Slashdot Mirror
Facebook Confirms Data Breach
another random user writes "A researcher by the name of Suriya Prakash has claimed that the majority of phone numbers on Facebook are not safe. It's not clear where he got his numbers from (he says 98 percent, while another time he says 500 million out of Facebook's 600 million mobile users), but his demonstration certainly showed he could collect countless phone numbers and their corresponding Facebook names with very little effort. Facebook has confirmed that it limited Prakash's activity but it's unclear how long it took to do so. Prakash disagrees with when Facebook says his activity was curtailed." Update: 10/11 17:47 GMT by T : Fred Wolens of Facebook says this isn't an exploit at all, writing "The ability to search for a person by phone number
is intentional
behavior and not a bug in Facebook. By default, your
privacy settings allow everyone to find you with search and friend finder
using the contact info you have provided, such as your email address and
phone number. You can modify these settings at any time from the Privacy
Settings page. Facebook has developed an extensive system for preventing the malicious
usage of our search functionality and the scenario described by the
researcher was indeed rate-limited and eventually blocked." Update: 10/11 20:25 GMT by T : Suriya Prakash writes with one more note: "Yes, it is a feature of FB and not a bug.but FB never managed to
block me; the vul was in m.facebook.com. Read my original post. Many other security researchers also confirmed the existence of this bug; FB did
not fix it until all the media coverage." Some of the issue is no doubt semantic; if you have a Facebook account that shows your number, though, you can decide how much you care about the degree to which the data is visible or findable.
A friend sent me an email a couple of years ago saying "Did you know that you have your phone number on FaceBook?". I said "Yes, I also have it in the phonebook".
Remember phone books? It used to be possible to match people with not only their phone number but their home address too.
Well, I'm safe. I tried fb for a year or so, never really did do anthing much on it. Sorry for the millions who do. I'm very sad. Very very.... sa-aad.
One giant privacy breach anyway. I mean seriously, they churn your personal lives into gold.
Not much right now, but SOMEDAY they will churn your personal lives into gold.
Its a new one on me to have an infected phone number. I guess they mean "not secret".
And who cares? Ever heard of phone directories? You can find millions of phone numbers in there. Including mine. Phone spammers have lists anyway or just have dialers that try every number in a range till one answers.
It would be really interesting, as a kind of control group, to ask a statistically represented sample of people how alarmed they are, on the basis of 1-10, about the following: 1) Their name is in the phone book, 2) The government has their Social Security Number, 3) Their face is recognizable by the bank ATM camera, 4) their neighbor has a X% chance of receiving their mail in the wrong mailbox. Throw in the word "breach" and watch the fur fly.
Gently reply
Why should I trust any random person off the street any less than I trust the Zuck?
"another random user" is, if I remember correctly, an actual users name. I've had a couple of stories posted where my user name is up there but is not a link. It sometimes happens like here
http://slashdot.org/submission/2281279/microsoft-calls-for-5b-investment-in-us-education
Watch those corners
I don't get why people give Facebook their real phone numbers, even if it's supposedly only visible to friends. Any "friends" should already have your number, and if they don't they can ask.
It's crazy how much the world has changed. When I was using the Internet in the 1990, there was a golden rule among pretty much everyone I knew that you do not give real names or personal information to any entity on the Internet for any reason whatsoever.
Wow times have changed! Here [company who specializes in marketing], have all my contact information for free!
Either people are incredibly dense, or they LIKE being spoon-fed ideas and marketing material.
Or is that redundant?
Lacking <sarcasm> tags,
Looks like someone's just pissed that Facebook didn't pay out for their "vulnerability" discovery.
Phonebooks were generally only easily available in the area you lived in and not accessable by Vlad in Minsk who wants to collect as much data as he can on you to impersonate you to a bank. Not only that , but once data is on a computer a lot of things can be automated. When its in barely readable type in a large book its a bit more effort.
Remember phone books? It used to be possible to match people with not only their phone number but their home address too.
Ah, yes! And let me tell you a story about that! I used to have a very common name. So common that according to the latest census there are 40,000 of me walking around the United States (first and last name). I have met myself (first, middle and last) four times and the second time I met myself I was 19 and he was 20 and he said to me: "Don't you ever let your name be published in the phone book" (as advice from one being raised in a major metropolis and I being raised in a very small town) and then went on to describe at length how, when he turned 18, he started receiving odd phone calls from credit card companies demanding he pay up tens of thousands of debt. After months of harassment, he finally got it all straightened out with one of the credit bureaus who then basically had to show the credit card companies that his records and the records of the real person they were looking for were completely different. The other odd thing was that the address the credit card companies had on file had the same exact abbreviations as his address in the phone book and the person had "moved" to that address right when my friend turned 18 and had his name put in the phone book.
... but I'd just as well keep as much of my life private as possible ... to avoid whatever creative scofflaw there might be out there.
Is it a common problem? Maybe not
My work here is dung.
As a truly anonymous and mostly coward user, I did notice and was a irked by that.
I'm both amazed and vexed at the current trend of using "random" for very disparate meanings. Oh well, that's how language evolves, I suppose.
I may answer the phone, and in general, talking to me on the phone is usually unpleasant, even bordering on unsafe.
The *only* difference between a "data breach" and their normal business model is that Facebook didn't get paid.
"Facebook has confirmed that it limited the Prakash's activity". -- What is "the Prakash"?
"Prakash disagrees with when Facebook says". -- That phrasing doesn't feel right to me either.
Curses! I [_______] a couple of [________] there.
I don't have my face in the book. I must be a sociopath serial killer.
So this is not about breaching phone numbers data that are set to private. This is about finding publicly published phone numbers through the normal search.
Meh. Phonebooks didn't even have privacy policies back in the day.
A more valid complaint might have been the ever changing default settings and user interface "improvements" which make finding the said settings very hard.
But even then, this is not really post-worthy.
Where you could look up a phone number given an address?
Best Slashdot Co
How else should I get hold of Lady Gaga's private mobile number?
Several people on here are bringing up the phone book parallel, but it doesn't really fit. Many of us are not listed in the phone book. For that matter, millions of people are unlisted, but give their mobile number to Facebook in order to receive updates or due to their security questions. These people (unfortunately) think their number is still unlisted and private due to their account settings, unaware how easy it is to get access to that information.
Point is, if put your number in the phone book, you expect it to be public. If you have an unlisted number and think your number is private, then it's going to be an awful shock when you find out your number is splattered across the Internet.
I grudgingly use Facebook (Forcebook, Farcebook, Facebroke, Facebork) because so many of my real friends from overseas postings here and there can be found on it. They move around, too, and, well, it just makes sense.. My Android phone just offered me the opportunity to install the FB app when I checked an email message from Facebook -- A friend request from a German pal of mine from my days in Armenia (See?) He's in Uraguay it seems. Well, when I was ready to do the install I read the permissions list.Holy privacy invasion, Batman! It was going to do all the crap I painstakingly don't let the creepy site do on my web browser (it is a battle). And then it was going track my location to boot.
Bondsbw, you so gave them permission to have your phone when you installed that app. Moreover, you also gave them permission to marry your firstborn child off to the evil sorcerer Zuck when he or she comes of age. (The sorcerer swings both ways.) Oh, I forgot F*ckedbook.
"No fear. No envy. No meanness." Liam Clancy
A friend sent me an email a couple of years ago saying "Did you know that you have your phone number on FaceBook?". I said "Yes, I also have it in the phonebook".
Except that you can opt-out form the phonebook with an unlisted number. Facebook harvests your phone number and your contacts phone numbers, names email addresses. Potentially they can access IMEI, record sound and take pictures at any time (not just when you click a button), manage your accounts (not sure if they can retrieve anything from other accounts like email etc...)
Who cares?
I hope I don't sound trollish, but it is ultimate your responsibility to safegaurd information you don't want passed around. Reliance on Facebook to safegaurd your stuff implies they care about a few phone numbers, or private photos, or whatever. They don't. They'll write some form letter to everyone and apologize and then go back to fretting about their stock price.
At Facebook you the product for sale. As long as you keep coming back they don't have a problem.
This reminds me of when the FBI visited my grandfather because he had the same name as some mafia guy who happened to live nearby. I remember him having to sign paperwork swearing he wasn't the same guy as the criminal. lol Crazy stuff! This was in the late 80s, btw.
"Never give up, for that is just the time and place when the tide will change." -Harriet Beecher Stowe ^_^
the majority of phone numbers on Facebook are not safe
Is this a viral campaign for another awful horror movie? If you call these unsafe numbers you'll die within 24 hours, that kinda thing?
systemd is Roko's Basilisk.
Oh wait, no it doesn't. Plus you have to actively search for people rather than just skimming off data while following links between user pages.
I verified that my mobile number is set to be visible to myself only. I then used a fake facebook account that I keep around, and searched for my phone number. Sure enough, my account showed up. If I try to remove it, I'm informed that I will no longer be able to use that phone to do anything with Facebook. I removed it anyway, and so far, Facebook is still returning my account when I search for my cell number.
They weren't so much upset about the data breach as they were that Prakash did not pay for it.
Proverbs 21:19
because I can.
if this is supposed to be a new economy, how come they still want my old fashioned money?
how-to-hack.us
Free stuff added daily :)
Facebook has confirmed that it limited the Prakash's activity but it's unclear how long it took to do so.
Am I the only one who thinks this was not the right response here? It seems like it would be far better to fix the damn vulnerability rather than blocking the guy who reported it...
Businessweek: What's possible at a billion-plus users that wasn't possible at, say, 500 million?
Mark Zuckerberg: There are two ways that I look at this. There's what we can build internally and then there's what can be built externally using Facebook. I'll start with the external stuff... when we were at half a billion people, you got these large-scale services like Skype or Netflix (NFLX) that also had big user bases. And we weren't yet at the point where the majority of their users were Facebook users, so they couldn't really rely on us as a piece of critical infrastructure for registration. A lot of startups did, but the bigger companies couldn't. Now really everyone can start to rely on us as infrastructure.
http://www.businessweek.com/printer/articles/74456-facebooks-next-billion-a-q-and-a-with-mark-zuckerberg
The problem isn't that the data exists. (As others are pointing out with phonebook analogies.) The problem is that the data--your data--isn't safe. Not that it's totally safe anywhere, but FB seems to have had more than their share of problems.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Somebody told me many people are commenting here :P .. Guys any technical questions and any comments can be made here :P and I would relpy directly
-- Suriya Prakash
I know how trolls are gonna get mad saying this is fake ... soooo here---> https://twitter.com/SuriyaMe/status/256448898258833408
Remove your number from Facebook listings (easy done) and write the administrators with a tort-actionable letter stating they have seven days to remove it from their database (not so easy; you will have to be prepared to take it to small claims court to action the tort, which in the UK is £5000 so make the option a claim for £4999.90. If you do end up taking a claim, you will likely get a summary judgment in favour since you made a legal request to a company, who are very unlikely to send a representative to challenge it. International borders be damned, they do not exist; when a company trades in the UK they play by UK rules or they fuck off.
Operation Guillotine is in effect.
> I verified that my mobile number is set to be visible to myself only. I then used
> a fake facebook account that I keep around, and searched for my phone number.
So you set up a Facebook account as Jane Doe with phone number 123-456-789-0000. However, several of your real-life friends have you under that number in their cellphone contacts as John Smith. Those friends have Facebook accounts, and their mobile phone contacts get scraped. Now Facebook knows you're lying, and they can connect that account with your real name.
I read about people who get freaked out, because minutes after joining Facebook, they get a long list of "people you may know" that they do actually know.
I don't do Fecesbook, but I probably have a profile anyways, according to a former Facebook employee... http://www.dailymail.co.uk/sciencetech/article-2165543/Facebooks-Dark-Profiles-twisted-genius-Mark-Zuckerbergs-quest-total-domination.html
> She claims that in Autumn 2006 everyone at the company was so convinced that
> Facebook was something that everyone should have that when the product team
> created an experimental feature called dark profiles in 2006, nobody even flinched.
> People can be tagged in Facebook photos even if they do not have a profile, and the idea
> was to create a 'dark' version which could apparently be activated if they finally signed up.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
twist on something. But then some person points out that someone got there before you. Well, sort of. Ha ha. Thanks for that link. That's funny.
"No fear. No envy. No meanness." Liam Clancy
"The ability to search for a person by phone number is intentional behavior and not a bug in Facebook.
"It' s not a bug, it's a feature." I've used this excuse many times - it's an indispensable tool for any software developer. After all, sometimes it goes unchallenged, and you get out of doing actual work.
Sorry, posting AC here for a reason...
I'm not saying it's good or bad (hey, let's start a flamewar!!), but due to the kind of work I do & the circles I swim around, I know of 2 very well-known, high-power attorneys in New York who are already preparing to file against Facebook.
I'm not saying Facebook is already headed down the MySpace rabbit hole, but Mr. Zuckerberg and Mrs. Sandberg might want to try to get out in front of this.