Hacker News Reader

Comment by Wowfunhappy | Hacker News Reader

The fact that this exists makes me uncomfortable, but I'm having trouble pinpointing a reason why it's bad. People are opting into the data collection. Perhaps they don't know the full extent of what Facebook is tracking, but sideloading apps on iOS is not a one-tap process—anyone who used this had a sense of what they were doing.

And, $20 per month is pretty substantial compensation.

The way that Facebook is bypassing Apple's rules feels shady, but I've always felt those rules were user-hostile to begin with. I firmly believe that users should have control over their own devices, and that means letting users give information to companies if they so choose—especially if they're being financially compensated.

View on HN

Recently, there was an HN thread of a Chinese man who sold his kidney for an iPhone at 17 years of age and 8 years later was bedridden for life because his remaining kidney failed.[1]

You could say the people who bought his kidney for an iPhone did nothing wrong. The kid had control over his own body and they made a deal the kid thought was good.

I think, though, that he wasn't properly educated of the risks that doing such a trade would leave him with, and that the people who offered him the deal very well knew them, but targeted him for being a naive child who wouldn't take them seriously.

I think this is the same case. People just don't understand or don't take the risks of this seriously enough, and companies like Facebook take advantage of that.

[1] https://news.ycombinator.com/item?id=18925780

Most kidney failure causes will affect both kidneys.

The failure was brought on by the surgery itself.

His was apparently caused by a lack of quality post-operative care.

You're implying (perhaps unintentionally) that selling an organ is equivalent to selling information on what websites you visit. There's a reason selling organs is illegal, at least in the US.

I don't think personal information is so valuable that we need to outlaw its sale.

Organ selling isn't illegal because organs are valuable.

Impingement on quality of life by the seller of an organ can be, and is translated to a value statement. However, the paradoxical nature of human beings which relies largely on emotional responses dictates that while we can have people starving in the streets, because it would make society squeamish, they can't be allowed to sell their organs, for the sake of their own human dignity and quality of life, never mind that society stripped them of both anyway.

This isn't paradoxical at all, when both options are horrific there is little benefit to cover up one with the other and claim a solution.

Furthermore a short term windfall from selling organs will not provide the skills or assets required to prevent long term starvation and homelessness; so now the horror has been compounded: homeless, starving, and prone to debilitating illness.

The paradoxical nature is that being homeless and starving is horrifying but something humans have become accustomed to, and yet the idea of selling organs is embedded culturally as being shocking, even if the end result of being starving and homeless is relatively equivalent to being desperate enough to sell organs, so it's not allowed.

Also, how you mention as fact that money from selling organs won't prevent long term starvation and homelessness is surprising; you don't know that's the case one way or another but you're trying to pass off an opinion as fact. I can't argue either that it would help with a clear and definite metric, but the correlation of living conditions and money is clear. How real-life application of such legalization or organ selling, with quality of surgery and post-surgery care, legal predatory practices, and other factors are dealt with are potential problems, but those are issues that exist in all commercial domains.

I also never argued organ selling as a solution to a problem; as others mentioned, it is a potential band-aid to a problem that lies in wealth inequalities, but which I find interesting as a societal flashpoint that show how knee-jerk emotional responses can cause logical paradoxes.

Impingement on quality of life by the seller of an organ can be, and is translated to a value statement.

How much is a Jew's life worth vs a Christian's life vs a Muslim's life? Or would it make you squeamish to try and adjudicate that? Or are some things not worth putting a price on because of principles, because breaking those principles would have worse second and third order effects?

Well, the market as an aggregate dictates that. It's entirely reasonable to assume that from market to market, buyers have different value assessments for people of different religions, and place different values on each. On a personal level, I would pass judgment by objective quality of organ, but that's beside the point. The idea of employment already places value statements on people and mainstream moral perceptions mark discrete points that shift from moral to immoral, when in fact its all on a continuous scale and the point at which it shifts is arbitrary.

Noone said they were equal, just that informed consent is important.

I’m led to believe a whole bunch of intellectual heavy weights agree that privacy is so important it needs to be heavily regulated fairly immediately.

I tend to agree with them.

Come to think of it, is there anyone making a strong case for weaker privacy protection? I’m prepared to put aside my existing assumptions long enough to read an article or two.

> I don't think personal information is so valuable that we need to outlaw its sale.

Europeans seem to disagree. Maybe your "reason" is just cultural bias?

GDPR doen't outlaw the sale of personal data. It just prohibits selling personal data without user consent.

Under GDPR, it should be perfectly legal to compensate a user for agreeing to share personal data with marketing companies.

No, the point is that under GDPR you can't sell personal data because it remains the property of the person it was shared by. You can sell access to that data, but the purchaser inherits the terms under which that data was shared and can't use it for any purposes the owner did not already agree to -- plus that transfer itself has to be consensual.

Also under GDPR the consent can be revoked at any point and the data has to be deleted. Plus the owner has to be given exhaustive information about what data was gathered, what basis it was gathered on and who it was passed on to (recursively).

> equivalent to selling information on what websites you visit.

You make it sound like they're just obtaining a list of URLs, but that's not it. For $20, they get to impersonate you while you're in the VPN and after you leave (they have all your passwords and session cookies). They can also impersonate anyone you deal with. They have all decrypted information going between you and the rest of the internet. Not even your ISP gets that amount.

Even further problematic is the scale at which they can do this. This isn't just a concern we should see as individuals but also as a group. They can control a grand portion of information flow and authentication in the whole web.

This is actually a great comparison, because I think both boil down to (a lack of?) informed consent. I think there's nothing inherently wrong with selling all your data for $20 a month. If you know exactly what you're doing.

Very likely the kid didn't understand exactly all the risks and wasn't informed when selling his kidney. And I would guess it's the same thing for a lot of kids signing up for this facebook thingy thinking "free $20 a month? Let's fucking goooooooo!"

But I honestly feel just as creeped out by apple dictating what people can install on their phones and what they can't.

See, I felt like it was not a great comparison because a body part is a very different thing from web traffic. Since Facebook does not stand to gain anything from inflicting material harm on you, the expected value of giving them your data is at worst very slightly negative. They’re likely not even recording most of it. (What would they do with it?) The same can emphatically not be said of a mission critical singly-redundant organ.

you may not feel immediate effects but at a societal scale it does come back to bite you

They can’t run this program on a societal level because it would cost too much (>100B a year in the US alone, which is surely more than the value they derive from it). So we really only need to be concerned about whether this hurts the individuals involved, and whether Facebook plans to do anything unethical with the data.

The danger is judging informed consent by what we would find acceptable. It's conceivable that one could understand the risks yet not appreciate the probability involved, or have a value system skewed towards present gratification. The point is that the concept of informed consent in cases like this don't really add much information.

You're allowed to set your value system however you want, that's not my business. My issue is just that there is no details on their server-side security, and that the terms used to describe the effect of the root certificate are not nearly strong enough. But if someone truly is informed about who is collecting this then their's nothing wrong, other than FB violating their agreement with Apple which I trust Apple is seriously chewing them out for.

I think there's nothing inherently wrong with selling all your data for $20 a month. If you know exactly what you're doing.

Informed consent is _impossible_ here because there is no way a person can know what future use the data will be put, and Facebook sure as shit ain't gonna tell, and they're even less likely to limit their future use of the data through an agreement made in the present.

If they don't limit and detail all use of the data, collection would (probably) be illegal under the gdpr.

By my calculations it was either an iPhone 4 or 4S.

It comes down to informed consent. But that's a whole can of worms.

One which needs to be opened and we need to sift through to find an acceptable answer. It is difficult to find something that allows freedom of choice and doesn't require a huge amount of knowledge. Plus, who decides what the facts are? The required minimum knowledge? How do you measure understanding? Are we going to have a ministry of truth? If so, who watches the watchmen?

I got chills reading this. Great comparison.

> People

Children, specifically.

> Perhaps they don't know the full extent of what Facebook is tracking

…is this not bad?

> sideloading apps on iOS is not a one-top process—anyone who used this had some sense of what they were doing

This is not sideloading; this is enterprise app distribution. Users are not self-signing this app.

> And, $20 per month is pretty substantial compensation.

For a child who doesn't know any better, maybe…

They're not sending cash, it's a check or a deposit into a debit card. Not many "children" under the age of 16 have those.

So many of the comments in this thread are literally "Think of the children!"

Really? I think I opened my first bank account when I was 10 or so. My parents had to co-sign but other than that were not involved in it. I don't think this was very unusual, the bank even promoted a special free account for young people. I had summer jobs from the age of 12, would you expect me to shove the money under my mattress?

Well your parents surely would be pretty involved with that, if their 12 year old son needs a ride down to the bank. It's not something that's going to be slipping under their noses.

If they're thinking of the child, that is.

Which brings us back to you falsely claiming anyone but you uttered that phrase, and your implied assertion that there is something wrong or odd with looking out for others, including children.

Actually, the article says the money was paid "via e-gift cards", so I don't think a bank account would have been needed.

I use the app. It is $20 amazon gift card.

May I ask why?

> This is not sideloading; this is enterprise app distribution. Users are not self-signing this app.

Just to be clear, that's the process I was referring to. I consider it a form of side loading, because the app is coming from an unofficial, non-Apple source.

Enterprise apps won't run until you manually go into settings and certify that you trust the developer. Far from the most onerous of tasks, to be sure, but significantly more involved than tapping a download button. I don't see how someone could be "duped" into running an enterprise app.

They weren't duped into running it, i.e. they knew they were downloading and installing an app from Facebook Research. They likely did not understand the effect of installing the VPN and trusted root provided by the app.

> They likely did not understand the effect of installing the VPN and trusted root provided by the app.

I'm just not convinced on this point. I think it's likely a lot of people did understand that Facebook could see all their internet traffic, and thought for $20 it was a fair trade. There's a HN user down thread (anonymous5133) who says he used the app and quite liked the exchange.

Now, it's possible these users did not think through all the consequences that sending this data to Facebook could have—but just how much responsibility does Facebook have here? Does Facebook need to say in big red type, "This data could be given to health insurance companies some day and used to deny coverage?" (I'm not even clear if that would be legal, but I bring it up as an oft-cited nightmare scenario.)

Many of the things they are spying on aren't just the business of the person who's getting the $20 either. If you message someone, do you expect them to turn around and sell that to Facebook? If you are one of Facebook's competitors, don't you deserve to not have them use their monopolistic power to scrape your data?

If there had been a hack of the data collected by this program, people could very easily and rightly have been fired or disciplined for exposing corporate data through a VPN. Even if most things are run through a corporate VPN or intranet, one sign in to your work account on Office 365 is game over for the company.

Whether or not you agree with Apple's rules, the fact that Facebook is willing to violate their Enterprise Certificate agreement with Apple is a red flag.

If Facebook is willing to break an agreement with one of the largest corporations on the planet, what reason is there to think that they will keep any promises they make to individual users?

> I'm having trouble pinpointing a reason why it's bad … $20 per month is pretty substantial compensation

But Facebook's competitors did not consent to their traffic being spied on and had a reasonable expectation that their traffic would remain safe from this type of intervention on iOS devices. Ignoring the ethics of paying users for data and so on, this seems like a straight up case of industrial espionage. The article says that this is how FB spotted the rise of WhatsApp, and presumably informed the offer. They would have known exact usage information, this is espionage via surveillance.

Why do Facebook's competitors get a say in it? Facebook is only getting access to user-visible data; if the users decide to give that away (in exchange for compensation), it's their right. Amazon users aren't Amazon employees—they didn't sign an NDA and are free to share what they know.

At an individual level that may be so, but if they're doing it en-masse then they essentially had secret/sensitive competitor information when they made an offer to buy WA, daily active users, usage-by-demographic etc.

On top of that they would have had access to message formats, headers, encryption protocols and so on, things that are potentially trade secrets. This isn't user-visible data and app owners shouldn't expect that competitors can access it directly from a user's phone.

By that logic, is the NPD collecting trade secrets by tracking game sales? We know a lot of publishers would prefer that information is unknown.

Combining legally-obtained data to come to a conclusion is not illegal or immoral.

You could say the same about predatory payday loans. Just because something is opt-in doesn't mean it can't be manipulative and harmful.

Links below might help put a finger on exactly what's giving you that icky feeling?

To me, the problem seems to be (a) lack of informed consent, compounded by (b) the targeting of a vulnerable population.

[1] https://en.wikipedia.org/wiki/Belmont_Report [2] https://en.wikipedia.org/wiki/Respect_for_persons [3] https://en.wikipedia.org/wiki/Informed_consent

Those two and the lack of a robust, documented framework for Facebook to delete the data it is not interested in analyzing and store what it is securely.

The biggest question I have is why they needed the root to analyze popularity of future competitors. Surely doing domain requested (visible even with TLS) and number/time of requests would be sufficient, and that would have greatly reduced the amount of private data gathered.

$20.- is actually quite cheap for a total invasion of privacy. You can rent out just your Facebook account for $500.- per month[1].

[1]: http://fbdollars.com/

People are opting into data collection in a way that creates a severe security vulnerability. Not only have you given up confidentiality (of everything, including passwords), you've also sacrificed integrity and availability. You can no longer trust anything you do on your phone.

A hypothetical experiment Facebook might be interested in conducting: Do people use Facebook more if Twitter is slow and/or unreliable?

This gave me words for that uncomfortable feeling:

https://www.theguardian.com/technology/2019/jan/20/shoshana-...

Reply on news.ycombinator.com