Facebook e-mail mess: Address books altered, e-mail lost
news.cnet.com
news.cnet.com
I wish it weren't this way. I have several friends within facebook whom I like and respect, and they produce a lot of great technology. But, I fear facebook having more power than they already have. It can only end badly for the user.
Facebook really needs a "don't be evil" moment, but I suspect it's too late, and I suspect that Zuckerberg simply doesn't think that way.
I mean the advertisers.
Facebook wants access to your email so badly that they're willing to steal it. This is, in my opinion, among the worst things they've ever done for user privacy (and security, but mostly privacy in this case), in a long list of subtle, and not-so-subtle tactics.
It also has very real security consequences. The automatic contact list updates for potentially millions of users means that sensitive information is likely flowing into facebook servers as we speak, without users knowing it. Passwords, medical information, company secrets, who knows what else? Someone who trusts facebook enough to use it for social interactions might not trust them enough to know about their medical conditions, proprietary company data, passwords for other sites, etc. Facebook took away that privilege for many people with this change.
All that said, here's what's important: This does nothing good for users, and a few bad things. The fact that facebook made this change, knowing that the vast majority of users were not interested in using facebook email thus far, tells us that facebook thinks first of facebook. Even if there were no privacy or security concerns, what the user wants wasn't even in the equation, when facebook did the math on this.
Wait, seriously? People are using websites where the password reset emails are being sent from somebody's Droid phone? I think you've gotten a little carried away.
They desperately want your email...they don't want it because it's cool to be an email provider. They want it because they intend to use it. The point isn't what specific piece of data they'll get from it (though passwords will be among that data--as a mail server administrator of 15+ years I can assure you of that); the point is that it's simply evil for them to interject their servers into the path via deceptive means.
It's low grade evil; but low grade evil multiplied by millions starts looking like more serious evil. Just like low grade incompetence begins to cause serious harm when it is inflicted on millions.
Sometimes an email or text is better for everyone. But I always split up the info between two bands. Most info in an email and a SMS for the password. Or just have them change it after they log in.
I find this idea interesting. Can an entity like a corporation have a life beyond that which is given to it by its employees? Like the ship of theseus, can you replace all employees and still have a business that "feels" the same?
To me, this is essentially theft.
Well, who is crazy now? :) And I repeat what I said before. If you don't delete your Facebook app. They'll keep pulling stunts like these over and over again. It's very clear from their history that they have extremely little care for customer interests.
If x service is making money off their product (you, user) then you should really have at least some "rights". The key word being should.
They're set up as a minimum standard of acceptable behaviour that someone should be able to expect by default and that there is no reason why a company shouldn't / can't adhere to. Generally they're around physical protection from harm, though they do extend to other things (including Data Protection in Europe).
Why should these rights at least exist? Because (a) people can't be expected to take a detailed look at every product and service they might use to assess it fully, that would simply be too time consuming, so you set a basic standard for prevention of harm and (b) can you imagine what the likes of Facebook or Exxon or whoever might do without them.
So basically, you're saying people should trade trust in one third party (the service provider) for trust in another third party (whoever sets and enforces the basic standard). I can understand why people may choose to do this (though in many cases I don't think the second third party is any more reliable than the first), but I don't see it as an improvement. I don't think FB cares about whatever legal standards are in place; to them that's just a cost of doing business. But they do care about losing users.
can you imagine what the likes of Facebook or Exxon or whoever might do without them.
Sure, and I can also imagine people not using FB or Exxon (many people boycotted Exxon for years after the Valdez spill, IIRC). Also, I can turn the question around: can you imagine what those who are trusted to enforce standards of behavior might do once they know the public trusts them and won't question what they do? How good a job did regulators do at enforcing standards of behavior on investment banks?
And before you ask, I do not use FB, precisely because I don't trust them to take care of my data. And it's not just FB; I don't trust Google to take care of my data, which is why I don't use gmail, for example, or any other Google services except search and maps. I don't expect anyone to take care of my data unless I'm paying them, as a customer, to do that--and even then I watch them.
I'm not saying that because company X conforms with the (very light) regulation in place that they're to be trusted, just that I see benefit in having two forms of protection in place.
That's worth drilling into your head.
Yes, that means that User = product from HN's perspective, but I am willing to bet it is a lot more of a complex connection than it is with facebook ;-)
I pay for cable, yet I still get advertising.
That "not paying means you're the product" is a nice sound bite, but it doesn't actually mean anything.
Paying for media is an interesting exception. Very often for newspapers, etc, you are both buying a product and becoming a product.
But in the end it's a good warning to know the business model of those you get free stuff from.
For example, on iOS, it looked like this almost two years back: http://www.neowin.net/images/uploaded/iPhoneNumber.png (as seen on this page from October 2010: http://www.marismith.com/facebook-phonebook-how-safe-your-ce...) I don't have any old screenshots of the Android version, but the current app is similar to the iOS screenshots above.
And they'll still call you that. Facebook's hold is too great.
I'm all for going fast and sincerely believe in "A sense of urgency", but Facebook is really lucky they're not serving more serious/demanding customers.
How's the stock supposed to get back to 38 now?
Sorry to be cynical, but: it was never supposed to be at 38 in the first place. Facebook isn't worth anything close to its nominal market cap, it's just the latest very high profile pyramid scheme, or rather it would have been if they hadn't gone in so absurdly high with the IPO that even the heavyweight investors interested in risky tech stocks have mostly run away.
Yeah, sure there is some potential but perhaps not that much. Everyone does scream its got the same trajectory as Google, but the thing is they are already slowing down.
If the stock hits 38 again and Facebook has not figured out a marvelous new way to make a lot more money, then its all just speculation and gambling.
A couple quick questions:
1. How much did you buy in at? 2. WHY on Earth did you buy?
(Granted, a LOT of Facebook touches personal information, but something like this is pretty tendril-y in its reach).
If any of us pulled the same stunt, even if authorized to access the system for other reasons, would we not be subject to prosecution? Hopefully, the same will happen to FB.
In addition to the Federal communications and cybercrime statutes, there is California Penal Code 502:
(c) Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense: (1) Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data. ... (4) Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network. (5) Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network. ... etc.
It remains to be seen if there is a prosecutor with the backbone to go after this.
Can anyone find language permitting FB to destructively alter the contents in profoundly unusual ways so that email is redirected to FB servers for interception and delivery as FB deems appropriate?
I'd really like to see an informed legal opinion on the possible criminality of their actions.
But now, Facebook changed people's email addresses without their permission. The cache gets updated, and boom, the old address is gone.
But what makes it more scary is that people don't actually remember that they originally got the address from Facebook and they don't understand the caching behavior. All they know is that the old address is gone. So they think that email addresses that they didn't get from Facebook are also at risk.
The workaround is to manually copy email addresses from Facebook to some other system. Any email addresses you get from Facebook by automatically syncing aren't safe.
It's a pity; after all, most of the point of the system is that you shouldn't have to manually update your address book when your friends change their contact info.
I can't believe anyone at Facebook was dumb enough to think this was a good idea. But at the same time, I can't believe some "rogue engineer" did this by accident. I'm curious to see what Facebook says about it.
anyone else think Apple and Facebook make interesting partners? They're both doing their best to get users into their own domains to the exclusion of all else
In iOS6 any app that wants to access your address book or calendar has to request permission. It's very much like how an app requests permission to send push notifications in iOS5.
I suspect that the problem being described happens when the only source of someone's email address was the Facebook contact, as I doubt that, e.g., a Facebook contact would overwrite someone Gmail contacts. At this point it's not clear, however.
I think someone needs to confirm exactly what's happening here.
The root of the problem is facebook. The important questions should be directed at facebook. We can look to Apple or Google for help, but ultimately when we install an application, we grant it our trust and Facebook routinely tramples all over it. Turns out that it's a winning strategy.
I noticed a lot of those permission alerts, over and over.
They'll tell you.
Because people want to keep in touch with their friends, "friends", followers, etc.. They need to notify them that they are using some other way to communicate.
Where is the poor (business) design?
You'll see this when people start recognizing Facebook as the crap it really is, and stop using it.
I don't think it's going to disappear, but it does feel as though it's reaching something of a peak.
But this is another ballgame. What they've done here is effectively hijack a completely unrelated and ubiquitous communication channel — without any action on my part, and without giving any indication of doing so!
I don't even use Facebook, but since I created a Facebook account at some point in the past, they potentially have access to my inbound email traffic. That's just absurd and stupid.
It doesn't seem to be clear, as I write this, exactly what is going on there and how much is completely automatic/without consent vs. how much was "expected" behaviour. It's pretty clear that a lot of people aren't happy about it regardless, though. Even if some contact originally got onto your phone via integration with a third party service, that could have been years ago. If you weren't aware that the contact was only remaining there/unmodified because the third party chose to leave it that way, it's understandable that you might be upset if that changed without warning after a long time.
Still waiting.
All we ask is that your private communications never again leave this application. Perhaps you think you’re being treated unfairly?
It would be disturbing if they changed an existing entry that you created yourself, but if it's only an entry bound to an external (facebook) account, I'm not sure it's that bad. Which one is it then?
Words to live by.
(So am I. I'm aware.)
The community has altered the posting guidelines. Pray we don't alter them any further.
Root it and use titanium backup to force uninstall, it's how I removed all the junk.
- email from address associated w/ facebook account goes directly to facebook messages
- email from address not associated w/ facebook account does not arrive, in neither messages nor 'other'
I think this is just incompetence. hopefully, it's coupled with a little incontinence.
Now I'm glad it's broken!
"Google says it is removing Facebook contacts because they are not stored locally on the phone like other contacts. This means that, unlike your Google contacts, the Facebook listings aren’t exportable so, if users decide to close their Facebook accounts, those contacts will disappear from the address book, something which violates Google’s notions of data portability."
http://blog.laptopmag.com/google-removes-facebook-contacts-f...
This is a great example of why I continue to keep my information segregated across different networks. For all of the nonsense Facebook keeps pulling, I continue to have a healthy does of scepticism when allowing them access to ANY of my information - let alone letting these networks interact with each other.
This was obviously intentional, and the timing makes sense -- Apple is rolling out address book synchronization with Facebook.
I hope this forces Apple to reconsider.
Value of Zuck's shares post-IPO: $19 Billion
Pissing off 800 million users with a forced email change: PRICELESS
There are some things money can't buy. For gut-wrenching invasion of privacy there's Facebook.
I played around with my new (and unwanted) email address and found the following:
1. Email sent to the new facebook address from the gmail account associated with my profile gets delivered to my facebook messages.
2. Email sent to the new facebook address from another gmail account I own is not delivered. It simply disappears.
This is basic stuff. I guess they did like no testing before they released this f*up to their billion or so users.
An older German lady I know told me many times growing up that you should not $h|t where you eat. In other words, it pays to keep some things separate from other things.
If you value someone's contact information, keep track of it separately. And have a backup.
As I understand this latest feature, if I am a contact on someone else's phone, and their FBook app notices that I am a FBook user, that person's entry for me get's slammed to now point to me@FBook. So when that person emails me, it no longer goes to me@me.com, it goes to me@FBook.com. Which is an address that may or may not exist, but I'm gonna go out on a limb here and guess that FBook doesn't respond with a no such address, it just consumes the data. And I'm suddenly unreachable.
Then I read this:
"alterations that had begun in their contacts and address books outside Facebook -- valid e-mail addresses were being changed for @Facebook without people's awareness"
WTF?! This sounds like the facebook app has access to modify the contents of a phone's address book without direct user action. Is that what's happening here? I just checked all my contacts and everything seems fine (BB7.1)
I know facebook doesn't want you to do it, but there has to be a way....
I'm not sure how this would work on/in the mobile ecosystem, but I'd have to imagine that getting on your desktop/laptop computer for a few minutes would be worth the effort of backing up the information.
Its been more than a day now, and the facebook contacts are still there in my phone. May be you want to add the facebook account, and then revoke its permission from the facebook website. I think this will leave your facebook accounts in your phone.
I will update this post if my contacts disappear in near future.
People call G+ a desperate attempt, but this is ground-bottom. There's only word to describe this, disaster.
It's even more sad FB is using it (the fact that all of my friends are on FB and hence I wouldn't switch) to take undue advantage in a way that I would not permit had they asked me.
I just checked mine, but seems all my contacts only have phone numbers since I use Gmail and GApps web-only accounts.
I don't know if the FB app can write to your contacts (although it can read them, which caused that dust up earlier in the year). That's where the danger might be for iOS 5 users.
http://techcrunch.com/2009/12/15/facebook-lie-terms-of-servi... "Mr. Schnitt suggests that users are free to lie about their hometown or take down their profile picture to protect their privacy..."
The clarification from Barry Schnitt (Facebook’s Director of Corporate Communications and Public Policy) was even worse:
"I think WSJ is paraphrasing. What I said is profile picture and current city are optional. You don’t have to include a profile picture or you can include a picture of your dog or anything you like. Similarly, you don’t have to indicate your current city or you can indicate that your current city is “Atlantis”, “Valhalla” or, again, anything you like. We hope people will use accurate information if they are comfortable doing so because that information helps them to be found by their friends, which is part of the point of joining the site."
No, you take your own decisions, you don't have to give knowledgeable answers. But it is always a good thing to word your answer while taking in respect the nature of forum you are posting it to.
Now I'm just itching for downvotes. GIVE ME THEM.
Basically, when you can't even answer your own rhetorical questions correctly, then it's pretty much all downhill from there.
This is what happen's when you mix work and pleasure ha ha, it's a stupid kid's playground to post stupid thing's and do nothing all day! I just can't get past it, why would anyone sync their address book to FB!? ha ha ha