Hacker News Reader

Comment by smoyer | Hacker News Reader

Now things are going to get interesting! I completely understand the desire for privacy but I think it's unrealistic to expect that Facebook won't consolidate its data by user across all their applications. Facebook (and Google, etc.) are now in the same business as the credit reporting agencies ... You are their only product.

My hope is that the increasing outrage will drive users to one of the secure messaging applications.

Disclaimer: I have neither a Facebook nor a WhatsApp account.

View on HN

Now things are going to get interesting! I completely understand the desire for privacy but I thinkmit's unrealistic to expect that Facebook won't consolidate its data by user across all their applications. Facebook (and Google, etc.) are now in the same business as the credit reporting agencies ... You are their only product.

The difference in this particular case is that Whatsapp made an explicit promise that they would not start sharing their data.

Respect for your privacy is coded into our DNA, and we built WhatsApp around the goal of knowing as little about you as possible: You don't have to give us your name and we don't ask for your email address. We don’t know your birthday. We don’t know your home address. We don’t know where you work. We don’t know your likes, what you search for on the internet or collect your GPS location. None of that data has ever been collected and stored by WhatsApp, and we really have no plans to change that.

If partnering with Facebook meant that we had to change our values, we wouldn’t have done it. Instead, we are forming a partnership that would allow us to continue operating independently and autonomously. Our fundamental values and beliefs will not change. Our principles will not change. Everything that has made WhatsApp the leader in personal messaging will still be in place. Speculation to the contrary isn’t just baseless and unfounded, it’s irresponsible. It has the effect of scaring people into thinking we’re suddenly collecting all kinds of new data. That’s just not true, and it’s important to us that you know that.

Make no mistake: our future partnership with Facebook will not compromise the vision that brought us to this point. Our focus remains on delivering the promise of WhatsApp far and wide, so that people around the world have the freedom to speak their mind without fear.

https://blog.whatsapp.com/529/Setting-the-record-straight

I read that blog post when the acquisition was announced ... And laughed! While it feels like the (then) WhatsApp CEO was sincere, did anyone really believe that Zuckerberg would be a hands-off owner? Or that his public-only data content ideas wouldn't become dominant? I'll agree that I think this move contradicts his blog post but I also don't think the purchased entity gets to set the terms after agreeing to be bought ... That would be an interesting contract to read.

you wouldn't pay 2 billion for messaging app with few hundred millions of users that is without ads and doesn't make any money to be philanthropic about it, would you (or anybody else)

20 Billion. 2 Billion was what it was worth. Maybe.

22 billion

Well, they could've actually started charging for the service. $1 a year was more than reasonable for me.

I remember it said 1$ from next year onwards and first year was free. May if they weren't not bought out by FB that would have been their option and it would have been a better one. Not sure why any of the lead not start new clone and start charging

I for one didn't believe that blog post and deleted my WhatsApp account the moment the acquisition notice came up. It didn't make much sense why a messaging platform would be bought for $19 billion and not used by Facebook to better target advertising.

This all comes back to the two-faced saying of one thing loud and publicly while in the small print buried in legalese proclaiming something else. That practice needs to be illegal. It is basically fraud.

One aspect of European data protection is "freely given, informed consent". You can only do what the user has consented to. If a company loudly says "We'll never share it" and the ToS says "We can share it", then what has the user consented to? You could make a case that the user is consenting the loud proclamations. EU data protection law doesn't allow dense legalise behind a click-through as "consent".

So maybe EU law is already doing what you say it should do. :)

German law basically says that terms of service and end user license agreements can't contain surprises. If a service explicitly states it doesn't do certain things, the user hasn't consented to the service doing those things, even if the ToS or EULA contain a snippet in fine print saying the service may actually do these things after all.

This already bit WhatsApp when they tried to ban users for using alternative clients. A German court ruled while they may block those alternative clients, banning the user is unexpected because most other services don't have that kind of policy on alternative clients.

So they could have still kept that policy but they would have to make it unambiguously clear and draw attention to it outside the ToS or EULA because it's something users wouldn't expect from that kind of service.

The EU is way ahead in protecting consumers. Thankfully I am an EU citizen (for now, #Brexit) but unless other major economies follow corporations will keep trying.

Part of the "product/service" is the protection of privacy that was promised and since breeched. It is because of network effects that make it hard for users that understand privacy and value it to move to another service such as Signal. If there were that form of "user liquidity" then our privacy would not be violated for users would simply switch to a product that valued their privacy.

> The difference in this particular case is that Whatsapp made an explicit promise that they would not start sharing their data.

    They "trust me"
    Dumb fucks
    / https://en.wikiquote.org/wiki/Mark_Zuckerberg /

They trusted a promise. Again. The only question is how many times can this be done.

Thanks for bringing up the quote. It is worth remembering when it comes to Facebook.

That said:

> The only question is how many times can this be done.

Seems like German courts says it stops here.

Where does it say that Facebook will respect that blog post?

That blog post is written and published by Facebook on their own website.

We could ask this question recursively ad infinitum. Because their intention to respect wherever it says they'll respect the blog post can be questioned too.

qed.

I'm not sure I mind FB collecting data on my when using FB directly.

OTOH today I read a 10 minute article on an unrelated site about loneliness. When I got to the end of the article an in page popup appeared that said something along the lines of "Liked by 9571 people including your friend John Smith".

I was extremely creeped out. What right does FB have for knowing that I read some article on an unrelated website?

I immediately installed Ublock Origin, blocked facebook.com and messenger.com. My plan is to delete all my cookies and run a separate chrome profile for facebook. Not sure I'll be able to keep the discipline.

Yes I know Chrome saves some of the same data but you can optionally encrypt it and Google at least claims they aren't using for ads https://www.google.com/chrome/browser/privacy/

On the other hand Google's other services like analytics are probably tracking me but so far they haven't been as creepy.

On the Mac there is an old app called Fluid that makes this process easier; single website browsers appear as separate applications.

Thanks for this, I would never have discovered this useful app without you. Thanks.

I keep Facebook script blocked on my main chrome instance. I therefore can only check Facebook on incognito (where script block is disabled).

The added friction of signing in every time to check Facebook has had the added benefit of stopping me visiting Facebook unconsciously. The amount of free time clawed back has been substantial!

While you're installing extensions like uBlock Origin, I would also recommend Privacy Badger from EFF. [1]

[1]: https://www.eff.org/privacybadger

Clicking "like" on an article is a action that you take only if you want that like to be seen by your friends. It is an inherently public action, don't see anything wrong here.

GP is not objecting to Facebook telling him that John Smith liked the article, too. He is objecting (I think) to the fact that Facebook knows who he is (as evidenced by knowing who his friends are), and knows that he just read that article (as evidenced by telling him who among his friends liked it).

And that is creepy, I think, and one reason I have all the good adblockers and tracking blockers and cookie cleaners that GP mentions installed, too.

If you're logged into FB and there is a relationship between the site and FB, then why is it a surprise that the site is able to id you? And when I say "you" I don't mean "John Smith from sf working for company X" but a number with some generalized demographic data attached. There are strict pii guidelines that adtech has to follow, no one really knows who you are. FB and other adtech giants need to do a much better job educating the consumer about what actually happens to data and how ad targeting works.

Most people, I submit, don't log out of FB, they just close that browser tab. So, basically, most people are always logged into FB.

Next, there is no obvious relationship between the site and FB - it's some random article on some random other site, say the NY Times, on some random, say potentially embarrassing topic. However, there's a FB "like" button, or some other tracker.

Now, the site might just get some ID with demographic data (and hobbies and what have you). But FB now knows that you read that article (how could it have told you, otherwise, that John Smith read it?). That might not be a surprise to you, having some knowledge in the industry, but I submit that many if not most people find it both surprising and creepy.

Next, your argument seems to be that with some more education people would not find it surprising, and neither creepy, because adtech is so well behaved and under strict guidelines and "no evil" and all. So, at that point we'll just have to disagree.

Sorry, I didn't mean to say that adtech as a whole is well behaved or cares about user experience, if it was, ad blockers wouldn't be as popular as they are. But I do think there is also an education issue where most people think that PII is being exposed that makes it sound creepier than it actually is.

I didn't click "like". I didn't in any way directly interact with Facebook. I googled articles on loneliness, picked one, read it. When I got to the bottom without clicking anything I was effectively informed that Facebook knew and recorded I had just read the article.

I misunderstood what you were uncomfortable with, I thought you were uncomfortable on your friend's behalf that FB was showing his other friends that he liked an article.

But I'd like to better understand where you're coming from, because personally, I wouldn't be bothered by the relationship between the site and FB while I was logged into FB. If FB's algorithm knows I visited a specific site and uses that to improve the relevancy of what is shown to me in my feed, then everyone benefits. Help me understand what's creepy here?

I'm curious how you find it not creepy. Imagine every company you every interacted with spawned a flea sized drone to spy on you at all times. Are you saying you would not find that creepy?

Sure, they could potentially provide you with better service by spying on you 100% of the time. Would you accept that trade off?

I'm curious why is FB knowing every site I visit (or every site that has FB related analytics/ads/comments/like buttons/etc) embedded not creepy to you?

I get that when I visit the GAP or Target or Walmart there are security cameras. I get that they could use that info to decide how to better arrange the store. I get that they could even do something like notice what I'm looking at, put displays on the aisles and beam useful help/ads at me (I see you're looking at diapers, maybe you'd like some wet tissue on aisle 3)

But I'd find it creepy if their surveillance extended outside their store. I'd find it creepy if they could partner with every security camera with every other store. I look at shoes at Ecco an get a message from Walmart "We noticed you looking at shoes. We have lots of shoes on sale!" or "We saw you looked at jackets at Nordstroms. Your friend liked that green one you looked at".

Why is that any less creepy when I visit non-FB websites?

I don't find it creepy because no person in FB doesn't actually know it is me, to them I'm a number in an algorithm. The only way it could become creepy is if they publicly associate my name with the actions and start displaying this information publicly, but I trust them not to complete suicide by taking that action, just like I trust that my ISP won't post all my info somewhere with a history of all the sites that I visit.

Actually google just very recently changed their privacy policy to show you ads based on your bookmarks and places you surf the web on. Its started about 3 weeks ago.

Whatsapp gained massive users with their "no commercials ever" claim. They were a small independent company. And people arguably got invested in the network as a result. Now they reverse on that but the public feels locked in. I myself think... just switch to Signal or Telegram, but the amount of WA users is simply massive here in the EU. Everybody uses it.

Sometimes I wonder if the strategy of announcing "due to the anti commercial data privacy demands in Germany we are forced to suspend all German WA accounts for the next couple of days" is ever discussed at Facebook.

I'd be interested to see the political pressure it would create. I think the network is strong enough that people won't switch to other apps instantly and there would be a pretty big "just gimme back my WA" outcry which politicians would probably need to respond to.

Obviously the Datenschutzbeauftragte are theoretically independent but I'm sure they'd feel the heat. At least I'd be interested in seeing this play out if a law is being discussed. It won't ever happen but I have a feeling people would want WA enough that it could theoretically be used as a strategy.

My understanding is that the German people generally are very wary of data being moved around and collected 'unnecessarily'. I think a ploy like this would only backfire on FB.

Yes, I'd second that. While there would no doubt be some sort of outrage from the users, I don't think it would be nearly as strong as suggested. Germans in general, and especially the more educated, tend to be very protective of their data protection rights. If FB attempted something like this, it would be torn to shreds by German media.

> Germans in general, and especially the more educated, tend to be very protective of their data protection rights.

Indeed being German I can say this is true for Germany because of the experiences with two dictatorships on German ground in the 20th century - the last one ending only about 26 years ago. Many people living in the GDR that were under supervision by the Stasi (often without knowing) have read the Stasi file (if it exists) and know what details have been recorded about their lifes and what kind of kompromat could in principle be derived from it.

I already see non-technical people switching; it would backfire massively since now the rest will overcome their inertia too.

And oddly, Germany requires to to declare your religion to the government. So I guess the question would be: what is considered necessary? If Facebook needs data to offer a free service, that seems necessary unless Facebook employees are volunteers and servers run on kitten sneezes and rainbows.

This is not a requirement by the government. The question is asked on behalf of the communities of faith that explicitly tasked the government with that. That is a right religious communities have guaranteed by the constitution.

The government is not asking you if you are a member of a religious community that has not choosen to use that service.

> And oddly, Germany requires to to declare your religion to the government.

I trust my government with my data (well, mostly) because if it abuses that trust, I know that I and my fellow citizens can vote it out of power. We have no such control over FB.

Do you mean on tax forms or the declaration that you are not a member of Scientology?

Afaik you can enter whatever you want on the tax form, it is just used to collect membership fees/church tax on behalf of a church. Mostly part of an old deal between the state and the catholic church.

Scientology on the other hand counts more or less as an enemy of the state, stability and not something you let near children. So you need to fill out a corresponding form for specific jobs. If even half the stories of what they get up to are true that is a good thing.

I think also that it would backfire, if you look at what happened in Brazil [0], the blockade made Telegram very popular and again with what's happening here, they benefit [1].

[0] https://news.ycombinator.com/item?id=10749129

[1] https://twitter.com/telegram

Extreme non-techies will say "WhatsApp is broken, use this app instead". People who read the news will know it's about the US companies wanting to spy on your data (remember Germans don't have US 4th Amendment rights), and will switch apps.

I'm not convinced German constitutional protections are weaker than the 4th Amendment. The constitution even includes a right to the guarantee of confidentiality and integrity of information technology systems as ruled by the constitutional court. https://www.bundesverfassungsgericht.de/SharedDocs/Entscheid...

> I'm not convinced German constitutional protections are weaker than the 4th Amendment.

Here's a report from the EU commission about why the US constitutional/legal protection is much less than the EU (and hence German) equivalent:

    http://www.europarl.europa.eu/RegData/etudes/STUD/2015/519215/IPOL_STU%282015%29519215_EN.pdf

Basically: Unlike the EU Charter of Fundamental Rights, US 4th Amendment doesn't cover non-US people outside the US, and it only covers government warrents. What Facebook does with your data is not covered by the 4th Amendment. What Facebook does with your data is covered by Article 8 of the EUCFR.

I think the argument is more that Facebook is a US company, Facebook isn’t bound by German law (unless they operate in Germany, which they do), and the 4th Amendment only applies to Americans.

> Facebook isn’t bound by German law (unless they operate in Germany, which they do)

If you're not in the USA or Canada, and use Facebook, your agreement is with Facebook Ireland Ltd, and bound by Irish, and European, data protection law.

A Facebook user in India has EU data protection rights.

I think people would switch pretty quickly. Most people will have friends locally and regionally - there will be some cut off internationally but they'd be the minority. And if everyone you know is prevented from using the same messaging service, the expedient solution is to change to a different one.

Telegram is a terrible platform and not at all comparable to signal.

Maybe encryption-wise but function-wise it is miles ahead of both WA and signal. There are bots, stickers, live preview of gifs and (YouTube) movies, an audio player built in, an API, real desktop clients (yes I understand that breaks e2e encryption but it's nice when my phone battery is dead I can still send people messages), channels, cloud storage. Still it feels faster than WA. WA is a (very) local minimum and moves very slowly, we can do much better as users.

Could you elaborate? I am using Telegram not because of privacy concerns but because of the desktop and tablet clients. I had absolutely no issues so far.

Telegram's weak points, as far as I can tell:

* chats not end-to-end encrypted by default (only secure chats), so clear text is on their servers

* group chats can't be secure chats

* the crypto is somewhat unconventional. While the developers had their reasons (constraints of mobile platforms), and no exploit has been found so far, AFAIK, any self-rolled crypto is a bit of a red flag to cryptographers.

* I have no reason to distrust Pavel Durov or his motives, but I am somewhat skeptical of services based in Russia (also, just to be clear, of services based in the USA or other five eyes).

To me, Wire might be the best of both worlds (as I've said in another post in this thread, and BTW I am not connected to them in any way):

Signal protocol; based in Switzerland; smartphone, desktop and web client; free; text and voice chat and group chat; open source (GPLv3, and on github); signup with phone number or email.

Wire does not use Signal Protocol. They use a protocol of their own devising that we do not recommend.

https://github.com/wireapp/wire#proteuscryptobox for info on Proteus/Cryptobox that Wire uses.

hey moxie! thanks for your work on signal

Telegram is not based in Russia. Pavel Durov fled the country and is currently operating Telegram from Germany.

It's not end-to-end encrypted, so telegram still has access to all your messages and can turn over data in the case of a subpoena or if they just feel like it.

the desktop client was not encrypted at all last i checked, only the mobile client.

signal is e2e encrypted, it's in a completely different ballpark

No, what's more interesting is previously Whatsapp users had a reasonable expectation of privacy. Facebook acquired the company without first checking with the EU or anyone else if they would oppose them removing that privacy and mining user data. Now they're caught between a rock and a hard place because they need to spy in users to justify the purchase price, but they never bothered to ask if it was OK with regulators first.

Saying "users don't have to use us" after there's already a massive, massive installed base is ridiculous and Facebook knows it. If it were just as easy as switching to another messaging service they NEVER would've paid that much money for Whatsapp. It brings almost nothing unique to the table outside of it's user base/momentum.

I got down-voted for saying it last time this was brought up, but:

Sharing data is what these companies do. The only way to keep your data safe is to use open-source, e2e systems.

Even if you trust any company today, there's no reason you can trust said company tomorrow.

Facebook are quite free to consolidate all user data in the EU. And then be bound by EU laws.

Which would of course limit what they can do with it. And I suspect it's commerical use, not consolidating, that Facebook are more concerned about. :)

Google etc. are not in the same business as the credit reporting agencies.

The latter collect your data and sell it to third parties. The former collect your data, keep it a tightly-guarded secret, do not sell it to anyone, and use it to make their own product more profitable.

I think the difference is important to keep in mind.

Reply on news.ycombinator.com