Facebook F’s It Up Again

Ticker

Monika Bauerlein,
CEO

Dear Reader,

The next few months are make-or-break for Mother Jones’ fundraising, and we need more online readers to pitch in than have been of late. In "It's Not a Crisis. This Is the New Normal," we take a level-headed look at the brutal economics of journalism, why investigative reporting like you get from us matters, and why we're optimistic we can grow our base of support in a big way—starting with hitting a huge $300,000 goal in just three weeks. Please learn more and donate if you can right now.

The next few months are make-or-break for Mother Jones’ fundraising. We need to raise $300,000 quickly, and we need more online readers to pitch in than have been. Please learn more in "It's Not a Crisis. This Is the New Normal," where we go into the brutal economics of journalism, and what makes Mother Jones unique and worth supporting if you can right now.

Fight disinformation: Sign up for the free Mother Jones Daily newsletter and follow the news that matters.

Here’s the latest from Facebook:

For years Facebook claimed the adding a phone number for 2FA was only for security. Now it can be searched and there’s no way to disable that. pic.twitter.com/zpYhuwADMS

— Jeremy Burge 🐥🧿 (@jeremyburge) March 1, 2019

For years, Facebook has been badgering its users to set up two-factor authentication, which is indeed considered best practice for online security. This requires you to give Facebook your phone number so that they can text you a passcode to log in to your account.

But last year we learned that Facebook had made all these phone numbers available to advertisers so they could target ads. Now it turns out that even if you never added it to your profile, other people can still look you up via your phone number.

Is this a big deal? In and of itself, maybe not. But there are two big harms here anyway. First, Facebook has once again revealed personal information without asking permission. The default should be to keep security information completely private unless you explicitly give permission to share it. But in this case it’s not. And not only is the default set to make it shareable, there’s not even a way to change it once you discover what’s going on.

Second, this kind of behavior will rightfully make people suspicious of security enhancements. It’s in everyone’s best interest to improve online security, and we should always feel confident that online companies are at least doing their best to keep our security information safe and private. Once again, though, Facebook has blown up this implicit contract in order to improve its bottom line by a few dollars. Nice work, guys.