It's not just Facebook. Thousands of companies are spying on you
cnn.com
cnn.com
The difference is these few days blew off the periphery of uncertain users. It won't hurt them now, but in the long run - it may be like tobacco. Annectodal example from here on.
I've tried many times to quit Facebook, these latest ones threw me off board for good. I tried to do it smartly by contacting people I know and want to keep in touch with and then posted on my wall and my profile pic that I am going out of fb for good. I gave (I think reasonable) 72 hours and some people did reach out and most congratulated me. Which means a lot of people want it, they get its bad for them but "everybody is there" is the main argument. I don't try to convince them, I just tell them where they can find me. Tonight I am out for good.
I wouldn't give much weight to those congratulations. When I went vegetarian a lot of people did the same. Most new acquaintances that discover my vegetarianism respond very positively, specially left-leaning people. Although I try not to preach, I'm too often the only one that orders a salad. But they always follow it with "I see that it's wrong, but I could never stop eating burgers/cheese/jamón". I'm not even sure they truly think it's wrong, but feel a need to say it.
It's one of those things that many people associate with positive traits or stories. We've all seen the inspiring posts or youtube videos of the people who refuse to use a car because of pollution, or stop eating meat because of animal suffering, or will never use a device that runs proprietary software...
We seem to like these stories, and sometimes even admire the commitment, while having no intention of doing anything like. We feel good for congratulating them of tweeting our support.
(For example, many here admire Richard Stallman's commitment and honesty, and agree with a lot of what he says, but read him froma Mac. We are never going to switch to an old libreboot-able PC with gNewSense, but we sympathize with his cause.)
Many people love Facebook, and many others hate it but can't be weaned off it. We won't get very far by abandoning Facebook and prompting others to do the same. We'll a alternative, and/or very strong positive and negative reinforcement to do so.
> The difference is these few days blew off the periphery of uncertain users. It won't hurt them now, but in the long run - it may be like tobacco.
Your comparison with tobacco is very apt. People stopped smoking when a) leaving it was applauded, and b) people still smoking were starting to be seen with some contempt. It took a long time to build those up though. We are very far away from that with Facebook, and even if us leaving is the beginning, I don't think we want to wait 10 or 15 years. Tobacco damaged lungs, Facebook damage could be much more insidious.
That's how it starts, but I've noticed that over time, more and more people have learned more about why one would be a vegetarian (among others because they ask as part of small talk, and I quickly mention a few non-obvious points before moving on), and have experimented with eating vegetarian for a month. And the important part is: when they're around other vegetarians they know, they're proud of giving it a try, which is extra motivation for them to keep it up.
After having formed a habit, many of them keep it up for at least most of the time. And then, of course, they will go on to have the same effect on other people. That's how cultural change happens.
Of course, the problem with Facebook is that the primary method of showing off that you're quitting Facebook would be Facebook itself. I guess the 72h grace period is a good way to deal with that to some extent.
Distract, divert, confuse and conquer!!!
Works-every-time. In every (media controlled) topic!
You need to ask yourself "what about..." and make sure your target truly is the worst offender and not just the most publicized offender, or you become the attack dog of the media.
If the author is calling for regulation of the category that includes facebook, how is he distracting and diverting attention from facebook?
They cross it with your location, your movements, your emails, expenses, everything.
There is no single more spooky company than Google.
Clearing cookies makes no difference - the hash of WebGL and Canvas fingerprints stay the same.
Geographic location is a much larger issue.
On the topic of disabling, if one disabled javascript by default, one would get the immediate effect of not seeing most of the advertising on the web (outside of submarine articles).
I bet people telling others that they "need" this shit to use the web probably has significant overlap with those who say they "need" Facebook (or any other random app) or else there would be no other way to find events or things to do. Like without facebook groups, one would die! lol
However, even if it would show better results then my user agent and accept header is apprently pretty unique anyhow. But why bother.. My ip addresses do not change that often.
Google being careful with user data, may be true now. But what happens one day when Google goes bankrupt? And they have to sell all their information about their users at firesale prices.
Yahoo went bankrupt, and sold off its data about their users.
Imagine the treasure trove of information that can be gleamed from every single American's online activities. Imagine all the "innocent" people that can be blackmailed, and have their lives destroyed.
Imagine a company like no other in human history, that is amassing information on every single American, on every single person in the world, and on a scale that has never been done before. Imagine.. Google.
Google needs to be regulated. The public needs to know what they are doing. And we need restrictions on what can be done with that data. If they go bankrupt one day, then they cannot sell it. It must be destroyed. It is too dangerous to be sold off to the highest bidder.
We are the product.
If you calculate the likelihood that companyX is a) hoarding sensitive data about you AND b) isn't competent at securing said data, I'd rate Google as less of a threat because I estimate (b) is much less likely.
The best way to win is not to play. I block cookies, scripts and also don't use FB or much of Google except search & email.
Usually, when an entity motivated against our best interests is considered “competent”, we calculate that they are more of a threat. This makes fine sense to me. Why would one reason differently about Google? It looks illogical to me.
Google is a company. Google is optimized for profit, not data privacy. Quite the contrary, of course. And that isn’t changing any time soon. Right now, they have a lot of surplus, but that can change, which will effect the nature of their optimization’s. For that reason, we should consider the incentives since they are evidently the core motivation of Google’s behavior.
If I’m not mistaken, you are encouraging others to trust an unrelated entity known to be incentivized against their best interests. Sounds like a tough sell to put it lightly.
This reads like self-satire.
Quite a huge difference there.
Saying it's fine for Google have so much power just because they are not working like Facebook, is stupid. History repeats, but we never learn our lesson.
This is kind of dumbing down the issue, but: anyone not well-versed in implications of privacy violations would feel way stronger when claiming "Mark Zuckerburg is partly responsible for Donald Trump becaming president" versus "Google, Facebook, Amazon, Apple and Microsoft have data which will make you more susceptible to spending slightly more money [...on something you don't actually need]"
I'd recommend you try and spend more time with 'regular' people rather than tech bubble then. What you're seeing here is this knowledge breaking further in to the mainstream.
Add a sprinkle of righteous outrage at the unethical tactics of Cambridge Analytica and how the Trump Campaign was able to use data that the DNC would rather have exclusive access to.
"Regular people" don't care that their data is hoarded, they only start caring when it is framed nefariously (and disingenuously) by interests like the above.
If the framing is a good or bad thing is just a matter of opinion. A 'good' way of flipping what you've written is 'we've finally found a way to break through to regular people about these issues on a level they understand and resonate with'.
To call general articles on websites like cnn.com "targetted influencing " is a bit of a stretch.
Facebook has been too slack, and the good part about this whole thing is that they may finally might get their sh*t together. At least they have the power to bring this under control, as the various decentralized alternatives being touted here on HN won't have.
> To call general articles on websites like cnn.com "targetted influencing " is a bit of a stretch.
Yeah, well. Depends on your definition of targeting, but influencing it is. And as usual, how good or bad you think that influencing might be depends on if you like what you are being led to believe or not.
When the good tribe does it, it's "remarkable insight into the political base and clever use of modern technology", when the bad tribe does it, it's "disturbingly sophisticated targeting and an automated violation of consent". Really, go read the write ups about previous democrat campaigns, the narrative was of tech savvy modern progressives leaving the conservative old timers in the dust.
Russel conjugation is the favorite trick or the press today as they hawk their narratives:
"I am trying to get an important message out. You are running a political campaign. They are spreading harmful propaganda."
But 99% of harvested data is gathered with only proxy consent of 1% of the users, and most of either group is unaware of what's happening. Ignoring this ratio in order to haggle about exactly how the 1% was or wasn't tricked is entirely beside the point.
The bigger problem with this whole affair is that people correctly diagnose a breakdown in the mechanisms for forming consensus reality, which makes a lot of information suspect. This should make you question your in-groups' world view as much as the out-group. But instead of going back to primary sources and reevaluating what they know, people only double down on it more, and use it to justify why the out group is even more clueless/insidious than before. But one of the biggest hallmarks of propaganda is that the enemy is both horribly inept and terrifyingly powerful at the same time, swapping between the two seamlessly to serve the current narrative.
The coverage in my country has been more about castigating Facebook et al and both major parties have copped flack for their voter-intelligence operations.
Another thing: Did you know that facebook recorded your phone calls (time and recipient)? Or, it sold your personal info to brands for marketing outside of facebook, say by email?
https://www.icloud.com/#contacts
Even many games collect this information. Even really, really popular ones.
https://techcrunch.com/2016/07/11/pokemon-go-wants-to-catch-...
And with graph theory this means that if they got, say 10% (more likely 1% or so) of people to do this, they can reconstruct 99% or more of the total graph easily.
Hence the constant astonishment by privacy advocates that actually watch their own usage. "I don't use a smartphone and yet they figure out the email addresses of people I only ever call" type of comments.
Meanwhile government organizations have become famous in recent years for subpoenaing this information at the drop of a hat ... especially for divorces, but even for commercial conflicts (e.g. non-payment).
Everybody's in on it and this fight has been fought ... and comprehensively lost. The justice system is not going to let this source of information go, and that means companies aren't going to let it go.
You just can't have applications in the cloud and privacy, because the cloud means that aggregating the information from many sources is easy. Not that it isn't theoretically possible, but it just doesn't work in practice.
TOS for games and social networks like Facebook may mention they access this information but it's not their sole purpose and users are may be surprised this is happening.
Also, at least in the case of iCloud, contacts data is encrypted in flight and at rest. Apple doesn't have access to the data, and can't be shared with authorities even under subpoena.[0] Again, I don't know the situation with Google Contacts. I agree that the situation with games and social networks is much more problematic and something to be concerned about.
Yeah, there are definitely concerns when storing information on others' servers, but it's also important to weigh them appropriately. That said, depending on your level of paranoia, you might not accept anything anyone says, and that's your choice.
So this still requires you trust Apple, and any organization that can compel Apple to take action, to not break your security. This, of course, includes any organization that can subpoena Apple, which due to international cooperation includes quite a few organizations.
The ONLY person that can be entrusted with information and be legally protected from subpoenas is you yourself, and your lawyer (and even then technically only when actually representing you, although I don't think that line has ever been crossed), and even that only applies within the US. I agree that Apple does seem to have had some success with this information, has not released such info -so far- in a public request (there are, however, a number of non-public channels for subpoenas).
If I were to ask you to enter your bank information on a website with javascript that encrypts the information, then sends it to the server under my control, end-to-end encrypted (the server does not know - independently of the frontend - the encryption keys. Of course the whole system still does know the information), would you trust that ? Of course not, as I control the frontend and the backend, and therefore I can still decrypt it. I can change the frontend code to send me the unencrypted information (or worse - the encryption key the backend does not know - as that would give me access now and access to any future updates), same trick as with LVM encryption.
Maybe I even need you to visit the site before I'd be able to decrypt it, but I hope you can see that I can still access the information if I control both, and when you decide to entrust information to that you should still decide if you trust me, and anyone who can subpoena information from me. The only difference is a few extra steps for me when I want to access the information.
So far Apple's argument is that it would be unreasonable ("onerous" I believe is the legal term) to demand they actually execute those steps. We don't know if that argument held up in the non-public channels (there does seem to be a compromise made [1])
People think that if you have LVM encryption on a disk it can't be copied without having access to the encryption key. That's wrong, of course I can copy it, I just can't read it unencrypted at that point. If I then install a boatloader that uses a side channel to send the encryption key to me (the 128 bytes of the key, not the actual data on the drive) and from that point on I have access to the information I copied earlier. Note that "protected boot" doesn't actually protect you either. I simply install a bootloader that looks exactly like the official bootloader on screen, you enter your password, it simulates an update or whatever, replaces itself with the official bootloader again, and reboots. Presto, I now have access to all your drives and you're none the wiser, and the only thing I needed was physical access to the information (in other words, only the exact same thing I would need if it wasn't encrypted at all).
[1] https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...
So, only software you compile yourself, and never storing data on servers you don't own? How about hardware, including chips, from third-parties? Trusting encryption algorithms others have certified? How far does your trust extend? Is it reasonable for others to have different levels of trust than you?
That's why I'm saying that you only need to be watch out for cloud software. Local contact storage is of course fine.
It's just that neither android nor Apple/ios has that.
Contacts has code in it that is explicitly designed to expose this info (to provide features found useful by many Apple customers of course). And we know that the safety guarantees are somewhat noncommittal (and I would argue at least a bit misleading).
And that's enough, if you want to avoid giving out this info, I'd use other tools to communicate.
Only that it appears you're misrepresenting the situation. I would ask the same of you as to why it's important to continue to rail against Apple and Google to make incorrect claims and build straw men when those claims are pointed out. Here, you again shift your position. Initially you talk about cloud storage for contacts, and it's not an option to not use the cloud for storage. When I point out that that's wrong (at least for Apple), you retreat and now only talk about contacts in general. If I'm wrong about anything I've said, please point it out. If I knew more about Google and Android, I'd fill in those details, too, but I don't.
> "let's just say that I'm pretty sure I would just avoid using a smartphone all together for anything important."
If your point is you don't think using a smartphone for anything important, that's fine, and I completely agree that, depending on your threat model, smart phones may not be a good option. But you don't need to make false, misleading, (or perhaps just uninformed) claims about specific features. That just undermines your point. If you're coming at this from an op-sec perspective, that requires a particularly calm and dry-eyed look at the situation, as any misrepresentation likely has severe consequences.
Start here:
Spend $1000's a year on sites that are still highly invasive. Using blockers and disabling js often breaks them. Does this business really need to send my data off to a dozen 3rd parties to upsell me on a drillbit set?
If you didn’t pay, you are the product.
If you did pay, you may or may not be the product. But that’s not covered by the trope.
Why do it? Because they can?
Without Javascript it would not be as easy.
With the help of the "modern browser" and its defaults, its like shooting fish in a barrel.
The original HTTP/1.1 RFC has some reasonably low limits on simultaneous connections; todays ad-sponsored browsers ignore them.
Turn off Javascript and the web marketing Rube Goldberg machines begin to fail.
Most web pages try to coax users into turning on Javascript, or even installing a different browser.
At this point, a web developer will jump in and try to convince us the web cannot work without Javascript.
This is false. There was e-commerce on the web before Java1 or Javascript.
1. Java began life as a language intended to be embedded in devices. It was repurposed to be a scripting language for the web. That was a failure.
Javascript is a "success" but in the ways that it is abused, it can be every bit as annoying as a 1990s Java applet.
Why?
I’ve been a webdev for 20-something years, and it sure didn’t used to be the tradeoff.
When you have systemic rent-seeking, any sort of gift-economy is priced out.
Another resource: https://en.wikipedia.org/wiki/Signal_(software) happens to come from a completely-free-of-3rd-party-ads-yet-free platform…
It's good to be wary, but the idea that nothing is ever free is actually wrong and helps make people think they have to give up something or pay etc. even when they don't need to. We need to get beyond "How can it be free‽ There must be some catch!" and to the reality of just "Is this really free without a catch?"
Because we should be wary but not give into the idea that free is actually too good to be true. Things can actually be free, and people can actually be pro-social in their motivations.
Paid for by Brian Acton's conscience.
My ad blocker blocked 20 scripts, the page somehow managed to still load something from facebook.com--which was the last script to load and froze the page, and then a video started playing automatically.
Doesn't look like CNN can preach anything.
The author suggests that the key difference now is GDPR compliance will ultimately force the public to routinely pay attention to the personal data industry.
While facebook is bad, Google and Android is far worse. Singling out facebook without comment on the unrestrained greed and ethical vacuum in the engineering community that makes this possible seems not only insincere but also feels like a hatchet job by vested interests, happy to replace facebook with their version of the 'users are dumb' and laugh their way to the bank.
The community here is deeply intertwined with invasive practices and implementing and defending them for years now and cannot simply wash their hands away.
World is about money. You have to realize that that best money come form people who don't give a f$#k. They click on ads, they give their personal data, they buy the most, etc. We can rant as much as we want that Apple does not give us PRO hardware that Microsoft does the same but most of their income is from ordinary people who just use their hardware/software.
"so dumb. of course the founder of a competing company would criticize them"
Or: "what was the scandal?"
How on earth, though, is this "big news"?
In any half serious newspaper this isn't big news but more of a reminder of a story they ran when Facebook launched this shit.
The question is why is everyone picking on FB? In china or russia, Xi or Putin orders the institutions to attack so and so and the media/government hounds an entity.
What happened with FB? Was it just an magical organic process where the media, government, etc all decided to attack FB all at once? That's quite a coincidence. What's even more interesting is how britain, canada and western europe also joined in as well.
I'm not a fan of FB. I've never had a FB account and never will. But what has happened in the past year vis a vis FB is quite astounding.
I don't think there has been a day on HN the past year where we didn't have a hit piece on FB.
The Wikimedia Foundation (Wikipedia, et al) bends over backwards to explicitly avoid harvesting and hoarding long-term analytic information that can clearly identify users and their patterns, even internally. Also, the (very minimal) level of co-operation with state actors (etc) is tracked and published at https://transparency.wikimedia.org/ .
So it takes peoples time, attention, and details on top of behavioral monitoring.
In contrast, Google provides me with a very competent productivity suite, a superb photo-managing software navigation, maps, aggregate traffic data,and a host of tools to actually build a business and educate myself and others.
Plus i get enterprise class security for my account and -arguably- the best web email service.
The day theres a data breach or in this case a breach of trust, im more likely to view google in a better light and give them the benefit of the doubt. Facebook gets my contempt and scorn.
Then don't use it. I don't use it. It's not that difficult.
> In contrast, Google provides me with a very competent productivity suite, a superb photo-managing software navigation, maps, aggregate traffic data,and a host of tools to actually build a business and educate myself and others.
This reads like cringe material from google's social media team.
> Facebook gets my contempt and scorn.
Well both google and facebook get contempt and scorn from me. But then again I don't work for google or facebook so I can be somewhat objective.
> facebook is performing one big MITM
Is it a MITM attack if you choose to use that platform? That's like saying Uber is kidnapping, because you're in someone else's car. The whole point of MITM is you don't know there's a MITM.
> shameless siphoning
Accurate.
> selling all information to nefarious bidders
The data by CA was not sold, it was stolen. Facebook sells targeted ads.
They also build 'shadow profiles' of people who don't, though.