Hacker News Reader

Comment by asenk | Hacker News Reader

Good time to remind that Facebook has previously intentionally bypassed permission dialogs to gather data without user permission:

https://assets.documentcloud.org/documents/5433555/Note-by-C...

View on HN

Also nice reminder about that lovely photo of Zuck with a sticker covering up his webcam. Now why would he do something like that ... ?

Because he's much more likely to be targeted than any of us for things like that?

In a building he owns, on a network he owns, defended by an army of network engineers he employs?

No, he’s not protecting himself from any external threat.

Ever heard about 0days?

Couldn't he just tell that army to add an exception for his account?

This is common practice among US government employees as well. The fact that Zuck does it as well doesn't say anything about Facebook's practices WRT their users.

This is common practice among US government employees as well

Sure, but they are protecting themselves from the Russian hackers that are in all the US government networks. Zuck is protecting himself from Facebook itself.

What about taking the laptop outside of the office? Doesn’t seem like a crazy thing to do.

Not sure who downvoted you. But I agree 100% with this, he is a high value target.

I feel like a high value target to me, though. If the environment is untrustworthy enough for Zuckerberg to defend himself against it, he should consider his own role in making it that way.

But the truth is you should always treat your environment as untrustworthy. I don't think you should deduct him points for blocking his webcam.

It is an ADDITIONAL privacy step. He runs a company with thousands of employees, and with any company like that you never know if someone may decide to become a bad actor, and physically compromise him.

But yeah lets continue to hate on facebook.

> But yeah lets continue to hate on facebook.

Yes, because they're voracious collectors people's personal information. We can hate on "bad actors" as well, we don't have to choose one or the other. But as long as Facebook is behaving creepily, whether deliberately or inadvertently, let's hate on them. There is no reason to tolerate their mistakes.

“ALL ANIMALS ARE EQUAL / BUT SOME ANIMALS ARE MORE EQUAL THAN OTHERS.”

I do it. My wife does it. My sister does it. The cameras at Bloomberg all had shutters, and I used it there as well. It's just good (paranoid?) OPSEC to defend against remote takeover exploits.

How does tape over a camera prevent remote takeover specifically?

It doesn't, obviously, and I never said it did. It prevents the camera from being used to surreptitiously record useful information when a machine has been remotely compromised. It's the same reason nothing with a transmitter is permitted in classified areas without specific authorization. Preventing a remote takeover is effectively impossible, but these steps reduce the usefulness of such an action (which is part of the defense against them).

> > > It's just good (paranoid?) OPSEC to defend against remote takeover exploits.

> > > [Camera shutters are] just good (paranoid?) OPSEC to defend against remote takeover exploits.

> > > [Camera shutters are] ... good ... [defense] against remote takeover exploits.

Clearly I misunderstood your intent, but the comment does seem to indicate what I thought.

Nothing there says or indicates anything about preventing takeovers. Preventing is a strict subset of defending against.

Physical controls can be as effective as technical.

I also noticed they've started resetting the notification settings I set through the Android settings menu for Messenger. I didn't know this was supposed to be possible.

I think the developer can change the notification channel ID (which they use to group similar notifications and the user can disable a specific channel) and then you basically start with a channel without previous settings. You would have to disable all notifications for an app completely (not just a specific type) to prevent this for the future.

Or, you know, delete the demonstrated-untrustworthy app from your device...

I don't have it on my phone and I don't see a reason for a native app for facebook. The mobile website works good enough if I need to check something (sadly it's heavily used also by companies and newspapers in my country) and messenger works through https://mbasic.facebook.com/messages/

Thats what bothers me the most about my Samsung phone. Facebook came preinstalled and I cannot uninstall it. I can only deactivate (whatever that means).

I don't use facebook, I actually never did. Its not the fact that I'm loosing a few MBs of storage that really bothers me, it's the fact that this is the facebook app.

You can uninstall it using ADB, even without rooting. Not a consumer-friendly solution but I’m throwing that out there in case you want to try it.

I think I'll try that. I guess that'll work for LinkedIn/Office as well? However, not sure if the BYOD policy will like that.

That's actually what I ended up doing to 'fix' it. It's disappointing, yet not surprising, to learn it's intentional subversion of the API.

How does one "bypass a permission dialog"? What's the permission dialog for, if it can be "bypassed"?

By finding a bug or oversight in how the dialog was implemented.

> Good time to remind that Facebook has previously intentionally bypassed permission dialogs to gather data without user permission:

I wonder if the camera app leaves some by-product that the Facebook app can exploit to derive some data that the user would not usually give to FB.

Perhaps it initializes the GPS without being prompted (as camera uses it for geotagging). Or maybe it checks for the time required to enable the camera, comparing with previous attempts in a kind of A/B test, so it can know if the camera was being used for another app?

Reply on news.ycombinator.com