Backblaze Privacy Update: Third-Party Tracking | Hacker News Reader

Backblaze Privacy Update: Third-Party Tracking

backblaze.com

129 pointsdexterdog69 comments

Firstly, this post does not even mention or describe what kind of information was exposed and makes it seem like some inadvertent tracking that's not serious in any way. You can continue with your root cause analysis, but you already know very well about what kind of information was exposed and shared with Facebook. The least you could do is own it and alert people about it.

> We take the privacy of our customers’ data and personal information very seriously...

It's astonishing that there is no apology of any kind on this post. Is that too much to ask for such a grievous violation?

> On March 8, 2021 at 8:39pm Pacific time, a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages.

It went unnoticed for two weeks, with Facebook gathering information about the customers' files! And yet, no apology!

on tv at least, they say that apology is the same as admitting guilt, so they might not want to do that for legal reason

anyone know if that applies to the real world?

Could it be any more admitting guilt than

>a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages.

"We take privacy very seriously" is a sign that they don't take your privacy seriously at all.

inadvertently is the operative word here - I.e. their position is that this was just an accident.

There will never be an apology. A corporate apology is an admission of guilt. An admission of guilt opens it up to lawsuits. Through its litigeous nature, the US has evolved a culture whereby apologies and human decency are antithetical to survival.

Yev from Backblaze here -> I apologize for this mistake. We've updated the post with additional information now that we have it and there's also an apology.

On another note, have you contacted facebook to get the data removed from their servers?

Yes, this is rather disappointing. It's probably also in breach of GDPR assuming backblaze haven't contacted customers directly, informing them about the nature and detail of leaked data (based on your use of backblaze on X, we see that the following filenames and Metadata was incorrectly handed over to a third party (Facebook)...).

Wouldn't this also be a GPDR violation by Facebook as well?

Possibly. But Backblaze has an agreement with the user; and they have taken data they need / are justified in handling (filenames, sizes) and leaked them. Google docs wouldn't be liable if I stole your credit-card and put it in a Google doc.

It may be that fb is doing something illegal here too - eg the whole way tracking pixel work seems difficult to square with gdpr - but the tracking pixel/service looks a bit like the drill used to force a lock - another party (like BB) must deploy it. And arguably the purpose is not to "steal" data.

Yev from Backblaze here - with sincere apologies. After we removed the offending code on Sunday night we went into investigation mode and conducted a rca - we wanted to get some kind of blog post out there so that folks could see that we were working and investigating the issue. I will grant you that maybe our initial execution on that was lackluster, but we wanted to make sure we had a better handle on what we were talking about. We've since updated the blog with additional information, you can read those here: https://www.backblaze.com/blog/privacy-update-third-party-tr....

> We are also reviewing applicable third party code on the website.

This is very simple. On all dashboard and similar signed-in pages, there's exactly zero applicable third party code.

If you think otherwise you do not in any way take "the privacy of our customers’ data and personal information very seriously".

As such, you should be much more specific about what you mean with "we removed the offending code".

If you never intended for third party scripts to run on the dashboard page, well then you got some serious explaining to do as to how your deployment process let that slip.

I see the blog post now says the following:

We also subsequently removed Google Tag Manager from the private pages.

This is good. However, the question then becomes how on earth did Google Tag Manager get added to those pages to begin with?

Either you did not consider this a cause for concern, or it slipped past your code review. In either instance, how could I ever trust you with my data?

That question needs a serious answer.

They literally sent file names and file sizes over to Facebook. That might very well include very personal or confidential data. The fact that they don't even mention this and make it sound like some random unimportant tracking happened without them noticing is completely ridiculous.

Yeah, like file names of say PDF's, files with unique identifiers that give insight to the users personal life, worse still profile names of PC backups etc. etc.

The part I don't understand is how exactly does a tracking pixel end up collecting filename information?

Because it's a script that examines the DOM and ships the information from the page to facebook for analysys.

How do we know it did this? They didn't say so

Here's the screenshot: https://twitter.com/Benjojo12/status/1373707799054712836

Thanks! Was missing this in the context.

"Facebook has confirmed that all data inadvertently sent has been deleted"

"We have added protections to prevent this error occurring again"

Those sentences do - not - appear.

Security in services is all about liability and risk rather than an absolute guarantee.

I've seen so much anger over this issue that it's left me confused. Questions like how they can ever be trusted now. They could never be trusted. If the information is really that important, then it should be encrypted before being passed to any other service. Companies will screw up, the question is how are you going to be on the hook for it. The great thing about services is that you can pass the blame the service than if you had dealt with it in-house.

That said, this has been an embarrassing display for Backblaze and I hope they redouble their efforts on infosecurity. But mistakes happen. If there's a pattern, then that's a different story.

Their reaction so far does not appear to be anything but attempting damage control on social media. Maybe a pattern is forming before our eyes.

There are known mechanisms to prevent leaks/exploits of this sort by sending some additional headers[0], on most of the modern browsers. Apart from that, the cookies should be strict for such a service. I logged in to my friends account to find neither implemented.

They better act quick about "ensuring it doesn't happen" or I will distrust them completely.

[0]: Content-Security-Policy (setting at least connect-src) and X-XSS-Protection to start with. More here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

Wow! is crazy they don't have that implemented.

Backblaze is missing the part where you conduct an investigation, request assistance from Facebook, and determine what data was leaked to third parties.

> Our Engineering, Security, and Compliance/Privacy teams—as well as other staff—are continuing to investigate the cause and working on steps to help ensure this doesn’t happen again.

Silo the sales and marketing department away from the real products like the person in that other thread was saying. Sales people can't be trusted with private data.

> We take the privacy of our customers’ data and personal information very seriously [...]

And yet, your blog/landing site wants me to opt into sharing my 'personal data' with 20 different 'advertisement partners'. Come on.

I would say that opt in is pretty Ok in terms of privacy of customers protection.

One does not protect one's customer privacy by asking if it can be violated, often using dark patterns.

Well that's exactly how you do it. By definition.

Asking for consent means that you don't violate their privacy since they agreed to the data being collected and shared.

Using dark patterns is of course not Ok but also a different topic.

Yeah. Backblaze are addressing this "blunder" only because they got caught. Not because they give 2 shits about their customer's privacy.

The smug tone in this joke of a response to the issue proves this.

Man, your distrust seems toxic to me. The simplest explanation is they goofed as they admitted, if they were malicious, they'd upload those file names from their server straight to FB's, not through your god damned browser.

And of course they only addressed it after they "got caught", they didn't know about their fuck up before that, if you want to sneer at them, sneer at them for not being careful enough to let this happen, not what you wrote.

I'm not trying to defend them, more like I want to protest against ungrounded casual insulting bashes like yours that seems way too freaking common nowadays. I do think they care about customer privacy, because it affects their income. (Admiteddly they were too casual about it, they were still partnering with Facebook...).

I agree with you in principle.

That said, this way of doing things gives so much plausible deniability that it must at least occur to people.

We've been burned on so many fronts by so many companies that it really is a learned behaviour to toxically distrust when things like this happen.

It starts with politics. They're never held accountable for lying, evwn brazenly.

never attribute to malice that which is adequately explained by stupidity

> We take the privacy of our customers’ data and personal information very seriously

I wish companies would actually mean this and apply it proactively instead of just copy and pasting this in their apology after something like this happens.

Many companies do apply this proactively. It's just that you pay no notice to the 'lack' of incidents.

I didn’t mean to imply that no companies actually care about privacy and security, I meant companies affected by a public incident like this.

> We take the privacy of our customers’ data and personal information very seriously

> a new Facebook campaign was created that started firing a Facebook advertising pixel

I think they actually don't give any figment of a shit of their customers data if they are adding to the Facebook hoover of personal information.

> We take the privacy of our customers’ data and personal information very seriously

Yet the first thing I'm greeted with is a cookie consent dialog with "allow all cookies" being the only prominent button.

If I don't want to allow the privacy-invading tracking cookies I need to click a less prominent piece of text called "manage cookies" and avoid clicking on another prominent button called "accept all cookies".

They do not give a shit about my privacy.

Exposes a law:

"Any company announcing that they take their users privacy seriously does not in any way."

So a name "Facebook law of privacy" ?

Even the title suggests that it's just a heads up on some minor functionality. Not really what I would expect from a company that puts "Trusted Storage Cloud" in their <h1> and encountered an incident that completely eradicates that trust.

More details on the issue: https://twitter.com/Benjojo12/status/1373707799054712836

HN discussion: https://news.ycombinator.com/item?id=26536019

I've been a happy Backblaze B2 user for the past few months, but this and another recent event leaves me feeling like I'll have to abandon their service (or at least mirror everything to S3 just-in-case) soon. Recent event being when GoDaddy suspended their user-facing B2 domain a month ago because of abuse requests that were apparently not handled correctly. That and the fact that they still don't have a user-facing status dashboard to communicate the status of their systems has me worried.

Yev from Backblaze here -> thanks for being a Backblaze customer. We've finished our root cause analysis and have updated that blog post with additional information. We also have moved domain registrars to make sure that behavior doesn't happen again. Sincere apologies for the issues you've experienced.

So they posted a blog before informing their customers directly?

They had time to write, post and update, and I am still not seeing any emails about it

Looking at this submission, comments and its ranking here, I’m sure that nobody from Backblaze will comment here or on HN for some more time. This blog post makes it seem like an internal gag order has been imposed. Some hand wavy updates are what we should expect I suppose.

The post title is also dishonest in saying third party tracking and not adding details — this is Backblaze that intentionally and explicitly shared sensitive data with third party tracking. It’s not as if some third party tracked Backblaze’s paying users surreptitiously.

This response is actually helpful for the competition as far as the HN audience is concerned.

Edit: I’m really curious on the extent of coverage of this issue. I searched online and found only mjtsai.com and theregister.com covering this sensitive information leak. Are there any other major tech sites that have covered it so far?

Wow, please try again.

Why would I trust you this wont happen again?

Anyone got any alternatives?

I started looking into it, but I'm concerned there won't be a 1:1 equivalent.

Wasabi, maybe?

Many of them in the previous post about this subject.

After reading / comparing prices, for my needs I ended up with:

- OVH Cloud Archive: 0.0023/GB for cold storage + incoming/outgoing prices. https://www.ovhcloud.com/en/public-cloud/prices/#storage

- iDrive: $ 69.50/5TB/year https://www.idrive.com/pricing

- Wasabi: $5.99 / 1TB/month: https://wasabi.com/cloud-storage-pricing/#cost-calc

I've started using rsync.net with the borg client (replacing b2 and rclone) and loving it so far. I'm also surprisingly finding borg/rsync.net is suiting my usecase (personal backups) better than b2 did which is a nice bonus. I am paying more but can't complain as the value I'm getting is still good.

If you're in the EU and a backblaze user and consider that some PII may have been leaked to 3rd parties, you can contact your local GDPR watchdog (aka national "Data Protection Authority", or DPA).

See: https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Gross. Why are they involving Google and Facebook? Those are the two main companies I'm trying to get away from and Backblaze is part of my setup.

Yev from Backblaze here - We've updated the blog post with additional information after completed our root causes analysis. You can read the updates: https://www.backblaze.com/blog/privacy-update-third-party-tr....

I expect zero http requests to any Facebook servers when I visit anycorp dot com and that’s regardless of whether I’m a paying customer or logged in user. If any actual data is transferred that’s even worse, but already having a connection to Facebook via a tracking pixel for “audience building” or similar is over the line already.

oof, this blog post is even more cringy than their repeated replies on twitter "...we’ve looked into and verified the issue and have pushed out a fix. We will continue to investigate and will provide updates as we have them."

this is a perfect example of how NOT to handle a PR nightmare.

Oh well, that's it then. I guess I'll only use Backblaze through `rclone` and utilize client-side end-to-end encryption. And I might still not use Backblaze.

A very disappointing article.

This really isn't an acceptable response. I cancelled my account and moved back to AWS S3. Unfortunate.

I wonder if a class action is coming.

Why you would not just use a cloud provider for this, I just don't get it.

What do you mean?

s3, Google equivalent storage. Less cost for just about the same effort.

b2 is backblaze's S3 and it is cheaper than either S3 or Google Cloud storage

And maybe now we know why!

Reply on news.ycombinator.com