Hacker News Reader

Comment by Lionsion | Hacker News Reader

> For the most part 'shadow profiles' are dead as of 2013-ish when OpenGraph v2 came out.

> Facebook knew about shadow profiles and they already addressed it.

No, I think you're confused. IIRC "shadow profiles" are the profiles Facebook builds of non-users based on data those people didn't share, like their friend's contact lists.

The shadow profile issue has nothing to do with Facebook's public API. It's all about what data they're collecting and what they chose to do with it, regardless if the results are accessible to 3rd parties or not.

There are multiple separate problems with Facebook, Cambridge Analytica is just one (and the one Zuck probably wants to focus on because it makes him look the best and is not structurally threatening to FB's business model).

View on HN

> IIRC "shadow profiles" are the profiles Facebook builds of non-users based on data those people didn't share, like their friend's contact lists.

From a development standpoint I clearly defined the 'shadow profile' you just explained.

Facebook provides OpenGraph APIs that app developers can access personal data that is granted by a user. Previously to OpenGraph v2 you could access all friend data and pull down the whole social graph for any friend level shared data through one initial person, those were shadow profiles. For each individual permission you only needed one friend to agree to it if the other friend shared at the privacy defaults of friend access to everything.

That has been shut down at of OpenGraph v2, look back on that time where they added it, lots of scammy sites were mad they couldn't build shadow profiles anymore. I built games on Facebook at the time and this was obvious to many game companies that were just there to collect data on users to sell not about the game. Remember all the birthday apps and zombie infection games? All data syphons. Facebook shut it down back then, not really because of privacy but partly, mostly largely because they were scared other companies were getting access to the whole social graph like many did including Zynga, CA, others.

Were 'shadow users' a problem, yes, but go try to pull friend data or personal messages today, those are unique permissions you have to be granted by each user that you access and for each action, you also have to undergo a Facebook app review and justify use of them like you do with background geolocation on Apple.

Part of this attack on Facebook is to bring in the government filter and firewall [1] as an extension of FOSTA / SESTA and most of these issues are resolved at Facebook already.

If you don't want a government censorship filter [1] that the ISPs and large companies like Facebook will run, then understand that this is opening that can of worms.

[1] https://www.wired.com/2017/04/internet-censorship-is-advanci...

EDIT: for the people arguing details about 'shadow profiles'

> So what is a Facebook shadow profile, and where does yours lurk? [2]

> A Facebook shadow profile is a file that Facebook keeps on you containing data it pulls up from looking at the information that a user’s friends voluntarily provide. [2]

> You’re not supposed to see it, or even know it exists. This collection of information can include phone numbers, e-mail addresses, and other pertinent data about a user that they don’t necessarily put on their public profile. Even if you never gave Facebook your second email address or your home phone number, they may still have it on file, since anyone who uses the “Find My Friends” feature allows Facebook to scan their contacts. So if your friend has your contact info on her phone and uses that feature, Facebook can match your name to that information and add it to your file. [2]

[2] https://www.digitaltrends.com/social-media/what-exactly-is-a...

that's not what shadow profiles are

Explain how pulling friend data through one individual into a 'shadow profile' that they themselves didn't give you access to isn't a 'shadow profile'?

What is YOUR definition of a 'shadow profile'? If it is the same as the guy above we are talking about the same thing just from a more dev/api perspective.

Yes Facebook ALSO developed user profiles who had never joined Facebook but those are ALSO 'shadow profiles' and not the majority of the data groups like CA used. They used more 'shadow profiles' like I mentioned. They connected users across many apps via their global facebook id and harvested users friend data as well.

Why don't you go google "shadow profile" and clear this up? The term is not typically used to refer to what you seem to think it means.

I know what they are, why don't you describe it to include all types. I clearly highlighted both types in my other reply to you.

A 'shadow profile' in any system is profile information attained about a user through indirect means like through some friend permission or contact list pull. Are there different types of 'shadow profiles', yes. Is Facebook still doing it? Yes. Can app developers still build them via the API? No not as of OpenGraph v2.

The non public information they build on you like call logs to later match up to real people is bad but you can't just go grab all that data from Facebook like CA did in the past before. Facebook actively doesn't want other entities having that data as it runs their entire ad platform and is their gold mine.

Here is a source since you are arguing semantics about 'shadow' profiles/users:

> So what is a Facebook shadow profile, and where does yours lurk? [1]

> A Facebook shadow profile is a file that Facebook keeps on you containing data it pulls up from looking at the information that a user’s friends voluntarily provide. [1]

[1] https://www.digitaltrends.com/social-media/what-exactly-is-a...

> Facebook provides OpenGraph APIs that app developers can access personal data that is granted by a user. Previously to OpenGraph v2 you could access all friend data and pull down the whole social graph for any friend level shared data through one initial person, those were shadow profiles.

So you're saying if someone uploaded their phone's contact list to Facebook, you used to be able to access that data (about their contacts) from Facebook's API?

Just to be clear, the person with a "shadow profile" doesn't necessarily even have Facebook account.

I still think you're mistaken and trying to map "shadow profiles" to the profile scraping that was done by Kogan and Cambridge Analytica.

'Shadow profiles' are anything that Facebook got without asking for direct permission to get.

It could come through a friend list on Facebook back when you could do that or through harvesting the contact lists on mobile. Both are shadow profiles and both weren't granted access but Facebook got to it (or app developers did) via a friend permission or from the native mobile apps contact list harvesting and tracking.

The most you could get about a user that wasn't part of Facebook was their email, name and anything in their contact list and they probably eventually tracked that user through various means, many companies still do this and other bigs did as well such as LinkedIn. Even on LinkedIn though, one initial user had to use their app or their import feature to get to the 'shadow profiles'. Most 'shadow profiles' came from initial granting by a 'friend' or associate.

They are both 'shadow profiles', anyone that got their data pulled without being directly asked is one. Facebook shut down the friend list and global user id tracking/correlation nearly 5 years ago. Most of the problems were back in 2007-2014 when app development on Facebook was bigger and games were huge there because of this.

Reply on news.ycombinator.com