Friday, September 28, 2018

Facebook gave advertisers the phone number you use for 2FA

Personalized ads have played a big role in making sure digital businesses have a high success rate. It is one of the biggest reasons why Facebook (and many sites like it) is a free platform. As the saying goes, free cheese is only in a mousetrap. Facebook doesn’t request a direct payment from any of the users, so that’s why someone may think that it’s free to use. But, as we already know, Facebook sells a lot of our info to advertisers. They already know our full name, birth date, parents’ names, what we like to do on the weekends, who we like to hang out with, how much time we spend on the internet, which Netflix show is our favorite, and so much more. But, there are still a lot of things that we don’t know that Facebook knows about us. Scary, right?

You can call me paranoid, but my take on privacy is like this: if I didn’t provide the information, then you shouldn’t have it. So, when Facebook hits me with ads from local startups or a coffee shop just 10 meters away from my place, I’m not even mad, because I provided that information via various ways (I filled in the living place field, turned on the location services, etc.). But, sometimes things get creepy. I’m sure every now and then you stumble upon an ad or a suggestion of something/someone that you have a connection with, but Facebook shouldn’t know that you do.

Some smarter people decided to dive deeper and found the secret ways that the company manages to find all kinds of information about you. Giridhari Venkatadri, Piotr Sapiezynski, Alan Mislove, and Elena Lucherini found out, that Facebook gives advertisers the numbers you use for two-factor authentication. To rephrase this, the secret number you used for securely logging into your account, that should’ve never been associated with it, is now no longer secure. Advertisers can use it to target you for various reasons. One of the authors of the paper, Giridhari Venkatadri, said that he was surprised to find out that Facebook is targeting ads using the information that has not been provided directly.

Kashmir Hill, who is a senior reporter at Gizmodo, also mentioned that she’s been trying to get the company to disclose shadow contact information, which is what she calls information that is provided non-directly. Hilariously, Facebook doesn’t even disclose the mentioned information in Europe, where GDPR law requires them to do so. Professor Alan Mislove says that while Facebook discloses which advertisers have our information, it should also tell us how they got it. Facebook should be a lot more transparent, that would work out for a lot of users. The company can also theoretically let you know exactly which number, email address, or any other piece of information advertisers used to target you.

The point is, your data is valuable. Neither Facebook nor any other company that claims to be free should use the information you didn’t provide, via ads or any other way possible. The whole point of using a two-factor authentication is to make sure that you’re securely logging into your account. I don’t think it’s considered as security when your own private mobile number that you chose not to share with Facebook or any other third parties is still shared anyway. Up to this day, Facebook manages to get away with what they do. The social network’s representative’s stated that they can’t explain how exactly their algorithm works. They also like blame users, who upload their contact info on the Facebook. Still, Gizmodo’s article clearly shows that even when your mobile number is only known to you, Facebook can still get a hold of it, and then give it to advertisers.

We should also mention that Facebook is not the only platform to collect the shadow contact information about the users. Instagram (which is owned by Facebook, but still), Twitter, Pinterest, and other social networks are known to use the similar methods. Their reasoning behind this is to give user’s “the best-personalized ads experience,” which translates to “we have to pay server bills and you don’t want to pay us.” Only thing I can tell you is to think twice before typing your mobile number, email address, or any other kind of identifying information, as the 21st century isn’t exactly known for being very privacy-friendly.


Source: Gizmodo

HostGator Web Hosting

0 comments:

Post a Comment