Slashdot Mirror
Facebook Confirms Data Breach
another random user writes "A researcher by the name of Suriya Prakash has claimed that the majority of phone numbers on Facebook are not safe. It's not clear where he got his numbers from (he says 98 percent, while another time he says 500 million out of Facebook's 600 million mobile users), but his demonstration certainly showed he could collect countless phone numbers and their corresponding Facebook names with very little effort. Facebook has confirmed that it limited Prakash's activity but it's unclear how long it took to do so. Prakash disagrees with when Facebook says his activity was curtailed." Update: 10/11 17:47 GMT by T : Fred Wolens of Facebook says this isn't an exploit at all, writing "The ability to search for a person by phone number
is intentional
behavior and not a bug in Facebook. By default, your
privacy settings allow everyone to find you with search and friend finder
using the contact info you have provided, such as your email address and
phone number. You can modify these settings at any time from the Privacy
Settings page. Facebook has developed an extensive system for preventing the malicious
usage of our search functionality and the scenario described by the
researcher was indeed rate-limited and eventually blocked." Update: 10/11 20:25 GMT by T : Suriya Prakash writes with one more note: "Yes, it is a feature of FB and not a bug.but FB never managed to
block me; the vul was in m.facebook.com. Read my original post. Many other security researchers also confirmed the existence of this bug; FB did
not fix it until all the media coverage." Some of the issue is no doubt semantic; if you have a Facebook account that shows your number, though, you can decide how much you care about the degree to which the data is visible or findable.
Phonebook? Is that like an e-book on your phone?
Phonebooks were generally only easily available in the area you lived in and not accessable by Vlad in Minsk who wants to collect as much data as he can on you to impersonate you to a bank. Not only that , but once data is on a computer a lot of things can be automated. When its in barely readable type in a large book its a bit more effort.
Remember phone books? It used to be possible to match people with not only their phone number but their home address too.
Ah, yes! And let me tell you a story about that! I used to have a very common name. So common that according to the latest census there are 40,000 of me walking around the United States (first and last name). I have met myself (first, middle and last) four times and the second time I met myself I was 19 and he was 20 and he said to me: "Don't you ever let your name be published in the phone book" (as advice from one being raised in a major metropolis and I being raised in a very small town) and then went on to describe at length how, when he turned 18, he started receiving odd phone calls from credit card companies demanding he pay up tens of thousands of debt. After months of harassment, he finally got it all straightened out with one of the credit bureaus who then basically had to show the credit card companies that his records and the records of the real person they were looking for were completely different. The other odd thing was that the address the credit card companies had on file had the same exact abbreviations as his address in the phone book and the person had "moved" to that address right when my friend turned 18 and had his name put in the phone book.
... but I'd just as well keep as much of my life private as possible ... to avoid whatever creative scofflaw there might be out there.
Is it a common problem? Maybe not
My work here is dung.
The *only* difference between a "data breach" and their normal business model is that Facebook didn't get paid.
So this is not about breaching phone numbers data that are set to private. This is about finding publicly published phone numbers through the normal search.
Meh. Phonebooks didn't even have privacy policies back in the day.
A more valid complaint might have been the ever changing default settings and user interface "improvements" which make finding the said settings very hard.
But even then, this is not really post-worthy.
The phone book doesn't have my cell phone number, or most other peoples' cell phone numbers, but that is what Facebook has most of the time. The phone book doesn't have photos of me, my friends, and my family so as to positively identify me from anyone else in the world who might share my (relatively common) name. The phone book doesn't not allow me to find people by interest so I can find people to call and sell my products to. The phone book requires you to know pretty specifically who you are looking for in order to find them without using the trial and error method. Oh, and lastly, you know the phone book is going to list your number unless you do something about it, and many people choose not to have their number listed, Facebook was never supposed to list your number and so people gave it to them expecting it to remain private. So, while you might not care that Facebook decided to show your number, plenty of people would be bothered by it. It isn't the end of the world or anything, but to downplay it and equate it to having your number in the phone book is a just a bit crazy. Oh, and a point I nearly forgot, lots of teenagers have their cell phone numbers in their Facebook accounts, and without tackling why they shouldn't to begin with, those numbers should definitely not be available publicly.