Hacker News Reader

Comment by discostrings | Hacker News Reader

So it sounds like when people give Facebook access to copy their contact lists / address books from an email account or phone, Facebook tries to match those email addresses and phone numbers to other Facebook accounts. Sometimes, those email addresses and phone numbers aren't already part of the Facebook account they're matched with, but Facebook is pretty confident of the match. So Facebook stores those addresses and numbers as part of the matched account's "shadow profile".

The problem they're reporting here seems to be that when one used the tool to download one's account, the addresses and phone numbers from friends' "shadow profiles" were included.

It makes you wonder what other invisible data is attached to a Facebook profile...

View on HN

I work at Mailgun and this may explain why when our customers use Facebook as a customer acquisition tool they inevitably end up with a large amount of bad email addresses, leading to a poor email sending reputation or worse.

While I'm not familiar with the information Facebook shares through Facebook Connect, this seems to be a big short coming. You may not be getting the customer's real, current email addresses.

We have to tell people that Facebook is not a reliable way to obtain valid email addresses. The only way to properly do this is to have customers submit their email addresses directly to your own signup form and then validate them with a confirmation link sent to that address (double opt-in).

The issue is that when you use Facebook connect and get the user's email it returns the email originally used to sign up for facebook. Since people signed up years ago, many no longer have that as an active address, which leads to the poor email quality.

Wow - I expect most Facebook users have invalid e-mail addresses if that's the case. Originally, you could only sign up with a college or university e-mail address, and pretty much all of those addresses are now dead because people graduated or left.

What about sending email to <facebook-username>@facebook.com? Then it just ends up in their "Other" box in Facebook messages, but at least (I suspect) it won't bounce.

That is an alternative. Although, we have found they throttle incoming SMTP traffic pretty aggressively. I don't fault them for this - I'm sure they are bombarded by spammers.

Here's an interesting post I came across on the subject: http://www.whatcounts.com/2012/06/what-is-the-deliverability...

They also keep sort of "reverse lookup" information on everyone - basically, what other people have you in their address books.

They keep this information on you even if you are not a Facebook user.

The blog says the fix was made in the DYI tool. That means they would continue to maintain "shadow profiles", but would stop letting others know that FB has a shadow profile on you. Al these blog posts and notification emails are just a PR propaganda to make gullible users believe that FB cares about their privacy.

Just discovered that this post is linked by the CNet article ( http://www.zdnet.com/anger-mounts-after-facebooks-shadow-pro... ). Thought maybe nebula would be interested to know :)

http://packetstormsecurity.com/news/view/22713/Facebook-Wher...

You're mostly right except for one thing:

The extended data download did not include shadow profile data from just your friends. It included shadow profile data from anyone that matched any of your contacts. If zuck@facebook.com was one of your contacts, you would have retrieved all of his data.

This could have been used as a very targeted malicious data mining tool. It probably was.

Reply on news.ycombinator.com