Facebook Is Not the Internet's Only Privacy Villain
choosetoencrypt.com
choosetoencrypt.com
<a href="//twitter.com/USERNAME"><img src="twitter-dot-png">Find us on twitter</a>
And host twitter-dot-png yourself.
(edited to remove autolinking)
"Bbbut, everyone does it. It's industry sop..."
Until we outlaw a way to make money, expecting people to morally not use it to is extremely naive. Something a 5 year old would expect in fact.
There is a reason why we have police, courts and jails after all.
Of course, this works best in an economy where there are a surplus of jobs.
Developers have the power to refuse bad actions, especially like you say in a job-rich environment. But unless software developers experience risk consequences for developing something bad, some number of them will not obey their conscience.
> some number of them will not obey their conscience.
Let's just hope that as time progresses that more will follow their conscience. I honestly think that as our other needs are being taken care of that people are able to act more on their own personal ethics. It is substantially easier to be ethical when you can put food on the table.
I’m still concerned, though... addition to basic security, some people will compromise ethics for status. In particular, an observation JL made in the book is that people staying in the finance industry despite reservations were often parents buying their kids a fancy education.
Abolish Harvard to fix Facebook? Less Eton, more ethics?
I despise Google, Facebook et al and I develop a webpage in my freetime for a club that I'm in. I'll gladly work an extra hour, if it means I can avoid sending data to one of those asshat companies, but it's really not as easy as it sounds.
I for example used a template to base my webpage on and that template creator chose a font, as he should, but then instead of statically embedding the font file, the guy included it by linking to Google Fonts, meaning that all of my users' browsers sent their IP and that they are visiting my webpage (as part of the HTTP Referrer) off to Google.
I found out by looking at my page with NoScript and I suppose, you could find out by looking at the network requests, too, but neither are necessarily something that a hobby webdev is going to look at.
Another time, a module decided to load JQuery off of a Google server. And incidentally, that module was installed by the guy who maintained the webpage before me, so that's another point how "everyone doing it" does actually make it harder on you.
Then we wanted to embed a map. I happened to know of OpenStreetMap, but most webdevs probably don't, because everyone's using Google Maps everywhere.
For videos, I was convinced to embed YouTube-videos, because of networking effects and such, so then I wanted to at least try to make it privacy-friendly and, you know, comply with EU law, so I put up a picture, if you clicked on that picture, it would then load in the actual YouTube player.
I was hoping to find a module that did this automatically. I found one. Exactly one, that is. And it was kind of shitty at that. So, then I had to spend not just one extra hour, but probably rather five, to try to patch that module up into a semi-usable something.
I even thought about creating a place for minimal themes that don’t load remote JS (and don’t do silly stuff like scrollbar hijacking).
Though interestingly the DDG app says "3 trackers blocked" and only shows twitter being blocked.
The real point is that targeting any "fix" too narrowly toward Facebook, or Google, or any one party doesn't fix it for the others. It might even distract from or interfere with development of a more general solution. But that's exactly the path a lot of people seem to be going. By all means, criticize Facebook if you think they've done something wrong, but don't stop there. Make sure you understand the full scope of the problem, and the options for addressing it in a general way, and the benefits or drawbacks of each approach. Progress doesn't come from everyone saying "me too" on a bug report. It comes from people talking about and then implementing ideas to make the bug stop happening anywhere. I've seen precious little of that.
In fact I don't know of any example that required a plurality of people to act, that wound up being anything but a unit fix and not a global fix for a problem.
More than likely someone will go down in flames, everyone will congratulate themselves on a job well done and then it will be business as usual for everyone else doing the same thing. Hell, I'd be surprised if Facebook even takes the hit for this one.
Or it could set a precedent... It has to start somewhere. Maybe Amazon or Google is next.
Were you thinking in general about some legislation? Say something like GDPR?
> Progress doesn't come from everyone saying "me too" on a bug report. It comes from people talking about and then implementing ideas to make the bug stop happening anywhere. I've seen precious little of that.
That happens if there is a common platform everything runs on. Maybe a shared library. You just fix the security bug in it and every application relying on it will benefit (generally speaking). In a way legislation, taxation, treaties, open standards are somewhat like it. When those change it affects everyone. But that is kind of rare, so doing it one instance at a time is still making some progress.
That's the key: it affects everyone. In constitutional law there's this concept called a bill of attainder, which is a law directed toward a specific person instead of an action. Many constitutions, including that of the US, forbid them. I think any solution to these problems will be as much legislative/regulatory as technical - GDPR is an early model for this - but it has to be about the behavior. Otherwise it's just politicians playing favorites. I've seen some of the replies mention precedent as though it's a good thing, but we hardly need another precedent for the government picking winners and losers.
> But I digress.
Yes you do. Starting with all that makes the reader feel that "they're not even the worst offenders, Google/Apple/Amazon is probably worse". Which may be true but you present no proof for that and it's not even something that you needed to argue.
> By all means, criticize Facebook if you think they've done something wrong, but don't stop there. Make sure you understand the full scope of the problem
Or stop there if you wish - it's still something. It's certainly better than thinking "I don't have time to understand the full scope, so I'll let others do the criticism".
> I've seen precious little of that.
Well, lead the way. Show us how to do it. Help us understand the full scope of the problem and address it in a general way. Don't just chide people for criticising Facebook.
Facebook being slapped with a massive fine/being broken up might not do a lot to stop the general trading and exchange of users data online, but its enough to get the politicians to say "job done" and move onto the next issue. We need to focus on fixing the issues that allowed the FB/CA scandal to occur, instead of just focusing on the symptom.
Or it might; the other companies are watching, and precedents do matter.
I honestly don't see how bringing Google/Amazon/Apple into this won't do more harm than good. In fact, if I were Zuckerberg, that's exactly how I would try to mitigate the issue for Facebook.
When it comes to Facebook (or other social media companies) it's all about self-portrayal and in the end we have control which information we provide. To some degree at least.
Amazon on the other hand has direct unfiltered buying behaviour data. Isn't this advertiser heaven?
I'm glad there are no friends on Amazon.
Yes, but what good are they to make you buy stuff or otherwise spend money?
> hourly location data,
Location data is a commodity nowadays, if Amazon want's your locations data, it can have it.
> and lots of other things freely
Your messages, which are probably much more useful than your photos and your location, but what else?
My point is that Amazon's data is much more valuable, but I'm neither in advertising nor data brokerage so I might as well be wrong.
I think these groups targeting your pocket book may have the most immediate effect on your person -- however -- I don't think it's the scariest or most malicious outcome.
Climate, activities, fashion, lifestyle, branding, etc... can all be determined from photos. Computers are getting better at this, just look at Amazon's fashion camera, the "Echo Look" that recommends clothing.
Company culture determines everything!
There was an article in Forbes or Bloomberg or something recently that stated that Google now gets something like 80% of all credit card transaction data, online or offline.
Amazon also has a photo hosting service, so they could have photos of you if you use it.
Prime Photos has unlimited storage an uploads every single picture you take by default. As such, a lot of people use it.
> hourly location data
The Amazon app requests location data and it probably checks when you use the app.
Amazon appears to be under the belief that retaining customer trust is much more valuable than selling customer data for immediate gain.
I suspect it has to do with their unique financial setup that allows them to operate with a long-view, and not have to chase quarterly profit.
Tracking people makes them :(
Interestingly, you can log in and see your own profile there. I did that a few years ago, and introduced subtle errors into it (e.g. I changed my car to a different brand of car, and the "extended warranty services" robocalls around a year later started calling about my nonexistent vehicle).
[1] https://developer.myacxiom.com/code/api/data-bundles/main
[2] https://developer.myacxiom.com/code/api/data-bundles/bundle/...
https://www.searchencrypt.com/
which seems to be heavily ad-laden (e.g. searching for "free" gets you ads, which it doesn't on Google).
Is this facebook data being funneled back to the record labels and their parent companies to sell advertising? my research says its likely, this feels similar to the CA situation, just not as political..?
The fact that people use Facebook to login to EVERYTHING, means that Facebook has access to their usage data.
A different thing is Facebook gadgets on random websites while you are logged in into Facebook.
(Direct quotes from their privacy policy below)
"Consistent with the permissions you give us to collect the information, we may use the information we collect, including your personal information:
1. to provide, personalise, and improve your experience with the Service and products, services, and advertising (including for third party products and services) made available on or outside the Service (including on other sites that you visit), for example by providing customised, personalised, or localised content, recommendations, features, and advertising on or outside of the Service;"
....
And here are some of the parts about data collection:
"We may also collect other information available on or through your Third Party Application account, including, for example, your name, profile picture, country, hometown, email address, date of birth, gender, friends’ names and profile pictures, and networks.
You may also choose to voluntarily add other information to your profile, such as your mobile phone number and mobile service provider.
...
"When you use or interact with the Service, we may use a variety of technologies that collect information about how the Service is accessed and used. This information may include:
information about your type of subscription and your interactions with the Service, such as interactions with songs, playlists, other audiovisual content, other Spotify users, Third Party Applications, and advertising, products, and services which are offered, linked to, or made available on or through the Service;
The details of the queries you make and the date and time of your request; User Content (as defined in the Terms and Conditions of Use) you post to the Service including messages you send and/or receive via the Service; technical data, which may include URL information, cookie data, your IP address, the types of devices you are using to access or connect to the Spotify Service, unique device ID, device attributes, network connection type (e.g., WiFi, 3G, LTE) and provider, network and device performance, browser type, language, information enabling digital rights management, operating system, and Spotify application version. motion-generated or orientation-generated mobile sensor data (e.g., accelerometer or gyroscope).
You may integrate your Spotify account with Third Party Applications. If you do, we may receive similar information related to your interactions with the Service on the Third Party Application, as well as information about your publicly available activity on the Third Party Application. This includes, for example, your “Like”s and posts on Facebook. We may use cookies and other technologies to collect this information; you can learn more about such use in the section Information about cookies and other technologies of this Privacy Policy."
some quick searching says that spotify pays the record companies monthly, around 50-70% of revenue for the music licensing.
however there seems to be a serious distinction between free subscriptions and paid.
Because free users are getting music for free, this seems to be where the Spotify Group may be packaging up and selling data to music companies or elsewhere to pay for hosting, salaries etc.
I guess the opt out is to disconnect your facebook from spotify;
Or, create a new separate spoitify account. But, because your billing/email settings would be the same.. it's would be easy to join/coalesce the account data in the backend.
or just buy cd's
While I would love to see greater privacy awareness and consideration from all entities I use, the fact is that there are certain web properties that I find indispensable and without a privacy considered alternative.
Facebook I can live without, likely even happier than with it. I also think that the social contract of "sell me as a product in exchange for enabling my social communication" is not the correct paradigm, and once there's a user friendly alternative similar to secure scuttlebutt (i.e. Mozilla level friendly), that best represents the proper social contract (I'll provide hardware resources to enable my social communication).
Seriously, writing off any attempt at discussing or fixing the problem because "it's a pipe dream"/"network effect"/etc will ensure that you do end up going nowhere.
Disclaimer: I work for Google
Sure, Cambridge Analytica was using the data to influence an election, but Google is not shy about it's own social activism, and it's efforts to manipulate users into seeing it's view of the world.
Google's only protective of our data for selfish reasons: If you sell our data outright, the third party doesn't have need of you anymore, but if Google maintains a tight hold on the data, Google can continually sell the ability to make use of it (through Google's advertising services and the like) over, and over, and over.
The harm to me is the same either way.
I understand your point that we as end-users don't have any control over the way the data is used in either case. But I do think there is a material difference between the two scenarios.
(From what I've found, most people upset with "all political parties are the same" are people who belong to one, and are upset that they get grouped in with people who do the exact same things they do. Not "all political parties" are the same, but the two of them I deal with as a US citizen definitely are.)
The outright lying about purpose thing, by which CA’s key data was gathered, for starters.
Once the data is out of your control, there is no longer any way to control what is done with it. Don't think that Cambridge Analytics are the only ones who did this and who have this data. Shutting down CA won't stop the exported FB data from being put to all sorts of uses.
What is to say Facebook itself or Google can't operate in the same way?
When you create an Apple ID, apply for commercial credit, purchase a product, download a software update, register for a class at an Apple Retail Store, contact us or participate in an online survey, we may collect a variety of information, including your name, mailing address, phone number, email address, contact preferences, and credit card information.
When you share your content with family and friends using Apple products, send gift certificates and products, or invite others to participate in Apple services or forums, Apple may collect the information you provide about those people such as name, mailing address, email address, and phone number. Apple will use such information to fulfill your requests, provide the relevant product or service, or for anti-fraud purposes.
In certain jurisdictions, we may ask for a government issued ID in limited circumstances including when setting up a wireless account and activating your device, for the purpose of extending commercial credit, managing reservations, or as required by law.
The problem is that most companies sell that information on to other parties. I've read on the interwebs that Apple doesn't, but I'd feel better if I could see it in a web page or something more concrete.
Facebook is a pioneer in letting others dip into their vast treasure trove with doe-eyed innocence and many apologies.
Seems to work fine in Chrome on Android though?
There are differences, but they aren't worth worrying about. You are still vulnerable to being abused by Google's data about you as well as Facebook's data.
Have they guaranteed this in writing somewhere, or is this just something that you're saying? It's harder to put together a profile that's not personally identifying than one that is; what if I ever used google maps to find directions from my house?
The average person doesn't read or believe a website's stated privacy policy any more than they read or believe a tech product's EULA.
I could list a thousand companies who say one thing, and do another. I find it extremely naive to believe them at face value.
Now I’m using Firefox Multi-Account Containers to separate Gmail from the rest. And I am considering switching entirely to ProtonMail.
The internet was built by government organizations (e.g. DARPA, NSF)
It’s by bringing the actions of popular bad actors to light that we’ll raise awareness to the rest. People need something tangible that they see is affecting them, and Facebook’s scandal is just that.
What usually happens is that the one "bad actor" gets turned into a "bad apple," convincingly repents, is renamed, or is dismantles, other companies have a quiet period during the media frenzy to avoid being the next focus, then continue with impunity.
If focusing on facebook brings legislative changes, then good. If focusing on facebook just punishes facebook, who cares?
Everyone. Punishing one single bad actor (and one of the biggest, at that) is indisputably better than punishing zero. By having one answer by the consequences of their actions, the others see the same can happen to them.
The math is simple. A bunch of little people against multiple tech giants. There’s no way the people have a chance to deal with all the giants at once. One at a time, maybe.
We should be asking, how do other companies share their data? How much info does someone publishing to each app store get? What do third-party vendors on Amazon get? What do advertisers get?
Also, how much did direct marketers already know before the Internet came along?
Even if it's just Facebook, it's a step forward. You can't expect to take down all internet giants at once.
If Facebook/Google are really gathering our data to enhance advertising, it isn't helping the end user. Although it could, if they shifted their focus from ad revenue to user experience (not gonna happen).