Hacker News Reader

Comment by spicyj | Hacker News Reader

The app doesn't send anything to the server:

https://twitter.com/alexstamos/status/655459585642225664

So says a random tweet.

According to Facebook's Privacy Policy [1], "We collect information from or about the computers, phones, or other devices where you install or access our Services, depending on the permissions you’ve granted." Since obviously you've granted it permission to access the clipboard of your device and you've agreed to this Privacy Policy while installing the app, Facebook can legally collect, store and sell the contents of your clipboard.

[1] https://m.facebook.com/about/privacy

Says a random tweet from Alex Stamos, who is very well respected in the security community...Oh...and Facebook CSO.

Looks like the FB engineers just pop the URL and check for "https?://"[0] at 0 in the string.

[0] - http://i.imgur.com/AhIpWDe.png

It's great to hear from Facebook that we can trust Facebook. /s

I guess it's good to be cynical at times, but do you really think the tweeter and indeed Facebook would put their reputations on the line to gather such a small, insignificant information?

I doubt he's lying, but you have to trust that what he's saying is accurate and stays accurate. Some helpful dev that doesn't get the privacy issues could switch it to process the clipboard on the server, or accidentally add some logging code which happens to log that value remotely.

I'm more concerned that iOS gives this ability without any warning or notification to the user, because even if Facebook is virtuous (now) about this, other future apps may be less so.

It may seem small and insignificant to us, but how much do you think advertisers would pay to see the link that I just pasted into an iMessage, or the contents of the email I just copied?

They would pay significantly less than the billions of dollars Facebook stands to lose if they were found out to do this.

How could this cost them billions? They do lots of things that are pretty gross. Does this cross some sort of line they haven't crossed before?

Wasn't he only just recently CSO (or similar) of Yahoo? What's the story there?

EDIT: found this: http://www.siliconbeat.com/2015/06/24/yahoo-loses-security-c...

Where it is written:

> Stamos also won plaudits this spring at Austin’s South by Southwest festival when he revealed the company will roll out end-to-end encryption for Yahoo Mail by the end of the year.

Except, I don't believe Yahoo ever did "roll out" end-to-end encryption for email?

A Google search or two leads me here: https://github.com/yahoo/end-to-end

Thanks, that's a nice repository. I see that like its parent (Google's end-to-end), it is collecting dust for 99.99% of users.

While I wouldn't consider this very active, it's certainly not collecting dust.

https://github.com/yahoo/end-to-end/commit/8bf5dca239bb1df3f...

It is collecting dust for 99.99% of users. You've linked me to a commit of a merged pull request. That is not an indication that any of Yahoo's users are using this code (unless you count the developers). Maybe Yahoo will actually make their end of year deadline for "all users" [1], we'll see. They have less than two months left to do so. My knowledge of Google's end-to-end attempt leaves me skeptical, and not because this is any sort of a technical challenge, but because it's a political challenge.

[1] http://yahoo.tumblr.com/post/113708033335/user-focused-secur...

Can't make a coherent response, so you hit the downvote button out of frustration. lol.

> random tweet

From the Chief Security Officer of Facebook....

And the CEO of a car company recently said "This was a couple of software engineers who put this in for whatever reasons."

Cool. If FB feels like making a public commitment to financial liability in the event it's discovered that they violate this, it might almost be worth believing.

...whose twitter profile says "All tweets are my own blah blah blah [sic]"

But there's no way to verify that. Perhaps the OS should show something in the status bar when an app accesses the clipboard.

Reply on news.ycombinator.com