8

I'm not registered with Facebook and I've never logged in to Facebook inside the browser I use, Today I enter the site facebook.com and see my actual phone number on the sign in page with this message:

Facebook requests and receives your phone number from your mobile network

So how does a website, in this case Facebook get the mobile phone number inside the browser?

enter image description here

  • See also a similar question on Security.SE. It seems, however, that your situation is different (or that Facebook message is wrong and misleading). – Arseni Mourzenko Jan 30 at 18:30
  • you might as well ask how the person you just called got your number, or the person you emailed got your email. Its surprising because people consider their number 'personal data' but no security has been breached or implemented – Ewan Jan 30 at 22:29
8

Basically your mobile phone company is adding your phone number to HTTP headers when you visit certain sites.

So when you visit www.advertiser.com your request goes to your mobile phone operator, via cell towers, through their network, off to the internet

Obviously the cell tower knows your number, as does your phone operator, they configure their router to add some more headers to your HTTP request (unencrypted) because the owner of advertiser.com pays them to do so.

This extra data is then sent over the internet to www.advertiser.com who can simply parse it out of the headers and put it back in the <input> tag in the response.

facebook are being quite open about this here. But they will also get the phone number, along with the website url of every site you visit with a like button somewhere on it. Which they then store on a big database in china

http://www1.icsi.berkeley.edu/~narseo/papers/hotm42-vallinarodriguez.pdf

| improve this answer | |
  • 2
    Lovely ........ – Robert Harvey Jan 29 at 15:47
  • 3
    Of course, if the data is stored in the USA, it's subject to US laws on search and seizure. This is scarcely any more comforting for anyone outside the USA. – Simon B Jan 30 at 11:55
  • 6
    Since Facebook is all HTTPS (including the page on the screenshot), how would the mobile phone operator be able to tamper with any data, including the headers? Imagining that the mobile phone operator installed it's own certificate on the phones it sells in order to be able to decrypt all the traffic would sound particularly creepy and is likely to be illegal in both United States and EU. – Arseni Mourzenko Jan 30 at 13:39
  • 1
    well, theres TLS interception, or the site paying the operator to add the data can just give it a copy of the cert for the site. it doesnt need to be on the phone. Or the site could include a http tracking link, or you can do some clever stuff with the key exchange itsself – Ewan Jan 30 at 13:54
  • 3
    If Facebook has a deal with mobile operators, presumably the operators could just tell Facebook their IP-ranges. Then, whenever Facebook wants to know a user's number, Facebook could just ping the provider to say, "Hey, I got a packet from such-and-such an IP address that's in your claimed range, what's their number?". – Nat Jan 30 at 14:29
1

Given fields are remembered by browser, so for example if I enter some store (online), and they use the same field keys as other stores a lot of input will be filled automatically (by browser).

If it is the source of your phone number, I would check the browser settings to exclude remembering digits. If not, it might happen you enter some pin-code or something, on another site there will be the same field key, but hidden so you even don't know when the browser will do auto-completion for you and send sensitive data.

| improve this answer | |
  • It's not this the case. – Kodis Jan 30 at 22:28
1

Facebook requests and receives your phone number from your mobile network.

Without confirming, that sounds literal to me. This is, it sounds like Facebook literally just asks your mobile network provider to tell them your number.

I'd imagine it works like this:

  1. Some Facebook page wants your mobile number.

  2. Facebook checks what provider's IP address range your IP address is in to determine your provider.

  3. Facebook sends a request to your provider to the effect of:

    Hey, we got traffic from a user at 123.123.123.123, which is an IP address within your service's range. What's their number?

  4. Then, I guess, your mobile internet provider may choose to respond to Facebook's request.

It's probably an automated service that they've got set up. Such a service would seem pretty easy to implement and run on a technical level; the major hurdles would seem to be legal/political.


From Facebook:

We may suggest a mobile number for you based on information we receive from sources such as:

  • Your mobile phone or tablet.

  • Contact info provided by others on Facebook.

  • A mobile number that you entered previously but didn't confirm.

Facebook

So as Facebook describes it, they may try to pull phone numbers from multiple sources.

| improve this answer | |
  • This is interesting and if true it's outrageous. – Kodis Jan 30 at 22:42
  • @Kodis You might be able to get more information if you call your mobile internet provider's technical support to ask them if they are, in fact, providing Facebook with your information. Does seem a lil strange if consumers are opted-in by default; but, if they have gone that far, ideally they'd at least allow opting-out. – Nat Jan 31 at 3:23
  • 1
    @Kodis The interesting thing about this is that, if it's true, it'd seem to break a pattern about paid services having stronger privacy policies. I mean, usually it's not so surprising when free services sell users' information as their business model. But seems like mobile internet providers tend to charge a good bit for their services, and if they anger their customers, then their customers might switch to another provider, making something like this seem less obvious. – Nat Jan 31 at 3:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.