Hacker News Reader

Comment by nmeofthestate | Hacker News Reader

Facebook is saying the info was scraped, but I don't see my phone number publicly visible anywhere on Facebook, yet it's found by HIBP - any idea what they're referring to?

View on HN

I believe the data was scraped from the API endpoint that allowed looking users up by their phone number--the bot just ran every possible phone number and got back everyone who had that feature enabled. They've locked that endpoint down, but this is the fallout from that initial failure to rate limit.

One must be really dumb to allow a bot to make hundreds of millions of API requests and not noticing.

Considering in 2017 they were serving up 1.2 trillion API requests a day it's a drop in the bucket.

[0] https://developers.facebook.com/blog/post/2017/04/18/graph-a...

That's not that many API requests at Facebook's scale. Would be curious as to the rate that the requests were made; as well as how many IPs they were distributed over.

The Fappening was Find My iPhone API rate unlimited......

I've always double checked that my phone number was listed as private and yet they leaked that, so I don't buy their argument that it was scraped.

I just double checked and its set to "only me", which is what its always been. (I think I only added it because the app wanted it, but its been years since I've used the app, so don't remember)

The data is definitely not publicly scraped. I downloaded the data set. Phone number, location, date of birth etc were always private. It's possible that they have a private API that shares the data to advertisers and that might have been scraped. I created https://fbleak.com to show masked data to users to show the extent of the data leak.

FYI, https://haveibeenpwned.com says my phone is in the FB leaks, but your site says it isn't.

That’s odd. Can you let me know which country you are from ?

Australia (+61), is not in the phone dropdown?

Actually Australia was not part of the breach.

If you find discrepancies between those tools, you can go through the dataset by yourself since they are all over the internet now... I checked the set and didn't find myself in it but most if not all of my close-kin are in it.

Reply on news.ycombinator.com