Facebook admits harvesting 1.5 million people’s email contacts without consent

[CyberTech]

Content source

https://www.theverge.com/2019/4/18/18485089/facebook-email-password-contacts-upload-1-5-million-security-cybersecurity

Facebook has admitted to accessing and storing the email contacts of as many as 1.5 million of its users without their consent. Business Insider reports that between May 2016 and last month, the social media platform asked some of its new users to verify their email address by providing the password to their email account. After doing so, the users’ contacts would be automatically imported, without any option for the user to opt out.

Responding to the report, a Facebook spokesperson told Business Insider that email contacts were “unintentionally uploaded” as part of the process. They said that these contacts had never been shared with anyone, and that the company is now deleting the contacts that were uploaded. Facebook also claims to have fixed the “underlying issue” that led to the problem.

Email verification is a standard practice for online services, but Facebook handled it in a very different way. Usually, when you sign up to a new service you’re asked to provide an email address, which then receives an email with a link in it that you have to manually click in order to verify that the email account belongs to you.

Instead, what Facebook did was to have users verify that they owned an email account by handing over their password to Facebook. “To continue using Facebook, you’ll need to confirm your email address” read the page asking for a user’s email password.

Users didn’t technically have to go through this process, but The Daily Beast notes that the service’s more traditional verification options were hidden behind a nondescript “Need help?” link located below the email password box. Users could also verify their account with a code sent to their phone.

Prior to May 2016, Facebook would still upload a user’s contacts if they provided their email account password. However, that month, Facebook deleted the message that informed users that this upload was going to take place, but didn’t stop the upload from happening.

In small print displayed beneath the password box, Facebook claimed that it wouldn’t store the password entered as part of this process. However, the social network, which hasn’t had a chief security officer since August of last year, has previously had problems keeping to its security obligations. Just last month, it emerged that the platform had stored hundreds of millions of passwords in plain text, and in the past it’s also used phone numbers provided for security verification purposes to target users with ads.

Facebook said it’s notifying anyone whose contacts were uploaded to the service over the coming days.

 

[Handsome Recluse]

Unintentionally.

 

[Arequire]

Instead, what Facebook did was to have users verify that they owned an email account by handing over their password to Facebook. “To continue using Facebook, you’ll need to confirm your email address” read the page asking for a user’s email password.

God forbid Facebook ever suffers an XSS attack that involves any kind of spoofed login form. Normies will just be lining up to hand over any and all information they can so long as they're able to see photos of what their friends are having for lunch...

 

[oldschool]

Corporate corruption and deceit. That's why I'll never use it. All the big social media is really social harvesting!

 

[eonline]

as a facebook user I only have one thing to say.....

 

[Burrito]

I'm pretty sure this was all just an unfortunate accident.

What we have learned over time is that large corporations are always on our side,

They respect us, our right to privacy, and our general dignity.

When they come out with their explanation, I'm sure we will all feel better.

The End.

.

 

[Hamxa]

Glad I deactivated facebook long time ago except messenger. Which I install and check every other month or so. I should get rid of messenger as well but then again.. Anyway good riddance.

 

[SumTingWong]

Glad I deactivated facebook long time ago except messenger. Which I install and check every other month or so. I should get rid of messenger as well but then again.. Anyway good riddance.

DEactivated doesn't stop Facebook from tracking you and using your data and info. You have to delete your Facebook for that.

 

[Hamxa]

DEactivated doesn't stop Facebook from tracking you and using your data and info. You have to delete your Facebook for that.

It's dummy email and no timeline or profile information etc.