Slashdot Mirror
Facebook Confirms Data Breach
another random user writes "A researcher by the name of Suriya Prakash has claimed that the majority of phone numbers on Facebook are not safe. It's not clear where he got his numbers from (he says 98 percent, while another time he says 500 million out of Facebook's 600 million mobile users), but his demonstration certainly showed he could collect countless phone numbers and their corresponding Facebook names with very little effort. Facebook has confirmed that it limited Prakash's activity but it's unclear how long it took to do so. Prakash disagrees with when Facebook says his activity was curtailed." Update: 10/11 17:47 GMT by T : Fred Wolens of Facebook says this isn't an exploit at all, writing "The ability to search for a person by phone number
is intentional
behavior and not a bug in Facebook. By default, your
privacy settings allow everyone to find you with search and friend finder
using the contact info you have provided, such as your email address and
phone number. You can modify these settings at any time from the Privacy
Settings page. Facebook has developed an extensive system for preventing the malicious
usage of our search functionality and the scenario described by the
researcher was indeed rate-limited and eventually blocked." Update: 10/11 20:25 GMT by T : Suriya Prakash writes with one more note: "Yes, it is a feature of FB and not a bug.but FB never managed to
block me; the vul was in m.facebook.com. Read my original post. Many other security researchers also confirmed the existence of this bug; FB did
not fix it until all the media coverage." Some of the issue is no doubt semantic; if you have a Facebook account that shows your number, though, you can decide how much you care about the degree to which the data is visible or findable.
A friend sent me an email a couple of years ago saying "Did you know that you have your phone number on FaceBook?". I said "Yes, I also have it in the phonebook".
Remember phone books? It used to be possible to match people with not only their phone number but their home address too.
One giant privacy breach anyway. I mean seriously, they churn your personal lives into gold.
Not much right now, but SOMEDAY they will churn your personal lives into gold.
Its a new one on me to have an infected phone number. I guess they mean "not secret".
And who cares? Ever heard of phone directories? You can find millions of phone numbers in there. Including mine. Phone spammers have lists anyway or just have dialers that try every number in a range till one answers.
It would be really interesting, as a kind of control group, to ask a statistically represented sample of people how alarmed they are, on the basis of 1-10, about the following: 1) Their name is in the phone book, 2) The government has their Social Security Number, 3) Their face is recognizable by the bank ATM camera, 4) their neighbor has a X% chance of receiving their mail in the wrong mailbox. Throw in the word "breach" and watch the fur fly.
Gently reply
Phonebooks were generally only easily available in the area you lived in and not accessable by Vlad in Minsk who wants to collect as much data as he can on you to impersonate you to a bank. Not only that , but once data is on a computer a lot of things can be automated. When its in barely readable type in a large book its a bit more effort.
Remember phone books? It used to be possible to match people with not only their phone number but their home address too.
Ah, yes! And let me tell you a story about that! I used to have a very common name. So common that according to the latest census there are 40,000 of me walking around the United States (first and last name). I have met myself (first, middle and last) four times and the second time I met myself I was 19 and he was 20 and he said to me: "Don't you ever let your name be published in the phone book" (as advice from one being raised in a major metropolis and I being raised in a very small town) and then went on to describe at length how, when he turned 18, he started receiving odd phone calls from credit card companies demanding he pay up tens of thousands of debt. After months of harassment, he finally got it all straightened out with one of the credit bureaus who then basically had to show the credit card companies that his records and the records of the real person they were looking for were completely different. The other odd thing was that the address the credit card companies had on file had the same exact abbreviations as his address in the phone book and the person had "moved" to that address right when my friend turned 18 and had his name put in the phone book.
... but I'd just as well keep as much of my life private as possible ... to avoid whatever creative scofflaw there might be out there.
Is it a common problem? Maybe not
My work here is dung.
The *only* difference between a "data breach" and their normal business model is that Facebook didn't get paid.
"Facebook has confirmed that it limited the Prakash's activity". -- What is "the Prakash"?
"Prakash disagrees with when Facebook says". -- That phrasing doesn't feel right to me either.
So this is not about breaching phone numbers data that are set to private. This is about finding publicly published phone numbers through the normal search.
Meh. Phonebooks didn't even have privacy policies back in the day.
A more valid complaint might have been the ever changing default settings and user interface "improvements" which make finding the said settings very hard.
But even then, this is not really post-worthy.
I grudgingly use Facebook (Forcebook, Farcebook, Facebroke, Facebork) because so many of my real friends from overseas postings here and there can be found on it. They move around, too, and, well, it just makes sense.. My Android phone just offered me the opportunity to install the FB app when I checked an email message from Facebook -- A friend request from a German pal of mine from my days in Armenia (See?) He's in Uraguay it seems. Well, when I was ready to do the install I read the permissions list.Holy privacy invasion, Batman! It was going to do all the crap I painstakingly don't let the creepy site do on my web browser (it is a battle). And then it was going track my location to boot.
Bondsbw, you so gave them permission to have your phone when you installed that app. Moreover, you also gave them permission to marry your firstborn child off to the evil sorcerer Zuck when he or she comes of age. (The sorcerer swings both ways.) Oh, I forgot F*ckedbook.
"No fear. No envy. No meanness." Liam Clancy
I hope I don't sound trollish, but it is ultimate your responsibility to safegaurd information you don't want passed around. Reliance on Facebook to safegaurd your stuff implies they care about a few phone numbers, or private photos, or whatever. They don't. They'll write some form letter to everyone and apologize and then go back to fretting about their stock price.
At Facebook you the product for sale. As long as you keep coming back they don't have a problem.
That's hilarious. I suppose the real criminal NEVER would have signed paperwork swearing he wasn't the real criminal.
I verified that my mobile number is set to be visible to myself only. I then used a fake facebook account that I keep around, and searched for my phone number. Sure enough, my account showed up. If I try to remove it, I'm informed that I will no longer be able to use that phone to do anything with Facebook. I removed it anyway, and so far, Facebook is still returning my account when I search for my cell number.
Businessweek: What's possible at a billion-plus users that wasn't possible at, say, 500 million?
Mark Zuckerberg: There are two ways that I look at this. There's what we can build internally and then there's what can be built externally using Facebook. I'll start with the external stuff... when we were at half a billion people, you got these large-scale services like Skype or Netflix (NFLX) that also had big user bases. And we weren't yet at the point where the majority of their users were Facebook users, so they couldn't really rely on us as a piece of critical infrastructure for registration. A lot of startups did, but the bigger companies couldn't. Now really everyone can start to rely on us as infrastructure.
http://www.businessweek.com/printer/articles/74456-facebooks-next-billion-a-q-and-a-with-mark-zuckerberg
The problem isn't that the data exists. (As others are pointing out with phonebook analogies.) The problem is that the data--your data--isn't safe. Not that it's totally safe anywhere, but FB seems to have had more than their share of problems.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Remove your number from Facebook listings (easy done) and write the administrators with a tort-actionable letter stating they have seven days to remove it from their database (not so easy; you will have to be prepared to take it to small claims court to action the tort, which in the UK is £5000 so make the option a claim for £4999.90. If you do end up taking a claim, you will likely get a summary judgment in favour since you made a legal request to a company, who are very unlikely to send a representative to challenge it. International borders be damned, they do not exist; when a company trades in the UK they play by UK rules or they fuck off.
Operation Guillotine is in effect.