Hacker News Reader

Comment by thisisit | Hacker News Reader

This is one of the strangest defenses for Facebook - everything works as expected.

Cambridge Analytica downloaded data? The API worked as expected and people should have been smarter to not share data.

Facebook has special APIs for phone manufacturers? The API works as expected and people shouldn't buy phones from the manufacturers they don't trust.

But, here's the thing - FB shouldn't have allowed this at all. In one part, security is about making things harder for people to break-in. Currently, manufacturers can use official API to siphon off data to non-FB servers. Sure, manufacturers could run some kind of MITM attack to achieve something similar. But having an official API is a strict no.

View on HN

>> people shouldn't buy phones from the manufacturers they don't trust.

You're literally hosting your life on it. You should indeed not do this.

There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them. You can't rely on capitalism to resolve the Prisoner's Dilemma here. This is why Right to Repair legislation has become necessary, for example.

> There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them

Apple is a pretty good actor in this regard though, and they're clearly betting a lot on markets to realize the attractiveness of that.

> This is why Right to Repair legislation has become necessary, for example.

I'm not sure I see how a "bad" actor (maybe like Apple) in terms of the Right to Repair is relevant in the context of trusting device manufacturers. If anything I think Apple's (somewhat self-serving albeit not completely detached from reality) argument would be, and has been e.g. https://news.ycombinator.com/item?id=11047359, that their control of device repairs and servicing decreases the risk of malicious software or hardware components being installed.

Apple is not a "Pretty good actor". Better than some, yes, but good? No.

Honestly, Apple's privacy move over the years is genius. Its going to be a long time, maybe never, before I buy something besides an iPhone. I don't even like Phones(in general) that much and Apples aggressive cable policies drive me insane but this is getting really scary.

That was an unusually balanced perspective in a debate that usually tends to lack much nuance here.

FWIW I'm partially in the same boat: I like Apple the company and I'm happy for everyone that likes and uses their products but I'm kind of incompatible myself.

True, but let's say you bought a DSLR camera, wouldn't it irritate you if the manufacturer was secretly uploading your pictures elsewhere for others to use against you? To most, such practises would seem beyond intrusive. I sort of feel that this is what's happened here, albeit, in a subtler manner.

Is there any evidence that has happened? That sounds like it goes directly against the APIs terms of service. If device manufacturers are doing that, they could equally upload your passwords from the browser.

>. If device manufacturers are doing that, they could equally upload your passwords from the browser.

And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful.

In OSes you can theoretically attack any app, but it is a pain to even debug them with different versions, changes to their custom storage formats, etc.. Unless they build an ABI, document which parts are stable and give it to you.

FB can tell you about it but there is no law mandating anti-hijack security features. Nevermind that the spyware can be inserted in the client itself or in the official gateway supplied by Huawei, necessary "for technical reasons", making it completely invisible.

Once the manufacturer goes outside the licensed API and uses your credentials to do more than Facebook allows, it commits an actual crime against you in most jurisdictions.

I'm sure people will be investigating and finding a few examples of on phone API violations then transferred.

My bet: no criminal cases. Facebook charging less than 50k for violation of an API contract on data that isn't theirs, if numbers are disclosed. No standing for users except in a class action that get $5 or less on a new phone or $2 or less as a check.

> And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful.

With the API, presumably there's an auth token that is only stored on your device. Facebook should also be able to detect unusual access with an auth token. Really, the auth token makes it easier to detect funny business than a username/password.

> secretly uploading your pictures

What if instead of it being a secret, it was a big button with “upload photo to Facebook” on it?

If Facebook outsourced the implementation of that button for each different type of camera to the respective camera manufacturers, rather than implementing it themselves, would that change it from a non-problem to a problem?

just because something is true doesn't make it a good defense of facebook.

What if your friend does this and gets your data, even though you got the safe phone. Do we now have to be aware and affected by the technology choices of all of our friends? The problem here is that you are affected by not just your decision but the decisions of anyone who has access to your data on Facebook.

>people shouldn't buy phones from the manufacturers they don't trust.

People shouldn't put their pictures , and relationship status, and whom they know, and what they think, and where they go, and what they talk in private about, to a private company's service that they don't trust.

Oh, except for, they do.

Companies shouldn't intentionally mislead users about privacy and data use. They should be either trustworthy or held accountable for deceiving consumers.

A large part of GDPR's value is killing these misleading practices by exposing them.

Facebook never mislead anybody about how their data was being used. That's a lie the media is feeding everyone for some reason.

Zuck recently said their legal contracts required data to be deleted and therefore it was. That's directly misleading.

I hear nothing about people not trusting Facebook, other than from those who don't use it. But plenty of people who either trust them or don't care either way who do put their personal data and photographs on Facebook. It's only when stories such as Cambridge Analytica make the news that they then realise how their data is being used.

Who are you talking about that in one breath say they don't trust Facebook and in the next go and put their data on their servers?

How can Facebook protect your data from a hostile phone manufacturer?

They can... not enter into agreements to share data with them as is detailed in this article?

Is this a trick question?

You're completely right. Facebook should not have created APIs that could be used to re-implement a Facebook application. They most certainly should not have made such APIs available to companies that are anything less than completely trustworthy in every possible way.

Facebook's error was in believing that anyone outside Facebook could be trusted to author an app. I expected they know better now.

So if I consent for my data to be transferred, why I should be prevented from that?

Facebook wanted to do this so everything did work as expected, they have been doing it for a long time and built it precisely to be used just as Cambridge Analytica used it. The only problem came when it was used to help Trump. When it was used to help the Obama campaign nobody batted an eye. Facebook is a political agenda and getting more people involved and helping their favored campaigns is something they were very interested in doing; that is why they allowed this - not realizing it would bite them back.

https://www.investors.com/politics/editorials/facebook-data-...

Reply on news.ycombinator.com