Here's the discussion on the Facebook post: https://news.ycombinator.com/item?id=18202589.

How do I check if I've deleted Facebook?

Does deleting Facebook mean I no longer have a right to know if my data was breached while I was a member?

What if I never signed up. I am sure they know about me. Wonder if there is a way to request that information from them...

Yes they do, it's called a shadow profile[1].

If you're in Europe you might have some some recourse (GDPR and such), but if you're from the US you are most likely out of luck.

Regardless, Facebook might have a detailed profile on you but not know your name. I doubt there is much you can do.

[1]: https://theconversation.com/shadow-profiles-facebook-knows-a...

On the other hand, there's no way to log into a shadow profile, and shadow profile information is never displayed to any logged in user, so you're safe against this particular exploit.

If any of your other apps are connected to fb then all your info was likely granted to fb as well .

FB should timestamp these articles. It happened a couple of weeks ago, or is this new news?

Everybody should timestamp all articles.

People don't want to because they want their content to be "evergreen" and they think that if there's a date that's more than a year or so old, people will disregard / discount the content. So by default many blog CMSs default to not showing the date of any articles.

Facebook is not a small blog operator. They should view this as a professional communications medium.

Someone in Facebook's PR department is reading this part of the thread and saying "it's working!"

If your content is "evergreen", show me a "last updated" timestamp in the last year.

/grump

published timestamps. another vestige of the earlier blog web.

You can thank SEO for that. Something about older content being less "relevant"

This is new, particularly the details around search history and location data being stolen, as of an hour ago.

I think it's the security incident that happened couple of weeks ago and they have more details now?

The first article has the date at the top: "October 12, 2018".

They might intend to repeatedly update the second one, which might be a reason not to put a published date on it.

I forget what the text looks like in your second link when you're not logged in but after I logged in the verification text appears as follows:

""" Is my Facebook account impacted by this security issue? Based on what we've learned so far, your Facebook account has not been impacted by this security incident. If we find more Facebook accounts were impacted, we will reset their access tokens and notify those accounts. """

I'm curious did they reset everyone's tokens? I remember the day when I was meeting friends for dinner and all or just got logged out of fb at the same time.

I get the same message that I'm not likely impacted

Same, I think, I commented to my wife something like "that's worrying I've been logged out, sometimes that means your account is compromised", but I get the "you're not affected" message too.

IIRC that was on Facebook Lite on Android. I don't know my password so didn't log in at the time, but it just worked the next time I tried.

Might be unrelated.

I see the same thing. Wonder if anyone was informed that actually had been affected.

I have been affected, quoting text:

Is my Facebook account impacted by this security issue?

Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information:

    Name.
    Email addresses.
    Phone number.

Based on what we've learned so far in our investigation, the attackers did not gain access to certain information, such as:

    Account passwords.
    Payment card or credit card information.

Mine continues:

Additionally, the attackers also accessed other account information, including:

- The following information associated with your Facebook account:

    - Username.
    - Date of birth.
    - Gender.

 - Types of the devices you've used to access Facebook.
 - The language you choose to use Facebook in.

 - If you previously added this specific information to your Facebook account, it was also accessed:

    - Relationship status.
    - Religion.
    - Hometown.
    - Current city.
    - Work.
    - Education.
    - Website.

 - The 10 most recent locations you've checked in to or been tagged in. These locations are determined by the places named in the posts, such as a landmark or restaurant, not location data from a device.

 - The 15 most recent searches you've entered into the Facebook search bar.

 - People or Pages you follow on Facebook.

Had the same list as you, I was just happy it did not mention Messenger since that would be accessing truly private data.

The data you listed is semi-public in my case.

There's lots of "verification" data there, and lots of info to make convincing phishing attempts. That's serious juju.

Like if I say "I'm calling from Samsung about your SMA500FU, phone number #####, ..." that gives me a lot of trust for a phish.

I wonder, say, how many phones I could get by mailing people an envelope saying their phone was at risk of exploding, sending corresponding texts, etc..

I also got an alert in my feed. I stopped using Facebook 2 years ago... I didnt delete my account. But this incident highlights the latent risk our data poses across hundreds of websites...

Is my Facebook account impacted by this security issue?

Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information:

  Name.
  Email addresses.
  Phone number.

Based on what we've learned so far in our investigation, the attackers did not gain access to certain information, such as:

  Account passwords.
  Payment card or credit card information.

They should not require you to log in to their site to look up whether they have victimized you. I used to have a FB account but threw the random password away. Was I affected? No way to know?

Not to mention those of us with deleted Facebook accounts. It looks like I’m not affected but to anyone who had an account during those dates and deleted it since, how do they find out?

Yet another reason they should email affected users, guess they care more about not publicizing bad information than taking responsibility.

They explicitly state they will email impacted users.

Does a user with a deleted account qualify as an impacted user? I think the visibility is an issue.

As one of those people, this summer I encountered a spotify issue where my spotify would randomly start playing Cannabis Club ATL. Others had the same issue. Perhaps unrelated, too difficult to tell, especially if FB doesn't consider me an active user.

Does a user with a deleted account qualify as an impacted user?

If they still store some user details (which it seems they do) and then this leaks - absolutely.

What about those who have never been users yet Facebook stores plenty of information about?

Does that mean they are still storing my email address? I deleted my account 2 years ago.

I don't know? I don't see you would be impacted without an account.

I guess they may be concerned with unauthenticated users checking if others are compromised.

Likewise. They should send a notification to all e-mails on record for compromised accounts.

It's such bullshit that they put the info into a card that disappears street the first time you read it.

Thx for the check-link :)

I understand in general that only "pure" facebook users were impacted and that "WhatsApp" users aren't?

(not sure how integrated WhatsApp is with the Facebook infrastructure - I do use WhatsApp but I don't have a Facebook account)

the best way to keep your passwords secure is the old fashioned way. Write them down and put them in a lock box. I only access my financial information from one computer. Perhaps I am paranoid.

True but not relevant at all to the current discussion.