Hacker News Reader

Comment by varenc | Hacker News Reader

I don’t get some of the concerns about this.

Take the Facebook app that Huawei built using their special API access to offer Facebook on their devices. Their implementation was supposed to store the Facebook data locally on the phone. Of course, there’s a concern here that Huawei, a company with strong ties to the Chinese government, could still be siphoning Facebook data off the phone despite that breaking their agreement with Facebook.

But if you don’t trust the device manufacturer and their operating system, what does it matter? If Facebook existed solely as a mobile web app on the phones or as a Facebook Inc produced app, you still have to trust Huawei to not be siphoning off that data. If you don’t trust Huawei, you’re at risk regardless of whoever made the software you use on their phones.

(The device manufacturer FB implementations that stored data on non-FB servers are a different situation though...)

View on HN

This is one of the strangest defenses for Facebook - everything works as expected.

Cambridge Analytica downloaded data? The API worked as expected and people should have been smarter to not share data.

Facebook has special APIs for phone manufacturers? The API works as expected and people shouldn't buy phones from the manufacturers they don't trust.

But, here's the thing - FB shouldn't have allowed this at all. In one part, security is about making things harder for people to break-in. Currently, manufacturers can use official API to siphon off data to non-FB servers. Sure, manufacturers could run some kind of MITM attack to achieve something similar. But having an official API is a strict no.

>> people shouldn't buy phones from the manufacturers they don't trust.

You're literally hosting your life on it. You should indeed not do this.

True, but let's say you bought a DSLR camera, wouldn't it irritate you if the manufacturer was secretly uploading your pictures elsewhere for others to use against you? To most, such practises would seem beyond intrusive. I sort of feel that this is what's happened here, albeit, in a subtler manner.

> secretly uploading your pictures

What if instead of it being a secret, it was a big button with “upload photo to Facebook” on it?

If Facebook outsourced the implementation of that button for each different type of camera to the respective camera manufacturers, rather than implementing it themselves, would that change it from a non-problem to a problem?

Is there any evidence that has happened? That sounds like it goes directly against the APIs terms of service. If device manufacturers are doing that, they could equally upload your passwords from the browser.

>. If device manufacturers are doing that, they could equally upload your passwords from the browser.

And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful.

In OSes you can theoretically attack any app, but it is a pain to even debug them with different versions, changes to their custom storage formats, etc.. Unless they build an ABI, document which parts are stable and give it to you.

FB can tell you about it but there is no law mandating anti-hijack security features. Nevermind that the spyware can be inserted in the client itself or in the official gateway supplied by Huawei, necessary "for technical reasons", making it completely invisible.

Once the manufacturer goes outside the licensed API and uses your credentials to do more than Facebook allows, it commits an actual crime against you in most jurisdictions.

I'm sure people will be investigating and finding a few examples of on phone API violations then transferred.

My bet: no criminal cases. Facebook charging less than 50k for violation of an API contract on data that isn't theirs, if numbers are disclosed. No standing for users except in a class action that get $5 or less on a new phone or $2 or less as a check.

> And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful.

With the API, presumably there's an auth token that is only stored on your device. Facebook should also be able to detect unusual access with an auth token. Really, the auth token makes it easier to detect funny business than a username/password.

What if your friend does this and gets your data, even though you got the safe phone. Do we now have to be aware and affected by the technology choices of all of our friends? The problem here is that you are affected by not just your decision but the decisions of anyone who has access to your data on Facebook.

There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them. You can't rely on capitalism to resolve the Prisoner's Dilemma here. This is why Right to Repair legislation has become necessary, for example.

> There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them

Apple is a pretty good actor in this regard though, and they're clearly betting a lot on markets to realize the attractiveness of that.

> This is why Right to Repair legislation has become necessary, for example.

I'm not sure I see how a "bad" actor (maybe like Apple) in terms of the Right to Repair is relevant in the context of trusting device manufacturers. If anything I think Apple's (somewhat self-serving albeit not completely detached from reality) argument would be, and has been e.g. https://news.ycombinator.com/item?id=11047359, that their control of device repairs and servicing decreases the risk of malicious software or hardware components being installed.

Apple is not a "Pretty good actor". Better than some, yes, but good? No.

Honestly, Apple's privacy move over the years is genius. Its going to be a long time, maybe never, before I buy something besides an iPhone. I don't even like Phones(in general) that much and Apples aggressive cable policies drive me insane but this is getting really scary.

That was an unusually balanced perspective in a debate that usually tends to lack much nuance here.

FWIW I'm partially in the same boat: I like Apple the company and I'm happy for everyone that likes and uses their products but I'm kind of incompatible myself.

just because something is true doesn't make it a good defense of facebook.

>people shouldn't buy phones from the manufacturers they don't trust.

People shouldn't put their pictures , and relationship status, and whom they know, and what they think, and where they go, and what they talk in private about, to a private company's service that they don't trust.

Oh, except for, they do.

Companies shouldn't intentionally mislead users about privacy and data use. They should be either trustworthy or held accountable for deceiving consumers.

A large part of GDPR's value is killing these misleading practices by exposing them.

Facebook never mislead anybody about how their data was being used. That's a lie the media is feeding everyone for some reason.

Zuck recently said their legal contracts required data to be deleted and therefore it was. That's directly misleading.

I hear nothing about people not trusting Facebook, other than from those who don't use it. But plenty of people who either trust them or don't care either way who do put their personal data and photographs on Facebook. It's only when stories such as Cambridge Analytica make the news that they then realise how their data is being used.

Who are you talking about that in one breath say they don't trust Facebook and in the next go and put their data on their servers?

How can Facebook protect your data from a hostile phone manufacturer?

They can... not enter into agreements to share data with them as is detailed in this article?

Is this a trick question?

You're completely right. Facebook should not have created APIs that could be used to re-implement a Facebook application. They most certainly should not have made such APIs available to companies that are anything less than completely trustworthy in every possible way.

Facebook's error was in believing that anyone outside Facebook could be trusted to author an app. I expected they know better now.

So if I consent for my data to be transferred, why I should be prevented from that?

Facebook wanted to do this so everything did work as expected, they have been doing it for a long time and built it precisely to be used just as Cambridge Analytica used it. The only problem came when it was used to help Trump. When it was used to help the Obama campaign nobody batted an eye. Facebook is a political agenda and getting more people involved and helping their favored campaigns is something they were very interested in doing; that is why they allowed this - not realizing it would bite them back.

https://www.investors.com/politics/editorials/facebook-data-...

The revolution is going to happen for stupid reasons, just like Louis XVI was executed after cooperating (mostly) with the revolutionaries for years. American politics and news takes are a form of heightened collective idiocy that leaves me convinced that we will only improve ourselves semi-consciously while stepping on a rake and having it nail us and the oppressed people of at least five other countries in the face.

However, it's high time for Facebook to face intense regulatory scrutiny. Mark has been unfair to us for quite a while, so I'm going to yawn if he complains when the tables are turned. If FB gets broken up or its profits get reduced, Mark can replace his tear stained clothing with one of the identical replacements from the infinitely deep closet his billions constitute.

> Mark has been unfair to us for quite a while

What a huge statement you’ve buried here and then glossed over. This is the crux of everything, of course. I don’t agree with this statement, but hey, at the end everything comes down to this one notion.

The threat is going from rather hypothetical to more and more concrete. The phone is an appliance that runs software. It would require some substantial effort to get around that barrier - reducing the risk of it actually happening.

Now we're seeing that it didn't require any baked-in compromise in the hardware, firmware, or Android distribution. It's available via API.

The difference is between having a window that's easy for a thief to break and giving the thief a key to your house and asking them to sign something promising not to steal.

I would like, at least, for a thief to have to put some effort into it.

This is a really bad analogy, and misleading. A better analogy is like Facebook is a bank with safe deposit boxes. I give my key to my phone, and then my phone goes and gets something from the box for me.

There is no window to break. My phone can take the key and send it to the phone manufacturer who can then get into my safe deposit box whenever they want. The only way having an API makes this easier is that the manufacturer's Facebook app is more obscure than the browser, but the manufacturer's browser can just as easily steal keys, and it's no more or less illegal.

Except that providing an API to a third party, without controls, makes Facebook complicit. They don't get to provide such an API to a third party and then disavow themselves of any responsibility what it is used for.

Whereas if the manufacturer backdoors the browser of the phone to steal or siphon data from Facebook users, Facebook's only fault is creating the unnecessary data hazard itself (which is merely irresponsible instead of illegal in the US).

As I understand it the API has controls. There's no fundamental difference between the APIs we're talking about and the web interface, except the API is easier to use programmatically.

And a lot of thieves won't break the window.

Once these issues become the focus of politicians, the technical details matter less. If public opinion is opposed to a particular issue, especially if that opposition is bipartisan, politicians will leverage that for political gain -- just look at zuckerbergs congressional hearings, was all about political points

However, that doesn't mean they'll actually legislate anything with teeth, depending on other factors like lobbying etc. pharma is a great example of this -- universally hated industry at the moment, lots of lobbying power at the moment, and probably lots of people lobbying against them (this is speculation, but I imagine the American hospital association and AHIA probably are endorsing the drug pricing = cause of US high healthcare spend narrative). Strong bipartisan political opposition to an industry + strong lobbying by the defending industry = political actions that are all bark and no bite

The mechanism really matters a lot - think how it would look if a vendor kernel trojan was found siphoning FB data, vs "accidentally" sending off some official-api provided FB data to their statistics servers.

"Trusting" or "not trusting" your phone is a very binary threat model. I don't think many tech-savvy people would say they fully trust their Android phone vendor. But you can count on the vendor's self interest to some extent, and basic competence in managing the risk to their reputation.

FB's special manufacturer's API included access to some of your friends' data, in some cases even when they had refused permission for it to be shared, so the concern is not merely with data that would have been on your device in some form.

What bothers me is that they don't allow me to download this data from Facebook's half assed takeout tool for experiment my Facebook data.

Do I have access to my friends contact information they choose to share with me? No? Why does the BlackBerry app have permissions that I (in data export) don't?

It’s pretty negligent to sell or give access to a company, someone else’s personal data with a handshake and wink that they won’t turn around and do nefarious shit with it.

So while you’re right, it’s also just kinda shitty and probably illegal or at the very least unethical.

My current employer has to maintain records on what their customers do with the product after the sale; they're a chemical supply company and it's a federal law.

Yes, but your current employer doesn't turn around and sell that info to any medium-to-high bidder. They also have a well defined and legitimate reason to use such data.

I have a hard time imagining Huawei siphoning data via MITM without someone noticing odd traffic and thoroughly nuking their PR.

This is different.

This isn't about apps putting buttons on devices or people trusting device manufacturers. FB has lied about how and when data gets disclosed, has intentionally not respected the privacy controls that users' set, and lied to Congress about the subject.

If this is an accurate tl;dr, then shouldn't facebook be liable for even allowing Huawei phones to access facebook at all even over 3rd party browsers? Any information going through any Chinese manufactured device might as well be at risk. All it takes is the Chinese government saying "hey Huawei, add a keylogger if you see the phone is activated on a US carrier".

I'm trying to say facebook shouldn't be responsible.

I think the "the data was supposed to be stored on the phone" thing is a little misleading.

I've never owned a Huawei phone, butwhen I looked at my Motorola phone five years ago[1], I found that it was getting Facebook data via a proxy service that Motorola had set up. This was probably partly as an abstraction layer, but do you really think no one in their marketing (or similar) department thought "as long as that data about their FB contacts is passing through our systems, maybe we should analyze it in some way"?

Even if they weren't explicitly collecting it, it probably ended up cached on their servers somewhere, and it was typically sent over plaintext HTTP (even though FB supported HTTPS), so someone else could have easily collected it too.

I've looked at a lot of mobile apps, and I don't think what Motorola was doing was at all unusual, but again, I haven't done a comprehensive analysis of other vendors.

I do agree that the vendor could always configure the phone to explicitly upload anything to them even if something like the FB APIs were accessed directly, but IMO that seems less likely than siphoning off the data as it passes through their middleware.

[1] https://www.beneaththewaves.net/Projects/Motorola_Is_Listeni...

So the basis of your argument is that you posit that device manufacturers are wiretapping their customers phones en masse (committing a felony)... but somehow this is a story about Facebook?

Huawei does not have "strong ties to the Chinese government." There is absolutely no concrete evidence that Huawei of such a relationship. Please stop spreading propaganda.

Are you serious? At this point we have to assume that every single Chinese company has strong ties to the Chinese government. Even if it doesn't have strong ties today, if Xi wants there to be strong ties, they will be there tomorrow.

It's frightening that this is downvoted so quickly - Xi has exactly this sort of unfettered power and more.

If we follow that thought it would seem to me it is the same in the US. I'm not saying it is okay for others to do it because the US does it too, but cleaning ones own house really should come before pointing fingers.

Are you saying the two governments are equivalent, particularly in limitations on power?

Is their management in China? If so couldn’t one argue that they are under the complete control of the Chinese government ?

Ah, I see, simply being headquartered in China is enough to make them an arm of the Chinese government.

That's some powerful projection. I mean, unlike the case with Huawei, there is extensive hard evidence of American telecom companies deliberately compromising their hardware to facilitate American spying. We know that the American government routinely intercepts American telecom equipment and compromises it [1]. We know that the NSA seems to conveniently have plenty of zero-days into Cisco hardware [2]. We know that all American ISPs and all major American technology companies provide the NSA with direct feeds for all their communication [3, 4].

So, it actually would be fair to say that all American technology and communication companies are under the complete control of the US government.

But the strange thing is that despite numerous investigations by multiple intelligence agencies and NGO nobody has ever found any of the millions of devices Huawei exports each year to be compromised. But the less evidence that's found the more Americans insist Huawei's technology can't be trusted. There's never any evidence provided and, remarkably, nobody even claims to have evidence that they conveniently can't disclose. There's just a series of directives and pronouncements by the government and the media that obviously Huawei is an arm of the Chinese government until everybody -- well, at least all the Americans -- believe it.

The moral of this story is that (1) like the accusations against Facebook, the accusations against Huawei are without merit [5] (2) the greatest threat to people's privacy and the integrity of global communication networks is and always has been the US government and (3) the American media will never, ever speak the truth about this simple fact until they are forced to by leaks.

But please, continue to freak out about Facebook and Huawei. It's clear

[1] https://www.theguardian.com/books/2014/may/12/glenn-greenwal...

[2] https://arstechnica.com/information-technology/2016/08/cisco...

[3] https://www.nytimes.com/2015/08/16/us/politics/att-helped-ns..., https://www.thedailybeast.com/why-verizon-is-happy-to-help-o...

[4] https://en.wikipedia.org/wiki/PRISM_(surveillance_program)

[5] Note here that unlike the US government Facebook has never, ever been caught doing anything illegal. While one can argue they over generously share data with firms like Cambridge Analytica etc. there's nothing remotely illegal about this thanks to America's extremely weak privacy laws. The reality is there are many, many companies doing far worse than Facebook but they're not based in SV so nobody cares.

> But the strange thing is that despite numerous investigations by multiple intelligence agencies and NGO nobody has ever found any of the millions of devices Huawei exports each year to be compromised.

Do you recall the backdoor that was placed in over 700 million android handsets of Huawei and ZTE? I'm pretty sure that should be considered to be a compromise. The phones sniffed SMS message content, contact lists, call logs, location data and other personal user information and automatically sent that info every 72 hours. The software could also remotely install and update applications on the phones.

> Note here that unlike the US government Facebook has never, ever been caught doing anything illegal.

You were doing great...

Just because they haven't been punished, doesn't mean nobody is aware.

> never, ever been caught doing anything illegal. While one can argue they over generously share data with firms like Cambridge Analytica etc. there's nothing remotely illegal about this thanks to America's extremely weak privacy laws.

.. illegal in America. It's still unclear whether they've been involved in breaking pre-GDPR data protection law or even UK electoral law.

Huwei’s founder was an officer in the People’s Liberation Army and is party member. That alone isn’t exactly “strong ties” but I also agree with the other commenters’s points.

Reply on news.ycombinator.com