Hacker News Reader

> Royal Bank of Canada to read, write and delete users’ private messages, and to see all participants on a thread

There's a settlement out there for anyone with a Facebook account who was turned down for a loan by RBC. No chance RBC wants its dirty laundry aired in a Fair Housing suit.

Why would RBC even expose themselves to this liability? What was the point?

With every single one of these companies I am...baffled, that anyone thought this was a good idea, but in this situation especially it makes zero sense. All that liability for what possible upside?

I think this was intended to be a customer support channel and they had to be able to delete the messages containing bank info after a certain amount of time. I had read something about it, I don't think carte blanche access to users' messages was sought or given, it was just support conversations. I didn't use it so this is like my memory of 2nd hand info.

I used to work in Social Media customer support using a well known platform, in a large telecommunications company.

We could only access the private message history containing the conversations we had had with the individual, nothing else.

You think people care about their personal data, you should see what type of information they provide through private messaging platforms. Including through public posts, it's shocking.

Well, sure, there are always people that act against their own best objective interest but the case here is that Facebook is making a bad decision for them, and also not informing about it other than in broad, hard-to-grok language.

One reason would be that RBC was allowing people to send money from its app via Messenger - http://www.rbc.com/newsroom/news/2013/20131211-facebook.html

> Well, that explains some of the conspiracy-mongering that was so rampant around this feature. Facebook (probably) wasn’t secretly recording your phone calls etc. They didn’t need to - they were getting streams of data from other partners.

I really wish there was a law requiring real disclosure of such customer/user-data sharing agreements with enough detail to know what's actually happening. The disclosures should include things like schemas, example records, and reasonable names for data receiptients (e.g. Amazon Inc., not Sunshine Data Brokers II Inc., an unacknowledged subsidiary of Amazon).

There's no way to make an informed choice about using a particular service or dealing with a particular company without that.

GDPR makes a pretty good attempt at that.

RE: Royal Bank of Canada, their access to the Messages API was specifically to let people send money to their friends via Messenger through the RBC app.

In Canada, the only way method for P2P money transfer is through a system called Interac, which relies on email addresses. Using Facebook Login + Messenger was a big improvement since it's harder to accidentally send money to the wrong person.

One possibility would be that Facebook users were supposed to be able to read, write, and delete their own chat messages via custom chat clients built by Spotify, Netflix, and so on.

If so, the New York Times is throwing shade on Facebook basically for not being enough of a walled garden. I hope their journalists are not that confused?

That would grant the app access to those permissions, not the companies.

Oh hey, would you look at that: https://www.theverge.com/2017/8/14/16143354/facebook-messeng...

I'm a bit worried that some journalists (and some readers) no longer care to make any distinction between an app having access for legitimate reasons that respect users' intentions and the whole company having access to do whatever they like. At least, they don't explain it well.

The distinction doesn't exist in practical terms. The company controls the behavior of the app; the fact that an app has access for legitimate reasons doesn't mean that any given use of the access was for legitimate reasons.

I don't think this article made the case that the access granted was unreasonable.

Mark my words. There is going to be an article that grossly misunderstands oauth and tells people that facebook, twitter, etc, are all giving access user information to third party's willy nilly and that there is an entire system widely used across the web for encouraging this sort of behavior.

Yeah, I think nytimes is intentionally being misleading here. I don't doubt FB made some shady deals with the big tech companies, but it seems like they're conflating granting app permissions so that certain functions like sharing Spotify songs over Messenger work with granting access to all user data.

They have been exactly that confused (or possibly intentionally deceptive) in the past. One of their previous articles pretended that Facebook, by giving users the ability to log in and interact with their friends via a built-in manufacturer app on their Huawei smartphones, was actually giving those friends' data to Huawei: https://www.nytimes.com/interactive/2018/06/03/technology/fa...

> Facebook also allowed Spotify, Netflix and the Royal Bank of Canada to read, write and delete users’ private messages, and to see all participants on a thread.

At this point it’s hard to dispute that at Facebook “private” is synonymous with “public” for most practical purposes.

Shared under NDA with business relationships is not “public” for the common use of the term. Although I agree with your sentiment, your statement isn’t really accurate. Otherwise I would be able to read Spotify users’ facebook DMs, and I can’t.

You’re kidding, right? If I send a “private” message, but everybody from law enforcement to my bank has access to it, it’s not private. It’s public knowledge as far as any background checks or loan applications are concerned. By contrast, if my bank worked out a deal with Bell where they get to record my all phone conversations they would still be committing a felony in almost all jurisdictions, NDA or not. That’s a reasonable example of “private” communications.

You have a very good point, and in an ideal world that's what one would expect. Unfortunately our mindset has to change and we have to be way more suspicious on what companies do with our "private" data.

It’s public knowledge as far as any background checks or loan applications are concerned.

You give permission for those and the data accessed is often not public. There are degrees of privacy - what you're trying to do make up your own definition of 'public' and then have message board fights about it. It's not really a sensible position, let alone interesting conversation.

> There are degrees of privacy - what you're trying to do make up your own definition of 'public' and then have message board fights about it.

This is actually a fair criticism. I don't know why you're being downvoted for it.

> You give permission for those and the data accessed is often not public.

I'm not sure this was always the case with Facebook though. Let's say my friend John gives RBC access to his messages and I message him asking to loan me $50 because I'm struggling with money. Down the road if I apply for a loan from RBC they now have access to my "private" message, without my permission and can ostensibly then use that information when determining my creditworthiness. All without my knowledge or consent.

It's up for sale to commercial entities who pays up, and available to law enforcement with no legal expectation of privacy. That's public for the common use of the term.

I’m always puzzled by the need people have to try to dispel the notion that Facebook listens to ambient audio or conversations.

They are the bad guys. They didn’t need to steal Android phone logs either, but they did.

I just wish there was a way to figure out _why_ I'm getting some ads, to dispel that fear.

On Instagram last weekend I and a friend were shown a number of ads for Chandon sparking wine after I bought a bottle, and someone else at the party also did and we talked about it.

Both of us insist we didn't google sparkling wine, Chandon, or anything we think relevant... it really does on the face of it appear Facebook had listened to us.

If you purchased the wine with a credit card then Facebook has the ability through agreements with other data providers/aggregators to connect it back to your Facebook, Instagram, etc account. Source: I know someone who is in biz dev at one of said companies and sells this type of “profile” data to Facebook and countless other companies. If you purchased with cash then sure does sound like they were somehow listening.

Hmm, I did. But her bottle was a leftover from a wedding several months ago (because we're connected on IG perhaps? Seems like quite the stretch though).

Also surely advertising the same wine I just bought to me is... dodgy ROI at best?

It'll remain a mystery forever.

At least wine is a consumable. Compare the thread on how Amazon will relentlessly advertise you the same refrigerator you just purchased.

this happened with a few co-workers. They got ads about things we spoke about at work and shared it with the group on slack. After nagging them about uninstalling FB for a while, the targeted ads scared some of them to finally uninstall the always listening FB spyware from their phone(s)

I once dropped my work laptop and snapped the plastic housing on the charger plug. I only discussed it verbally with my manager and said that I, as a consultant, would replace it at my own expense. Before I'd had chance to search for and price one up adverts for laptop chargers started following me around the web.

It could have been that she then searched for a charger and being a small company we all shared an external IP address, that we also shared the ads... or it could have been that spy software on my phone had sold our conversation to advertisers. Either way, mic privileges were locked down and ad and tracker blocking efforts doubled after that.

I don't think that's a fair suspicion when you shared the same IP address

Boy, if you think the amount of data FB sells is creepy, wait until you find out how much information your insurance provider sells, or your cell phone provider, or your credit card provider, or your health provider...

If you ever get in a car accident in the United States don't be surprised to get mail the very next day from accident insurance attorneys because you bet every service you use is selling every aspect of your life without your explicit knowledge or consent. Every time you use a credit card to purchase something that information is sold to a network larger than you can imagine, who will in turn sell it to their network. Your geographical location is sold by your cellphone provider whether you realize it or not and whether you think you have GPS tracking turned off. If you have a SIM card that's tied to you as an individual, it's being sold.

Here's just one example: https://www.washingtonpost.com/news/the-switch/wp/2018/06/19...

Notice how the keyword is "suspend"? I don't doubt that they've quietly resumed the practice. In fact, I bet all of these companies and service providers are overjoyed right now that the media is so focused on FB to care about all of the shady shit they're doing on a daily basis.

I'd rather not have any of my data shared, of course, but if I had to pick and choose between my health insurance being sold and versus what TV shows I liked on FB, I'll take the TV shows any day.

Is this reply meant to be for me? It doesn't seem specifically relevant.

Facebook isn't tapping your phones microphone 24/7. It's a nice little dystopian theory that's been disproven time and again.

A far more probable and less exciting explanation is that your credit card provider (or the store you bought the wine from) is selling your information and Facebook happens to be one of the buyers.

Furthermore, people grossly overestimate how unique they are. At any given point in time you're a target market for millions of products, you just don't notice the ads for the ones you don't buy. Just because there's a correlation doesn't mean you were singled out as an individual.

I think something shady was going on with the company formally known as Axciom:

"On May 14, 2014, Acxiom announced that it had acquired LiveRamp, a data onboarding company, for $310 million. LiveRamp was founded in 2011 as a spinout of RapLeaf, a marketing data and software company founded in San Francisco, California in 2005 by Auren Hoffman and Manish Shah.

In May[2017], LiveRamp announced a consortium formed with two other ad tech companies, AppNexus and MediaMath, to compete with Facebook and Google in the area of programmatic advertising, the term used to refer to the use of automation software to buy advertising.

In 2016, LiveRamp acquired two data and identity-matching startups, Arbor and Circulate, for more than $140 million combined. The company also announced the launch of IdentityLink, a method of anonymizing consumer's identities as they are tracked across multiple platforms.

In February 2018, Acxiom announced a reorganization from three divisions into two - a Marketing Solutions group and its LiveRamp business. In May, the company announced international expansion into Brazil, Netherlands and Italy, and released Global Data Navigator (GDN), a portal for identifying available data elements by country. In June 2018, Consumer research firm GfK MRI has partnered with Acxiom."

https://en.wikipedia.org/wiki/LiveRamp#2010s

Well that's my point - however they're doing the targeting is so good as to be creepy and so I wish there was a way for me to force them to show me why I'm seeing a particular ad.

So here's how it could have happened....

You may have brought it online in which case almost certainly there was a FB tracking pixel fired back from the e-commerce website to signal that you did. On the other hand if you bought from an offline store and swiped a loyalty card while doing so, your transaction might have been uploaded to create a custom audience. If you paid by your phone or have your loyalty app on your phone this becomes even easier - convenient offline to online matching is the only reason loyalty program apps are pushed.

Finally, even if you didn't do any if these and the other person did, if you both connected to the WiFi at the party and checked FB (or better still you added the other person as a friend), the shared IP address between your devices is enough of a signal to begin connectings.

I don't understand why we're not allowed to be skeptical of accusations once the masses have decided that a company is evil. Aren't you at least curious about what they actually did and how they made decisions?

It's quite possible that, even at a company that has done some bad things, other things have a more innocent explanation.

I am, but they don't seem to be exactly keen to tell us that. They seem more interested in bunkering down and writing pre-made apologies for each thing the media discovers.

"Facebook would like access to your contacts. Do you agree? YES no"

Address book import and triangle closing drives the most PYMK features across every social network. It's a gold mine, and that's why everything wants it.

> to read, write and delete users’ private messages

I wonder if the delete permission was by accident or whether these companies were actively deleting private messages - craziness.

Facebook's permissions scopes have never been that granular - if you get approved for a permission it's generally access to create, edit, view, and delete all in one.

(Citation needed)

It's a little hard to cite now - most of the user-level permissions are gone, or are behind a "This permission is restricted to a limited set of partners and usage requires prior approval by Facebook" restriction.

They've clamped down repeatedly on how much data comes out of the API - you used to get full info on friends, then just their names and IDs, then that list wound up filtered to just other friends who'd authorized the same app.

It used to be extremely wide-open.

It's not exactly nefarious to query friends of friends in the same geographical area. The problem is people willingly constructing a social graph without care for the consequences. G+ theoretically enabled this sort of isolation but in practice it is too much work to maintain separation. The only way to win is not to play at all.

> Gizmodo and other news outlets have reported cases of the tool’s recommending friend connections between patients of the same psychiatrist, estranged family members, and a harasser and his victim.

Geez, and I thought I was annoyed with mere former bosses showing up who I didn't part on good terms with

> Spotify, which could view messages of more than 70 million users a month, still offers the option to share music through Facebook Messenger.

Not sure why the others needed it

Spotify doesn’t need to read your DMs to let you message share links, either.

That's what that article had - on Googling it looks like Spotify makes suggestions in messenger when talking about music as well.

https://www.theverge.com/2017/8/14/16143354/facebook-messeng...