Facebook says one hundred API users may have improperly accessed user data | Hacker News Reader

Facebook says one hundred API users may have improperly accessed user data

nbcnews.com

209 pointshappy-go-lucky67 comments

Could this be related to upcoming release of internal documents?

>Big new leak of internal Facebook docs to be published Thursday. There’s been extraordinary attempts by Facebook to suppress this including seeking disclosure of emails sent to journalists & MPs

https://twitter.com/carolecadwalla/status/119140241162292838...

>At noon on Wednesday, Dublin time, I + others will publish full copies of 6,971 pages of Facebook confidential and legal documents, leaked in February.

https://twitter.com/dcampbell_iptv/status/119139795858925977...

Hadn’t heard about this. Certainly casts their recent cozying up to the Republican establishment in a new light (i.e. avoiding further enforcement actions).

Duncan Campbell (@dcampbell_iptv) started posting links to documents: https://twitter.com/dcampbell_iptv

UPD Reuters story: https://www.reuters.com/article/us-facebook-antitrust/facebo...

Computer Weekly story: https://www.computerweekly.com/news/252473540/Lawmakers-stud...

This is referring to 100 external software developers that use Facebook's APIs, not Facebook engineers as I initially assumed reading the title.

Source: https://developers.facebook.com/blog/post/2019/11/05/changes...

To clarify further, the exact phrasing used was "roughly 100 partners", as in roughly 100 external legal entities. Each legal entity could have any number of software developers.

Ok, we've put partners in the title above.

I use the facebook API but don't consider myself a facebook partner. I'm fine with "API user"

But other partners may have hundreds of users.

They 're all using my key, i get the data and i m responsible for it, not the FB user.

Ok, we've turned the partners into API users.

Remember that Facebook PR has a habit of releasing a tiny number when they break bad news. The actual number has been as much as 100 times larger[1], but they get the smaller number into articles and the news cycle moves on. For some strange reason their initial wrong estimates are always in favor of Facebook.

Based on that, this “one hundred” may well turn out to be “ten thousand”.

1: https://www.vox.com/2019/4/18/18485528/facebook-instagram-pa...

The Facebook blog post would probably be a better source, since it explains the nature of the data: https://developers.facebook.com/blog/post/2019/11/05/changes...

I.e. apps added to a group by an admin could get some metadata about members of the group.

(That blog post would also have been harder to mis-interpret than the NBC article. Half the early comments seem to think that this was about Facebook engineers improperly accessing data.)

If we do that, people will say that we're trying to protect FB by replacing a news article with a corporate press release. Is there a better third-party article?

Obviously there isn't!

I don't know what goes into running this site, but personally, if I know I'm guaranteed to get a totally one-sided take, I'd rather have the one from the people who actually know how to code.

>>I don't know what goes into running this site, but personally, if I know I'm guaranteed to get a totally one-sided take, I'd rather have the one from the people who actually know how to code.

In other words, if you don't know how to code, you are probably not intelligent enough to write about a technical topic?

No, there are intelligent people everywhere. But intelligent people are often catastrophically wrong when writing on a topic about which they know nothing.

The key word, of course, is "often" and not "always".

How would you know the difference?

It’s not about knowing the difference; it’s about recognizing the pattern and applying the appropriate measure of skepticism. It happens with complicated topics in other fields as well.

People who think they always know best are often catastrophically wrong when it comes to writing about the topic they think they know better than anyone else.

At some point, you've got to let people decide for themselves what is true. A single source of information is an unreliable source.

In the context of a Facebook user, what is the difference between data and metadata?

I guess it depends on whether you view this as a continuum or have an absolute "anything the user touched is user data" take. Compare it to a couple of security issues they had last year:

First, the one where the attackers would have had full access to the accounts. Photos, posts, private messages, likes, contacts, etc: https://newsroom.fb.com/news/2018/09/security-update/

Or the one where some apps could read photos that they were not given access to, or in some cases that the user hadn't shared at all: https://developers.facebook.com/blog/post/2018/12/14/notifyi...

I'm confused as to how this is 'improper', if Facebook made this data available why are the developers at fault?

Regardless of how many developers have "improperly accessed user data", you can do a lot of stuff as a regular person such as tracking how long all your friends sleep:

https://github.com/sqren/fb-sleep-stats

After I found one of my friends doing this, I quit FB (this reason among others).

You could find much much more personal information about your friends before social media, the old fashioned way -- stalking. Both stalking and this kind of data scraping have the same response: get better friends.

Sitting in the comforts of your own home is very different from having to go outside to reach the victims.

And blocking social media stalkers is much much easier than stopping real ones. It is indeed a different game, but I don't think it's qualitatively worse.

It can be automated and packaged into a solution for anyone to use. IRL stalking is hard and dangerous, and it's going to be that way for the foreseeable future. Is that "qualitatively" worse enough?

No, because blocking people takes one click. You can completely solve the problem in literally two seconds. For that reason, I’m more confident of my privacy when on social media sites than in real life.

I have never seen a comment which is so ignorant of Facebook's past behavior.

Are you aware that Facebook at one point unilaterally decided to allow people to see and comment on photos of friends of friends (i.e. 2nd degree connections)?

Just in case you are not clear on what actually happened: this "feature" didn't initially exist, so you behaved in a certain way one day. And the next day, they added this feature and you had no way to opt out of it.

Am I now supposed to also monitor and choose the friends of my friends? And then also study Facebook's API to know what level of access is provided to first degree connections? And then second degree connections? And are you suggesting everyone who uses Facebook is supposed to learn about all this stuff?

If past admissions are any indication, expect a 'revised' admission in a few weeks where they 'discover' that the actual number is one thousand partners who have improperly accessed data.

> “Although we’ve seen no evidence of abuse, we will ask them to delete any member data they may have retained and we will conduct audits to confirm that it has been deleted,” the company said in the blog post.

I wonder how these "audits" are done? Force the individuals into a legal agreement through threat of a larger action?

The audits are a figment of a lawyer's imagination.

Edit: when I wrote this I assumed "developers" meant employees of Facebook who work as developers. Actually they're referring not to "developers" but 3rd parties to whom they issued access tokens. My comment is still valid..

They make them pinky promise. (Can't break a pinky promise.)

I may have heard of such a thing happening at another company. Certain personalities just can't seem to help themselves.

Intelligence agency employees engage in LOVEINT.

Must've been the Gates of Galloo devs

100 is a number that raises my curiosity. Not 97 partners or 104 partners. Exactly 100.

FB's post actually says "roughly 100 partners", not exactly 100.

How can it be that Facebook with all their engineering prowess can't even tell who accessed what, let alone put adequate permission controls on their APIs? Didn't they invent GraphQL and whatnot and aren't they bound to GDPR in EU requiring them to list specifically and individually the external partner companies they're sharing data with, and the kind of data shared?

Probably laziness. A few years ago (before GDPR) third party "apps" on FB could access many things, and FB just said "don't worry, the devs can't do anything bad because they had to click a button that said they'll follow our rules, or be banned!".

So many of my friends used stupid quiz apps, certainly leaking my data to those 3rd parties too.

>> How can it be that Facebook with all their engineering prowess can't even tell who accessed what, let alone put adequate permission controls on their APIs?

> Probably laziness

Facebook is a lot of things, but they're not lazy. As far as can be seen, their decisions are largely intentional. If they didn't do something, it's because they didn't want to or it would hurt their bottom line, not cause they're lazy.

So many controversies with facebook lately. It seems like there is something wrong with facebook.

What a surprise.

We watched this documentary in the fake news class I taught this past summer.

https://www.netflix.com/title/80117542

While some of the assertions in the film are unsubstantiated, the resulting classroom discussion on the role of social media and privacy were immensely constructive.

Did your class cover any aspect of how the mainstream media, like cable and broadcast TV news channels and the top printed newspapers in the country, also practice heavy bias in their reporting, and how the members of your class could become aware whenever those biases arose?

Yes, we did. We cover the difference between journalism and its ethics for the social good and the media, which is produced for consumption.

A key problem is the dearth of actual journalism today. The Economist being one of the few exceptions, along with Reuters (not sure how to classify them though).

I was a bit underwhelmed, while some of the voter suppression stuff was pretty abhorrent, I thought building personality profiles and launching targeted ads was pretty mundane at the end of the day.

The next level of discussion that interests me is why social media manipulation is so powerful in the first place.

If people's beliefs are so heavily influenced by who we communicate with, what are the chances that we aren't under those same forces, and is there even an objective point of view in any of this?

> I thought building personality profiles and launching targeted ads was pretty mundane at the end of the day. The next level of discussion that interests me is why social media manipulation is so powerful in the first place.

Well, if you push in that direction then the whole narrative falls apart. There is absolutely no evidence that social media based personality profiles are actually effective -- why would knowing somebody likes Taylor Swift be better for targeting political ads than knowing where they live and their party affiliation, like in traditional ad targeting?

It's just absurd, and nobody ever counters this narrative because nobody has an incentive to. Journalists want people to believe this to get them afraid of Facebook. Facebook wants people to believe it because that makes their ads worth paying for. Doubly so for Cambridge Analytica and the like.

> There is absolutely no evidence that social media based personality profiles are actually effective

And that's why microtargeting has become pretty widespread in its use during political campaigning [0], because it's not effective at all.

> why would knowing somebody likes Taylor Swift be better for targeting political ads than knowing where they live and their party affiliation

Because FB knows all of these things, and not only who likes Taylor Swift. Care to name any other place where data like that exists in such an aggregated format?

[0] https://www.bloomberg.com/news/articles/2017-09-29/the-germa...

> Care to name any other place where data like that exists in such an aggregated format?

Come on. Both political parties maintain databases of voters containing plenty of personal information. When people canvas door to door they know precisely what kind of people will answer the door. This is a basic aspect of campaigning that was around well before Facebook. 2004 wasn’t the stone age.

You're picking Taylor Swift to make it sound your argument is solid...

Aren't there better indicators? If I follow my local city's LGBT group's FB page, well, what do you think my political leanings would be? Or on the opposite end, if I follow that megachurch's FB page? Or even if I'm just friends with many people who "checked-in" there last Sunday.

Sure, but do you really think this basic information about general political leanings wasn’t available before social media? 2004 wasn’t the stone age.

Can you point me to the online ad service where in 2004 you can do "Show this ad to people of (gender/age/race/sexual orientation) living in (area) who like (these things)"?

Also Cambridge Analytica did more than that, they figured out whether the voters were easy to influence from their Facebook profiles, and they targeted people on the fence with ads pointing to Anti-Hillary conspiracy videos...

If you think journalists are just lying about Facebook being able to do all that (it's just all fake news, right?), read this article: https://www.forbes.com/sites/kashmirhill/2014/06/28/facebook...

and notice how FB didn't have any concrete denials in the lines of "None of this is true"...

> social media based personality profiles

It's not based on social media likes, it's a literal 5-factor psychology personality survey [1].

[1] https://www.businessinsider.com/facebook-personality-test-ca...

I once took a "media and society" class where I was told that critical thinking meant to take all my facts from the New York Times alone, that the NYT was infallible, and that I shouldn't even try to evaluate facts from "unauthorized sources" because they were all definitely lies anyway.

On reflection, I think this kind of class is bad for society. Are you sure you aren't running that kind of class?

Yes. We cover numerous types sources, from traditional newsprint journalism, to online reporting by some crank with a blog. The idea is to develop and apply critical thinking skills while reading/hearing various news/editorials/advertising sources.

For some reason, I don't think this is surprising.

Within the tech industry, specially Hacker News readers, we know that Facebook does a lot of "growth hacks", "gorilla marketing", "Microsoft way of doing things - Bill's era (remember Netscape vs. IE?)". So, even if FB Internal docs are released, the real surprising fact will be that end users are not going to simply stop using FB, IG, WhatsApp and we get mystified about "WHY"?! Or just "accept" that's always the case.

At the end, the users are either not interested to follow what FB does nor they have access to the truth. With those Billion of users, most of them are outside the sphere of influence of American media. Each country shows its most interesting news, a combination of top current world and local news. The current ones would be "Climate Change", "Hong Kong Protests", "Trade war US and China", "Something in the Middle East", "Something about US Stocks", and maybe: something about FB.

If we imagine ourselves as news writers, it is not easy to convey the nuances, calculated moves, and strategic choices that FB is doing to control its market to the general population. Thus, there are many barriers to really use this information to change FB behavior. Perhaps I'm pessimistic about it.

So at the end, it will only be surprising if the users understand and FB get huge pushback from its user base.

Reply on news.ycombinator.com