Comment by Meekro | Hacker News Reader

Comment by Meekro | Hacker News Reader

I see a lot of these articles about Facebook and privacy lately, but I'm still wondering what, precisely, Facebook is doing that people object to and what kinds of changes would satisfy those who are upset.

Near as I can tell, this is about data in Facebook's databases finding its way to other organizations without the users' knowledge or consent. But the way this happens is pretty benign:

1. User installs Facebook app, and that app phones home with info about user's friends (who did not consent to this). This is what happened in the Cambridge Analytica scandal. People started asking why apps are allowed to see info about the user's friends (who did not install the app). But to a programmer, the answer is obvious: it's the "app inherits owner's permissions" model that's been part of the Unix tradition for decades. Anyway, Facebook has since changed this behavior.

2. User adds some bots as friends (maybe because their profile photo is of a cute girl), and the bots phone home with public info about user's friends. This is an entirely predictable consequence of the "friends of friends" permission model. Facebook users can set "friends only" permissions to prevent this, but most don't bother.

Is it one of these two vectors that's getting people upset, or something else that I'm missing? Keep in mind that advertisers never get to see people's private info. They just make an ad and say something like "show this to people aged 18-25 who are into video games."

My objections are thus:

1) Facebook uses any info I put into their platform to create a centralized, indexed, searchable, public database of people. This is dangerous for a lot of reasons, but notably in the vagaries of Facebook’s privacy settings (which seem to get reset every so often).

2) Facebook allows advertisers to target using a huge number of selection criteria. This allows advertisers to target some very specific — and vulnerable — groups in a way that is creepy at best. See also how the GOP was easily able to target specific racial cohorts in tight districts to spread FUD — the same tactics also work outside of politics when trying to sell things.

3) Machine learning outside of Facebook’s control makes it trivial to connect social media accounts to other activity the user may perform on the Internet — and thus connect that semi-anonymous online content to their real world relationships (e.g. the database of porn actresses linked to their Facebook profiles)

This collection of user data is Facebook’s entire business. The whole corporate bureaucracy is set up to protect this database and its data collection activities. You can’t have Facebook without it. So in a word, a lot of people object to Facebook’s entire business model — it’s just most people weren’t aware what that model asked them to give up until recently.

>But the way this happens is pretty benign:

That would definitely be how FB describes it...

But the reality is FB had previously been investigated by the FTC for privacy violations and practices, in order to avoid enforcement action, the entered into a settlement agreement with the FTC agreeing not to engage in certain practices, develop new privacy standards and practice and allow 3rd parties to audit their privacy practices regularly...

FB violates that settlment agreement, including but not limited to, scraping email contacts from its users which allowed them to not only get that initial data they were not entitled to but more importantly to them to obtain secondary email address they could link to single users and even emails of non-users to create shadow profiles and buildout their social network through other email contacts. For example I’m not a FB user, you are, they inviolation logged into your email and scaled your contacts, identifying me, and then they build my shadow profile and build my profile from every other user who had me in their contacts.

Probably not benign.

What about the shadow profiles? Collecting data on people who have never even signed up and have not given them any data whatsoever?

That's what I strongly object to.

The difference in the amount of data that FB has on people who have an account and those who never had an account (like me) is minuscule...

I'll note that FB changed the behavior for number 1 over five years ago - and they only had that policy in the first place since the tech community at the time was slamming them for being a walled garden.

Most people complaining about FB's privacy practices are just on a bandwagon - I've never seen actual evidence of harm from FB's practices re: privacy.

Here are the top two things I consider utterly invasive.

1) shadow profiles. Facebook has profiles for everyone, regardless if they have a profile on the social network or not. You many have never visited Facebook and still they collect info on you based on a variety of identifiable information they can find online.

2) forbid ad targeting by e-mail or phone number. This allows everyone who knows my e-mail or my mobile phone number to specifically target me with tailor made ads. The ramifications of this could be really scary.

Didn't know about these shadow profiles, that's pretty interesting. Does anybody have an informative link handy to read more about this?

The existence of shadow profiles are pure speculation born out of the idea that just because FB can it will keep every bit of data.

When in reality FB just like any other well company has only stores what it needs as long as it needs to provide the services they do.

On that note I might add that most data (if it wasn’t to begin with) becomes meaningless after a few days

So how come when you first join FB it starts suggesting people to befriend who you already know? The only way to do that is by collecting information in the background for every living being. They aggregate everything and then they make correlations. By the time you decide to join they have a pretty good idea about people you might know. I can't see any other way for something like that to work.

All your friends uploaded their phone books. When you signed up, facebook searched for your number.

The nuance with a shadow profile basically comes down to when facebook compiles the relationship of your data into a single entry. People think if they do it ahead of time, its weird.

People also seem to ignore that facebook BUYS a lot of data, just like many other marketing data conglomerate.

> "The existence of shadow profiles are pure speculation"

Zuckerberg admitted to congress that Facebook collects data on people who are not signed up for facebook (but implausibly denied being familiar with the term 'shadow profile'.)

You've already hit the nail on the head.

Facebook is providing a friendly user interface to do normal people stuff. To the users who aren't technically sophisticated or haven't thought deeply about any of this, sucking up their contacts and shipping them off to wherever is just not something they would have imagined, let alone agreed to.

And yet they did, at least technically, when they clicked some button saying they had read 40-pages of legalese.

Reply on news.ycombinator.com