Hacker News Reader

Comment by kbenson | Hacker News Reader

At least at one point, you could. See the example of the person who pranked his roommate through very specifically targeted facebook ads. [1]

It's even mentioned in that article how to get around the fix they put in so you couldn't target a group of less than 20 people.

I'm not sure if this particular method still works, but let's take a step back and think before we make claims about what is and is not possible in a complex system with lots features and knobs to twiddle. Whether this was an emergent feature from other features of the system or a specifically desired and designed behavior, at least at one point Facebook allowed very fine grained targeting.

1: http://ghostinfluence.com/the-ultimate-retaliation-pranking-...

View on HN

That still doesn't really sound like the same thing. Highly specific targeting based on PII you already have is a very different prospect than harvesting PII for tens of millions of strangers.

I concede you might be able to target a single person, but how exactly is that stealing data? It would sure take me a really long time to (one at a time with ads) get all that juicy-juicy data.

There were black hat scrapers in 2013-ish that enabled affiliate marketers to enter a FB page or public group,and export all the commenters' and likers' names, handles, numeric ID's, locations, emails, ages and a few other things to a CSV.

I assume their scraper was more in depth. If you had friend-type permissions back then you could perhaps see their posts and shares. You'd need post and share content to run text analysis, figure out their hot buttons based on language and frequency, sort them into groups and then target then.

Affiliate marketers could also upload lists of unique user ID's (like the FB group members scraped above) for specific ad campaigns, y'know, disguised hookup sites, skin cream credit card rebill offers, etc.

Back then, many of the privacy options were deeply hidden, obscure, changed names a couple times a year or were unavailable.

I wasn't entirely clear. I was really just responding to the point that you couldn't target people yourself. It wasn't meant as a refutation to your point, just a clarification of one aspect of your point.

That said, since you can target specifically, if the system did allow some way to exfiltrate user data, it would make financial sense for larger analytics companies to do so to provide value-added services where they could target much more specifically than Facebook intended (or at least intended to make obvious?).

Reply on news.ycombinator.com