Hacker News Reader

Comment by inetknght | Hacker News Reader

> Cambridge Analytica used the Facebook API to ask users to share data about them & their friends. Stupid users agreed to that.

Not reading a 1000 page EULA doesn't make users stupid. It makes Facebook predatory.

View on HN

The OAuth consent screen is like 3 lines of text, maybe 100 pixels in length and width. There is no EULA, so not sure what you are talking about.

There's no 1000 page EULA to read, and FB wasn't the predator. CA asked for data and user said yes, same as if you accept a friend request with someone who gossips about you behind your back.

This is ludicrous. So somebody friends me on Facebook, someone who I know and trust. Then that person comes along some quiz, and then in teeny text at the bottom of what looks like a standard "blah blah blah" popup is the information, carefully worded as to not be too alarmist, that that person's friends' data (i.e. me) will also be sucked up.

At that point, why just stop at friends? Why not go to any transitive relationship with the argument "well, you trusted that person, so it's just like them sharing the data you already gave to them". Of course, the absurdity of that is that one person can share the whole world. I do not think this is a slippery slope argument at all, given that FB already went halfway down the slope before there was outrage.

The same argument could be said today about your web browser.

I wrote this comment for people in this conversation to see. Yet you allowed Google Chrome access to the comment. You let your adblocker see it. You let lots of software companies scrape it. You shared the data with a wider audience than I intended.

Sure, the argument doesn't hold much water on the public internet. But now consider HN was an invite-only forum, in fact an invite-only forum just like my facebook page...

You’re making the same argument. Public comments are fair game and there’s no expectations of privacy. A private, or invite only, or a network like fb with complex privacy controls is another story entirely.

If you told Facebook to give someone access to your personal information and they took it and handed it off to a third party, what is Facebook supposed to do about that? What can Facebook do about that? What could any website do about that?

I despise Facebook, but I really don't understand this whole Cambridge Analytica thing. There doesn't appear to be an endgame for those criticizing Facebook over the ordeal. Of all the despicable things Facebook has done, why is this the one that everyone clings to?

It's not that my friend gave my info to someone else. My friend allowed the app to ask Facebook information about me.

In the end, it's still Facebook who handed over my data. That my friend decided that was OK doesn't change much.

As I understand, it was a browser extension which scraped data off the Facebook pages visited by users. There is no way Facebook could reasonably detect or combat that.

> As I understand, it was a browser extension which scraped data off the Facebook pages visited by users.

That is false:

https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...

Nevermind. I thought it was a browser extension. I was not aware of the "Open Graph" platform. Thank you for the correction.

I think you're confusing it with another recent FB event where they sued browser extension makers for scraping FB data.

https://www.zdnet.com/article/facebook-sues-two-chrome-exten...

> My friend allowed the app to ask Facebook information about me.

Unless there's a major security vulnerability, you can only delegate access to data you have access yourself. So your friend did the equivalent of giving Cambridge Analytica your data - the technical implementation of it (as to whether CA got the data off your friend's phone or from Facebook directly) doesn't really change the outcome.

How is this any different than FB asking for access to your private contacts, to "help" you find them on FB? What if one of your friends isn't on FB, and doesn't want FB to have their info? Your friend didn't give you permission to give FB their private contact information, ie phone number. FB then goes and makes a shadow profile based on that info you supplied without permission, and any time you mention or tag said friend, whether in a text of photo.

> CA asked for data and user said yes

I think a lot of people are forgetting that you were also able to get tons of data on a user's friends, just from that user accepting. No consent on the friends part. If you and I were FB friends and I accepted one of those requests, CA now also knows your profile info and likes.

What you said. I was starting to read the like 100 comments about how people clicked yes and so be it, but the entire time I was thinking, wait, no, that's not what happened. It's what you just said. Amazing how a little time leads to revisionist history for these people defending facebook.

I absolutely believe in my mind that big companies are actively posting to HN, Reddit, FB, et all, to steer different narratives.

There’s no thousand page EULA. Just a screen that says “do you want to allow this app to access your profile data and your friend list” and they clicked yes.

Should Cambridge Analytica then be held accountable for being dubious in what users were giving access to and what they would do with that data?

Do you think if they knew the full scope of Cambridge Analytica's work they would've allowed them to access the data?

Absolutely, but if I remember correctly Cambridge Analytica is no more and the law doesn't seem to be going after whoever was behind the company.

> Do you think if they knew the full scope of Cambridge Analytica's work they would've allowed them to access the data?

Honestly? I'm not sure - a lot of people already dismiss privacy concerns and ad tracking as "I've got nothing to hide" or "it's just ads, no big deal". Unfortunately I wouldn't be surprised if people opted in even if CA was fully transparent with their intentions.

However, CA even broke Facebook's API terms of use, so at least if CA was transparent Facebook wouldn't have allowed them API access to begin with (though I'm sure they would've worked around that, with malicious apps/browser extensions or just asking for raw Facebook credentials, bypassing the API completely).

If I tell you to go on Facebook and take screenshots of your friends’ profiles and send them to me and then I do dubious things using that information, whose fault is it? I’d split it between you and me. Facebook is not at fault at all.

Reply on news.ycombinator.com