes do need to look at them and operate on them (compare them, transcribe them, dictate them, recognize them).

UUIDs are a lot shorter than the gibberish you typed: 604a6a34-6d33-4148-8e75-6aee31b0d963

It is true that it's difficult to compare and transcribe.

When I opened this post, I saw it was much wider than any post I have seen on hackernews. I tried looking into the css, I thought it was somehow different, for whatever reason.

I could not find anything and then I encountered your comment. Apparently, your unbreakable long word makes the site very wide.

I didn't know comments can affect how wide the page borders are. Is this not bad UI? I am unsure who to ask.

@dang

There is a contact link in the footer too, you know.

But yeah, seems like bad UI. I would have thought overflow-wrap would be set on posts.

Sorry about that. I didn't think about the overflow effects. Alas I can't edit the post now.

It's a bug. If anyone can figure out how to fix it without breaking something else, it would be great to hear about that at hn@ycombinator.com. My CSS is too meagre.

I've added whitespace to the GP comment now.

I see what you did there.

But I think in 2021, I'd be fine with a phone "number" in UUID format, because I can always send it by computer to anyone who needs it. The added inconvenience is easily worth not getting several spam calls a day.

I wish we all had SIP and our own gateways, we could ditch the carriers, the central directories, automate the dropping of SPAM, encrypt our calls with PGP, serve our keys and end points in DNS and just take calls at our email address.

You can FaceTime call a person using their email as identifier, or use voice call button in whatever IM they're using. If all these internet communications were interconnected, we would not need phone numbers anymore.

The data is missing some people like former Facebook executive Jay Parikh. One possibility: they never put in a phone number into their Facebook account.

Does anyone know alternative places to download the data set? The original forum it was posted in is slammed.

Search for "fbleaks" on telegram

Thank you, I am now downloading all the available data, can’t wait to play around with it.

One of the annoying things is that there's a timestamp making up the 10th column that has ':' in it, but the delimiter for the fields is also ':', so it makes a clean import to a database a bit of a hassle as the file may need some processing, probably will just do a find and replace as all the time stamps seem to be 12:00:00 AM. The column holding the current employment is also problematic.

I haven't seen the data yet and there's likely a better way of doing this, but worst case - couldn't you just script replacing :00: with -00- (through :59:)? Then, if you wanted, replace ':' with a better delimiter and then replace the -00- back to :00:?

I'm assuming there's a better way w/ regex but I'm not great with regex. Could probably find that with a few minutes of google though, just replacing the pattern of :##: with -##- using numeric wildcards.

Looking for this as well.

Me too. 35 millions of italian user is really near the 100% of italian internet users. So I need to understand how many info about me and my family are on the web.

There's a magnet link somewhere in this thread

https://archived.moe/g/thread/80976828

I can say that this is interesting; the founder of Facebook itself is a victim of a leaked data. I wonder how much would it cost to buy Mark Zuckerberg's phone number?

https://twitter.com/mikko/status/1378732263266004994

Someone (or a script) flagged Ronson who had posted direct links.

I only tested the Norway link in his post but that was legit.

(I first verified with Virustotal and then thought twice before opening the zip file.)

I'm confused ... You downloaded the zip file? That's just as bad (legally) as unzipping it.

It's called research.

I need to know what I need to protect my family and in-laws against this time.

Edit:

- yes, I also immediately downloaded the "manifesto" of the mad bomber in Norway ten years ago, not because I admired him but because I despised him.

- Troy Hunt keeps downloading data sets with peoples personal details (logins even) and is not getting into any kind of newsworthy trouble.

There are things you should be very careful with, both in physics (don't hoard fissil material), chemistry (same with various poisons), biology (don't try to get hold of smallpox etc) - and data science (certain images are forbidden for what I think is good reasons), but I don't expect police to show up on my door because I have downloaded a publicly available data set and grepped relevant names from it and then forwarded the relevant lines to the ones I found.

Edit 2:

I also had a copy of MyDoom somewhere, I think on a disk that is broken now. Never got in trouble for that either despite telling people.

Maybe don't say it online under an identity that is strongly linked to a piece of meat that might be put punished ;-)

Downloading illegal data is not research, particularly if you're not a security researcher. Research has ethical boards for exactly this reason.

Those certain images you described are publicly available too. That doesn't make downloading them _legal_.

The fact is you've a dataset containing personal data of millions of people is obviously illegal -- why this didn't raise red flags in your mind is curious.

Edit: I'd certainly not expect police to kick your door in either, much like if you pirated a movie.

My point is: be careful.

Maybe Mark Zuckerberg can sue Facebook, get a handsome reward and just put it back in the company, so it all evens out in the end?

Sooo... what's the number? :-)

One could find the first half of it starting on the 14083rd digit of π, and the second half starting on the 60435th digit of π.

Speaking of halves...

If you half the number, it would be just 453,223,693 more than world population as of March 2020 according to Wikipedia’s article “World Population”.

At least Mark is dogfooding.

If this were a game of intrigue, it would provide plausible deniability for anybody who got caught with his contacts. Would have been fun to include that in the article.

Reply on news.ycombinator.com