Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to know how Facebook discovers the people who you know in real life or who know you.

I tried the following to see if Facebook can still discover my acquaintances in real life and suggest them to me as a friend.

  1. I connected using a VPN (an anonymous VPN, not one of those free VPN services). I have confirmed that it does not leak my actual IP address.
  2. I cleared the cookies in my browser (specific to sites like Facebook, Google, and Yahoo) and started a fresh instance of Browsing Session. Anyway, cookies specific to Facebook only should matter, and I cleared them all.
  3. I registered an email account with an email service provider who does not require a mobile number for registration. I used an email ID name which had no resemblance to my real name. I did not mention anything related to my geographical location while registering the email address. Please note that this was a fresh email address, and I have never used it to send an email or receive an email.
  4. Now, I registered on Facebook, using a name which does not resemble my real name in any way.

However, Facebook requires phone number verification before you complete registration on Facebook. This is the only place where I specified my real phone number to receive their security code.

Once, I completed the verification. The moment I logged in, I could see Facebook giving me a list of suggestions of people I may know. It was surprising indeed, since this list was extremely accurate. It included people I knew in the past as well my current acquaintances. It makes me rather suspicious.

The only way I see that Facebook was able to identify the people who may know me or I may know them was using my phone number. So my assumption is:

  • They appear to have a deal with the telecommunication providers in different countries. Once you disclose your phone number, it looks like they get access to the entire list of phone numbers with whom you have corresponded in the past. Then, they do a second level lookup to identify the Facebook profiles of those corresponding phone numbers.

Also, interestingly, there are some people with whom I may not have ever corresponded with on phone. But of course, Facebook can find them through other people I know and suggest them to me.

Am I correct that Facebook was able to do all the correlation of people I know in real life using my phone number?

It would be interesting to see whether they could still correlate it if I use another phone number.

share|improve this question
5  
Did you use the same phone number for your anonymous Facebook profile and your main one? –  paj28 Jun 19 at 8:39
29  
Frankly IMO this question could be pared down to very little more than "with a brand new account with only a phone number as a personal identifier, how is Facebook able to so accurately suggest people I may know?". The wall of text (literally a screenful of it) adds very little above and beyond that. –  Michael Kjörling Jun 19 at 9:33
2  
@NeonFlash - so what phone number did you use? Is this a throw-away prepaid number, or a number that you do actively use to communicate with people? –  paj28 Jun 19 at 9:55
2  
Edited to remove unnecessary detail and simplify down to the core assumption and question. –  Rory Alsop Jun 19 at 11:49
4  
@NeonFlash - You haven't told me what phone number you used, but I suspect you did use the same one as on your main profile. When you activated that on your anonymous profile, it removed it from your main profile, but then the two accounts were linked in a way that is not directly visible, but causes friend suggestions. –  paj28 Jun 20 at 10:00

5 Answers 5

up vote 80 down vote accepted

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries.

Well that's ONE explanation.

Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters.

All they have to do after you register with your real phone number is look through all those contact lists, and find the people who possess your number.

This idea that they may have arrangements with telecom providers seems a little far-fetched to me, in great part because it is simply illegal in many countries to disclose phone records to anyone without a court order.

share|improve this answer
2  
This is how i would explain it, too. Seems the most logic explanation to me. –  user37819 Jun 19 at 8:22
25  
Agreed - the mobile app explicitly gives Facebook permission to see your contact list. –  Rory Alsop Jun 19 at 9:22
3  
Yes: unfortunately your contacts have leaked your details to Facebook, probably without telling you; almost certainly without asking. –  Andrew Leach Jun 19 at 11:51
3  
@TimS. Alas, you can't possibly hope that all those who have your phone number have done the same... –  executifs Jun 19 at 12:20
1  
@BumblebeeMan I don't see how that makes any sense. It identifies by phone number, not by contact name. Unless you have and use the criminal's phone number. Then it's starting to sound like you're the criminal at that point. –  Cruncher Jun 19 at 17:09

Repeat the same process, but use a new prepaid phone number. If they can still guess who you are then it is freaky. If not, then it is probably your friends' contact lists which have been sucked up into Facebook.

It would be an interesting exercise to try the same, but with your work number and see what kind of connections Facebook infers from that.

share|improve this answer
    
You don't need a new prepaid phone number there are ranges of fake numbers that you can use provided for use in TV fiction and so on. –  Jack Aidley Jun 20 at 11:23
8  
@JackAidley How would you then be able to receive their security code, to complete registration? –  Angelo.Hannes Jun 20 at 15:04
    
Ah, fair enough. I didn't realise that actually forced you to confirm via mobile now. –  Jack Aidley Jun 20 at 17:21

I can certainly state that it is not only phone numbers. It is also your email conversations from past and i mean way back. More than 10 years ago and im still suprised that they would got his far. Everybody is traced and stored along with you mails, internet history etc so there is no need to hide cause you can't especially with the new phones and surf pads. Remember to not just turn them to sleepmode if you want to be private.:-)

share|improve this answer
    
Are you claiming that Facebook somehow has access to all Gmail/Hotmail/My mail server/etc and are reading all emails? Plus they're somehow storing my internet history (regardless of my device/browser/etc), but turning off my devices (not sleepmode!) will help this? –  Chris Murray Sep 10 at 9:20

Facebook has nothing to do with telecom companies in suggesting related friends.

To verify it, you create another account, fake every single detail except the phone number. The results will be completely different.

It's important to understand how the Facebook's social works. Well, the complete details are kept secret as Google keeps its search algorithm secret, but there are some correlations that Facebook has talked about. It builds a reputation score between you and every other user in a particular location. Then they suggest you based on the reputation score. A higher score means that it has matched your profile at several fronts like age, school/college, city, friends of friends etc.

A lower score means a less correlation, but a probable match. A negative score means no correlation. The moment you add a friend, your base score increases with respect to everyone in your friend's friendlist, thus providing a probable list of people you may know.

And in this way the list keeps growing. Not to mention, a phone number is also a criteria to rate your score against others, but it is not the sole criteria.

I hope it gives some insight.

share|improve this answer
1  
I don't think this answers the question. I read the question as saying that Neon Flash did not enter in information like age, school/college, city, friends of friends, etc. So, I don't think this explains what Neon Flash is observing in his experiment (unless there's something he isn't telling us). –  D.W. Jun 20 at 23:11

They use graph theory to find people who have connections to many people you have connections to. These connections can include an actual friendship relationship, or they it may be something you have in common on your profile. Essentially, they find cliques that contain people you are connected to and the other people in the clique are suggested to you. This is also how the NSA uses facebook to find "terrorists".

As soon as you add 1 connection, they can start making assumptions about who you know.

share|improve this answer
3  
This doesn't answer the question that was asked. How would Facebook "find connections to many people you have connections to" if they don't know which people you have connections to, in the first place? There's a chicken-and-egg problem in your answer. How would they bootstrap the process by obtaining some connections to some other people you know? That's what this question is asking. –  D.W. Jun 20 at 23:10
    
The connections are friend, following, or attributes in common. –  Owen Johnson Jul 9 at 20:23
    
The OP seemed to suggest that he had not made connections yet ... –  schroeder Sep 15 at 22:01
    
The connections can be attributes in common, this includes places you said you were associated with (career info, home town, current city, inferred from phone number or IP address). They also have data from other users that they compare to data they have about you. For example, if you supplied your phone number, they can see (using the Facebook mobile app) who has you in their contacts list. The connections are not necessarily ones the user has voluntarily made. –  Owen Johnson yesterday

protected by Community Sep 15 at 23:03

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.