Facebook unintentionally uploaded 1.5 million users email contacts

[Brink]

Facebook harvested the email contacts of 1.5 million users without their knowledge or consent when they opened their accounts.

Since May 2016, the social-networking company has collected the contact lists of 1.5 million users new to the social network, Business Insider can reveal. The Silicon Valley company said the contact data was "unintentionally uploaded to Facebook," and it is now deleting them.

The revelation comes after pseudononymous security researcher e-sushi noticed that Facebook was asking some users to enter their email passwords when they signed up for new accounts to verify their identities, a move widely condemned by security experts. Business Insider then discovered that if you entered your email password, a message popped up saying it was "importing" your contacts without asking for permission first.

At the time, it wasn't clear what was happening — but on Wednesday, Facebook disclosed to Business Insider that 1.5 million people's contacts were collected this way and fed into Facebook's systems, where they were used to improve Facebook's ad targeting, build Facebook's web of social connections, and recommend friends to add.

A Facebook spokesperson said before May 2016, it offered an option to verify a user's account using their email password and voluntarily upload their contacts at the same time. However, they said, the company changed the feature, and the text informing users that their contacts would be uploaded was deleted — but the underlying functionality was not.

Facebook didn't access the content of users' emails, the spokesperson added. But users' contacts can still be highly sensitive data — revealing who people are communicating with and connect to.

While 1.5 million people's contact books were directly harvested by Facebook, the total number of people whose contact information was improperly obtained by Facebook may well be in the dozens or even hundreds of millions, as people sometimes have hundreds of contacts stored on their email accounts. The spokesperson could not provide a figure for the total number of contacts obtained this way...

Read more: Facebook uploaded 1.5 million users email contacts without permission - Business Insider

 

[Brds7t7]

Colour me shocked! (He said sarcastically)

 

[Brink]

(Update on April 18, 2019 at 7AM PT: Since this post was published, we discovered additional logs of Instagram passwords being stored in a readable format. We now estimate that this issue impacted millions of Instagram users. We will be notifying these users as we did the others. Our investigation has determined that these stored passwords were not internally abused or improperly accessed).

Read more: Keeping Passwords Secure | Facebook Newsroom

 

[ranett]

Colour me shocked! (He said sarcastically)

Wasn't this the same group who wanted user's banking records?:sarc:

 

[iNiffy]

What Kind Of Information

What kind of information is on the user contacts?

 

[townsbg]

How do they unintentionally do that? Also how does gathering email addresses help them with targeted ads? They want to collect more and more information about us.

 

[Brds7t7]

What kind of information is on the user contacts?

Depends on what the user decides to add to each contact. But could include home numbers, mobile numbers, addresses, email addresses, IM usernames.

I don't know how much of the contact info was uploaded though, but knowing Facebook it would be everything.

 

[file3456]

Glad I ditched that platform of crap. But it seems a lot of Apps you install communicate behind your back to Facebook so I've read.

 

[Brds7t7]

I joined it in 2008 (I think), and ditched it around 2014. Absolutely no regrets at all. The people I keep in touch with have other ways of contacting me anyway.
I never installed any Facebook apps on my phone anyway. Too many permissions. I just used the mobile or desktop websites (with some privacy extensions installed).

While I did have my privacy locked down on there, I didn't install any apps on it, never connected other accounts to Facebook, and shared zero of my private life on it - I still regret ever opening a Facebook account!

 

[goodlad]

use FB only for my work purposes & I have an habit of setting unique password for each & every single social media site & others. So even if someone cracks it, not an big issue, I don't use it for something that needs secrecy.

 

[file3456]

But it seems a lot of Apps you install communicate behind your back to Facebook so I've read.

What I meant by this is that I read an article that certain Apps you install or damn near all Apps you install communicate to Facebook. Whether you have a Facebook account or not. I can't find the damn article now though Google.

 

[goodlad]

What I meant by this is that I read an article that certain Apps you install or damn near all Apps you install communicate to Facebook. Whether you have a Facebook account or not. I can't find the damn article now though Google.

do you mean the apps on smart phone or the apps on general pc/laptop too ?


Call me old school, I don't have an smart phone & have no intention of buying one either, so it shouldn't bother to me if its apps on phone. I'm happy with my feature phone - I don't need fancy stuff, just a phone to call someone in emergency or someone to call when needed.

 

[Alejandro85]

What I meant by this is that I read an article that certain Apps you install or damn near all Apps you install communicate to Facebook. Whether you have a Facebook account or not. I can't find the damn article now though Google.

This is absolute true and a widely used spyware tactic. The point is that any website or program that uses a FB plugin/button/link/whatever ends up submitting some info to it, even when it's totally unrelated and regardless of the user's usage of FB. Most links, buttons, the typical "follow me on ......" actually do some data harvesting under the hood in addition to their visual purpose. Facebook, Google, Twitter, LinkedIn, and probably many others do the same on some scale.

For a practical example of this, the mere fact of opening SevenForums (logged in or not) publishes some of our private data to Google servers, "courtesy" of Google Analytics. You can see those in your browser development tools.

 

[Barman58]

I have for a long time treated FB as Malware, if you make this choice you do appear to have less issues

 

[spc3rd]

Call me old school, I don't have an smart phone & have no intention of buying one either, so it shouldn't bother to me if its apps on phone. I'm happy with my feature phone - I don't need fancy stuff, just a phone to call someone in emergency or someone to call when needed.

Same here. Been using the original Samsung Convoy flip phone for a number of years now, and also have no inclination toward upgrading to an Android or some other variety of Smartphone.

 

[file3456]

do you mean the apps on smart phone or the apps on general pc/laptop too ?

On a phone.

And for a long time "Apps" (applications) were called programs on a computer. Now the two are confused.

 

[goodlad]

Same here. Been using the original Samsung Convoy flip phone for a number of years now, and also have no inclination toward upgrading to an Android or some other variety of Smartphone.

haha, so have someone like me thousands of miles apart :roflmao: I'm using Nokia though, N72 - its been around 10 odd years since I got it, if I recall correctly. I had motorola flip phone prior to that - don't recall the model name, had to replace it after screen got spoiled due to rain water - service center told me, you could buy a new phone for the same price instead

On a phone.

And for a long time "Apps" (applications) were called programs on a computer. Now the two are confused.

yep usually when I used to hear apps I thought it was a mobile automatically but now people who use laptop/computer, have started referring to programs as apps as well

 

[blue skies]

yep usually when I used to hear apps I thought it was a mobile automatically but now people who use laptop/computer, have started referring to programs as apps as well

Ugh. I hate that!! To me, apps are the simple little applications made for smart phones and tablets, and programs are for laptops and PCs. It really bugs me when people call computer programs "apps" even though they are of course applications.

 

[RoWin7]

I remember this. I don't use FB, but I was getting email invitations from (real life) friends who were members. Email was supposedly sent out by them, but really just form letters with their name added on.

 

[RoWin7]

use FB only for my work purposes & I have an habit of setting unique password for each & every single social media site & others. So even if someone cracks it, not an big issue, I don't use it for something that needs secrecy.

But do you have an email directory attached to that account? That's what they were hacking.