Facebook's Zuckerberg Preaches Privacy, but Evidence Is Elusive
bloomberg.com
bloomberg.com
- Focusing on adding e2e encryption for messaging services serves as a nice deflector for FB's privacy issues. Their advertising systems aren't going to change in terms of efficacy and revenue potential if private messages between users are inaccessible to Facebook. I'd be surprised if they're using this data anyway, but it's Facebook, so who knows. In any case, expect the messaging to focus on increasing privacy through message and video encryption, which completely ignores the underlying issue of profile-building and behavior modification that Facebook's non-messaging platforms allow, and which I didn't seem to hear any plans around addressing.
- IMHO, pretty much all posturing around privacy by Facebook should not be taken seriously until they announce a change to their business model. Since they haven't, it doesn't take much effort to tease out the rest: their business model relies upon surveiling user behavior and selling behavior modification products, so you can expect no announcements around product changes that would undermine those efforts significantly in the name of privacy until their business model changes. Everything until then is just at best noise, at worst dishonest framing to take the heat off of them by those who are ignorant of the underlying dynamics, like regulators or the general public.
This does not make messages inaccessible to Facebook, as they control both endpoints.
Although when it comes to Facebook, we have to take them at their word that it's truly end-to-end.
Just because the protocol is well-formed doesn’t mean the totality of the implementation is trustworthy.
#ShowUsTheCode
https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...
They seem to be VR meeting spaces: https://blog.mozvr.com/introducing-hubs-a-new-way-to-get-tog...
The model you describe seems like a good one, similar to what most Linux distributions do. The distro maintainers are trusted and they compile packages and distribute the binaries, but people can run the package generation scripts themselves to get their own package straight from the source. Reproducible builds allow users to confirm that the maintainers aren't doing anything sketchy - that probably isn't a possibility here, but this model is still far better than what FB/WhatsApp and even Signal do.
It's better to have to trust somewhat verifiable promises about the Facebook app than to have to trust unverifiable promises about Facebook-the-entire-organization. That's the advantage that E2E provides.
Maybe they'll start training a personalized ML model on client devices and maybe even send it back to the mothership for further exploitation.
A good analogy: it's like writing a letter and asking the mailman to put it into an envelope, so she leaves the room and comes back with your sealed envelope.
The mailman then looks at you and says "I won't read it, I promise.", Wink wink.
That's end-to-end encryption for the commons.
Nah, nobody gives a damn about the source code, or reproducible builds to ensure the binary they're executing was compiled with that source.
The main gap in trust is that Facebook has a long history of lying and cheating to maximize for themselves so there's no basis to trust that their new moves are good for users.
But conspiracy theories about e2e being read by Facebook are probably bogus, and certainly a distraction.
Even though the source is closed, I'd bet they're doing a credible job of securing messages so that even Facebook can't read them.
That's not the issue, it's a distraction from what's really important.
What's really important is that Facebook has lost control of the monster it created. This is a way to let the monster loose and avoid accountability.
Their platform amplifies harmful content like incitement to violence, terrorist recruiting and coordination, and political propaganda.
By encrypting everything so even Facebook can't read it, Facebook escapes accountability for the harm their platform inflicts on people.
Very similar to a chemical company dumping toxic waste in public water, Facebook is dumping their pollution on the public by using strong encryption to make it physically impossible for Facebook to control the monster they created.
The keynote's online. (https://www.facebook.com/FacebookforDevelopers/videos/422572...) He mentions end-to-end encryption a variety of times, but one example is at about 15:23, where he states, and here I do quote, "without having to worry about hackers, governments, or even us being able to see what you're saying".
Now, skepticism about Zuckerberg and Facebook is warranted, but my recollection of the keynote is that statements like this didn't leave much wiggle room on this particular point. They were playing word games in other areas, like abusing the term "interoperability" to mean "between the different Facebook-owned apps", but I don't think they were here.
Although it's not all that's desired, it's something. After all don't forget that entities much less legal than Facebook are after your data (like the NSA).
This is fine in my book as long as they involve more sociologists/psychologists in the process, are transparent about unintended consequences and what behavior modification they are indulging in.
The thing that is becoming clearer and clearer from the data accumulating about people's behavior is left to themselves ALL people have low awareness of their own damaging behavior. Whether it's to themselves, their families or communities. Those that do have some awareness have little clue about how to climb out of holes. Spotting issues early, alerting/educating people about them and showing them what options they have to improve their own behavior is a huge opportunity to do good.
Even with your conditions, this would be the exact opposite of "fine" in my book. The involvement of sociologists/psychologists would make it even worse.
Or are you saying, as it sounds like here, that access to Facebook data is good for the fields of psychology and sociology?
In any case, the involvement of socio/psychologists in the process of user manipulation makes the situation worse precisely because it could very likely make that manipulation more effective.
It's time to bring the hammer down on advertisement and manipulation of people's behaviour. Imagine if the government would try to nudge people in the way these companies do, we'd never here the end of it and rightfully so.
You've never seen a Got Milk ad, have you?
That's not the government - it is a private association of "... milk processors and dairy farms."[1]
Non health related example: https://datasmart.ash.harvard.edu/news/article/how-governmen...
Also any taxes on goods like cigarettes or fuel are nudges. Also zoning..
(Not the OP) Personally, yes, it applies in full to all other companies. That said, marketing and advertising companies (which Facebook counts as) are the most egregious with this sort of thing.
https://www.theverge.com/2017/8/14/16143354/facebook-messeng...
Excellent description of personalized advertising.
IOW, they'll talk about privacy for a while until everyone stops talking about how evil FB is. Then they'll slowly stop talking about it and work their way back down to where they are now. All the while not actually doing anything at all to change.
Even moreso, it'll be about FB redefinining "privacy" as "whatever FB is doing with their users," then lobbying themselves into a regulatory capture for the nation (globe?) as a whole.
I forget where I heard it, but there's an old aphorism, "of course you're free, because this is what freedom looks like."
We've seen internal memos raising questions effectively ignored. Facebook's own actions seem to indicate there is no limit to what they'll do to users. Their own actions seem to indicate there is no limit to what they'll do to companies that partner with, specifically lie about what level of access they're providing. Their own actions seem to indicate they don't seem to care even when they operate on another platform such as when they released a traffic monitoring VPN on Apple's app store, it was removed by Apple... so they just renamed it and put it out there again.
Facebook as an entity seems antithetical to privacy at its core. It couldn't have grown into what it is with limits... I can't imagine they are capable of being anything else.
Of course that serves their business: in the beginning they had to be the hub everybody connects to, to get as much attention as possible. Now their business is to monopolize the data, so that ads are sold via their systems.
Framing that as privacy is a great strategy, from Facebook's perspective.
Just not sure how that works.
I do agree that their privacy motivations may be a way to make sure that "we got ours, now nobody else should".
Indeed, because it lets them pretend like they're defenders of privacy while being able to completely ignore the privacy threat that Facebook itself presents.
I actually think there is a limit. That limit is that they won't do anything that would cause an exodus of users.
It like the old saying: "find the amount a tyranny that people will tolerate, and you've found the amount of tyranny that they live under"
Bingo. Most people on Facebook are well aware of how "public" their posts are but aren't aware of how public their personal information is to advertisers. Facebook's new "privacy" focus isn't intended to solve the platform's real privacy problem, it's intended to distract from it.
Edit: Spelling
How public is it, then? As a Facebook advertiser I've never seen this elusive personal information collected from the masses, available for indiscriminate pickings. Facebook only sells access to eyeballs coupled with anonymized targeting based on this personal information you refer to, not the information itself.
Yes we know you never publicly posted about being gay or joined a group for gay men, but your internet history says differently.
>> [example foreseen danger]
> Has there been one incident of the scenario you've described?
Don't shift the goal posts. You asked for a foreseen danger. @britch gave an example foreseen danger.
I also think the example is unfortunately realistic. I would not be surprised if in the near future repressive governments attempt to compel data brokers, pimps, and hoarders to provide information on 'undesirables'.
That is sufficient all by itself, even if that information is never overtly used in a way that personally harms me.
For example, someone might be gay and haven't yet told friends and family. Facebook probably knows from their browsing history. How difficult would it be for someone to run an ad on Facebook, cleverly disguised as an "article" to encourage clicks, targeting gay people in a particular region. Five minutes, tops? Well every gay person who clicks on that link has just given away their IP address and location information and the purchaser of that advertisement has a pretty accurate list of gay people and where they might be located. Hopefully they're using that list for benign purposes but who's to say?
Do you think the average Facebook user is aware of how their information is leaked by simply clicking on a link in a Facebook advertisement?
True, but that isn't a whole lot better. Surveillance companies like Facebook like to make a big deal out of this, but I don't think it means as much as they like to pretend.
Unless there is a complete engineering stop and development of privacy policies and tools, and review of all existing tools and processes the necessary cultural change will not occur.
Facebook would have the money to do that and possibly have positive change throughout the industry if they would do something like this. Like Microsoft made the Secure Development Cycle a thing in the early 2000s.
But I'm already reading news how now all Facebook messaging platforms will be able to send messages to each other - sure thing that that violates everything WhatsApp stood for in past. Also, tons of privacy questions that come up with such merges of technology and the data it connects.
Don't forget that Zuckerberg started out making an app to get laid. It's a long, long road from there to preaching ethics and whether or not he actually has reformed, he has not exhibited that reformation.
This is also funny, in a grim sort of way:
> Late last year, Facebook admitted that Clear History is taking longer than expected -- it turns out that browsing data, which the company uses to help send more targeted advertising to users on its social platforms -- is more deeply ingrained into Facebook’s systems than anyone realized. Simply finding and deleting the correct data without disrupting Facebook’s advertising and analytics businesses has been a big enough challenge that the product hasn’t gotten off the ground...
If Facebook were serious about this, they could easily implement a "nuke all of my data" option that would wipe all of your history. Not just the stuff gathered from beacons, but everything, so people could start over from scratch with their new understanding of how Facebook operates.
But they clearly aren't serious. I suspect that the only real "clear history" option will be exporting your data, deleting your profile, and making a new one, preferably using a new email address from a public computer.
As a result, it's not that you can't make your own social platform, it's that your platform lacks critical components for instant gratification.
Maybe I am wrong though. Open to discussion for my perspective.
- First it would have a cost, either in money to pay someone to develop/run the platform or in time/knowledge to tinker with some open-source solution. That shouldn't be a problem as the target market is the group of people who are making a conscious choice to dodge the ad platform. BUT it does severely reduce the network effect, possibly down to the point of becoming an ultra-specialized niche club.
- Then, there's the point you bring up: you'll essentially be trying to sell steamed broccoli inside of a candy store.
Personally, Facebook and such has pretty much poisoned the whole idea of "social media" entirely. My default position these days is that if it's "social media", then I can't trust it.
I don't know how many people share my attitude. It might not be enough to matter.
- User data is held in a trust with independent trustees (like a mutual fund complex) who oversee and set limits on how the platform company uses the data for advertising.
- Users can "withdrawal" their data at any time.
- Instead of micro-targeting individual users advertisements would be sold to groups (like a mutual fund) based on anonymized data from the users who choose to join that group.
- Users could "invest" in a particular group by joining groups that reflect their interests and creating content/posts in those groups. Daily up votes would represent the creators "share" of the advertising proceeds to that group (like dividends) so good content is rewarded.
- Development/maintenance would be paid by a flat % of advertising revenue taken off the top before the "profits" are distributed to "shareholders."
His proposed strategy doesn't really makes sense and seems like misdirection and lip-service. You can't change the way people use Facebook, but you can forgo any pretense of privacy, which may be the only thing that can honestly and realistically be done.
These breaches and preaches are now a daily occurrence, having found a new level of tedium, especially since overtly parasitical behaviour has long been admitted and identified within certain ecosystems.
How would you determine if the new user interface provided (or not) any [new or perceived] level of privacy?
If one of the most powerful executives in America can't bring about wholesale change to the business and is truly helpless as you describe, who else could possibly come in and make a difference?
If the company's existence is threatened, so be it. They're in this position due to the actions they've chosen, and immortality is guaranteed for no one.
He has both the money and the power to do the right thing yest clearly has no desire to.
Do you have a source for that? I'm only aware of Onavo code being shared with another FB survey app which was running in parallel (ie, not the same app renamed and republished)
Yet this declaration was specifically about his view on privacy at FaceBook, not just random shit.
Sure, but the stupid stuff that I said as a teenager actually reflected true aspects of my attitude and personality. I suspect the same is true of the vast majority of people.
"Evil" is a a loaded term. I think it's more accurate to say that Zuckerberg is knowingly deceptive in an effort to ensure that Facebook can continue to engage in pervasive surveillance without too much public outrage.
There seem to be absolutely no consequences to their repeated misdirections and outright lies.
That way, you'll see that the 'dumb fucks' comment his made in his youth was not merely an example of immature cockiness tempered over time by maturity, but rather a profound insight into who he is and what he wants.
Ideally the internet would not need regulation, if only people cared more about doing whats right...and not what makes your shareholders rich.
I think the unfortunate reality is whenever there's money involved, certain players will win over and time and become gigantic and by the very nature of their being at the top, they are unethical. Naturally, the less ethical and more ruthless money makers win in the market if all other things are considered equal to their competitors.
Facebook's problems, and privacy violations in general, are different. It's not necessary to engage in mediated social interaction; you can opt out with no loss except convenience. There's no bodily harm, let alone death, so if you're burned once, you can simply never do business with them again.
That means the market could fix this problem. That it hasn't says that there aren't enough people who agree that it is a problem, or that the cost is worth the benefit to them. In a case like that, not legislation but education is the solution.
The problem is that avoiding doing business with them does not protect you from their behavior.
> That means the market could fix this problem.
Maybe, maybe not. But generally speaking, the free market cannot fix all problems, and particularly has an issue fixing problems that are imposed on people who already don't do business with the bad actor.