Facebook Graph Search Let Dev Scrape Thousands of Public Phone Numbers

It face like allour Graph Search privacy concernsweren’t just the ravings of a paranoid , tinfoil - hat - wearing hothead . Using Facebook ’s Modern comprehensive search prick , a tricksy piddling dev was able to collect a database holding thousands of Facebook exploiter ’ personal phone numbers .

https://gizmodo.com/how-to-lock-down-your-facebook-privacy-now-that-graph-s-5986399

While the identification number of useable , identifiable phone numbers pass on the thousands , Brandon Copley , the Dallas developer who exposed this major defect in Facebook ’s privacy controls , was actually able to download 2.5 million different entries . Many of these , though , were either dormant or “ not unite to a Facebook user with public options . ”

Hostinger Coupon Code 15% Off

Copley ’s extensive hacking , though discomforting , was supposedly executed with a seemingly noble end — he want to expose Facebook ’s rampant availability of info as an invasion of its users ’ seclusion . Naturally , Facebook take issue , tell Tech Crunch :

Your privacy mise en scene regularise who can encounter you with search using the contact info you have provide , such as your email address and telephone set number . you may modify these place setting at any prison term from the Privacy options Sir Frederick Handley Page .

Copley first identified the vulnerability when he incur goods that had been slip from him listed on Craigslist . By entering the listing ’s phone number into Graph Search , he was easily able to give chase down the criminal . But while this assist him , he recognized how easy it might be to scrape the social web and put together a database . Upon sending in his headache to Facebook , a penis of the surety team reply :

Burning Blade Tavern Epic Universe

I agree with you personally . We do have antiscraping protection ( ratelimiting , bad ip blocks , etc ) but it comes down to multitude operate their privacy , we can make the privacy tool usable and we can encourage them to use them but we could never just flip their privacy circumstance for them . So there is not much more we can do .

Deciding to take matter into his own hands at this point , Copley decided to“show them how a ‘ characteristic ’ like this is a security fault . ” As a Facebook developer , he was able to habituate his access tokens along with the Facebook Search API to do thousands of searches a day with the API relic of a non - rate - limited app . Facebook then sent him a cease and desist letter claiming that he was “ unlawfully acquiring Facebook user data , ” but the truth of the subject is , every part of data point Copley ended up with had been set to public — often by nonremittal .

All this is coming in the backwash of another Facebook seclusion scare just last Friday , in whicha post on Facebook ’s security blogrevealed that it had been exposing physical contact information for six million substance abuser , entirely unawares . While that bug has been closed , we ’ll have to waitress and see what follow of this particular revealing by Copley . Though if this bevy of privacy concerns is any indication , there are certainly more to come . [ Tech Crunch ]

Ideapad3i