{"id":11001,"date":"2020-02-24T19:04:00","date_gmt":"2020-02-24T12:04:00","guid":{"rendered":"https:\/\/news.adeptasiaconsulting.com\/?p=11001"},"modified":"2020-03-21T01:31:34","modified_gmt":"2020-03-20T18:31:34","slug":"facebook-wont-let-you-opt-out-of-its-phone-number-look-up-setting","status":"publish","type":"post","link":"https:\/\/news.adeptasiaconsulting.com\/facebook-wont-let-you-opt-out-of-its-phone-number-look-up-setting\/","title":{"rendered":"Facebook wont let you opt-out of its phone number look up setting"},"content":{"rendered":"
\n

Users are complaining that the phone number Facebook <\/a> hassled them to use to secure their account with two-factor authentication has also been associated with their user profile \u2014 which anyone can use to \u201clook up\u201d your profile.<\/p>\n

Worse, Facebook doesn\u2019t give you an option to opt-out.<\/p>\n

Last year, Facebook was forced to admit that after months of pestering its users<\/a> to switch on two-factor by signing up their phone number, it was also using those phone numbers<\/a> to target users with ads. But some users are finding out just now that Facebook\u2019s default setting allows everyone \u2014 with or without an account \u2014 to look up a user profile based off the same phone number previously added to their account<\/span>. <\/span><\/p>\n

The recent hubbub began today after a tweet<\/a> by Jeremy Burge blew up, criticizing Facebook\u2019s collection and use of phone numbers, which he likened to \u201ca unique ID that is used to link your identity across every platform on the internet.\u201d<\/p>\n

\n
\n

For years Facebook claimed the adding a phone number for 2FA was only for security. Now it can be searched and there’s no way to disable that. pic.twitter.com\/zpYhuwADMS<\/a><\/p>\n

\u2014 Jeremy Burge 🐥🧿 (@jeremyburge) March 1, 2019<\/a><\/p><\/blockquote>\n

Although you can hide your phone number<\/a> on your profile so nobody can see it, it\u2019s still possible to \u201clook up\u201d user profiles in other ways, such as \u201cwhen someone uploads your contact info to Facebook from their mobile phone,\u201d according to a Facebook help article<\/a>. It\u2019s a more restricted way than allowing users to search for user profiles using a person\u2019s phone number, which Facebook restricted last year after admitting \u201cmost\u201d users had<\/a> their information scraped.<\/p>\n

Facebook gives users the option of allowing users to \u201clook up\u201d their profile using their phone number to \u201ceveryone\u201d by default, or to \u201cfriends of friends\u201d or just the user\u2019s \u201cfriends.\u201d<\/p>\n

But there\u2019s no way to hide it completely.<\/p>\n

Security expert and academic Zeynep Tufekci said in a tweet<\/a>: \u201cUsing security to further weaken privacy is a lousy move \u2014 especially since phone numbers can be hijacked to weaken security,\u201d referring to SIM swapping<\/a>, where scammers impersonate cell customers to steal phone numbers and break into other accounts.<\/p>\n

\n
\n

See thread! Using security to further weaken privacy is a lousy move\u2014especially since phone numbers can be hijacked to weaken security. Putting people at risk. What say you @facebook<\/a>? https:\/\/t.co\/9qKtTodkRD<\/a><\/p>\n

\u2014 zeynep tufekci (@zeynep) March 2, 2019<\/a><\/p><\/blockquote>\n

Tufekci\u2019s argued that users can \u201cno longer keep keep private the phone number that [they] provided only for security to Facebook.\u201d<\/p>\n

Facebook spokesperson Jay Nancarrow told TechCrunch that the settings \u201care not new,\u201d adding that, \u201cthe setting applies to any phone numbers you added to your profile and isn\u2019t specific to any feature.\u201d<\/p>\n

Gizmodo reported last year<\/a> that Facebook uses that when a user gives Facebook a phone number for two-factor, it \u201cbecame targetable by an advertiser within a couple of weeks.\u201d And, if a user doesn\u2019t like it, they can set up two-factor without using a phone number \u2014 which hasn\u2019t been mandatory for additional login security<\/a> since May 2018.<\/p>\n

Even if users haven\u2019t set up two-factor, there are well documented cases of users having their phone numbers collected by Facebook, whether the user expressly permitted it or not. In 2017, one reporter for The Telegraph described her alarm at the \u201clook up\u201d feature<\/a>, given she had \u201cnot given Facebook my number, was unaware that it had found it from other sources, and did not know it could be used to look me up.\u201d<\/p>\n

To the specific concerns by users, Facebook said: \u201cWe appreciate the feedback we\u2019ve received about these settings and will take it into account.\u201d<\/p>\n

Concerned users should switch their \u201clook up\u201d settings<\/a> to \u201cFriends\u201d to mitigate as much of the privacy risk as possible.<\/p>\n

When asked specifically if Facebook will allow users to users to opt-out of the setting, Facebook said it won\u2019t comment on future plans. And, asked why it was set to \u201ceveryone\u201d by default, Facebook said the feature makes it easier to find people you know but aren\u2019t yet friends with.<\/p>\n

Others criticized Facebook\u2019s move to expose phone numbers to \u201clook ups,\u201d calling it \u201cunconscionable.\u201d<\/a><\/p>\n

Alex Stamos, <\/a> former chief security officer and now adjunct professor at Stanford University, also called out the practice<\/a> in a tweet. \u201cFacebook can\u2019t credibly require two-factor for high-risk accounts without segmenting that from search and ads,\u201d he said.<\/p>\n

Since Stamos left Facebook in August<\/a>, Facebook has not hired a replacement chief security officer.<\/p>\n

\n

Facebook\u2019s weapon amid chaos and controversy: misdirection<\/a><\/p><\/blockquote>\n