Hacker News Reader

Comment by jaimehrubiks | Hacker News Reader

I would like to know why some people stopped using Facebook claiming that the main reason is "the recent databreach". If you don't want to use Facebook for how they handle your data in the first place, it seems perfectly fine to me. But, the data breach exploiting 3 vulnerabilities seems to be bad luck, I don't really think they're not committed to security in that sense. I'd like to know opinions from others.

View on HN

The recent data breach made many people realize that you're always just 1 instance of bad luck away from having a bunch of aggregated personal data stolen. It's pretty reasonable to decide you're better off removing yourself as a target than hoping Facebook will never again experience bad luck.

It's not reasonable at all. You're 1 instance of bad luck away from death. But that's hardly a reason to not leave home.

It's hardly a reason to leave home, but it's definitely a reason to, for example, not go skydiving.

You obviously can't remove all risk, but you sure can reduce it.

That might not be the best example, though. You are more likely to die driving to the airport than you are to die while skydiving. That is an activity which is similar to riding a roller coaster: it seems much more dangerous than it actually is.

> You are more likely to die driving to the airport than you are to die while skydiving.

Can you back that up? I thought this was true too but did a quick check anyway and I found skydiving death rates are 8 in a million but driving death rates are 7.1 per billion kilometers. Driving to the airport is probably more dangerous than your average drive, but it still looks like the car trip is less likely to kill you.

Presumably you get value from leaving home, and these people realized they weren’t getting value from Facebook.

Personally I have still friends I cannot switch to other platforms so I am stuck checking my Facebook messages once a month, but that is the only reason I still have an account, and I have unliked everything else from the service.

The likelihood of death isn't enough to keep me from from leaving my house, but it is enough to keep me from driving without buckling my seatbelt. Everyone has to do their own cost-benefit calculations, and the benefits of Facebook will not always outweigh the costs of having their personal data leaked.

> The recent data breach made many people realize that you're always just 1 instance of bad luck away from having a bunch of aggregated personal data stolen.

There is no such thing as data stolen but from the files on your hard drive. As soon as you upload something to the Internet you publish it and have no guarantee but hope people you don't want to see it won't notice it.

Data breaches make the news because the data wasn't supposed to be published. Just because a third party has my data on a computer doesn't mean it's public. Under your logic I've published all my banking data, whether I've used online banking or not.

All I've meant is that nobody should ever feel surprised when the data they've uploaded leaks. Now the people have realized it can leak, what amazes me is that they supposedly didn't realize it in advance. Just don't upload your naked pictures anywhere if you are going to feel seriously upset for longer than a couple of seconds once everybody sees them. That's just "a rule of a thumb". I absolutely don't mean companies like Facebook should not bother to protect users' data, I mean users should never actually take this protection seriously. The Facebook problem did not affect me because everything I've ever uploaded/written there is what I would not mind showing/saying on a TV.

> The Facebook problem did not affect me because everything I've ever uploaded/written there is what I would not mind showing/saying on a TV.

Does that include everyone who you've friended and everything they've put on Facebook, plus all the data they've inferred about you and your friends through tracking and other third-party sources?

If a company holds some information internally, and an unauthorised third party surreptitiously obtains that information, wouldn't you call that stealing?

Every direct mail list provider on the planet has just as much info on you as FB, and they have garbage security. This is an overblown risk comparably.

Source: Have bought DM lists of millions of people with full addresses, estimated salaries, employers, etc.

How bad do you think a risk needs to be to justify not using a service you probably don't enjoy anymore anyway?

I actually refused to use Spotify for years because they required Facebook login. I gave in eventually as Rdio lost to Spotify in the market. Like many, though, I am deeply concerned about Facebook's policy direction and leadership. I did disconnect my Spotify account from my Facebook account the hard way (with customer support) a few months ago.

In general I am enthusiastic about federated signin, but I don't want to do business with Facebook.

What do you mean that Spotify requires Facebook login, I don't have a fb account and are using it just fine.

E: Missed the past tense. I just checked, you can sign up with your email address.

It used to. In fact Spotify shared the same auth database with Facebook (not oAuth, the literal same password - change it in FB, it changed in Spotify and vice versa)

Started doing FB only login in Sep 2011, but if you already had an email login you could keep it. Lasted for about a year then it was dropped.

Couldn't you just make a new, empty facebook account just for spotify login with no real personal info on it?

> But, the data breach exploiting 3 vulnerabilities seems to be bad luck

To me it seemed to stem from at least one fundamentally alarming design problem on their part, not "bad luck". [1]

[1] https://news.ycombinator.com/item?id=18203396

To me the data breaches was just the final straw. Naively perhaps I never believed that they would be so careless with my data as it turned out. Then on top they can’t even keep it out of the hands of people who don’t have a contract with Facebook.

I think that it could be the GDPR that is now forcing Facebook to be more open about breaches, and previously they may have been keeping them secret.

IMAO Facebook IS a data breach where people voluntarily comply to, not just some vulnerabilities. Login with Facebook is a pretty stupid thing to do anyway, happily giving away even more data.. Cannot think of 1 valid reason to do that except for being too lazy to generate a new password.

That's the whole point of OpenID. One account with one credentials, multiple profiles on multiple sites. Lazyness is good. Much better than creating n acoounts on multiple sites using the same passwords, getting the weakest site to be compromised silently and hackers streaming back to your other accounts from that one. I'd rather trust fb.com 2fa security team over joeschmoe.com's one.

With the benefit of hindsight, that OpenID allows the ID authority to engage in tracking is a significant design flaw.

I've used facebook/google logins for some small projects in the past. In theory it should be easy. The user doesn't need to remember their username let alone a password, or even if they made an account already. They can just click to log in.

There were two main issues. The first is that people don't trust facebook or google even if they already were signed into their services. They didn't want to give them any more information.

The second was that it was a huge pain to maintain and test. Facebook and google changed how the services worked semi-regularly and it was not trivial to find their documentation on how to update everything (and during that time nobody could log into your service).

It should have been easy, but it wasn't and it was not worth it.

Reply on news.ycombinator.com