3 ms·

Right, but that was a privilege that the users authorized them to grant, no? As in, the people who signed up for CA's app had access to those profiles, and they

by darawk 9y ago

Right, but that was a privilege that the users authorized them to grant, no? As in, the people who signed up for CA's app had access to those profiles, and they explicitly granted CA's app access to those profiles. And then CA scraped them and saved them. Am I understanding correctly?

JumpCrisscross 9y ago
> that was a privilege that the users authorized them to grant Kogan was granted permission to ephemerally use, for academic purposes, the data of a quarter of a million people who authorized the access. Kogan got fifty million peoples' data (i.e. Facebook let him scrape the data of people who had not given authorization, some of whom had explicitly gone into their privacy settings to turn off the sharing of their data with third parties), kept it, and then forwarded a copy to CA.
- chatmasta 9y ago
  This is hyperbole. He created an app, wrote in the description that it was for academic purposes, and then later amended the description / TOS to allow selling of data. Facebook is faulting him because he did not update them on the purpose of the app. There were no systemic barriers in place that Kogan had to circumvent to get access to the data; the Facebook API worked as expected and gave it to him. Regardless of the original “purpose” of the app (a small textarea input you supply to FB), the API would provide the data. The “purpose” of an app does not affect what data is available to it in any meaningful way. The idea that he should have notified Facebook of the changes is laughable; all he had to do is change a few text inputs to update the TOS. The FB platform does not treat an app differently based on its purpose. This is CYA language from FB trying to obfuscate the fact that any and every app has access to this same data, and FB has no control over what happens to the data once an app extracts it. Indeed, much of their business model depends on this premise. Further, the practice of changing terms / functionality of an app is a laughably commonplace way of circumventing the nearly non-existent FB platform review process. I have personally seen much worse incidents of FB app abuse in the wild. For example I once reverse engineered a top 10 iOS social app and discovered they were injecting custom JS into the WebView provided by FB to get the ID of all your friends, rather than the top 50 you can see. The app’s FB “app” was classified as a game which gave it the requisite permissions for abuse and even allowed the app to secretly invite all your FB friends to it without you ever knowing.
  - JumpCrisscross 9y ago
    > the Facebook API worked as expected and gave it to him "Breach" doesn't have to involve a technical malfunction. An employee handing confidential information to an outsider is a breach. Facebook collected users' information. The information was accessed, stored, and distributed without Facebook's (nor their users') authorization. That's a breach.
    - chatmasta 9y ago
      By that logic does every FB app that stores collected data on non-FB servers represent a breach? The crucial point here is that the users authorized the app to collect the data. Facebook has an extremely extensive authorization system for you to grant apps access to your data. Did Kogan use this system differently than every other FB app? What technical measures did he need to circumvent in order to get access to the data that you say constitutes a “breach?” To me, it looks like the system worked exactly as designed and intended. The only system he really circumvented is the honor system, which is about the only limitation on what an app can do with the data FB gives to it.
      - JumpCrisscross 9y ago
        > The crucial point here is that the users authorized the app to collect the data A quarter of a million people authorized the app to collect their data. It then gained access to fifty million peoples' data. Those extra data were accessed without proper authorization. All of the data were then used in an unauthorized manner. > What technical measures did he need to circumvent in order to get access to the data that you say constitutes a “breach?” "Breach" isn't constrained to technical vulnerabilities. If an FSB agent walks out of Langley with a bunch of sensitive CIA documents, that constitutes a breach.
        chatmasta 9y ago
        I get the point you’re trying to make, but I’m skeptical that a breach can be non-technical if there exists a technical framework whitelisting what apps can and cannot do. By implementing an explicit system for granting app access to user accounts, Facebook is effectively setting the boundaries of apps within that system. How can Facebook then arbitrarily pick an app utilizing the system that Facebook setup to protect user data, and say the app is breaching user data? If it’s a breach, the problem is the system by Facebook. If that’s true, then there must be a “bug” (technical or not) that Kogan exploited in the system. In that case I would expect Facebook to fix the “bug.” Yet the bug is the system itself. There is nothing to fix.

by darawk 9y ago

JumpCrisscross 9y ago

> that was a privilege that the users authorized them to grant Kogan was granted permission to ephemerally use, for academic purposes, the data of a quarter of a million people who authorized the access. Kogan got fifty million peoples' data (i.e. Facebook let him scrape the data of people who had not given authorization, some of whom had explicitly gone into their privacy settings to turn off the sharing of their data with third parties), kept it, and then forwarded a copy to CA.

chatmasta 9y ago
This is hyperbole. He created an app, wrote in the description that it was for academic purposes, and then later amended the description / TOS to allow selling of data. Facebook is faulting him because he did not update them on the purpose of the app. There were no systemic barriers in place that Kogan had to circumvent to get access to the data; the Facebook API worked as expected and gave it to him. Regardless of the original “purpose” of the app (a small textarea input you supply to FB), the API would provide the data. The “purpose” of an app does not affect what data is available to it in any meaningful way. The idea that he should have notified Facebook of the changes is laughable; all he had to do is change a few text inputs to update the TOS. The FB platform does not treat an app differently based on its purpose. This is CYA language from FB trying to obfuscate the fact that any and every app has access to this same data, and FB has no control over what happens to the data once an app extracts it. Indeed, much of their business model depends on this premise. Further, the practice of changing terms / functionality of an app is a laughably commonplace way of circumventing the nearly non-existent FB platform review process. I have personally seen much worse incidents of FB app abuse in the wild. For example I once reverse engineered a top 10 iOS social app and discovered they were injecting custom JS into the WebView provided by FB to get the ID of all your friends, rather than the top 50 you can see. The app’s FB “app” was classified as a game which gave it the requisite permissions for abuse and even allowed the app to secretly invite all your FB friends to it without you ever knowing.
- JumpCrisscross 9y ago
  > the Facebook API worked as expected and gave it to him "Breach" doesn't have to involve a technical malfunction. An employee handing confidential information to an outsider is a breach. Facebook collected users' information. The information was accessed, stored, and distributed without Facebook's (nor their users') authorization. That's a breach.
  - chatmasta 9y ago
    By that logic does every FB app that stores collected data on non-FB servers represent a breach? The crucial point here is that the users authorized the app to collect the data. Facebook has an extremely extensive authorization system for you to grant apps access to your data. Did Kogan use this system differently than every other FB app? What technical measures did he need to circumvent in order to get access to the data that you say constitutes a “breach?” To me, it looks like the system worked exactly as designed and intended. The only system he really circumvented is the honor system, which is about the only limitation on what an app can do with the data FB gives to it.
    - JumpCrisscross 9y ago
      > The crucial point here is that the users authorized the app to collect the data A quarter of a million people authorized the app to collect their data. It then gained access to fifty million peoples' data. Those extra data were accessed without proper authorization. All of the data were then used in an unauthorized manner. > What technical measures did he need to circumvent in order to get access to the data that you say constitutes a “breach?” "Breach" isn't constrained to technical vulnerabilities. If an FSB agent walks out of Langley with a bunch of sensitive CIA documents, that constitutes a breach.
      - chatmasta 9y ago
        I get the point you’re trying to make, but I’m skeptical that a breach can be non-technical if there exists a technical framework whitelisting what apps can and cannot do. By implementing an explicit system for granting app access to user accounts, Facebook is effectively setting the boundaries of apps within that system. How can Facebook then arbitrarily pick an app utilizing the system that Facebook setup to protect user data, and say the app is breaching user data? If it’s a breach, the problem is the system by Facebook. If that’s true, then there must be a “bug” (technical or not) that Kogan exploited in the system. In that case I would expect Facebook to fix the “bug.” Yet the bug is the system itself. There is nothing to fix.