Facebook's phonebook fiasco

Want to find the phone numbers of all your friends and some strangers, too? Just look inside your Facebook contacts page.

By Dan Tynan  2 comments

Who are all these people, and what are their phone numbers doing on my Facebook contacts page? That’s the question I am now asking.

I have 987 Facebook friends, some of whom I actually know. A handful of them are on my Android phone. Most if not all of the contacts inside my mobile phone are now listed in Facebook – as well as numbers for things like the pizza joint down the street, which doesn’t have a Facebook page.

You know how it goes on Facebook – somebody you don’t know asks to be your friend, you look over their friends list, decide they probably aren’t an axe murderer or a Tea Party member, and you say Yes, because Facebook is a fairly low risk, low maintenance connection. And if they prove to be truly annoying you can always block or defriend them later.

The vast majority of these people did not voluntarily give me their phone numbers. Some probably would if I asked, others might decline. But Facebook just gave me all their numbers – no questions asked. Apparently it’s because they elected to share their contact information with the world, so Facebook took the next step and added their info to my list.

Want to see for yourself? Launch Facebook, click Account and then Edit Friends, then select Contacts from the menu on the left. You should see a long list of profile pictures with phone numbers attached.

My Facebook phonebook: Who are all these people?

It gets weirder. There are also people whom I do not know, who are not in my Android phone’s contact list, with whom I share no connection whatsoever and have no friends in common, who are in my Facebook phone book. Now Facebook is asking if I want to friend them. I have no idea why.

And some of them are minors.

Wait, it gets weirder still. As regular readers of TY4NS may remember, I have a few Facebook alias accounts that I use for testing. None of these have their own cell phones or contact lists, so I never imported any contacts to them. Yet these accounts also display the phone numbers of everyone in their respective friends’ lists. So despite what Facebook’s contacts page says, this has nothing to do with using Facebook’s mobile app.

As Swiss developer Kurt Von Moos points out, Facebook has been syncing mobile contacts this way for some time. I’d just never clicked the contacts page before. He writes:

... with neither your knowledge or consent, [Facebook will] import ALL the names and phone numbers FROM your phone’s address book and upload them to your Facebook Phonebook app ... on Facebook.com, thus storing your private contact numbers on Facebook‘s servers. Once your phone is synced , Facebook will attempt to match the newly uploaded phone numbers to users that have listed the same phone number on their Facebook profile, whether you are friends with them or not.

Why the shock?
You are responsible for sharing your phone number when you provide it to Facebook. Facebook is doing what it feels like with it. As usual. Are people really still surprised when they find out that information they share with some free online web site is going to be used in ways that they didn't anticipate?

Hacker News user grannyg00se | What's your take?

Why exactly is Facebook storing all of those numbers on its servers? That’s a good question.

The problem: Many people give everyone on Facebook access to their contact information and may not even be aware of it. Freelance coder Tom Scott has created a Web app (called “Evil”) that randomly displays phone numbers unsuspecting Facebook users have made public, along with their profile picture. He blocks out the last three digits of each one, but they are visible on Facebook itself.

My advice: Stop sharing your phone number on Facebook. You can go to Facebook’s Remove Imported Contacts Page to delete the numbers of your friends (though when I tried to do that with one of my dummy accounts, it didn’t do a damned thing). You can go into your Account/Privacy settings, click Customize settings, and change access to your Contact Information so only select people can see your number.  Or you can just delete your digits from Facebook and be done with it.

Would you just hand your phone number to a random stranger in a bar or on the street? Probably not. So why are you doing that on Facebook?

TY4NS blogger Dan Tynan’s Facebook phone number is literally a Facebook phone number; don’t dial it unless you enjoy getting an earful of fax noise. Visit his snarky, occasionally NSFW blog eSarcasm or follow him on Twitter: @tynan_on_tech. For the latest IT news, analysis and how-to’s, follow ITworld on Twitter and Facebook.

Follow Dan on Google+

Author Dan Tynan has been writing about Internet privacy for the last 3,247 years. He wrote a book on the topic for O'Reilly Media (Computer Privacy Annoyances, now available for only $15.56 at Amazon -- order yours today) and edited a series of articles on Net privacy for PC World that were finalists for a National Magazine Award. During his spare time he is part of the dynamic duo behind eSarcasm, the not-yet-award-winning geek humor site he tends along with JR Raphael.

ITworld LIVE

SecurityWhite Papers & Webcasts

Webcast On Demand

Seven Deadly Sins of Cloud Security (Video)

As cloud computing gains popularity, too few people are aware of the security threats that are emerging. In this short video, experts from HP discuss the latest cloud security threats and explain measures to help overcome them. Hear about the seven deadly sins of cloud security and learn how to avoid becoming a victim of poor security in your cloud environment.Intel and the Intel logo are trademarks of Intel Corporation in the U.S. and/or other countries.

Sponsor: HP & Intel

White Paper

Establishing a Strategy for Database Security is No Longer Optional

The options for securing increasingly valuable databases are very broad and deep, and can be confusing. This research provides an overview of three categories of controls that should be implemented to ensure that enterprise data is protected in the most efficient and effective manner.

White Paper

Database Activity Monitoring Is Evolving

Read the analyst report and learn how you can leverage the core capabilities of a DAP solution for better database security.

White Paper

Protecting Against Database Attacks and Insider Threats: Top 5 Scenarios

Read this new eBook to learn the top five scenarios and essential best practices for preventing database attacks and insider threats.

Webcast On Demand

Distributed Database Security with Real-time Monitoring

View this demo and learn how IBM InfoSphere Guardium database activity monitoring can help protect your sensitive data in distributed DBMS environments with a holistic approach to data security and compliance.

Sponsor: IBM

See more White Papers | Webcasts

Ask a question

Ask a Question