feelin_googley

"Multiple Facebook profiles were extremely easy to scrape," he explains. In a series of conversations with Facebook security developers Copley explained the issue and was told there was "no security vuln here, even though it does seem like one on first glance."

The method of scraping can work in multiple ways but largely relies on feeding Facebook's API a list of phone numbers or email addresses that have been automatically generated. These could also have been obtained from data breaches or leaks of information online.

"Just query Facebook as often as possible until they ban your IP for querying too fast, and at that point you just slow down until the queries stop," Copley explained in an email. "I was doing my work purely for research and exposing the vulnerability for Facebook".

...

The issue was again raised by researchers in 2015.

Reza Moaiandin, who founded cybersecurity company CyberScanner, published a blogpost about the "loophole". he said he was able to gather thousands of users personal information by guessing their mobile numbers. Within this information were details of names, locations, and profile pictures.

In response Facebook told him it didn't "consider it a security vulnerability" but had controls in place to stop it being abused. Zuckerberg's most recent statement goes against this, admitting Facebook's efforts to stop malicious actors hadn't worked."

Source:

http://www.wired.co.uk/article/facebook-news-data-scraping-m...

"A few months ago, I discovered a security loophole in Facebook that allows hackers to decrypt and sniff out Facebook user IDs using one of Facebook's APIs in bulk - therefore allowing them to gather millions of users' personal data (name, telephone number, location, images, and more). This post is an attempt to catch Facebook's attention to get this issue fixed.

By using a script, an entire country's (I tested with the US, the UK and Canada) possible number combinations can be run through these URLs, and if a number is associated with a Facebook account, it can then be associated with a name and further details (images, and so on).

...

For those of you who are wondering why I haven't notified Facebook about the issue, the truth is that I have - back in April (2015).

Although I did receive a reply, initially the engineer I was in contact with was unable to reproduce the issue himself, and therefore failed to understand the technical details of how it should be fixed.

...

After a couple of months of waiting, I initially thought someone else will look into it and fix it but I heard nothing, so I raised the flag with them again. They finally came back to me and told me that this is not a big issue - they have set limits and I should not worry about this problem. But frankly, I am very worried.

...

Comment from reader:

Great blog post. I reported an almost identical issue (albeit a different API) to Facebook in January 2014 but faced similar difficulties getting them to recognise the scope for abuse. I was able to lookup contiguous blocks of mobile numbers (in blocks of 5,000 at a time) with no discernible rate-limiting - I could pull them down as fast as my connection could handle (maybe ~50k numbers/min).

If you make any headway with Facebook let us know and I will try pinging them again. It was especially worrisome as the number range I tried (NYC) had a hit-rate of about 20%."

Source:

https://salt.agency/blog/facebook-security-loophole/

...

Facebook has admitted 311,127 Australian users are likely among the up to 87 million users worldwide whose data was unknowingly and "improperly" shared with the British political consultancy agency."

Source:

https://www.theguardian.com/technology/2018/apr/05/facebook-...

As the FBI admitted a while back, Facebook was the best thing that happened to collecting intelligence and saving money (because everything is in the open).

By having "free" access and use of Facebook, these people have made Mark Zuckerberg a multibillionaire."

Source:

https://www.businesslive.co.za/bd/opinion/letters/2018-04-04...

"I imagine the replacement for Facebook will be ... something under the control of its users..."

This is what I am trying (poorly) to articulate. I use a very small proof-of-concept application to accomplish something like this; no website, no third party managing a "service". I paid nothing for this application.

Zuckerberg says, "The reality here is that if you want to build a service that helps connect everyone in the world, then there are a lot of people who can't afford to pay."

Its difficult to understand what he means by "a service that helps connect everyone in the world".

Users already pay for internet access. This internet service is what allows the subscriber to connect to everyone in the world. What he is describing sounds more like a central registry of contact details.

What was the most elusive "starting material" to create a Facebook alternative: the contact and other personal details for most of its users. However this information is, as the world now knows, no longer in the sole possession of Facebook.

For example, 420 million profiles from 2007-2010 were expropriated some 10 years ago. See https://news.ycombinator.com/item?id=16724375

Today in response to media pressure, Facebook announced publicly "most" of their users have likely had their account info expropriated. "We believe most people on Facebook could have had their public profile scraped in this way."

Moreover, with the recent changes Facebook has made, every user now has the means to easily export her data in a portable format.

As a user, I might look up a contact in the "Facebook directory" (of which there might be many copies in many places) and then choose to communicate with her through a different channel, one that Facebook does not control.

This channel does not need to be managed by a third party seeking to profit from selling advertising. It does not have to appear anything like Facebook or any of it subsidiaries, although it could.

Once the contact and I are in touch there is no reason to involve Facebook or any other ad-supported web company going forward.

Nonetheless, these are the assumptions I see:

1. The software alternatives or successors must be commercial.

2. The software must attract a certain quantity of users to be viable.

3. The software must enable networks comprising large numbers of people, perhaps in the millions or billions.

This scale is far greater than the average size of any Facebook users group of friends.

Over the years Facebook may have morphed into a "public square" for exercising "Free Speech" but in the beginning as I recall it was not a means to broadcast to other users outside of ones social circle.

Its primary utility is arguably still in enabling communication within small groups, not enabling broadcasting to the general public.

Wu's assumptions point toward a Zuckerberg-like centrally-managed approach to what I see as historically a locally-managed activity: the human tendency to form small groups.

For many years, gamers and others have been writing software to enable small groups to communicate over peer-to-peer networking, without any funding from advertisers.

Wu writes, "So what stands in the way of a genuine Facebook alternative? It isn't the technology."

Thats exactly right. IMHO.

Overall, Facebook says 87 million of its users were affected -- with nearly 82 per cent of them were believed to be located in the United States. ...

Canada's acting minister for democratic institutions has also said he'd be open to strengthening federal privacy laws, which don't currently apply to political parties."

Source:

https://www.cp24.com/news/more-than-620-000-canadians-affect...

   s/text-only/ASCII-only, no Javascript/
   s/browser/& I use/
   s/in VGA textmode//

I am in agreement with this programmers choices, for the most part. Certainly I agree with this one.

...

In an alarming revelation, he said that recent investigations into data privacy have revealed malicious actors cycling through hundreds of thousands of IP addresses in order to search for users by their phone numbers and scrape their public profile information.

Until now, users have had to opt out of making their profiles searchable by phone number. Most, Zuckerberg said, never opted out.

Though the CEO accepted blame for all of these data privacy and trust issues, saying, "It was my mistake," he also often put the onus on Facebook users to know better.

He mentioned, for instance, that the only information that bad actors would be able to scrape using a phone number was information that was public on Facebook user profiles.

Of the researcher who built the data-scraping app for Cambridge Analytica, Zuckerberg said, "Yes, he broke the policy, he broke people's expectations, but also, people chose to share that data with him."

And yet it was Zuckerberg and the company he built that made people's data privacy settings so open by default, and made it difficult to find, understand, and adjust those settings."

[ Poll: Is "open by default" congruent with "privacy by design"? ]

Source:

https://www.wired.com/story/facebook-exposed-87-million-user...

Soon after, Tinder users started noting on Twitter that they had been kicked off the dating app and couldn't log back on, as those who used Facebook Login were caught in an infinite loop that appears to be related to an unknown bug.

Since you need a Facebook account to log into Tinder, this bug has potentially affected Tinder's entire user base.

...

Tinder has responded in a tweet, "A technical issue is preventing users from logging into Tinder. We apologize for the inconvenience and are working to have everyone swiping again soon."

Source:

https://www.theverge.com/2018/4/4/17200034/facebook-broke-ti...

...

But it's fair to say that Facebook should be less trusted today than it was nine years ago.

...

Just like we should all be doing our part to detangle our lives from Facebook's web, app developers owe it to users to divest in their reliance on Facebook Login.

...

It's one thing to offer Facebook Login as an alternative way to easily create an account, but to straight up not offer any other way to log in to an app or game is just lazy on the developers part, and speaks to the way Facebook has lulled us all into complacency."

Source:

https://www.androidcentral.com/its-time-app-developers-fall-...

Those are indeed noble purposes that social media can serve. But if they were Facebook's true goals, we would not be here.

The ideal competitor and successor to Facebook would be a platform that actually puts such goals first.

To do so, however, it cannot be just another data-hoarder, like Google Plus.

If we have learned anything over the last decade, it is that advertising and data-collection models are incompatible with a trustworthy social media network.

...

When a company fails, as Facebook has, it is natural for the government to demand that it fix itself or face regulation. ...

If today's privacy scandals lead us merely to install Facebook as a regulated monopolist, insulated from competition, we will have failed completely.

The world does not need an established church of social media."

Source:

Tim Wu, law professor at Columbia University

https://www.nytimes.com/2018/04/03/opinion/facebook-fix-repl...

...

"While we think FB's high advertising performance speaks to the value users get out of the ads served, general consumer dislike towards advertising and increased data scrutiny could cause more users to opt-out of sharing data with FB," he said."

Source:

https://www.cnbc.com/2018/04/04/morgan-stanley-lowers-facebo...

Source:

https://www.popularmechanics.com/technology/apps/a19671683/f...

...

Schumer - who in 2016 railed that "a person's cellphone should not become a James Bond-like personal tracking device for a corporation to gather information" - has stayed relatively silent since Facebook's user data scandal with Cambridge Analytica broke last month."

Source:

https://nypost.com/2018/04/03/street-artist-taunts-schumer-o...

   Zero-width characters are invisible, `non-printing' characters that are
   not displayed by the majority of applications. F*or exam*ple, I've
   ins*erted 10 ze*ro-width spa*ces in*to thi*s sentence, c*an you tel**l?
   (Hint: paste the sentence into Diff Checker to see the locations of the
   characters!). These characters can be used to `fingerprint' text for
   certain users.

Without any privacy protections for individuals in the United States, companies such as Cambridge Analytica are able to exploit trillions of bits of personal information about individual voters.

And while Facebook has offered a plethora of apologies and suspended the company from its platform, there's not much you can do about it after the fact.

...

Yet, Facebook users ultimately have little recourse against Facebook itself.

...

Again, federal and state privacy laws offer very little protection."

Source:

Joel Winston (@joelwinston) is a Pittsburgh-based attorney who specializes in privacy and cybersecurity law. He formerly served as a Deputy Attorney General for the State of New Jersey and currently provides global legal and regulatory counsel to technology companies. [cf. technology users]

https://www.nbcnews.com/think/opinion/facebook-data-breach-s...

A little over a year after the IPO, on June 12th, 2014, Facebook quietly announced a change to its terms of service. "Starting soon in the U.S., we will also include information from some of the websites and apps you use," the company wrote. "This is a type of interest-based advertising, and many companies already do this."

...

In perhaps the creepiest example, Facebook applied for (and received, last year) a patent for a tool called Techniques, for emotion detection and content delivery. It would use the camera in your phone to take pictures of you as you scroll through content. Facebook would then use facial analysis to measure how much you did or did not like the content in question, so as to determine what kind of stuff to send your way. Ideas like this are what make Facebook, at times, feel like a giant blood-engorged tick hanging off your frontal lobe.""

Source:

https://www.rollingstone.com/politics/features/taibbi-facebo...

If I recall correctly many years ago on the djbdns mailing list djb said you did not know what you are talking about or something to that effect. At the time I thought maybe he was being a little harsh. As usual, he was right. You are annoying.

...

That said, the new CEO should not be Sheryl Sandberg. She's just as culpable as Zuckerberg, in terms of how Facebook got into its current predicament, and she's far too associated with the ancient regime."

Source:

https://www.wired.com/story/the-case-for-a-zuck-free-faceboo...

"Mar. 20, 2018 3:34 PM ET

With criticism swelling about the lack of a public statement from Facebook (NASDAQ:FB) CEO Mark Zuckerberg on the Cambridge Analytica scandal, the company held an open employee meeting today to discuss the matter, but neither Zuckerberg nor Chief Operating Officer Sheryl Sandberg attended, the Daily Beast reports."

Source:

https://seekingalpha.com/news/3340524-report-zuckerberg-sand...

Could be she is "invisible" because shes just too busy working behind the scenes.

"Sandberg: We did disclose -- on the Russian manipulation, we did disclose. We gave the information to Congress. We made it clear to people if they had seen those pages. There's a place you can go we [oops dont suggest its their responsibilty to look, rephrase] -- every situation we worked to get to the bottom of this we want to disclose. Sometimes, and I would say certainly this past week, we speak too slowly. If I could live this past week again, I would have definitely had Mark and myself out speaking earlier, but we were trying to get to the bottom of this and make sure we could take strong action. Our commitment is clear. We know this is an issue of trust. We know this is a critical moment for our company, for the service we provide. We are going to do everything we can. There will always be bad actors and I don't want to minimize that. But we are going to do everything we can to find bad actors. We're going to open tools transparently so people can help us find the bad actors on our platform. We're gonna notify users and we're gonna shut them down as fast as we can."

Source:

https://www.cnbc.com/2018/03/22/cnbc-exclusive-cnbc-transcri...

...

The basic principle is that a system must be designed not to collect certain data, if its basic function can be carried out without that data."

Frills on the system, such as [some feature conceived by PM or developer], are not part of the basic function, so they can't justify incorporating any additional surveillance."

These additional services could be offered separately to users who request them."

The title is "A radical proposal to keep your data safe."

But this doesnt sound "radical" at all.

To recap:

1. Dont collect data when unnecessary for the user.

2. Applications which perform a single function.

3. Additional "features" (i.e. more code) that add more functionality and make applications more complex are fine but they should be optional (e.g. not pre-installed or automatically added via "updates").

He is therefore taking a big gamble by agreeing to testify before the US Congress, even if Facebook has also ramped up its lobbying of politicians.

...

"He must also have the right physical posture and tone of voice. Even with the best preparation, it will be a physically and emotionally exhausting," he predicted."

Source:

https://www.fin24.com/Tech/Companies/facebook-gets-thumbs-do...

...

It's not possible in iMessage - with end-to-end encryption, Apple has no idea what you're sharing."

[ There is no technicological reason that one company, or any company, needs to have control over the management of these "groups" and the "messaging" that may occur within them.

Two "groups" communicating over internet need not be connected in any way, bridging them is an option that should be left for the user. For example, each group is reachable only via a separate network interface. Not "networks" or "interfaces" as defined by marketing copy and buzzwords, but traditional network interfaces defined by software. The type of interfaces displayed when a user types "ifconfig" and "ipconfig /all".

The interface used to "surf the web", the one that connects to the sewer of advertising that is todays web, is the not same one used to reach any group. Think of this like VLANs if you wish but its even simpler. I have been "beta-testing" such a system, which is not new, for many years. Theres no ads, no spam, no BS. It works. The "intelligence" of the network, so to speak, is at the edge, with the user.

Theres no money in this, necessarily. This isnt an elevator pitch. Its called "a private life". Everyone needs one. The whole point is to escape the commercial world for a little while. "Clean separation", like those network interfaces. ]

...

Facebook founder and CEO Mark Zuckerberg has responded personally, saying "Calm down. Breathe. We hear you." and "We didn't take away any privacy options."

Source:

https://techcrunch.com/2006/09/06/facebook-users-revolt-face...

"Privacy means people know what they're signing up for - in plain English, and repeatedly," said Jobs in that interview, which you can see below, aiming at the young techie and advertising-based businesses like Facebook."

Source:

https://www.recode.net/2018/4/2/17189192/mark-zuckerberg-fac...

...

Computer engineer Ryan Barrett fills in online forms with 0000s whenever a number is required and uses dashes for words. He says it is mostly out of principle: he wants to be in control of his information. Also, it's fun to try to fool the marketers. He has used a dozen different spellings for John Doe rather than entering his name. He even misspells his name when reserving airplane tickets and says it has never created a problem going through security.

...

He says he has friends who work at companies that look at multiple services to link up and cross-reference data on individuals-data gleaned from mobile phones, social media, grocery store loyalty cards and more. When those friends searched for him in their systems, they found little to no information. "There's a small feeling of satisfaction," he says.

...

All the lying does seem to foil advertisers. It is "a much bigger problem than people are aware of," says Nick Baker, director of research and consulting of U.K. market research company Verve, which conducted a 2015 survey showing a large amount of fake information on website registrations and the like.

Incorrect birth years, he says, are particularly nefarious because advertisers are often trying to match up habits or buying patterns with a specific age group.

...

Preethy Vaidyanathan, the chief product officer of New York-based marketing technology company Tapad, says they track much more valuable information from phone and web browser use.

Still, Ms. Vaidyanathan sees the value in hiding identity online. She says she uses a second email address with a fake name that she gives out to companies she doesn't want to bombard her inbox.

Source:

https://www.wsj.com/amp/articles/you-werent-born-in-1910-why...

...

Machine learning approaches are especially troubling, as the company continues to refuse to release any information about the functioning and accuracy of its models, even as they play an ever-greater role in shaping what two billion people can see and talk about in its walled garden.

Most recently, when asked about its efforts to train machine learning models to autonomously decide what is "fake news," the company responded that it was using a large number of signals (though it declined to elaborate on the full list of signals used) to train computerized models to fully autonomously scan what is being posted and discussed on Facebook and identify new stories the algorithms believe are false - all without any human intervention.

...

Despite controlling what nearly a quarter of the earth's population sees and says online in its walled garden, the company has survived nearly a decade and a half of privacy outcries without ever having to open up and give its users even the slightest insight into how they are being manipulated, moderated and commercialized.

...

Putting this all together, Facebook's utopian vision has devolved into a surveillance dystopia in which even its programmer creators can't be certain how or why it makes the decisions it does.

In the end, the telescreen's of Orwell's 1984 only surveilled the citizenry at random, while Facebook's unblinking algorithms never let us out of their sight, silently shaping what we are able to see and say without us having any right to understand the rules they quietly enforce, while even their engineer creators are not fully aware of the ramifications of the myriad inadvertent decisions that went into their programming."

Source:

https://www.forbes.com/sites/kalevleetaru/2018/04/02/faceboo...

"And it doesn't seem interested in closing this loophole any time soon."

https://slate.com/technology/2018/04/facebook-lets-advertise...

"I influenced three senators for $477.85"

"The goal of the ad campaign was to convince people to call their Senate offices and tell them to vote No on a confirmation. I registered the domain dumpdevos.com anonymously, set up a Facebook page, and we were off."

Source:

https://medium.com/@colinsholes/i-influenced-three-senators-...

...

Yes, I mean, that's the problem, is that they keep saying this, but, you know, there's this recidivism problem. They keep not really doing anything.

And I think that the problem is that their model depends on accumulating data and giving it to advertisers. And anything that comes close to threatening that business model, they don't really seem that interested in doing something serious about it.

...

You know, I understand that, but I think the time of "trust us" has got to be over.

...

You know, the - fundamentally, Facebook is a surveillance machine. They get as much data as they can, and they promise advertisers that they're able to manipulate us, and that is at the core. And so, you know, they started this by saying, well, this wasn't really a data breach, this is our normal business model, which I think should tell you something, and then later said, well, it's not so great, and so forth.

But they're really showing an unwillingness to do something more serious about this problem. And it keeps happening over and over again.

...

There is just something not right here with this company and their unwillingness to come clean. And I think that the idea, well, just trust because Zuckerberg wrote a message on Facebook, that everything is going to be fine is really something government investigators cannot trust.

...

And once again, I think the concern in Facebook's heart is that, at some point, this will hurt their advertising revenue and the promises they have made investors. And so they're unwilling to take serious steps.

...

And I think the fundamental problem is, they're all dependent on this pure advertising model, you know, nothing but trying to get as much data out of us and sell as much as they can of our time and attention to other people.

And that just leads in very dark directions."

Source:

Tim Wu

https://www.npr.org/2018/03/30/598208043/should-facebook-use...

"You know, I find that argument, that if you're not paying that somehow we can't care about you, to be extremely glib and not at all aligned with the truth.

The reality here is that if you want to build a service that helps connect everyone in the world, then there are a lot of people who can't afford to pay. And therefore, as with a lot of media, having an advertising-supported model is the only rational model that can support building this service to reach people.

...

I think now people are appropriately focused on some of the risks and downsides as well. And I think we were too slow in investing enough in that. It's not like we did nothing. I mean, at the beginning of last year, I think we had 10,000 people working on security. But by the end of this year, we're going to have 20,000 people working on security.

[ __% of total headcount at Facebook ]

In terms of resolving a lot of these issues, I think it's just a case where because we didn't invest enough, I think we will dig through this hole, but it will take a few years. I wish I could solve all these issues in three months or six months, but I just think the reality is that solving some of these questions is just going to take a longer period of time.

Now, the good news there is that we really started investing more, at least a year ago. So if it's going to be a three-year process, then I think we're about a year in already. And hopefully, by the end of this year, we'll have really started to turn the corner on some of these issues."