Comment by atwebb | Hacker News Reader

Comment by atwebb | Hacker News Reader

Parent Full thread

For people I've discussed with, the surprising part is that they can do anything with it. You and I know that (currently) if someone has the data, they'll scrape/manipulate it at will.

I believe, a reasonable person, would expect the limits of the access grant to end with the purpose of the app (a quiz) and not extend any further.

Most contracts/agreements have limits and this one is implicit in the working of the app. It is in no way clear that the app is earning it's money by selling/manipulating the data you're giving access to.

Additionally, it's disingenuous to ignore that a subversive app will make up/add features in no way benefiting the end user but for the sole purpose of scraping messages.

Intent is important, for some of these apps it is clear the only intent was to harvest data en masse.

Yes the user agreed to grant some permissions so a quiz could be taken. It cannot and should not be ignored that the app developer purposefully did not disclose the true nature of the app. This wasn't an accident. They didn't trip and fall into the data. They made something appear benign when it was really cancerous.

I think this is a concept that I find myself perplexed about. The defense of a lot of the use of acquired data is, "but you opted in!", which is of course true. However, when we give software access to things it's usually expected that the access is to conduct tasks pertaining to why we would want that software in the first place. For example when I use a web browser I give it internet access so that I can browse the web, or whatever. Not so that it can phone home and tell a company what websites I've been browsing. I feel like the defense, "yeah, but you opted in to allowing it access to the internet!" is a bit misleading.

Perhaps the personality quiz example that seems to be the cornerstone of this whole CA story is different: I'm not sure what your expectations would be allowing such an app access to your messages would be. However, there are quite a few examples of strange behaviour of software running on phones that it's pretty clear that isn't what you had in mind when you opted in. An example that comes to mind is Facebook apps activating your microphone to log conversations with people you have in person (I'm not sure there is any proof of this one yet but would anyone be surprised?): when you opt in to microphone use it's so that you can make calls on the app not to invite spying. "But you opted in!" Yeah, okay. "Sorry!" - Zuckerburg

Another thing worth thinking about is terms of service for websites. Most people don't read them, they just click accept because it's required to use the website. Most assume it's just standard legal speak that most sites use.

I feel like private messages are something that should never be granted to third party apps on Facebook. People just click allow because they assume whatever is listed, is being used for the purpose of the application.

I mean, just because I give the keys of my apartment to an electrician for a day doesn't mean they can use my apartment as they please and host a party for all their friends in the afternoon before I get back.

Yeah, but you just signed a contract that allows him to host a party in your apartment. So it means exactly that.

>Yes the user agreed to grant some permissions so a quiz could be taken.

You had to authorize the messages permission separately from all other permissions. If you didn't want your messages accessed, you simply declined that permission. This one's on the user, not on anybody else.

You're ignoring the 'reasonable person' argument which is important and forms a significant part of the legal system re: understanding contracts that you are signing. The reaction by the public and HN as a whole is perfectly justified. The permissions dialog is less interesting than the title of the app which wasn't "App to steal and repackage and sell your data you idiots!". In net, the app didn't tell the truth about itself, aided and abetted by Facebook's idiocy.

The permissions dialog is less interesting than the title of the app which wasn't "App to steal and repackage and sell your data you idiots!".

The Obama For America app stole data from about 4x the number of profiles that this app did - about 200 million people, less than 1 million of whom gave them any form of consent, much less informed consent, as was given here with the messages permission. Do you have an issue with that app’s title?

Where did OP claim they didn’t have an issue with the Obama for America app?

I strongly disagree - this one is on Facebook. For building a system that even allowed a "quiz" to ask for message permission in the first place.

Everybody (and Facebook best of all) knows that users will click [Accept] or [I've read the 27 page T&Cs] or [I hereby give Cambridge Analytica my firstborn child] without even slowing down to consider any consequences - in return for another tiny dopamine fix.

Sounds like both sides got what they wanted.

You are willfully ignoring the strongest point in my statement.

Reply on news.ycombinator.com