4 ms·
I was curious how the figure leaped from the 270k cited in the Facebook press release to this 50M figure. It sounds like they never had full access to the Face
by patja 9y ago
I was curious how the figure leaped from the 270k cited in the Facebook press release to this 50M figure.
It sounds like they never had full access to the Facebook profiles beyond the 270k who installed the app, but just harvested the friend lists of those 270k. This doesn't give the app developer full access to the friends' profile data, but I guess once you have the network of friend connections you can use other public data sources to fill in or infer the gaps. And of course some of those 50M will have FB profiles that are fully public open books ready for anyone to harvest.
I will say as someone who has developed Facebook apps, the whole ecosystem is pretty much on the honor system for protecting user data. There are some seemingly random and capricious (and often erroneous) abuse detection algorithms, but once an app has access to user data who knows what they do with it and whether it was kept secure -- surely Facebook has no idea unless they perform invasive manual physical audits.
- tobilg 9y agoYou could get access to the full friends‘ user profile data in Graph API earlier than v2.0. If you had 500 friends, and granted friends_* OAuth permissions to an app, the app had access to 501 user profiles.
- 616c 9y agoYou know where you read this?
- Xorlev 9y agoAt $dayjob-1 we relied on this to pull in your Facebook friends as contacts. Eventually FB limited the scope of this to friends who also had the app.
- tobilg 9y agoThis was post-v2.0 afaik.
- SubiculumCode 9y agoit was in TFA, btw
- IAmEveryone 9y agoI can confirm this, at least generally. Given access by a user, you had access to all the data the user could access, including the user’s friends’. There may have been exceptions, but, for example, friends’ likes were accessible.
- tobilg 9y agoIt’s gone from the FB Graph API docs, but the wayback machine still has it: https://web.archive.org/web/20130911191323/https://developers.facebook.com/docs/reference/login/extended-profile-properties/ https://web.archive.org/web/20130911191323/https://developer... I was possible to use the v1.0 API until Q2/2015 if I remember correctly (only if you had a v1.0 app though)
- bredren 9y agoFrom the very beginning there has been a rule that you were not allowed to persist data more than a few days in your own dB. But it was obvious there was no way for fb to verify what you did or did not keep. There has never been substantial control on profile data harvest on fb. It was whatever you could get users to okay, which was a lot given the value your app had to appear to provide.
- rpmcmurphy 9y agoA substantial percentage of the US population installed that "cow clicker" app at some point, and who knows what data they harvested. Even if they did not access your full profile, they could probably learn a lot about you based on when and how often you were clicking on cows.
- whatever_dude 9y agoWhile your point stands, Cow Clicker itself was unlikely to be doing something nefarious. It was created specifically as a criticism of similar game mechanics, and got viral mostly by accident. https://en.m.wikipedia.org/wiki/Cow_Clicker https://en.m.wikipedia.org/wiki/Cow_Clicker Hence why the researcher who created it decided to kill it.
- forapurpose 9y ago> It sounds like they never had full access to the Facebook profiles beyond the 270k who installed the app That's completely speculative, and we don't need more speculative information ... I'd much prefer to wait for evidence.
- stevenwoo 9y agoFrom the interview, the architect of the system says Facebook detected the download of data (50 million users' data might crush smaller companies.) and asked what was going on and he just told them it was for academic purposes so Facebook let it pass. Also when Facebook told them to delete it later, CA said they did but didn't.