Hacker News Reader

Is it possible to bring about a similar complaint against Facebook with the FTC? Or, if the FTC is the wrong agency, what would be the right one?

Of particular concern are "shadow profiles" - dossiers on people who have never even used or consented to using Facebook[1]. I'm no lawyer, but there could be precedent per this Vizio case.

In my opinion Facebook is hugely overstepping people's privacy bounds, even if they do bury what they do with some of the data in their terms of service. I never even knew about DeepFace, or mouse cursor movements, or any of the multitudes of violations of privacy outlined in the article below, and frankly it scares me and makes me angry.

[1]http://veekaybee.github.io/facebook-is-collecting-this/

By using FB, you consent to them using the information about you that others and you yourself provide. Dont like it? Dont use FB.

By that logic, we shouldn't buy or use Vizio TVs either. But the issue here with the FTC complaint is that there was not a prominent warning that the data was being collected or used in such a way.

I certainly never read or even saw any warning about facial matching in all my photos or my children's photos.

Besides all that, people with shadow profiles who never even used Facebook or agreed to their TOS are being tracked. This is not ok.

I feel like there is a double standard here: we are vilifying Vizio - a company that has mutliple competitors - for much less wrongdoing than what Facebook is guilty of, even though FB has a de facto monopoly on social networking.

Edit: there is a link on the ftc.gov website where you can file a complaint against a company with concerns how it handles your privacy: https://www.ftccomplaintassistant.gov/Company#crnt

> By that logic, we shouldn't buy or use Vizio TVs either.

Burn it all. Facebook and Vizio.

And every other company. Go live in a cave because thats where all companies are going and no one is slowing the process down. This consumer choice gambit very well be a false statement in the future.

> dossiers on people who have never even used or consented to using Facebook

I think you misread the comment. These are people that already don't use Facebook.

Except a lot of people are forced to use FB either for work or by friends/family. Without the right IRL social network these people are very disadvantaged given that practically everything social (as in, real life people hanging out, not "social" media) is on FB nowadays

don't like the single de facto platform for communication online? don't use it. i'm sure your friends will get ahold of you somehow. maybe whatsapp?

On the one hand, Facebook is ubiquitous enough that the government could probably step in and regulate them and it wouldn't be entirely unreasonable. On the other hand, I don't use Facebook and I'm getting along just fine. I have an account but log in about once a year. "Don't use it" is a legitimate option.

They still track you even if you don't have an account. Your friends give them more than enough info for them to create a detailed dossier.

crickets

>here is a particular major AV vendor who is selling raw clickstream data of millions of their user's internet usage directly to marketers and other parties right now. As far as I can tell, as long as it is buried somewhere in the terms and conditions no one cares.

ugh. Name them please! If it's in the ToS they shouldn't mind being called out.

Avast, source https://news.ycombinator.com/item?id=13079569 AJ007

Here are the terms, it's in section 8.Privacy, processing of personal information. https://www.avast.com/eula-avast-free-products

However "AVAST may publish or share such information with third parties that are not part of the AVAST Group but will only ever do so after removing personally identifiable information."

Also: https://www.pehub.com/2015/05/avast-leads-22-mln-round-for-j...

"Jumpshot also captures https clickstream data to reveal in-depth buying and social behavior above and beyond simple browsing."

Capturing https clickstream data is only possible when you MITM the user - see Avast.

They could make a deal with browser extension developers to bundle a surveillance module. That is why I never install any browser extensions.

They could for sure - others already did that and bought well running extensions.

https://www.reddit.com/r/IAmA/comments/1vjj51/i_am_one_of_th...

At least, not all extension developers gave in to $$$.

> removing personally identifiable information

no such thing.

> I had an interesting case with Instagram where after viewing enough pictures of women's butts it started also showing men's bare butts in my feed too.. at least until I never opened any of them, and they disappeared.

This truly is technology run amok. "Welcome to buttstagram, for your butt viewing pleasure."

When I think about this situation it makes me want to stay entirely away from social media and off the internet. Yet it's ubiquity in our lives makes it difficult to be integrated and participant in society without the technology. And a lot of the features really do disappear when you remain entirely anonymous (via tor, incognito, not having accounts etc).

I had a similar thing happen a year or two ago: At some point in the past I shut down my Facebook page, but a year later I created a new minimalistic one so I could stay in touch with my family. I posted a picture of a Vespa scooter I'd been restoring in the garage, and suddenly my suggested friends list started overflowing with guys in Indonesian scooter gangs and young asian ladies in head scarfs. (I friended one guy and we exchange "likes" every once in a while but even google translate doesn't understand 3/4 of what he says.)

Wait, what's cloudstagram?

That's a very subtle joke :)

(Those in the dark search for cloud2butt browser plugin)

That is my favorite extension. It subtly brightens my day when I come across one of its gems.

> Yet it's ubiquity in our lives makes it difficult to be integrated and participant in society without the technology.

Or: Yet the ubiquity in our lives of Stuff that was never built for us (pretty sure I never gave the billionaires at FB and Goog as much as a single dollar), but merely to lure us, makes it difficult to be integrated with and unwittingly enabling that Stuff without installing and using that Stuff.

Surveilling users without their knowledge and consent sure sounds like spying to me

What Facebook is doing is quite frankly scary. This Sunday over a birthday meeting with some friends, one of them was telling us about a restaurant called "Lucuma" (this is in Guadalajara, Mexico). My wife did nothing with her cell-phone, except having it with her during the conversation.

Later that day when we are back at home, she showed me an ad about that same restaurant. We never searched for something similar (this is a vegan restaurant), but only talked about it on our way home.

The restaurant most likely bought some ads that targeted your wife and your friends' demographic. It's far easier to do that than covertly access your phone's mic.

Your wife's friends probably searched it and facebook lumped you all together in their algorithm.

Still creepy.

It's also possible that the friends saw this ad first, thus planting the idea in the first place.

Here in NY recording people without their consent is definitely against the law and is likely to piss off important people. As fun as this CT is it seems extraordinarily unlikely that FB employees would risk going to jail for this feature.

This is why i torrent behind a VPN despite being subscribed to HBO now, Netflix, and Amazon Video. My guilt is ameliorated and at least a sliver of ny privacy is maintained.

You misunderstand how it works. This worked by fingerprinting audio and video at the TV display level, it's not part of the networking layer. If your content was shown on the TV you could be tracked regardless of source.

Thanks and noted. If I ever end up getting a SmartTV (due to dumb TV's no longer being sold), it's never getting on my network and going to be banned at the mac address level.

It needs to be physically disconnected or on a network without Internet connection. The Mac address is the easiest to spoof. If it has any kind of radio like WiFi you need to de-solder it, as the data could be collected by a car driving by, or via your neighborers Wifi.

> as the data could be collected by a car driving by, or via your neighborers Wifi.

What?

How is it going to connect to your neighbours wifi? How is someone driving past going to connect to your TV? Is the TV going to set itself up as an access point?

I'm completely behind not connecting random devices in my house to the internet but suggesting they are somehow trying to get data out by connecting to random networks or will just broadcast it for anyone to hear is a bit much.

Multiple compromised nodes working together to identify you.

We already see this with things like ultrasonic communication. A compromised (has sketchy app installed) phone could, for example, communicate with your television or computer speakers and mic via ultrasonic frequencies to determine what ads you have seen, or what digital streaming content you are consuming.

An app could take it even a step further and use a root exploit and secretly take a short recording every 10 minutes or so to relay to someone who wants to know what song or movie you were consuming.

This isn't just possible, things like this have already been found in the wild.

And you can bet your bottom dollar these snaky companies would keep their mouths shut under a NSL if it meant they could keep tracking you.

https://www.schneier.com/blog/archives/2015/11/ads_surreptit...

It doesn't even require anything that complex. If I remember correctly, even if your smartphone never connects to wifi AP's, while thhe WiFi radio is on, it does periodically scan for AP's in the area while either surrendering some identifiable information or establishing a pattern that can be used to identify you.

Frak it, TV is going in a Faraday cage

Get a projector a and a dozen or two bulbs and prepare for the technological winter.

I think the parent is being purposefully hyperbolic ... however, a router manufacturer could have a ghost APs that domestic goods could try to send via. It perhaps wouldn't be the weirdest invasion of consumer privacy story either.

In the UK nearly everywhere send to have a BT WiFi signal as they give out routers with a commercial side-channel that anyone can pay to access. If your smart device had access to BT WiFi they'd get a signal out in many places regardless of whether the TV owner had WiFi.

/EvilGenius

The neighbours might have an access point without a password. But I think if the vendor is really interested in collecting personal data he could just install a GSM modem with a prepaid SIM card inside so that the device doesn't depend on Internet connection.

If they really wanted to collect the data, they could make the TV auto connect to certain SSID's or any open WiFi.

Also lookup smart water meters, that can be read by driving by.

I thought Netflix and related services work the same way Spotify does: they pay content providers a small fee based on actual content viewing. If you pay Netflix a monthly subscription but never view any content on your account, I would assume Netflix keeps all of the revenue and doesn't pay out anything to the actual content providers. Just a guess, but it's possible your plan is backfiring by paying the company you don't want to support (since Netflix is the one implementing the tracking) instead of the companies you do (that actually create the content you like).

> your plan is backfiring by paying the company you don't want to support (since Netflix is the one implementing the tracking) instead of the companies you do (that actually create the content you like).

TBH, that's for too deep for my moral calculus. The only things I view/pirate from Netflix are Netflix original series and PBS documentaries/educational programs. I'm paying the former directly and the latter isn't really out to maximize profit but to enlighten and educate and it's somewhat supported by my tax dollars.

No - as a general rule, Netflix pays a fixed royalty for the content that they license from third parties, regardless of how many people watch it. This is why the quality of their predictive models is so important; the better they can forecast, the better they can determine whether the price they would have to pay is worth it.

(Of course, the royalty is different for every piece of content, but the amount is negotiated ahead of time; it is not on a per-usage basis.)

This is different from iTunes movies, Amazon (non-Prime) Video, Vudu, Google Play, etc., which license on a revenue share basis.

Actually no, in contrast to Spotify, they generally secure licenses for content for a flat fee and a 1-3 year time frame. It doesn't matter how much content is actually viewed, other than Netflix deciding whether it's worth trying to renew or not.

http://www.investopedia.com/articles/investing/062515/how-ne...

Spotify, at least, pools all payments before paying royalties.

So his strategy does increase royalty payments, but doesn't "vote" for who should receive those royalties.

Netflix also makes a lot of their own content. If he is pirating that content, then it's fair.

I think Netflix greenlights 3rd party content creator's projects, I'm not sure they have much if any in-house production.

Those deals probably include some combination of up-front payment as well as per-view payment.

I'm amazed you can access Netflix behind a VPN.

Why not, when you are abroad it is kinda the only way you can watch many of the content that is not available in other countries. Even subtitles are not available in English in some countries like Sweden.

Because Netflix blocks VPNs since a few months. It's really hard to find a vpn that works with netflix. Even setting up your own won't work, most ip ranges that are used by data centres are blocked by default.

He said he pays for Netflix, but torrents on a VPN.

That's a bingo!

Heck if your using a tunnel broker for ipv6, it thinks your using a vpn, sigh.

That sort of makes sense, given that is also punching through the geoblock.

I understand that, but I'm using an endpoint in the same physical area my actual internet connection is (NoVA).

I don't access Netflix, kind of the whole point :)

Whhen I do use Netflix it's through my PS4.

Facebook categorises a video view as anything seen for more than three seconds, so draw your own conclusions from that.

Instagram was purely chronological until mid way through last year. And it only shows you content you've subscribed to. So it's possible an account you were following changed its posting habits.