Hacker News Reader

Comment by superkuh | Hacker News Reader

This is a bait and switch. There's no reason to believe that Facebook will remain benevolent in the future. They will switch back to requiring some thing they can use to collect and sell your personal data even if it's not called Facebook. That was the point of them buying Oculus. They never tried to make money on the hardware.

View on HN

I'm positive they will still correlate activity from your Meta account with your FB. One possible point of this is to keep Meta users with access to their purchased content while Facebook maintains their ability to block/restrict user access on the platform.

But I don't have a Facebook account so what is there to correlate?

None that you know of.

Facebook indeed collects data on non-users

https://www.howtogeek.com/768652/what-are-facebook-shadow-pr...

It is deeper than that. After I google for anything , I generally see advertisements in my Facebook app for the specific thing. There is certainly some invisible link between Goog and Febu.

The word you're thinking of is remarketing.

You may not have an account on Facebook, but Facebook has an account on you.

It gets populated with data uploaded by other people, JavaScript widgets on random web pages that you visit, etc.

Facebook maintains “shadow profile” accounts for people who have not personally made an account [1], the answer to your question is “whatever information your friends and family exposed on your behalf and which is linkable to you”.

[1] https://medium.com/@SpiderOak/facebook-shadow-profiles-a-pro...

They did. I suspect that if they still do, there's going too be a really painful GDPR penalty heading their way.

Cost of doing business? Is GDPR protecting me as an American from Facebook shadow profiling me? How significant are GDPR fines?

In theory 4% from yearly revenue (not earnings, revenue), in practice I haven’t seen it being applied.

Here you go. Click your country's flag to see your results https://www.enforcementtracker.com (if you're European, that is).

They can still do it to non-Europeans

How can they tell how an email address is European?

Because you told them while you were creating your Meta account, and because the credit card you entered matched what you told them.

Sure, but we are talking about shadow accounts, not Meta accounts.

so you think they are confident enough to link somebodies randomly created alias, let's say "InteretDude420" to a real name? What if opened a VR Arcade and owned 100 Oculus Quests and made 100 separate accounts?

>so you think they are confident enough to link somebodies randomly created alias, let's say "InteretDude420" to a real name?

After a certain amount of fingerprinting, absolutely. It's not as if they are solely relying on user-submitted information such as a handle to make that link. And if no link can be made right this second, they can just continue to collect data under "InteretDude420" until they reach a certain amount of confidence to link it to a real identity.

And, even if they get it wrong some % of the time, who would ever notice or find out? Eventually they just get more data and increase the confidence rating for the correlation.

It is surprising how little information (even "anonymized information") is needed to de-anonymize someone. Plenty of papers on the subject if you are curious.

Yes, zip code/geo-location plus a few other points of personal data are often enough to identify an individual. Then tie that to a browser fingerprint and you can tie together all their "anonymous" screen names.

I read recently (or heard in a podcast; can't find the source lamentably) that almost all people can be uniquely identified by the top three locations they spend most time at.

I would expect most people spend most of their time at home and at work, so that doesn't really surprise me.

Presumably if you use their app marketplace you'll have valid credit card information stored in a data center of there's somewhere.

Considering all the metadata they can collect over indefinite periods of time, with 100% certainty, unless you invest extraordinary effort to give them enough misleading data.

There are plenty of studies (example: https://www.nature.com/articles/s41467-019-10933-3/) that show you need only limited amounts of data to be able to deanonymize people.

> let's say "InteretDude420" to a real name

For many targeted / personalized ads purposes you don't really care about the real name. You mostly care about linking hardware / software identifiers (IDFA etc.) to some kind of profile that you attached information to (Likes technology, fashion, classical music,...).

If you make 100 separate accounts and open a VR arcade you are probably just filtered out as an anomaly. It's not about having a 100% coverage, it's about having good enough coverage of most users. Just like filter out bot or ad blocker users as there's still enough regular people.

Facebook allegedly buys transaction data (you know like banks and payment processors etc. sell). So they have a browser fingerprint for you via cookies (you know that like and share button on every page on the internet) or just plain JS fingerprinting.

Matching all that data to the real information you just ran through paypal or other merchant (some merchants sell this data directly) is something an intern can do on their first day.

I thought they denied maintaining shadow profiles though? There seems to be some people at FB who actually care about getting this stuff right and doing the right thing but economic forces at this point appear to be pushing most of the company in a very different direction.

A massive number of sites have Facebook tracking built in, since FB pays them a fraction of a penny for each visit it monitors. They don't care what username you're using; they just need to correlative fingerprinting (IP addresses, browser/device profile, any data from other apps installed on the same device, etc).

If you opened that arcade, they'd probably recognize that through a couple hundred different datapoints and use that to further analyze user behavior (For example: Which FB/Instagram users went to your arcade, stayed for a significant amount of time, then left. Of those, which don't already own a Quest -- market to them).

I think the reason is more prosaic. Oculus Quest is a complete nonstarter in business for many companies because Facebook-anything is simply a no-go.

And they need to penetrate into this market because that's where the money is, not in subsidized headset retail.

Now whether someone will buy this "no need for Facebook anymore but not really" shtick is another story.

with that reasoning they would need to allow Google or MS AD accounts.

All Facebook needs is data that they can tie to a phone number or primary email. Geolocation and first name would be enough for that.

I think the real reason for requiring Facebook accounts was just padding user numbers and events for a quarterly report (likely for somebody's bonus to land).

> That was the point of them buying (and ruining) Oculus.

The point of them buying Oculus is because MZ thinks that VR might be the future, and he wants to own that space (Lest Facebook fade into irrelevance as a one-trick pony).

I'm of the opinion that the data they could slurp up from mining your VR usage is of limited use, because it won't meaningfully improve ad targeting. And if it doesn't improve ad targeting, there's no reason for advertisers to pay FB more.

I was so pumped for Oculus. I was following them way before Carmack joined. I had a DK2. What facebook did to Oculus is a good enough reason for me to hate them intensely forever.

What exactly did they "do" to oculus besides give them a ton of funding and try to bring them into the mainstream?

By way of analogy: They took a precocious, promising young child and assimilated her into the Borg.

They broke the emerging VR software ecosystem into the open side which many companies supported and a Facebook only proprietary one they asserted ownership and control of. Before Facebook bought Oculus there was cooperation and native software interoptibility between Vive and Rift.

Then they stopped supporting desktop head mounted displays for the most part and switched to building face mounted VR computers that happened to have an initially janky, and always higher latency, passthrough mode to support acting as a display for a real computer.

This has been what I've found frustrating about most past VR headsets or attempts to build one: I don't want a VR headset to be like a phone or laptop and have its own computer and app ecosystem; I want a peripheral that attaches to my phone and laptop.

but you can't create lock-in and an app store out of that.

You can connect any oculus quest device to your desktop and use it just like Vive with steamvr aka peripheral. It is an officially supported functionality. They didnt remove it by creating Quest, they just added standalone mode in addition to the "peripheral" mode.

If anything FB has greatly improved this. Airlink is a literal step-change improvement to VR that allows the user to have a totally wireless PC VR experience, something that was assumed to be very difficult/impossible over existing wireless standards.

>They broke the emerging VR software ecosystem into the open side which many companies supported and a Facebook only proprietary one

What? There used to be a bunch of different VR platforms, and only recently has the industry settled on a single open standard, OpenXR[1], and Facebook was (or at least claims to be[2]) one of the major contributors to that open standard.

There are a lot of things you can criticize Meta for doing with Oculus, but opposing open standards isn't one of them.

[1] https://www.khronos.org/openxr/

[2] https://developer.oculus.com/blog/openxr-for-oculus/

The second point doesn't make sense at all. Consumers vastly prefer standalone VR, and it was always the future.

For the first point, I'll give you that they prefer playing on their own platform. But they haven't "broken" anything. While yes you do need a software layer, e.g. Revive, you can still play steam games on oculus and oculus games on an index. And you have no idea whether that would have happened anyway as one of these companies got bigger.

Google used to say "do no evil" and now they don't, and they didn't get acquired before they changed. These things just happen.

>Before Facebook bought Oculus there was cooperation and native software interoptibility between Vive and Rift.

With respect, did you ever use a Vive or a Rift CV1? They absolutely had much worst interoperability prior to FB. The launch of CV2 gated it behind the Oculus store, making it impossible to use Steam with the CV2 before overwhelming negative feedback changed it.

> I'm of the opinion that the data they could slurp up from mining your VR usage is of limited use, because it won't meaningfully improve ad targeting.

Facebook is going to get lots more data than they get from you on desktop and mobile.

“…one of the things I’m really excited about for future versions is getting eye tracking and face tracking in.” — Mark Zuckerberg

https://uploadvr.com/zuckerberg-eye-face-tracking-quest-3/

This quote seems to be about using face/eye tracking to improve the VR itself, not something about ads or data mining.

Yeah, many VR consumers are interested in face/eye tracking as well, because it's the logical next step for improving social VR (which a social networking giant is obviously interested in). No need to read further sinister motives into it.

I can reply to this comment now but will repost the previous reply:

Not sure why I can’t reply to the sibling comment here but I still cannot trust Meta/MZ for anything - even if the stated goal of eye tracking is to “improve the platform” “They trust me - dumb fucks” Mark Zuckerberg

Having worked very briefly at a company that survived on ad-sales, I can assure you that face/eye tracking will definitely be used as a way to sell more or charge more for ads on the platform. At the very least it will be a way for a marketing team to go back to their bosses about how sticky their ad was. Ie ‘People looked at our ad for an average of 10 seconds!’

Yes, and there’s value to that. “Better avatars” is a central part of Zuck’s public sales pitch.

But the actual endgame is that Meta has been building a portfolio of patents that leverage eye and face tracking to better target you with ads and other content.

“The next patent really gets into it…It’s called ‘Techniques for emotion detection and content delivery’. This one is a straight up flowchart for capturing the user’s image via the camera to track your emotions when viewing different types of content. [Meta] could tie your emotional states when checking out videos, ads or baby pictures and serve up content in the future just by reading your initial state of emotion.”

https://www.forbes.com/sites/curtissilver/2017/06/08/how-fac...

Not sure why I can’t reply to the sibling comment here but I still cannot trust Meta/MZ for anything - even if the stated goal of eye tracking is to “improve the platform”

“They trust me - dumb fucks” Mark Zuckerberg

Edit: can reply as previously desired and edited to reflect that

If VR takes shape as imagined by Meta, though I personally don't believe it will, they will absolutely be in an excellent position to market to and profile you. I think the vision is that everyone spends most of their online time in VR - so interacting with all of one's interests/hobbies/discussions, online contacts, searches. All very valuable for monetization through advertisement and profiling.

> That was the point of them buying Oculus. They never tried to make money on the hardware.

They're not trying to make money from the hardware just like most gaming console companies don't make money from the hardware initially. Meta is trying to dominate the VR app market and make money from the Oculus Store. They'll probably take a similar approach to the App Store and Play Store.

It's a bit pedantic, but Facebook does not sell your personal data. They use it to target advertising. And at this point, every large tech company does the same thing. Apple, Amazon, Google, Microsoft. They all make significant revenue from advertising and they all use data they collect from you to target ads.

So, not that targeted advertising is so great, but it's looking like pretty much any hardware device from big tech companies in the future is going to work this way. I don't think Facebook is any different from the others any more.

> It's a bit pedantic, but Facebook does not sell your personal data. They use it to target advertising.

But they also leak personal data. A lot.

At this point, I'm willing to believe that the other adtech-corporations are more likely to be interested and capable in maintaining your data out of the prying eyes (of competing adtech-corporations).

> But they also leak personal data. A lot.

Some examples please. In recent memory I can only think of examples where services violated TOS (which I'm not sure how FB could prevent) or got authorization from the end user (as in the Cambridge Analytica case).

Any examples of them leaking data as a result of their own processes?

Already posted this above

“We do not have an adequate level of control and explainability over how our systems use data,” Facebook engineers say in leaked document.

https://www.vice.com/en/article/akvmke/facebook-doesnt-know-...

And? I'm not sure what this has to do with actual leaked data. I'm sure that many companies do not have a high quality data monitoring system, but very few actually leak data to the public.

Reply on news.ycombinator.com