Hacker News Reader

Comment by p858snake | Hacker News Reader

A. Go to profile -> down to friends list -> click on the pencil -> Remove the tick in the box (Will still show mutual friends though)

B. Change your privacy settings, Make it so you can only be found by searching certain things (eg: email address), Block your boss

C. Unfortunately not (yet?)

View on HN

A. Facebook has made it clear during the big "everyone" push that hiding your friends on your profile page is not the same thing as hiding it from public access; it is still considered public information by Facebook and can be accessed as such.

B. Much of your personal data is still publicly available through Facebook Graph, regardless of how much you try to lock down your profile. It's only a matter of time before people start scraping this information and publishing it in a way that it's clearly accessible from Google, and Facebook won't be able to do anything about it.

B. Much of your personal data is still publicly available through Facebook Graph, regardless of how much you try to lock down your profile.

I don't think this is true, as an example here is what the graph API shows about my account:

  {
   "id": "800679",
   "name": "Matthew Brown",
   "first_name": "Matthew",
   "last_name": "Brown",
   "location": {
      "id": null,
      "name": null
   },
   "gender": "male"
  }

In the past I've had to go through all of the privacy settings painstakingly to make sure nothing is public, but I don't see how it can be said that you can't hide what you want from the public / graph API.

1) The graph also shares your picture (800679/picture?type=large), likes (800679/likes) and your timezone as well. I consider this "much of your personal data."

2) Before the Graph, it was possible to hide all of this information completely if you used the strictest privacy settings. You could completely hide the fact that you had a facebook account; even the things you published on public FB pages would just show your first name and a placeholder photo.

3) Before the Graph, it wasn't possible to systematically scrape the info of all Facebook users sequentially. The fact that this is now possible will make it easy to collate the data and publish information about you that you haven't personally shared. Most users' photo albums are set to "everyone" (by accident, of course), but previously they were pretty much undiscoverable even if they were public. I'm pretty certain that this is going to be exploted by sploggers and others, just like every other large publicly accessible source of data.

How is your friend list still public information, if you set it to private? You are suggesting that the privacy settings don't actually do anything, which is inaccurate.

For example, if your friend list privacy is set to "Everyone", accessing your facebook page while logged out will show a random sample of your friends. Switch the privacy setting to "only friends" or something restrictive, return to the profile page in a logged out state, and note that your friends no longer are displayed.

The friends list is still available to third parties through the data API's. How long until a third party provides that data as a product? Actually, Facebook itself is already offering that data to employers, IIRC.

EDIT: To clarify, I'm not talking about the publicly exposed "graph". I'm talking about what they've long provided to their third party affiliates, e.g. all the approved Facebook "application" developers/hosts.

P.S. Notice the nice information asymmetry involved in this, as well. You, as a private individual, have no access to this. But designated (and / as in paying) parties do, at the sole selection (I think I'll avoid use of the word "discretion") of Facebook.

It is always technically 'possible,' to figure out how to make Facebook's privacy settings match yours, the fact that there are forum posts and blog posts like yours show that Facebook on some level is doing it wrong with privacy. Granted Facebook is a huge network, but if they are going to succeed, they need to match privacy with as much intuitiveness and perfectness as Google manages search results.

Not to defend Facebook per se, but "managing privacy intuitively" is hell of a user interaction problem. I don't know any design that could encompass all the complexity of human social interaction and privacy issues related to it intuitively.

This is indeed the last great problem of social UI — but Facebook could do with better defaults, which is half the battle.

It's pretty easy, actually, just make everything opt-in instead of opt-out.

It is in fact very hard to find these bugs. Most of the time when a person sees something about you, that person has no idea if that's in line with your preferences, so can't even know if Facebook is working as it's supposed to.

Something that contributes considerably to mitigation of the problem is to make changes "opt in". Users not opting in continue to get the old model. If you just can't support the old model any more, the default is removal of presentation and/or removal of the information involved.

A few people who can't be bothered to back up their own work and data, nor to respond to announcements of upcoming changes, may be pissed when items are "lost". But no one's privacy is compromised. Further, if you provide clear means of such a back up and/or instructions and advisement to maintain private copies, you can help lessen this second problem.

That's something to Google's credit, that they've officially supported and developed means for users to retrieve their data locally into documented, usable formats.

Reply on news.ycombinator.com