Comment by JumpCrisscross | Hacker News Reader

Comment by JumpCrisscross | Hacker News Reader

Parent Full thread

> It's important to recognize that this is not an exploit or high-tech exfiltration: it's extremely well-documented

This argument was used last time [1]. It didn't work then and it's a silly excuse now.

Users gave Facebook their "name, email address, age range, gender, locale, and profile photo" [2]. Some of them marked those data private (i.e. only for friends). Those data were shared, without the users' informed consent, with third parties through the log-in function.

Documenting a breach doesn't unmake it a breach. And a breach can be a breach without involving any technical exploits. This was a breach.

> Seeing this and being surprised is like watching a teen movie where the gossiper...

People didn't realize Facebook was selling their secrets. That may strike you as naïve. But it's this asymmetry, between specialists (e.g. Facebook employees and technologists at large) and non-specialists (i.e. most of Facebook's users), that drives the need for regulation.

An analogy can be found in lemon laws [3]. We protect consumers from specialists (e.g. car salespersons) taking advantage of the customers' reasonable ignorance of cars. Facebook is selling the world lemons and mocking them for buying.

[1] https://www.cbsnews.com/news/facebook-cambridge-analytica-wa...

[2] https://techcrunch.com/2018/04/18/login-with-facebook-data-h...

[3] https://en.wikipedia.org/wiki/Lemon_law

You’re either misunderstanding or misrepresenting what is happening here.

The website or app implements Facebook Login. When a user visits that they can choose to share their profile information with that app. Through poor security or malicious action that app leaks that information to third parties.

You can’t control data on systems you don’t own. So Facebook’s options are either (a) limit how platform apps use data via non-technical/legal methods (b) better educate users on the implications of sharing their data with external apps, or (c) refuse to share any user data with external apps.

We’ve seen the first option fail with the Cambridge Analytica scandal. Educating users consistently fails. And before Facebook built a platform, they were accused of building a walled garden.

It's almost like it's a problem that cannot be solved without outside intervention.

Are you suggesting regulation could have helped in this situation? Do you believe the problem is with Facebook sharing data (which they did with the user's permission) with an app? Or with an app failing to secure the data? Or with a third-party taking user data without permission?

> Are you suggesting regulation could have helped in this situation?

Facebook doesn't give a shit about its users. And for that I don't blame them. They're fighters. When they went public, so many assumed they were dead for lacking a mobile presence. Time and again, they've been called out as moribund and time and again they've won. That takes--and develops--thick skin.

That thick skin is now a hard head obstructing their view of the truth. When they drop the ball, it is never their fault. Someone is mis-defining a term, users aren't reading fine print, lawmakers are being mean, et cetera. The onus is put on us, the public, to determine how our rights can be balanced with their business model. As if their business is a given.

If Facebook were liable for repeatedly losing our data, for repeatedly refusing to tell users what it does with what they give them, for constantly lying about what it's doing and going to do, this would stop. Or Facebook would stop.

Neither users nor advertisers can unilaterally disengage. Not in meaningful numbers. Facebook is too powerful. The only solution is for it to be broken up.

Do you believe in the rule of law, or do you expect everyone to take the "moral high ground" (however you want to define that) all the time just because they should? Pick one or the other, but not both. Hint: one of the two is a fair and practical approach; the other is a pipe dream built from excessive virtue signaling.

Should Facebook be 100% held responsible to the law? Of course.

Should some laws be updated/created to help fill gaps where we might need more privacy? Possibly.

Should Facebook be held to some nebulous moral standard of what some people want but don't have the will power or public support to codify into law? Absolutely not.

Too powerful? If people actually cared more about privacy, then either the law would get changed (which is happening in some places), or Facebook would lose market share and be forced to make changes from market forces alone. No need for governments to arbitrarily pick winners and losers.

>Do you believe in the rule of law

Facebook Ireland Ltd. Does.

> Pick one or the other why not both?

> Facebook would lose market share and be forced to make changes from market forces alone

"Market failure is a situation in which the allocation of goods and services is not efficient" [1]. They are known failure modes that free markets suffer, and must be defended, from. Laissez-faire doesn't work.

[1] https://en.wikipedia.org/wiki/Market_failure

Found the Facebook employee.

All three options failing? So basically the very premise of Facebook is broken if we wish to uphold this value.

I'm not sure you can see this as a persistent failure in terms of FB (and similar) fighting against an unstoppable tide of ignorance. It's far more easier to see Facebook (and similarly Google with Android, for a very long time) sabotaging the effort from the start.

A user absolutely can choose what they share with Facebook, but Facebook makes no effort to tell you why you should edit the defaults. Instead, you have to click an edit button, and look at a list of checkboxes, and understand what each thing means, and double and triple check that this doesn't override your personal privacy preferences or have some other unintended side-effects. The default expectation from Facebook (and similar) is biased heavily against the user, purely by virtue of it being opt out.

It depends on users not being educated well enough, and giving them a good reason to care less about being more judicious with their profile.

Actually some apps wont allow you to login if you change any of the checkboxes.

> You can’t control data on systems you don’t own. So Facebook’s options are either (a) limit how platform apps use data via non-technical/legal methods

Under GDPR, as a data controller, you cant share data with another organisation without ensuring that they follow the same rules that you have set out for processing data. This may get interesting in Europe.

> Through poor security or malicious action that app leaks that information to third parties.

It's neither poor security or malicious action. Web site isolation rules by design give full privileges to any third party script the website includes. If a website uses facebook login, all third party scripts can access the facebook user name.

> And before Facebook built a platform, they were accused of building a walled garden.

That's not any kind of argument for the privacy-diluting practices of Facebook. If Facebook were a totally closed environment that shared your data with nobody, that's a problem for Facebook and the private companies who would prefer to exploit that information, not for the users, who at this point would very much prefer Facebook to be a "walled", but but in actuality a "regulated", garden.

The "not an exploit", I think, means something like "this is not, from Facebook's perspective, a malicious or unauthorized use of their platform and services".

In other words, it's not taking advantage of some accidental bug Facebook never intended to have; it's Facebook's system working as Facebook designed it to work.

Now, from the perspective of an individual person whose personal information was collected and distributed in this fashion, it certainly is unexpected and likely unwanted. But calling it a "breach" or "exploit" of Facebook implicitly covers for Facebook by implying that Facebook is a victim of some type of attack here. Facebook was not a victim of an attack.

> People didn't realize Facebook was selling their secrets.

Facebook doesn't sell data, it sells ads.

> Facebook doesn't sell data, it sells ads

That sounds like selling data but with extra steps.

They basically provide the data for free so you can buy more ads.

When you say Facebook is "selling data", I think most people would understand it to mean that advertisers can go to Facebook and buy a list of people who eat at McDonalds. That's very different from the opaque ad targeting Facebook actually sells.

There is a connection between the ad targeting information and the eventual anonymous click through though. You only need to connect that click to a real identity via either self disclosure (newsletter signup, social login, etc) or pushing your metadata through third party data brokers.

In the end you have a click associated with an advertising campaign linked to a real life (or even pseudo) identity.

Are you implying that this is a problem that arises specifically from Facebook's targeted advertising? I genuinely don't think that's the case.

It doesn't really matter if ads are served to everyone or if they are shown only to a targeted demographic - either way, only people who are interested will click on them. Also, I think it is safe to say that, roughly, it is only the efficiency of clicks per ad-view that will increase if one uses targeted advertising.

So, if the act of clicking a targeted advertisement does not in itself somehow "transfer" any more identifying data than a click on a regular ad would, which I don't think it does, then what's the problem?

Facebook is incentivised to collect and collate product data because it can then sell targeted ads for those humans. As long as the most cost effective path to those targets is through Facebook, and the aggregate target volume is high enough they will make money. Distributing the login data is just advertising.

That argument goes both ways: When you say Facebook is "selling ads", I think most people would understand it to mean that advertisers can buy ads like in a paper magazine. That's very different from the tracking and targeting ads Facebook actually sells.

“Hey, I heard you’re opening a baby store. Did you know John and Mary are expecting? Here’s their phone number, you should call them up.” vs. “Hey, I heard you’re opening a baby store. If I know anyone who is expecting I can let them know.”

But really your second example ends with "But when they do come inside you'll know I sent them and you can ask them their name yourself."

Same knowledge as your first example (names, expecting). I do admit you only get the information from people who come into the store.

They’re vastly different. John and Mary can choose exactly who they want to reveal information to.

Not on the modern web.

How so?

Signals. Searching for specific things, emails you're receiving in Gmail, videos you watch online etc.

Given Target was able to figure out someone was expecting based on behavior in their store, back in 2011 [1], even though they dont have a loyalty program, imagine what can be done with so many trackers that are on the web datamining your behavior from one website to another.

[1] https://mobile.nytimes.com/2012/02/19/magazine/shopping-habi...

But what signals can third party domains get if third party cookies are disabled?

Is fingerprinting so good that cookies are now irrelevant? I mean most mobile devices have the same screen sizes etc.

Fingerprint coupled with IP tracking is pretty good.

> emails you're receiving in Gmail

I'm sorry but if you care about privacy, you shouldn't be using Gmail.

The original assertion that advertising and data sharing are equivalent. But even in your examples the information is still fire-walled.

Google can know that you're expecting, because of a congratulation email. Facebook can know you're expecting, because of a life event. Arbitrary companies can't know who their baby store ad is being shown to.

You can argue that Google and Facebook are too big, and data being shared between YouTube, Gmail, Google Adwords, etc. is suboptimal. But that's still better than a company that will freely sell a database of information to be resold, mixed, etc. forevermore.

Right. "You can ask them their name yourself"

That doesn't mean they are going to give you their name.

And if they choose to give you their name, it's their right and responsibility.

It's important to remember, because someone might propose a law against a social network selling data. It could be heralded as finally giving users privacy. And Zuckerberg will be very happy that this PR mess has gone away

According to this article (as well as the Cambridge Analytica stuff) it doesn't sell data, it just gives it away.

Well it’s more like an exchange, because in the process they gain the ability to suck up virtually every piece of data you post in the external website because you basically hold them your key.

That why I lied to Facebook about all the profile info.

Reply on news.ycombinator.com