Facebook’s Wonky Privacy Controls Now Outing LGBT Youth Without Their Consent
betabeat.com
betabeat.com
However, I certainly could be wrong, and I'm certainly not advocating for anything in particular here.
We've done this before and it doesn't work that way.
Back in Colonial New England, say Massachusetts in the latter 1600s, nearly everyone in a given small town would be essentially 'transparent' to pretty much everyone else. There was so little room, and so few people, that there wasn't space to have much privacy.
And social norms were horrible. You couldn't get away with being of the wrong religion, with being suspected of adultery, or a lot of things that are either ignored or not considered problems now.
People didn't learn to accept others. They forced others to conform. And the revelations never stopped being interesting to those who enforced conformity.
Seems like very wishful thinking. It seems to be hard-wired into human nature to be suspicious of, and consequently antagonistic toward, noticeable differences. Forcing those differences out into the open probably won't significantly alter the impulse toward hostility. It seems just as likely that the differences will come out into the daylight, but the prejudices will sneak into hiding. I'm not sure if those prejudices are more dangerous when they're naked, or when they're cloaked.
I think you raise an interesting point, of course. I guess I just have a more cynical and pessimistic view of the result.
I guess this is complicated by the fact that our actions don't necessarily reflect our beliefs or identity, and a public display of actions or even just words (posts) can present a misconstrued image of ourselves to the world (or at least one that is ripe for misinterpretation).
There are many groups of people who still experience tremendous bigotry...for example, having everyone be completely transparent doesn't make transgender folks any less rare, or any less subject to prejudice and hostility. On the whole, having everyone "come out" about whatever it is that takes them outside of "normalcy" might be good for society. But, for an individual who isn't ready to be out, or who has safety concerns about being out, the total transparency argument is pretty hollow.
I know you're not campaigning for anything here, so I'm not really arguing with you. But, I am highly mistrustful of Facebook, and consider some of their tactics and goals deeply unethical, so I wanted to point out that what many are viewing as a neutral "technology marches ever onward" sort of thing is really more a situation of a few companies extracting value from exposing people's private lives, and constantly being on the look out for more ways to extract that value and more ways to profit from that erosion of privacy. It isn't neutral and it isn't accidental. Facebook (and Google to a lesser degree) wants to own your private life and sell it to the highest bidder.
People are often hiding aspects of there life not for embarrassment, but for protection. Then there is always the entire "blame the X" that precedes many great atrocities.
You may like to think the world is a utopia or not far off it but genocides are going on right this minute, its the last thing the world needs is more exposure to vulnerable people.
http://online.wsj.com/article_email/SB1000087239639044416580...
The original article was submitted to HN yesterday.
I don't use Facebook because of this. There's not much the company can do to prevent people from making things public about you that you'd rather keep among friends. How is Facebook to know the implications of you being at one party vs another? Sharing is sharing. Just because you keep your profile locked down doesn't matter when someone else can share whatever they like with whomever they like. I understand not having a profile doesn't completely prevent this, but it helps make it a lot less public. Nobody will receive a notification linked to my profile that I was tagged in a photo because there's no profile to associate. We're past the point of being able to prevent this entirely, but I'm not going to make it any easier.
the issue is facebook's controls.
If I add you to my group (without you even knowing), the system should not be sending out notices to all of your contacts that you 'joined' my group. You didn't join, you were added - there's a huge difference.
- that's up to Facebook, and the parent is quite correct, if you don't your private life out there for all to see, don't put it on a social networking site because you don't have any control, other that what Facebook feel is in their interest to have. You give up that control when you put it online.
I have no sympathy for people that get found out because they put the information on Facebook and someone they didn't want to know saw it. People have to start taking responsibility for their own privacy and not crying to Facebook whenever this sort of thing happens. Also I tend not to believe most people because its an easy way to tell a burning secret without actually doing it, the confessors version of suicide by police.
tl;dr - don't put your secrets in the hands of facebook's whims because they aren't your best friend, they are a commercial business and your privacy isn't their concern, except when it suits them to be.
Simply put, you when someone assigns you to a group, by default you should get a notification along the lines of "So-and-so has added you to a group x. Are you part of group x?" Very much like how tagging in photos currently works, though I think there the default is to allow tagging.
Total answer to this is if the person wasn't on facebook, none of this would have happened.
The point of the article was that these people did everything right apart from that. They DIDN'T put anything on Facebook. They were added to a group without their approval.
How is the answer "don't participate in society" instead of "make society a better place?"
- so says you, but what you're entirely missing (again) is that it's entirely up to facebook what notifications they send and just because you think they should, because of your privacy concerns, doesn't mean that FB will because their concern isn't your privacy, but rather making money for their shareholders.
Nobody is suggesting that facebook is now allowed to do this. We are suggesting that facebook should not do this.
Except they didn't. Someone else did.
Joined FB and added her details (real name etc) (first mistake)
Added her dad as a friend, even though he objects to her private life (second mistake)
Added the Queer Choir group leader as a friend (third mistake)
So she now has two FB friends with diametrically opposite views, and wants to keep them completely compartmentalised. Trusting Facebook to do that given the beacon fiasco, and the multiple privacy slip-ups since, is not wise. Yes this is FB's fault for having bad defaults, but you can't trust FB to keep all your stuff private, because they really don't care, and have made this clear many many times in the past. Their business model is predicated on sharing your data with as many corporations and people as possible.
There are other ways to share photos and events which are not a ghetto cut off from the web, so it's better just not to join a club which insists all your acquaintances must join in order to share and then lets them know the intimate details of your life automatically.
They didn't put the information on facebook. Someone else did and it looked like it came from them.
I would not let my parents sit in the room whilst I chatted with friends, or listen in on phone calls. I would not let them go through the photos on my phone, nor those of me on the phones of friends.
I think the point of a social network is to stay connected to people with whom you are comfortable being yourself.
I feel incredibly sorry for the people in question though.
> I think the point of a social network is to stay connected to people with whom you are comfortable being yourself.
I had to break this because apparently the fact that it says "friend" doesn't repel people who I haven't seen in years. SO right now I'm using lists and I've put tons of people in 'restricted' but still, this mentality is annoying as hell.
Regarding family: I'm friends with my grandmother and I hate it. She doesn't understand most of the stuff that I post about but she still comments stupid things on my posts and pictures. Well now she's on restricted but if she'd ever found out I'd be in trouble.
Sure you can try to have different profiles. But they easily spill over. And facebook collects a lot of data. The worst thing are probably the phone and address books of your friends. Someone has stored your email address or phone number associated with your real name on his phone and installs the facebook app and suddenly they now. Or people are stupid enough to give facebook access to their email account. They even started to ask friends of you what your real name is.
I recently had to delete my account because they realised I was using a fake name. I don't know if somebody "squealed on me" or they got the information elsewhere.
In the past your online identities were easily separated because everything was in a different place and it was easier to be anonymous. You could have several IM profiles for friends and family separated. With other people you'd only communicate through one of your many email addresses.
> I would not let my parents sit in the room whilst I chatted with friends, or listen in on phone calls. I would not let them go through the photos on my phone, nor those of me on the phones of friends.
Same with most people. Most people have different personas for different groups--they have their family persona that they present to their parents and other relatives, their casual friend persona they present to most of their friends, their intimate persona they present to close friends and lovers, their work persona for co-workers, and often others.
Facebook has purposefully decided to ignore that, and insist that you have a single Facebook persona. That gives you a couple poor choices for how to use Facebook. You can pick one of your personas and make that your Facebook persona, and do not "friend" anyone with it who does not belong with that persona. This is hard to explain to those groups that you use the other personas with.
Or you can try to use Facebook's poorly designed, poorly implemented, poorly documented, frequently changing, and laughably inadequate privacy controls to try to beat their "one size fits all" persona approach into something approximating the reality of any normal person's life--and if you ever trip up, you have a good risk of blowing up some aspect of your life.
[1] http://www.huffingtonpost.com/2011/09/09/the-new-facebook-pr...
EDIT: Just made a double-check now, guess what? An open passage:
Note: You can still be tagged, and tags may appear elsewhere on Facebook. I can't review the tags if they are found on someone else's timeline.
> You can still be tagged, and tags may appear elsewhere on Facebook.
Not completely sure but I think that applies to text links only which makes sense as you could just link to the profile in question anyway.
I think this changed when they upgraded to timelines. You can approve tags before they appear on your timeline but you will still appear as tagged on the photo which will appear on the person who tagged you's timeline. So you are 'protected' from your friends seeing it but mutual friends and the taggers friends will see it.
This is one of a several privacy controls Facebook diluted. I used to be able to say exactly when groups of people could/couldn't post on my wall. This was really useful. Then they changed it to allow me two options - friends (i.e. everyone) or only me. Had to hack together a weaker solution through multiple privacy settings.
The default behavior should be that other people can't release information about you without your approval, whether it's photos, location, group membership, reading habits, etc. This shouldn't be a tough concept for FB.
When working with unheralded amounts of potentially publicly consumable personal information, the bar for appropriate privacy handling that most of us expect is very high. And our bar is clearly higher than facebook's internal bar.
Yet, we usually conflate these discussions with asides about their motivations - financial gain, genuine ideological belief in open identity, or just mistakes from product leadership. Those are distractions, in that they often lead to speculative discussions that can make stakeholders revert to defensive positions. I would rather focus on functionality - pretty much every action a user takes on fb has potential privacy consequences, so we should be asking: * How obvious are those during the action flow? (pretty much not at all - and clearly the culprit here) * When building features, at what point and in what detail are the privacy consequences analyzed? (currently unknown but the impression continues to be that some privacy issues are intentionally reactively)
Aside: my personal experience with facebook employees is one of tremendous socio-economic homogeneity. I do wonder if the culture their building internally is qualified to handle the real diversity of 1B+ people. (If someone were to quote Danah Boyd's subaltern vs. hegemon model of social network interaction here, I would begrudgingly not cringe, just this once).
In this case I don't know why the group owner didn't think it was more appropriate to ask people "Hey, want to join our facebook group?", not to sign them up in bulk, given that it's obviously a touchy subject for some people.
Facebook is clearly wrong for making it unclear that group membership was publicly available information, that it is in essence a tweet of that information. But is it wrong for understating the fact that publicly available information can be publicly distributed to interested parties at any time? People need to know that this is the direction in which Facebook (and the Internet) is moving, and that they should just assume that anything they publicly post will be distributed to interested parties (of which the father surely counts). Sure, a lot of the blame falls on Facebook, but not all of it - if you don't want to be outed, tell your friends to make sure that anything they post about you is explicitly marked as a private share (which group membership is not).
You can only opt out of groups but everyone / allowed members can add you to it.
Even better, get added to a very active group and wake up to 700 notifications.
I could create a FB group called "Gay hackernews users" and add you to it (provided I have you in my friendlist) and it would be published to your friends. You could leave it afterwards, but first you'd join and it'd be published.
Facebook has a feature (and apparently there is no way to opt-out), wherein anyone you are friends with can post a tweet-sized message to all your friend walls by creating an appropriately group and adding you to it.
(1) this is basically the same as those email hack/viruses that email a spam link to everyone in your address book.
(2) how is this not already massively abused for spam? it is nearly identical workflow to the email use case: Gain control of an account, create a group, send message to all the vector's contacts.
The issue is that if you (as the LGBT youth) have your father as a friend, they can view your wall and will probably see that activity appear in their newsfeed.
In fact, facebook does have two different methods of reducing what someone can see. Either placing a contact in the "acquaintances" category and then only allowing "friends except acquaintances" to view posts on your wall, or manually adding an individual to the "restricted" list, which quietly blocks them from seeing anything you haven't explicitly made public would work.
At this stage, I think it should be a given that anything you put on Facebook (and perhaps any other web service) will eventually end up public to the world.
Just as not being on Facebook achieves nothing — you'll just be completely defenseless if someone tags you in an image (which is horrifying — as far as I'm concerned, the only acceptable solution is to allow only tagging of actual users, and only the ones who consented to that).
I acknowledge that the event in question wasn't a result of something the users in question did -- but that illustrates my point all the more that Facebook should be avoided.
Somewhat more ontopic, I'm a little hesitant to accede that someone adding you to a group makes you a member of that group in spirit. Sure, perhaps it convinces some folks that it's true, but so what? If somebody adds me to an open group entitled "People who hate women", I think it's easy enough for me to say "I didn't join this group, and I don't hate women. If I happened to actually hate women, I could see that being slightly more touchy, but whether or not anyone joins me to said group doesn't do anything to stop someone from simply accusing me of hating women, which is the same net effect (I believe).
I'm sympathetic to those affected, but am generally unforgiving of anyone surprised that Facebook screwed something up.
They did not do that. What happened is it appears a friend who did know added them to a group and before they connected to joining that showed up on their feed. They did nothing. They were passive, and they were still outed because facebook didn't ask for permission and broadcast that they had been added by a third party to a group to their wall.
I agree that you can sometimes seem cool by seeming aloof to what everyone else is doing, but when it damages your social life, most people aren't going to do it.
I agree with you.
I'm very happy I'm socially allowed to not be on Facebook.
There are a lot of people who are essentially forced to be on Facebook due to social obligations.
Your social solution can't work for them. They need a technical solution or a different social solution.
And, no, the 'different social solution' isn't going to be "Get everyone to accept LGBTQ people."
"There are a lot of people who are essentially forced to be on Facebook due to social obligations."
All the examples in this thread of reasons you're "forced" to be on the site amount to missing parties and not seeing pictures -- and it's a really vapid argument. It might suck to not see those pictures, but there's nobody forcing you to do so. It's still entirely up to you.
To clarify, I am not victim blaming. This argument is addressing the claim that a Facebook account is a requirement of youth. It is not. Choosing privacy over pleasure might be an unattractive option for some but it's an option all the same.
You're skirting pretty close.
> You have the option to choose between privacy and social pressure.
Well, that depends on the nature of the pressure, now doesn't it? Most people can't go through life without their support network, and by 'can't' I mean can not. If being part of your network means friending them on Facebook to avoid alienating them, then that's what people have to do, isn't it?
Yes, it's annoying if your friends don't include you - but there's still no obligation. You're not being forced into anything.
Most people consider social obligations to be obligations.
Again, it depends on what quality of life you can live with, and how you're able to achieve that quality of life. Most people would be in serious emotional pain if forced to live as hermits, which is what happens to you after you alienate enough of your friends. Depending on your circumstances, Facebook (and the leaving of it) could play a large role in that.
Facebook isn't a human right or requirement. "Need" is too strong a word, you need food, water, oxygen, sleep... you "want" Facebook.
Facebook offers a service, use it or don't. It has settings, set them and if it still doesn't work for you then don't use it. Noone is "forced" to use Facebook, "forced to..." is not equivalent to "it would be really nice to...".
...and human social contact, which for certain demographics of social groupings all but requires Facebook.
Let's recommend people don't use a site which does not recognise the concept of privacy, expands the realm of the public versus the private at every opportunity, and spams their friends about their activities without their permission. People (not just LGBT people) should avoid FB entirely unless they want to be exposed to embarrassing situations like this, as FB continually tries to erode their privacy.
Using a public site like Twitter or Blogger is far healthier, as then it is clear that all content is public all the time.
You may not think of security in this context (calling it privacy) but it's all about the same fundamental thing: the control of information flow. In the privacy context it's information flow about people. Jacob's theorem shows that Facebook's privacy will worsen over time as new functionality is added.
(1) http://www.informatik.uni-trier.de/~ley/db/conf/csfw/csfw199...
You are making a huge assumption that Facebook is as secure as it can be at its level of functionality. It is easy to see that they could add a tiny bit of functionality that barely hurts security and fix the "add any of your friends to groups" bug that their security and functionality would increase.
At least that gives away all those people who didn't read it.