Hacker News Reader

Comment by nappy-doo | Hacker News Reader

Have you ever looked at FB's ad platform? You don't download everyone's data and target the campaign yourself. You target, "18-25 males in these zip codes who like the yankees". I don't see how you go from that platform (hosted and controlled by facebook) to something else.

View on HN

At least at one point, you could. See the example of the person who pranked his roommate through very specifically targeted facebook ads. [1]

It's even mentioned in that article how to get around the fix they put in so you couldn't target a group of less than 20 people.

I'm not sure if this particular method still works, but let's take a step back and think before we make claims about what is and is not possible in a complex system with lots features and knobs to twiddle. Whether this was an emergent feature from other features of the system or a specifically desired and designed behavior, at least at one point Facebook allowed very fine grained targeting.

1: http://ghostinfluence.com/the-ultimate-retaliation-pranking-...

That still doesn't really sound like the same thing. Highly specific targeting based on PII you already have is a very different prospect than harvesting PII for tens of millions of strangers.

I concede you might be able to target a single person, but how exactly is that stealing data? It would sure take me a really long time to (one at a time with ads) get all that juicy-juicy data.

I wasn't entirely clear. I was really just responding to the point that you couldn't target people yourself. It wasn't meant as a refutation to your point, just a clarification of one aspect of your point.

That said, since you can target specifically, if the system did allow some way to exfiltrate user data, it would make financial sense for larger analytics companies to do so to provide value-added services where they could target much more specifically than Facebook intended (or at least intended to make obvious?).

There were black hat scrapers in 2013-ish that enabled affiliate marketers to enter a FB page or public group,and export all the commenters' and likers' names, handles, numeric ID's, locations, emails, ages and a few other things to a CSV.

I assume their scraper was more in depth. If you had friend-type permissions back then you could perhaps see their posts and shares. You'd need post and share content to run text analysis, figure out their hot buttons based on language and frequency, sort them into groups and then target then.

Affiliate marketers could also upload lists of unique user ID's (like the FB group members scraped above) for specific ad campaigns, y'know, disguised hookup sites, skin cream credit card rebill offers, etc.

Back then, many of the privacy options were deeply hidden, obscure, changed names a couple times a year or were unavailable.

The apps being able to siphon 10s of millions of user's data makes what you're saying you can't do possible though: you use an app to get everyone's data, then you analyse that and work out the groups you want to target and with what. Then you realise that the best way to deliver those ads, given your data is Facebook profiles and all your targeting categories are from Facebook, is with Facebook ads.

Reply on news.ycombinator.com