Hacker News Reader

Comment by nxb | Hacker News Reader

Facebook does the same with birthdays. I input my age as 90 when creating my account. They changed it to my real birthday somehow.

AND then they expose it publicly to anyone who looks up my profile, even when they aren't my friends.

AND this is all after me having disabled the "show birthday on timeline" and enabling every other privacy setting there was.

If there's one company using AI and data collection for evil, it's Facebook. Not to mention the years of silently disabling previously set privacy settings without getting the user's permission - e.g. the "show profile in search".

Insane. Facebook should be slammed hard by the courts.

View on HN

Facebook does some really creepy stuff. This morning it showed me my mobile (cell) number and asked me if I wanted to tie it to my facebook account.

I've never knowingly provided my cell number to facebook, as I don't use facebook as an o-auth provider so I consider 2fa as less important that my privacy in this case.

I don't use facebook. I don't use gmail. However, I assume that facebook and google know almost everything about me from people who have uploaded contacts and other information through apps and signup, and from the content of emails in my correspondents' gmail accounts.

I'm a product even without having signed up.

EDIT: Shouldn't I have some kind of say in that?

Yes, you definitely should.

'Shadow profiling' ought to be 100% illegal.

Thinking about it a little more, I suppose spies and law enforcement could warrant Facebook et al. "Gimme everything you've trawled about a3n."

Someone else had your mobile number and email, and then allowed Facebook to access their contacts (NEVER DO THIS) and they were able to match up the email you signed up with to your number or other piece of information, more than likely, so one of you're friends leaked it.

It's one thing for the friend to 'leak it', quite another for FB to then use it outside of anything tied to the friend.

They have no business propagating that information any further than the profile that supplied it.

We need a privacy structure to somehow protect our contact info residing in devices not our own, but I suspect that's rather challenging and would require a crypto solution. Maybe, I'm just describing a *nym form of messaging and crypto calling. There must be innovation in some form that's possible for contact lists.

Did you install their app or the messenger on iOS or Android?

They can read your number there.

Just because they can, doesn't mean they should.

I'm fairly accepting that every android app asks for "permission to read ..." permissions, but I don't want them to be so proud of this that they present their information back to me.

That's what is so creepy about Facebook, they've lost sense of what is normal, so they don't hesitate to show off how much they know.

I'm sure Google knows a lot more about me, but they have the sense not to parade that fact back to me unless I specifically ask.

I don't know why people install the Facebook app on their phone. You can't view stuff offline, meaning you might as well just go to m.facebook.com, the browsing experience is pretty similar AND you don't need to install that stupid messenger app AND they can't access stuff on your phone. They shouldn't, but the pessimist in me says they will.

Same with LinkedIn, who installs this crap? And why?

Of course, there's plenty of other crap on my phone that I've installed and is exposing me...

After Facebook announced frictionless sharing I removed their app and only log in via mobile browser in a private tab.

For me Facebook is a necessary evil. I'm not willing to miss the family trips that only get planned there so I just attempt to minimize damage.

I get that, and I'm exactly the same. I'm not saying I don't need facebook, it's very useful for keeping up with people from around the world. I just need instant notifications (like you) :p

> That's what is so creepy about Facebook, they've lost sense of what is normal, so they don't hesitate to show off how much they know.

Maybe what's normal has changed out from under you.

or their OTHER messaging app, whatsapp :P

and the number can also come from a friend phonebook within one of the aforementioned apps

This is a false statement (unless it's a very very old version of android). Provide a reference to back it up.

https://play.google.com/store/apps/details?id=com.facebook.k...

The permissions include:

Device ID & call information read phone status and identity

From: https://support.google.com/googleplay/answer/6014972?hl=en Device ID & call information

An app can access your device ID(s), phone number, whether you're on the phone, and the number connected by a call. Device ID & call information may include the ability to read phone status and identity.

Regardless what google policy says: the way to get the phone number is via: TelephonyManager.getLine1Number()[1]

Which returns "null" unless the operator actually stores the phone number in the SIM so it can be read from there (also it can be modified to be anything). While technically possible, I have not seen it in practice for long time (since 2010 or so).

On iPhone it's not possible for an application to obtain the phone number[2]. There was a semi-hack doing so and Apple rejected the applications off the store and closed the loop. (reading SBFormattedPhoneNumber)[3]. In 2013 there was another exploit to obtain it but it has been addressed as well.

[1]: http://developer.android.com/reference/android/telephony/Tel... [2]: https://www.google.com/?gws_rd=cr,ssl&ei=GNa4Vc3ODuxxxxrQCg#... --it's google search with the reject terms [3]: https://www.cocoanetics.com/2009/11/forbidden-fruit-apple-ap...

Some network providers don't write the phone number to the SIM, plenty of others do.

Well that may be, yet back in 2011 the application the company I worked for required sms verification (to prohibit multiple accounts) and the idea was to prefill the phone number reading that field. It totally didn't work and there were entries like '<unknown>' instead of null, etc. The application required Android 2.2 (iirc). The functionality was removed.

Personally I have not seen an EU provider storing a real phone number there.

They could've read it from some of your friends' address books/contacts.

IF this is true, then file it as a bug with Facebook, and claim the bounty!. You'll possibly get up to USD 10K depending how it is classed - I'd certainly say that if you have disabled showing your birthday on the timeline and yet it still appears, even to non-friends, then that's a pretty serios information leakage. So, rather than taking them to court, work out how to reproduce it, and get your free money...

How is that possible for them to know your real age, logically? (I don't mean you're lying, but only you can work out the link with other services and facebook that might be leaking this information).

Most likely, a number of nxb's friends have Facebook integrated with the contacts list on their smartphone, and have nxb's birthday associated with their contact details there. Another option is if nxb's Facebook account has been connected to their Skype account (though from their FB-skeptic stance I find it unlikely they would make such a connection in the first place).

- Deducing based on my median friends' ages.

- Easily deducing my approximate age from my Linkedin profile.

- Any of the numerous other private people data sources they have access to or have bought over the years. I'm sure my birthday and basic details are in some of those. It's impossible to get those all deleted once the information is out.

- Day and month are easy, because everyone wishes me happy birthday in the messages and wall posts. All that's remaining is the year, which could be easily deduced from Linkedin and other third party data sources. - Which I've mostly cleaned up now, until Facebook exposed it all again.

- I had a profile for a few months in 2005 before deleting it. Used a different computer, different location, different email and everything for this new one a decade later, but probably they've connected the identities. Looks like if you ever tell Facebook some private information, it's non-revokably theirs to expose to the world forever.

Facebook invests very heavily in machine learning / AI, and uses it heavily through out their platform. They collect and buy tons of data both on the site and from third parties. This deduction is trivial for them.

The bad part is not so much that they deduced these details about me though, it's that I specifically made it clear that I didn't want any age public, let alone the real age, and they exposed me anyway.

I don't think Facebook are as clever as you imagine, and they certainly would never do something as crazy as trying to deduce your age based on median friends ages. But, if you do give Facebook information about yourself, then it's no longer private to only youurself - it's known to both of you. You will have agreed to some T&Cs about sharing it based on certain account settings when you signed up, so as I mentioned above, if you can prove information leakage when you've set certain privacy settings explicitly then this is absolutely a bug in Facebook's system, and you should definitely report it...

I can't begin to guess as to why you'd feel that way.

Facebook runs one of the top machine learning research labs in the world. They're among the most clever in this domain, by every possible metric. They've written extensively about how they employ machine learning across their entire product line, and are adding more constantly. They've acquired numerous ML startups and world-class researchers.

https://research.facebook.com/

https://research.facebook.com/researchers/1543934539189348

Respectfully, you're absolutely wrong, and I'm suspicious as to why you'd be intentionally spreading misinformation that they don't use ML/AI to fill in the gaps in their information about their users.

The ML activities at Facebook seem to be focussed on delivering content and advertising optimally to users. They can determinine which posts or adverts you might 'Like' based on your friends choices, or those of other similar groups of users found by various demographics and metadata. It's right there in the research group page you linked:

> "We strive to find ways to deliver more engaging content in News Feed, rank search results more accurately, and present the most relevant ads possible."

I think it'd be a pretty poor use of ML and AI to use it to try and guess the gaps in your profile, and then fill them in. Of course I'm sure they try and show you content and adverts based on what they believe your demographic profile might be, but these beliefs are purely internal to the algorithms that make the decisions as to what to publish - they aren't used to populate your public profile.

In fact, Facebook want the profile information to come from you and for it to be as accurate as possible - to help those algorithms. It wouldn't be sensible or useful to just set your profile fields based on guesses, no matter how clever the ML behind it. As I said before, I think people ascribe too much intelligence to the way Facebook handles personal information - it isn't magic.

I don't know if they are using ML or not, but they filled in my "works at" field with laughably wrong information. I didn't bother to correct it. It's not far-fetched to me that advertisers would be interested in this kind of information- ads to your SO when your birthday nears, etc.

While you say 'they' did it, it's actually hard to know what is going on. Was it stale browser data that got passed in as autofill field values when you registered? Is it based on an old LinkedIn profile you associated with facebook and then forgot to update? Did you connect with the Facebook app on an old phone where you had contact details for yourself from a previous job, and synchronise them?

Actually, the LinkedIn profile is the most likely, people often try these things, signing up and click-thru acknowledging everything without thinking, then never touch the app again. All I'm saying is that often what you think of as external is actually caused by actions you performed and then forgot about, or never really registered in the first place. Although, some of this may well be down to 'Dark Patterns'in the UX, which should really be investigated and changed.

Nope- never worked there. Heck, I've never even been there. Not on linkedIn. Has nothing to do with what I do (Imagine I was an elementary school teacher and it said I worked at Delta Airlines). Never filled out a form. In this case, they used something to guess.

I do have a FB connection to the place, though.

Ok then, where is your proof that they are? It's perfectly possible to have world class researchers who don't use machine learning to do exactly what you claim it does.

The easiest way to do it would be if one or more of your friends have your actual birthday stored in their contact list which the facebook app has access to (I think, haven't been using fb in quite a while).

Facebook's apps have access to contact information. Someone who has her information in their phone allowed Facebook to suck it in. From then, matching a mail address or phone number or name (if the social graph matches) is trivial.

For the day and month, they can deduce it from friends posts saying happy birthday every year, for the year, they can deduce it (mostly) from your school friends.

That seems highly unlikely. I guess it's possible but it doesn't strike me as a good way of getting high-quality data, and in fact it would be easily gamed, and would have larege numbers of false positives.

In general, I think most of the 'Facebook/Google have secretly stolen my personal data with intrusive sureveillance' anecdotes really are the result of someone clicking 'yes', 'yes', 'of course' without thinking when they first signed up, and giving access to their email addresss book or similar, then forgetting about it. They then get more privacy concious later, and suddenly wonder how all the information got there. And since they're privacy concious now they couldn't possibly have uploaded it, so it must be Facebook hacking them.

I've yet to see an actual documented and acknowledged example of a company like Facebook or Google doing the sort of intrusive data mining and surveillance that people accuse them of without the user's permission being given. It always turns out to have been provided at some point previously in the relationship.

Facebook is absolutely filling in your- or at least my- private information based on context. It has my employment incorrect- based on guesses it has made (I've never given it employment data). It's so far off it's laughable - so I leave it. I figure they expect that I will fix it.

That's quite smart, in a devious way. You're probably much more likely to correct incorrect information than you are to fill out an empty form. I know I am.

There are plenty of documented examples of Facebook leaking data due to code changes, bugs, poor QA, or simply not thinking through the details. Good UX also should not fall back on, "We had your permission" when a company has such a historically poor (

Sure, 100% agree with you there! Facebook are very much into the nasty 'UI and UX Dark Patterns' game; the sort of things for which the 'lifetime achievement' award goes to RyanAir, of course. It seems like they are _trying_ to improve, now that people have noticed. But there's a big difference between:

1.) The Facebook and Google AIs are teaming up and following me and my friends and family around the web to see what we each had for breakfast.

2.) Facebook sort of tricked me into not clicking the button that said I won't not disallow them to keep all my personal information, and link it to my friends data too, if they can.

Facebook must die! The amount of policing, data collection, and privacy goof ups Facebook does is an insult to all its users. Combine this with a stupid "authentic names" policy and it possibly couldn't get any worse. It just seems like Facebook has taken Google's "Don't be evil" and adopted it as "Be evil!"

After all that: Why are you still a facebook user? The users have a much quicker way to resolve these issues than the courts.

Just some food for thought, Facebook sells its services to the intelligence community. If there were anything that resembled something like a global authoritarian surveillance network, it would be Facebook.

The genius part of it is that people maintain their own personal dossiers on themselves. Who would have ever, in their wildest dreams, been able to think of a future where an authoritarian regime has gotten its citizens to keep their own files on themselves. It's bonkers.

There used to be an assumption that a national, let alone global surveillance state would have been impossible due to the sheer workload of maintaining dossiers on everyone, who would have thought that is totally irrelevant because people are more than willing to self report.

I love Facebook xD

Reply on news.ycombinator.com