Hacker News Reader

> If Facebook scans my chat logs, […] their TOS permits them to scan my chat logs.

Your language betrays your cognitive dissonance. It it not your chat log. It was never your chat log. You typed characters into Facebook’s chat log, and the chat log is Facebook’s. There is no “permitting” needed. When you use Facebook (or Google, or whatever), you live in a glass house, an aquarium, with overseers who do not consider you a person with integrity, but more as a kind of pet to be inspected and analyzed at will. Facebook distracts you with “privacy settings”, but those apply to other pets in the aquarium, not its overseers. It might be discomforting to think of yourself as a pet in an aquarium, but you have chosen this yourself, by using Facebook.

The question if Facebook is permitted to scan your chat logs is therefore meaningless; there is no such concept. Facebook “scans” all its chat logs, all the time. (That’s why they have their chat logs.) The “privacy settings” have nothing to do with actual privacy from Facebook — like Monopoly money, it has no validity outside the tiny world of its own. Like “deleting” things, it appears to you to delete things, but does not actually delete them as far as Facebook is concerned — it is all logged and saved, forever. I could go on, but I’d better not.

(The same goes for Google and all the other cloud and social services.)

> The “privacy settings” have nothing to do with actual privacy from Facebook — like Monopoly money, it has no validity outside the tiny world of its own.

See also: People who believe they can disable the face recognition.

Also people who belive Chrome incognito mode means Google does not know what you're typing into that address bar and that there's no history or log of what you just visited.

Incognito mode is as upfront as possible that websites can record what you type. It's not what incognito is about, or meant to be about.

It's not "websites" that record what you type, but Chrome itself that sends every character you type into the address bar back to Google.

This is a configurable setting in Chrome.

They should fix the Incognito message then. Check to see if the search-as-you-type feature is on, then include the default search provider in the list of people who can see your data.

> It it not your chat log. It was never your chat log. You typed characters into Facebook’s chat log, and the chat log is Facebook’s.

But... that's just a cynical observation of the current, wild-west-style situation of data abuse. Society will slowly grasp the significance of what's going on and restore some sanity, ...right??

I am convinced that it will only happen if we succeed in making it a political issue. No one company or service can fix this, since all the incentives work towards more surveillance, not less. This type of so-called collective action issue is what politics and lawmaking exist to solve, so it is there a solution must be created.

At the least, those of us who actually care, but don't have infinite amounts of time to admin a LAMP stack, email server, XMPP server, and whatever else, will eventually be able to run Sandstorm[0] on a home server and be done with it. (I'm working on an appliance distro which will set this up more-or-less automatically.)

[0] https://sandstorm.io/

Hey, I'd like to hear more about this "appliance distro". E-mail me? (kenton@sandstorm.io)

But the best we can ever do is make it "wrong" with some non-perfect level of enforcement.

They will always have the ability to do what they like with the data they have control over.

Is it then a regression then from telephone and postal mail times ?

Yes, because with postal mail (a.k.a. snail mail) it was both technologically hard to open and scan mail without detection, and expensive to employ the number of people necessary to do it. With phones it was not hard at all technologically, but still expensive to employ people, and it was also rather expensive to record and store the data thus obtained.

Today, the technology to scan everything and keep it forever is trivial, and storage is very cheap.

PGP is a thing, that makes your mail mathematically impossible to open by brute force.

And you can self host your own XMPP servers or use any other peer to peer chat client like SIP.

And encrypted snail mail has been a thing since ancient times. So what?

Call me when that's something my mom can do. She needs secure communications too.

Have her sign up to a secure XMPP provider and communicate over that. Or host her an XMPP server on your end she can use. It is as simple as register -> use an xmpp messenger -> secure communications.

> Facebook distracts you with “privacy settings”, but those apply to other pets in the aquarium, not its overseers.

Indeed. I have argued before that the "privacy settings" are actually harmful. You should be making everything publicly available, because why would you give facebook access to this data but not your friends? Unfortunately this is contrary to what most people think. Of course, facebook doesn't actually allow users to make all the data available, in fact it's not even available to the user himself.

You give your doctor information you don't give your friends, you give your telephone company information you don't give your friends.

There are reasons to give private entities information that you don't want shared with the world.

Absolutely right. If you SSH-ed into my personal computer and started typing into a file, everyone would laugh if you claimed that what was in the file was your data. You're not doing anything different when you type into Facebook. If it quacks like a duck its a duck. Its data that sits on their systems, that you have no legal or contractual protection over. Its not your data, its their data. You're just the one generating it.

Folks desperately want to deny the physical nature of cloud services, and pretend that its the same as storing something on your hard drive at home. They want to believe that the software abstraction that shows local and cloud documents together is real. But you can't will away reality.

> If you SSH-ed into my personal computer and started typing into a file, everyone would laugh if you claimed that what was in the file was your data. You're not doing anything different when you type into Facebook.

Actually, I disagree on that detail. An account on a Unix computer, accessible by SSH, is a known thing with known cultural implicit privacy guarantees. I have servers, which I can certainly call “mine”, with users, who have SSH access. I would absolutely not consider any file they type into to be “mine” — it is theirs.

Those are just expectations. They're not anything you can beat someone over the head with, and as such are illusory.

The ethical sysadmin may think like that but the owner of the box has sudo (by proxy by replacing said sysadmin with a pliant one). Data then belongs to the box owner.

I certainly agree with you and I feel the same way but we aren't corporations (well, I'm not and I'm assuming you aren't either). I host e-mail for many others on my personal mail server and the only times I've looked at someone's mail was to troubleshoot an issue (and that just involved grep'ing to find the right file (maildir) and then examining the headers).

No, it is not "their data."

When I rent a safe deposit box from a bank, and store my valuables in it, my valuables do not become the property of the bank.

Likewise, just because I store some data on someone else's computer system does not make that data theirs.

Now, we may not yet have a good enough legal framework for protecting our data; in Europe, laws about this are better, while in the US you are expected to just use contract law for this purpose, and of course with online services you have no way of negotiating the contract and they always claim the right to do anything they want with the data.

But that does not make it "their data"; it just means that our laws need to be updated to better protect our data and not allow companies to simply claim they can do anything they want in non-negotiable user agreements.

Yes it's their data. The moment you click "I AGREE", it becomes their data.

There's some serious equivocation going on here around the ownership of the data. It's your data; you own copyright on it. Per the TOS, you grant them an "irrevocable, royalty-free license" to do things with the data.

(The set of things they can do with the data is subject to change, with notification, but if those changes are "adverse" to you, you have the right to revoke that consent. What happens to your data after that consent is revoked is something that probably needs to be explored legally, but it's pretty widely known that Facebook never actually deletes anything. And the TOS do say "irrevocable", after all...)

All that said, it's not their data. (Effectively) unlimited access, yes; ownership, no.

There is a difference between is and should be. Your valuables stored in a safe deposit box are still yours because its illegal for banks to look inside a safe deposit box outside an emergency. But no such laws exist for cloud data, and more importantly, every interaction you have with a cloud provider happens against the background understanding that the cloud provider has zero obligation to you regarding any data you put on their systems.

You can argue that things should be different. What I am talking about is how things are.

Depends what you are talking about when you say "their data". At a base level Facebook can read it, delete it, copy it, move it, etc. and you cannot, so it only makes sense to say they own it and you do not.

It's only when you add a shared construct like some system of ethics or law that your definition of data ownership make sense.

It's the difference between ownership defined by abilities and ownership defined by rights. It's a failure of the English language.

Computer security, especially, encourages you to think in base, practical (there must be a better word for this) terms. Since you can't guarantee other actors will respect your rights, you fall back to "If I don't want X done then I must make it physically impossible to do X rather than just wrong to do X".

The law is miles away from actually treating it as your property in someone else's hands. Europe has so far only started addressing the issue of "private information", which is data about you which you might or might not own.

The law around physical property in someone else's hands is on the other hand well established, and is referred by English speaking lawyers as "bailment". If you entrust people with your stuff and they misbehave, they are then liable for their negligence about it. So the legal theory should be simple, but "on the internet" is masquerading the issue. If I send some clothes to the dry cleaners to get cleaned, it is still my clothes. If I send some emails to be cleaned by a spam filter service, it suddenly is no longer my emails anymore. There is no reason why we need any new law to correct this, but there is political work to make it enforceable.

: https://en.wikipedia.org/wiki/Bailment

> When I rent a safe deposit box from a bank, and store my valuables in it, my valuables do not become the property of the bank.

Depends on the T&C [1]. Two things here, (1) you agreed to the FB terms and (2) took no steps to ensure your privacy despite these ever changing terms. More applicable digital lockbox hypo: when you put a gig of encrypted data on S3, AWS doesn't scan it and try to sell it to advertisers because you didn't agree to that. Further, they'd have to crack your encryption (i.e. PGP) as well if they wanted to violate those terms.

With AWS you get what you paid for. With FB, advertisers get what they paid for you.

[1] https://www.facebook.com/legal/terms

That's a horrible analogy. Facebook's data use policy specifically says "While you are allowing us to use the information we receive about you, you always own all of your information" [1], so nobody should laugh when people claim it's their data. It's just that as part of sharing the data with Facebook, you give them extensive rights over what they can do with it.

[1] https://www.facebook.com/about/privacy/your-info

you have taken a highly condescending and counterproductive method of argument. You list neither the specific provisions in the TOS, nor does you cite any law or custom to validate your position.

1) messages sent through chat are not specifically covered by Facebook's TOS, as such, the individual's premise that it is is false

2) whether or not the content is Facebook's property is irrelevant, privacy laws in QC forbid publication of this content under most circumstances (exceptions being public safety etc

finally, anyone who honestly thinks anyone working for Facebook has any occupational need to look at their chat logs has a rather inflated opinion of themselves

Actual publication of anyone’s chat logs is not what anyone is reasonably concerned about – it is a diversion. The real thing which Facebook does is total information analysis of everything about everybody, storing this analysis internally, and making the results available to unknown numbers of external parties, or alternatively allowing external parties to specify analysis algorithms to be specified, run them internally, and report the results to external entities. None of these things involve publication of any actual content provided to Facebook.

Also, the idea that the danger is that Facebook employees should read any chat logs is also a straw man argument – a distraction. Nobody except straw men actually puts forth this as a major problem. You would have been right to dismiss it, except that nobody made that argument. To be fair, it might happen, but the scale at which it even could happen is by definition limited, since Facebook cannot have that many employees with the time and inclination to do it. The real issue is the above procedure of eternal storage and analysis – on behalf of external parties and/or for internal use.

Your arguments are highly diversionary, and seem to be aimed at confusing the issue.

Facebook has the ability to scan and monitor chat logs and this is not prohibited either by their TOS or provincial law (for Quebec at least). However I am not sure you realized that I took the discussion a step further by pointing out, although I admit I should have made this clear to begin with, that the concept of ownership of the content of said logs can be divided into several different aspects.

There is the intellectual ownership (the ideas contained in the logs), there is the right to consult and have access to the logs, there is the publication right etc. These rights are also independent of one another, someone may have the right to consult the logs, but not to publish, or may have the right to publish, but only once someone who has the right to consult this information has given it to them

Also, it bears mentioning that simply claiming my argument is a straw man argument without actually telling me how that is so does nothing to show that it is so the issue of ownership was discussed in the first half of my commentary where i mentioned that Facebook's TOS allowed them do do what was described as such I addressed and confirmed OP's position

I then added that there were implications with what was being discussed and proceeded to give an example. Taken alone, yes it would be a straw man argument on my part, however, the point behind my commentary was to show that the practical damage that could be done by such a practice as monitoring and storing the information of chat logs would be minimized by the fact that not everyone can consult and publish that content

The good news is that you can always just stop giving Facebook information about you. I have largely stopped using Facebook a couple of years ago, though I joined in 2004. I use text, email, phone to communicate. I don't really have any urge to sign in and view my feed, the most interesting stuff I find on HN and Reddit. If there is something truly important about a friend, I'll hear about it whether or not I use Facebook. In general, the less I use Facebook the more focused and productive I am. Thats just me though, I have plenty of friends signing in on a daily basis and consuming the newsfeed like popcorn.

Even if you never visit Facebook, you still provide it with information about you. Most of the links you visit from reddit or HN have an embedded Facebook Like button, which gives Facebook information about the sites you visit. FB uses that information to target ads to you. http://www.forbes.com/sites/kashmirhill/2014/06/13/facebook-...

True. There are lots of tools to block that, however, on the desktop anyway:

1. AdBlock Edge (or Plus, but Edge doesn't have loopholes): https://addons.mozilla.org/en-US/firefox/addon/adblock-edge/

2. Disconnect: https://disconnect.me/disconnect

3. Ghostery: https://www.ghostery.com/en/

And I'm sure others….

I definitely agree with what your saying regarding ownership of your own data (photos, posts, comments, chat, etc..) and I definitely agree.

The second part of your comment strikes me as a bit ridiculous though. I cant invision a scenario in which someone would attempt to narrow down a group of users, given the provided selectors, to the point at which they know their 'target'(your son in this case) is in that group, and then(based on some boolean value (such as homosexuality)), figure out which ads are being served to that user in order to discern something about the user. (In this case seeing a certain ad would allow you to discern sexual orientation).

MarkCuban's post below (marked dead now) seems relevant, despite being decidedly offensive/inflammatory.

Why would _anyone_ go through all of that trouble when logging into the account directly or passively collecting network activity would yield the same answers?

If you're going to somehow attach the ads being served to a physical human (watching your sons computer screen to see what ads show up? Monitoring his traffic to see which ads are served?) you've already broken Facebook's model.

I _strongly_ believe that advertising is the wrong way to go about yielding revenue from a webapp in terms of the value it adds to our society(not that it isn't profitable for one entity). I just think your second statement/argument is a weak one.

> If Facebook scans my chat logs

There's evidence of scanning private updates & comments, going back to 2012 [1]. We could assume chat messages would be fair game in Facebook's eyes, though I haven't seen any confirmation.

[1] http://allthingsd.com/20120112/facebook-gives-politico-deep-...

You can use Bridgy to syndicate content to social networks from your personal site: https://indiewebcamp.com/Bridgy

Example here: http://dangillmor.com/2014/04/25/indie-web-important/

Facebook has already declared your data (i.e., the data you entered into Facebook) as theirs, to monetize at will.

There are several rational responses, but when some other entity keeps drinking your privacy milkshake, maybe the best way to respond is to poison the well.

Make any or all of the valid profile data fake. Potentially change it once in a while to something else also false. Don't invite people you normally would friend. Definitely don't use the profile for anything important.

What you described in your last paragraph has already been done, and it works. Here's an article about a prank performed using a similar idea: http://mysocialsherpa.com/the-ultimate-retaliation-pranking-...

> publicly available repository of data that I've allowed to be assembled

aboutthedata[0] by Acxiom is headed in that direction I think - just specifically for the ads they control, I think. I interned there, but I wasn't involved with aboutthedata.

[0]https://aboutthedata.com/

> I think the thing that frustrates me the most...

If you're really upset, then just quit FB. Otherwise, keep baa-ing with the rest of the sheeple. I quit 3 years ago when their abuses got to be too much. Amazing, I still have the same friends and enjoyable life. I suspect most people would discover the same.

Rather aggressive, but I agree. I deleted my profile 2 years ago, got back few more minutes of my daily life, and read more books.

I am still on GPlus since it doesn't have any noise (and going by the trend, it's not likely to replace facebook anytime soon) - only tech oriented people use it, and I am fine with it.

the fact that Facebook gets exclusive access to data that I think is rightfully public knowledge

The way I see it is the raw information itself isn't secret/private, but Facebook is the one who busted their collective asses collecting and organizing it. Similar to how companies don't have unlimited rights to Craigslist's data, the company owns the database. Facebook can't come sue you for sharing your personal information with other people- it's still YOUR information- but their catalog is theirs to do with as they see fit.

A (probably poor) analogy is a calculator. You, oh holder of the calculator, do not own mathematics. You don't have a license on the numbers that go in, nor the numbers that come out. Numbers belong to everyone. But you do own the calculator, and it is entirely within your rights to control who uses it and how.

Yeah, it is that easy. You don't even have to make up your own ad, you can just watch to see if other people's ads that are targeted to homosexuals are showing up on that computer.

You should take a look at what these guys are doing datacoup.com