15 ms·
Facebook's Not Listening Through Your Phone. It Doesn't Have To
- woodandsteel 9y agoThe author says facebook isn't listening in on your smartphone, but it can get all the information about you it wants by other means. That makes me feel so much better.
- torgard 9y agoThat seems to be the point of the article. People are in an uproar about being recorded, but not realizing they are being 'recorded' in many other ways.
- krishicks 9y agoIf you liked this article, I recommend his book, Chaos Monkeys, about his time at Facebook as an Ads product manager.
- creaghpatr 9y agoYes I agree, and he’s a great contributor choice for Wired which has been going downhill lately
- hawkilt 9y agoi was once talking to a friend that i should get a new laptop bag for my mac, i never searched on anything. but after 2 days i’m abale to see the laptop bag ad from amazon on Facebook
- UncleMeat 9y agoWhy would it wait two days? Have you never seen an ad for laptop bags before? I see them often. You can decompile the facebook app. You can install a cert and mitm the network connection. You can do anything to the client. Yet nobody has found any evidence whatsoever of this behavior.
- throwaway613834 9y agoUgh, I hate this nonsense. You say "you can do X" as if it's so easy. I assume this isn't something you're just pulling out of thin air and that you're at least saying this because you really know how to do it (i.e.: you've done it before). So, please do all of us a huge favor and explain how to do the MITM on Android step-by-step, which you seem to think we're all so lazy & unwilling to do. Not merely "in theory", and not merely on some random app, but in actual freaking practice, on the Facebook app. Because every single person I've caught saying this had evidently not tried it on the Facebook app himself to realize how nontrivial it is. People don't have the time or energy to switch their full-time jobs to being reverse-engineers of the Facebook app, so if you think it's so doable, please do the world a favor and show us how to put this myth to rest. (And to make it even easier, no need to assume zero prior knowledge. You can assume people already know how to do this on a desktop, and just teach them how to do it on the phone. I assure you that the knowledge does not simply transfer over.)
- quesera 9y agoI think it's safe to say that "you can do" here means "it is possible to, and people do". The risk Facebook would take by pulling a stunt like this is ginormous. See also: Amazon Echo. The consumer and legal backlash would be swift and stunning, and the secret would be impossible to keep. Mobile app decryption is a well-established process. Reverse engineering a large app is tedious, but fully comprehensible. If you're specifically looking for recording (streaming audio out, or spooling to storage), it's much more manageable. Of course there's a danger in assuming that someone, somewhere has already done this (or many someones). ~"With enough eyes, all bugs are shallow" ... sure, if the eyes are open. I don't know anyone who has done this work for the Facebook app, or for the Echo. But there are so many little boutique security firms out there today, and the technical prerequisites are so low...I just don't see how it's possible that it hasn't been done a hundred times. The genuine risk, I think, is that a Corp with all the tooling in place could be compelled by some vaguely legal process in some sketchy jurisdiction, to target an individual of interest with custom code. This isn't hard either. Of course, the "tooling" is minor and any popular app could be subverted usefully in this fashion, so Facebook is not special here. Still, most of us are laughably uninteresting to LE, but proper opsec still dictates caution.
- derekp7 9y agoTrue story -- I was making a peanut butter sandwich the other night. I used Smuckers Natural peanut butter. Pulled out my phone to look something up, and right there staring back at me was an add for Jif peanut butter. I don't ever remember seeing a peanut butter add on my phone before. They must have used some undocumented sensor on the phone to detect the smell of peanut butter and selected an ad based on that. (/sarcasm) Then again, maybe I've seen hundreds of peanut butter ads on my phone, mixed with the many thousands that come across, and I just hadn't paid any attention to them until something else happened at the same time to make the connection.
- corobo 9y agoOr Facebook saw you logged into Facebook using a laptop and whoever at Amazon set up the ad to target people who use laptops
- danso 9y agoDoesn't have to be searches. Can be derived from visiting pages (Amazon or not) that have anything to do with laptop bags. Can you open up your browser history and see if nothing you visited in those two days had anything to do with laptops or laptop bags?
- hawkilt 9y agonope i only spoke about it, never searched it on any shopping portals
- dfabulich 9y agoThe "Reply All" podcast had a fantastic episode on this. https://gimletmedia.com/episode/109-facebook-spying/ https://gimletmedia.com/episode/109-facebook-spying/ (Click the "show transcript" link to see the transcript.) One thing they realized is that it was impossible to convince anybody that Facebook doesn't listen in on microphone conversations, even given all of the facts. One of the co-hosts, Alex, gets on the phone with five people to try to convince each of them that Facebook doesn't use the microphone. He's unable to convince even one of them.
- MarkMc 9y agoI suppose it would be good for Facebook if Android had the capacity to show a log of which apps used which phone features when. eg. 12:36pm Google Maps used the location feature 12:48pm Instagram used the camera 1:16pm WhatsApp used the microphone for 34 seconds etc.
- mikeash 9y agoiOS doesn't have a log, but it does have a really obvious visual indicator (in the form of a fat red status bar) when an app uses the microphone in the background. I became convinced that this whole story was nonsense when I realized a lot of people reporting it were talking about iPhones. Something like what you describe would be wonderful on either platform, though.
- danso 9y agoYeah that seems to me to be the strongest argument against FB using the microphone. For iOS, it would require circumventing the Apple guidelines. FB is clearly a big player but not big enough for Apple to bend their privacy rules for.
- Yetanfou 9y agoThey created an exception to their rules for Über [1], a much smaller company than Facebook. If Facebook came with some convincing reason why they really needed something similar I don't see why they would not get their wish granted. [1] http://fortune.com/2017/10/06/apple-uber-secret-entitlement/ http://fortune.com/2017/10/06/apple-uber-secret-entitlement/
- halayli 9y agoauthor is relying on his own limited technical knowledge on wether it can be done or not. There are plenty of ways to do it like sampling / increase sampling when other fb friends are around or maybe they just listen randomly and in the end they’ll have a well built profile about you. It’s not like it needs to be listening all the time or respond anytime a keyword is said.
- shalmanese 9y agoThe author was the former Facebook PM in charge of creating the ads targeting team.
- halayli 9y agoPMs aren't as technical as you might think, and the fact that he worked for facebook means he could have strong reasons to deny that they are listening. My point was that technicality isn't what will get in the way of listening vs not listening. He's backing his claim by saying it's technically impossible but that's just weak defense.
- CodeWriter23 9y agoWell, a former PM who thinks voice analysis is not possible on-device and puts out the red herring of bandwidth and storage capacity as the foundational argument of why he “knows” they’re not listening. PS I don’t think “they” are listening and use other highly effective means to target ads. But I do think arguing such targeting is only possible in the cloud, and only after recording all the sound in your environment: the air conditioner, traffic, kids playing, etc. and let’s not forget ALL the silence in between, is intellectually dishonest. Especially when we all know that any always-listening device processes the signal locally, scanning for trigger words.
- danso 9y ago"foundational argument"? He spends half the article talking about the other issues, starting with "But what if those technical realities disappeared?" I think he smudges the issue by conflating FB's theoretical ingestion of such audio with its current data storage capacity and ingestion. Presumably, raw audio could be transmitted and processed without being stored. But does the state of the art language recognition allow for broad on-device translation beyond a subset of trigger words, i.e. "Alexa", "Siri", "OK Google"?
- ravenstine 9y agoI don't think they're listening through the microphone, but I've been wondering to what extent they use your photos to determine how to market to you. For example, most of my photos on Facebook show me with either hair or a hat on; as I've gotten older I've actually developed male pattern baldness, and so one day I thought it would look best to just buzz off the rest. I had a picture taken of me and use it as my Facebook profile pic. Since then, I seem to get more and more ads in my feed for hair transplants. Maybe they classify your photos and sell that data? If you think about it, there's a lot more guesses they can make from your photos than listening to a bunch of disjointed conversations. They really don't need to hear what you say.
- calvano915 9y agoIt wouldn't surprise me one bit. I have an extension that displays the tags that FB assigns to each photo. It detects emotions, environmental features, on and on. Not very hard to strategize with all that information and combining whatever else they know about you (what you "like", etc).
- iamben 9y agoCould that be confirmation bias as well? I have no idea how old you are, but quick knowledge graph result said "40% of men have noticeable hair loss by age 35, 65% by age 60, and 80% by age 80." FWIW, if I had a hair transplant product, knowing I could target guys aged ~35 and pique the interest of ~40% of them is a good start. If I cross that with another targeting option (perhaps you're 35 and single, and I assume that maybe getting worried that losing your hair will diminish you chances with women), and run a decent ad, perhaps you'll click. I'd obviously have the pixel code on my page and now you're on my retargeting list for ever more... I could do all that without any photo classification. Edit: Dwelling on this a bit more, of course - it would make total sense to bucket people with receding hairline photos into lookalike audiences for people who'd engaged with transplant ads... Although I suppose that could be equally relevant for targeting like mentioned above. Right age, relationship status, income bracket... Who knows.
- ravenstine 9y ago
- yosamino 9y ago> In the bright-eyed naiveté of my first few weeks as Facebook's first leader of the ads targeting effort Not to be too snarky, but this is facebook's (ex?) ad targeting leader telling us that everything is A-OK? He might well be right, and he presents some good arguments, but in the face of such an opaque system, that doesn't inspire much confidence.
- zherbert 9y agoToday my girlfriend spoke about wanting a cinnamon roll, and later in the day her iPhone Facebook app showed an advertisement for cinnamon rolls. We were trying to determine if maybe she had seen that same ad earlier in the day on Facebook, and it planted the craving in her head. Regardless, it was a very freaky experience. I doubt Facebook is listening, but it's likely their ads are inadvertently influencing us. As we scroll quickly through our news feeds, we automatically ignore most ads. But they are still making an impression.
- jordigh 9y ago> We were trying to determine if maybe she had seen that same ad earlier in the day on Facebook, and it planted the craving in her head. People don't seem to really understand how nefarious ads are. We think we're so smart. We won't be influenced by ads. No way we're falling for that. But if you know what "just do it", "the happiest place on Earth" or "think different" refer to, regardless of you opinions of those products, you have already been influenced by ads, and your next buying choices will reflect that. We're frail, easily manipulated creatures, unprepared for the combined centuries of expertise that hordes of advertisers can control us with.
- throwaway613834 9y ago> But if you know what "just do it", "the happiest place on Earth" or "think different" refer to, regardless of you opinions of those products, you have already been influenced by ads, and your next buying choices will reflect that. I beg your pardon? I know where the "happiest place on Earth" is and yet I have only ever been there once... because I was taken there by others, not because I chose to go. Not sure how my buying choices have ever even remotely taken that slogan into account.
- quesera 9y agoAnd your discriminating taste is duly signaled to the teeming HN masses. But you should make an effort to think more inclusively and creatively. I think you'll find GP's message quite straightforward. For the record, I will signal that I have no idea where the happiest place on earth is. My guess was some cruise line or other, but that seems inconsistent with your consumer experience.
- samspenc 9y agoThis part of the article where he describes crunching through some additional user data unnerves me: "It was like pressing a field of livestock into the sausage grinder, and getting out one hot dog as a result. And Facebook users are a very large herd." Sometimes I wonder if from a high level, that's how Facebook sees users' data ("field of livestock") that goes into the data processing engine ("sausage grinder").
- lichenwarp 9y agoI've seen this multiple times so it's totally not coincidence, you see a post that has someone wearing glasses for example and the next sorted post is someone wearing glasses but the post has no mention of glasses and is completely unrelated to the previous.
- jrockway 9y agoA lot of people wear glasses.
- throwaway613834 9y agoI stopped reading the article after the first piece of nonsense: > To make it happen, Facebook would need to record everything your phone hears while it's on. This is functionally equivalent to an always-on phone call from you to Facebook. Your average voice-over-internet call takes something like 24kbps one way, which amounts to about 3 kBs of data per second. Assume you've got your phone on half the day, that's about 130 MBs per day, per user. No, this is complete nonsense. They could easily record the audio locally (perhaps even sporadically rather than constantly -- you don't need constant audio data), do some local speech recognition when the phone is plugged in, and send over the resulting text in short bursts along with all the other data they send over. There's no need for raw audio to be sent over the wire. It's not like they need perfect accuracy.
- aptwebapps 9y agoYou should have kept reading, because that was discussed as well.
- teaneedz 9y agoIt doesn't really matter what a former PM focused on ad tech says, because true or not, the average user will not believe FB anyways. FB won't be trusted because of it's anti-privacy history and experiments. That FB gets so much data from other sources just increases the impression that FB is not to be trusted. The first argument made in the article is disingenious and only acts to discredit FB even more. It's not just a FB problem, it's an ad tech driven business model problem. However, Facebook keeps on a path that makes it the perfect poster of a company not to be trusted. Listening or not, FB is not trustable.