5 ms·

Not sure why people are so hung up on the "breach" vs "not a breach" debate. The issue is this: taking a random personality quiz online is old news. We've been

by dvt 9y ago

Not sure why people are so hung up on the "breach" vs "not a breach" debate. The issue is this: taking a random personality quiz online is old news. We've been doing these since the 90s. The problem is that when you log in with FB, your real name, and all of your metadata is attached to that quiz. It's not just "IP 12.342.32.1 is chaotic neutral" but "'Bob Smith, with a degree in X from Y, that likes A, B, and C and is newlywed' is chaotic neutral." The issue isn't really the quiz (and it's not even CA tbh), it's Facebook giving out real names, real pictures, etc. every time you "Log in with Facebook" on any random website or app.

akjetma 9y ago
Additionally, I think the public is now realizing how powerful the friend/follow metadata graph is. It's pretty easy/robust to infer traits about people for whom you don't have explicit information. Alan, Betty, and Charlotte filled out the quiz and all live in Florida; Dave has mutual friendships with Alan, Betty, and Charlotte; Dave probably lives in Florida. You can do this recursively and don't need to have concrete information about the majority of members in a graph in order to make pretty strong probablistic inferences about the traits of a large graph.
IAmEveryone 9y ago
I believe it’s a legal point: In case of a breach, Facebook would have been required to disclose it to the affected users. They are pushing hard against the term because it might end up determining their liability.
- dvt 9y ago
  Fair enough, but what if data points were implied? Where does that fall on the breach-not-breach spectrum?
darawk 9y ago
But this is how these sorts of OAuth schemes have always worked. It's always been explicit, too. You grant these apps access to this information. What exactly is the issue here? That this time it was used in a way people don't like? There's a reasonable debate to be had about how to deal with all this data, but to blame Facebook as if they made some error or leaked some data in an unauthorized way, or did anything that we didn't all know was possible this whole time is just totally disingenuous on the part of journalists and regulators.
- dvt 9y ago
  Yeah I agree. There's a price for the convenience of one-button logins, and we're paying it right now.
  - rando444 9y ago
    Considering Facebook is known to profile users who don't even have facebook accounts, it's likely much deeper than that.
  - netsharc 9y ago
    Well, fwiw, these quizzes weren't even on a separate website where you need to login using OAuth, but they were part of Facebook's "apps" ecosystem. And they were popular, so everyone was doing it, however harmful (and as has been said, even if you're not doing it, if your friend is doing it, the app can also see your information as your friend's connection). Add to that the tragic permission scheme where Facebook does say "This app can see this information..." without offering an option to allow/deny sharing of some things (I think they've changed it so you can give granular permissions). Granular permissions are also a pain point for me on Android phones. They were possible with apps on BlackBerry phones in the late 200x's, but on Androids before version 5 or 6? No, it's either give the app permission for all of requested functionality, or don't install it...
- creato 9y ago
  The thing that seems really wrong here is that you weren't just granting access to your own information, but all of your friends as well, who had little say in the matter beyond their original grants of permission to Facebook. It is this way that Cambridge Analytica was able to get 50 million profiles by just paying ~270k Amazon mechanical turkers [1]. It's true that everyone agreed to everything along the way: people allowed Facebook to have the information in question, and people allowed Cambridge Analytica to access that information. But it wasn't the same people agreeing to both. The set of people agreeing to the latter was much smaller than the former. It may be true that technically neither Facebook nor Cambridge Analytica did anything wrong (at least in collecting this information, this seems to be by far the least shady part of CA's business), but, Facebook's business is built on trust, and this is a huge hit to that trust. Arguing technicalities doesn't help. 1. https://www.nytimes.com/2018/03/19/opinion/facebook-cambridge-analytica.html https://www.nytimes.com/2018/03/19/opinion/facebook-cambridg...
briffle 9y ago
If it was just this, I would be okay with it. It was also saying "and here is a list of all of Bob Smith's friends, and their info". I have my Facebook profile set to 'friends', and perhaps its obvious now, but I guess I didn't realize an app installed by my great aunt now has all my information. I happily gave her access to see my profile, kids pictures, etc. But do I want every single thing she connects to to see any data I allow her to see?
- throwbacktictac 9y ago
  Does it really go that deep? I was under the impression that the app cool only grok that you are a "friend" of you aunt.
  - untog 9y ago
    No, it could ask users for permission to turn over their friend's photos/events/etc as well. Mad.
  - cosmotron 9y ago
    Yes. If you're curious what the present-day FB settings are that control this sort of information sharing, see here: https://i.imgur.com/6fyLx18.png https://i.imgur.com/6fyLx18.png It's located in the user's "Apps" settings [1] under the section, "Apps Others Use: People who can see your info can bring it with them when they use apps. Use this setting to control the categories of information people can bring with them." [1] https://www.facebook.com/settings?tab=applications&ref=settings https://www.facebook.com/settings?tab=applications&ref=setti...
  - florean 9y ago
    Yes, it really went that deep. But only if you pinky swore to only use that data to improve your app and then delete it! Facebook changed their API in 2014 and removed that ability, allowing companies to only see the profiles of friends that already had the same app (which the developer already had access to anyway). They claimed it was for user privacy, but really they realized they were giving away the crown jewels and allowing other companies to recreate large swaths of their social graph.
HenryBemis 9y ago
Getting the discussion to "breach/not breach" is taking the discussion away from the actual point. Facebook is a cancer for privacy. The affiliates of Facebook are a cancer for privacy. Privacy is a human right. Facebook is cancer (imho). That said, I believe FB would LOVE if we change the topic from PRIVACY to "anything-except-privacy". And yes. Any/all dictators (of any shape or form) are trying to silence the media/journalists. Why would FB practice a different method? This way they want to make sure that the next whistleblower won't have an outlet.
- twostoned 9y ago
  I agree with you about being very cautious about how this debate gets framed. Big corporations are boss at framing the debate in such a way that the results don't matter. Be very aware of this tendency.
vha32oiwe 9y ago
This thread seems to think the technical implementation is at fault. I'd offer an alternative: the fact that we're stuck "sharing" via centrally managed platforms is the real issue. I don't care about Facebook auth mechanism. Regardless of how it shares data, FB still HAS all the data, and can find a different way to share that with whatever party they want. There's no leverage in the information economy outside "Use the one or maybe 2 ISPs you have, and these handful of "top" providers online." It's like having a meat space economy be controlled by a top-down authority, and you can only trade along it's finan... distribution network. Oh wow, what a shock. We remade cyberspace society to be just as centrally controlled as meatspace society. While meatspace became more constrained in an authoritarian way yet again in human history. Human society exists in a strange loop of "build walls that are used to oppress me."
feelin_googley 9y ago
"Not sure why people are so hung up on the "breach" vs "not a breach" debate." Wild guess (probably incorrect): http://web.archive.org/web/20170205180142/https://www.foley.com/state-data-breach-notification-laws/ http://web.archive.org/web/20170205180142/https://www.foley....
equalunique 9y ago
Is there anyone in advertising who wouldn't want this? I honestly don't see why this is a problem. Many people don't care about what gets shared but do care about the benefits it brings to their user experience.

by dvt 9y ago

akjetma 9y ago

Additionally, I think the public is now realizing how powerful the friend/follow metadata graph is. It's pretty easy/robust to infer traits about people for whom you don't have explicit information. Alan, Betty, and Charlotte filled out the quiz and all live in Florida; Dave has mutual friendships with Alan, Betty, and Charlotte; Dave probably lives in Florida. You can do this recursively and don't need to have concrete information about the majority of members in a graph in order to make pretty strong probablistic inferences about the traits of a large graph.

IAmEveryone 9y ago

I believe it’s a legal point: In case of a breach, Facebook would have been required to disclose it to the affected users. They are pushing hard against the term because it might end up determining their liability.

dvt 9y ago
Fair enough, but what if data points were implied? Where does that fall on the breach-not-breach spectrum?

darawk 9y ago

But this is how these sorts of OAuth schemes have always worked. It's always been explicit, too. You grant these apps access to this information. What exactly is the issue here? That this time it was used in a way people don't like? There's a reasonable debate to be had about how to deal with all this data, but to blame Facebook as if they made some error or leaked some data in an unauthorized way, or did anything that we didn't all know was possible this whole time is just totally disingenuous on the part of journalists and regulators.

dvt 9y ago
Yeah I agree. There's a price for the convenience of one-button logins, and we're paying it right now.
- rando444 9y ago
  Considering Facebook is known to profile users who don't even have facebook accounts, it's likely much deeper than that.
- netsharc 9y ago
  Well, fwiw, these quizzes weren't even on a separate website where you need to login using OAuth, but they were part of Facebook's "apps" ecosystem. And they were popular, so everyone was doing it, however harmful (and as has been said, even if you're not doing it, if your friend is doing it, the app can also see your information as your friend's connection). Add to that the tragic permission scheme where Facebook does say "This app can see this information..." without offering an option to allow/deny sharing of some things (I think they've changed it so you can give granular permissions). Granular permissions are also a pain point for me on Android phones. They were possible with apps on BlackBerry phones in the late 200x's, but on Androids before version 5 or 6? No, it's either give the app permission for all of requested functionality, or don't install it...
creato 9y ago
The thing that seems really wrong here is that you weren't just granting access to your own information, but all of your friends as well, who had little say in the matter beyond their original grants of permission to Facebook. It is this way that Cambridge Analytica was able to get 50 million profiles by just paying ~270k Amazon mechanical turkers [1]. It's true that everyone agreed to everything along the way: people allowed Facebook to have the information in question, and people allowed Cambridge Analytica to access that information. But it wasn't the same people agreeing to both. The set of people agreeing to the latter was much smaller than the former. It may be true that technically neither Facebook nor Cambridge Analytica did anything wrong (at least in collecting this information, this seems to be by far the least shady part of CA's business), but, Facebook's business is built on trust, and this is a huge hit to that trust. Arguing technicalities doesn't help. 1. https://www.nytimes.com/2018/03/19/opinion/facebook-cambridge-analytica.html https://www.nytimes.com/2018/03/19/opinion/facebook-cambridg...

briffle 9y ago

If it was just this, I would be okay with it. It was also saying "and here is a list of all of Bob Smith's friends, and their info". I have my Facebook profile set to 'friends', and perhaps its obvious now, but I guess I didn't realize an app installed by my great aunt now has all my information. I happily gave her access to see my profile, kids pictures, etc. But do I want every single thing she connects to to see any data I allow her to see?

throwbacktictac 9y ago
Does it really go that deep? I was under the impression that the app cool only grok that you are a "friend" of you aunt.
- untog 9y ago
  No, it could ask users for permission to turn over their friend's photos/events/etc as well. Mad.
- cosmotron 9y ago
  Yes. If you're curious what the present-day FB settings are that control this sort of information sharing, see here: https://i.imgur.com/6fyLx18.png https://i.imgur.com/6fyLx18.png It's located in the user's "Apps" settings [1] under the section, "Apps Others Use: People who can see your info can bring it with them when they use apps. Use this setting to control the categories of information people can bring with them." [1] https://www.facebook.com/settings?tab=applications&ref=settings https://www.facebook.com/settings?tab=applications&ref=setti...
- florean 9y ago
  Yes, it really went that deep. But only if you pinky swore to only use that data to improve your app and then delete it! Facebook changed their API in 2014 and removed that ability, allowing companies to only see the profiles of friends that already had the same app (which the developer already had access to anyway). They claimed it was for user privacy, but really they realized they were giving away the crown jewels and allowing other companies to recreate large swaths of their social graph.

HenryBemis 9y ago

Getting the discussion to "breach/not breach" is taking the discussion away from the actual point. Facebook is a cancer for privacy. The affiliates of Facebook are a cancer for privacy. Privacy is a human right. Facebook is cancer (imho). That said, I believe FB would LOVE if we change the topic from PRIVACY to "anything-except-privacy". And yes. Any/all dictators (of any shape or form) are trying to silence the media/journalists. Why would FB practice a different method? This way they want to make sure that the next whistleblower won't have an outlet.

twostoned 9y ago
I agree with you about being very cautious about how this debate gets framed. Big corporations are boss at framing the debate in such a way that the results don't matter. Be very aware of this tendency.

vha32oiwe 9y ago

This thread seems to think the technical implementation is at fault. I'd offer an alternative: the fact that we're stuck "sharing" via centrally managed platforms is the real issue. I don't care about Facebook auth mechanism. Regardless of how it shares data, FB still HAS all the data, and can find a different way to share that with whatever party they want. There's no leverage in the information economy outside "Use the one or maybe 2 ISPs you have, and these handful of "top" providers online." It's like having a meat space economy be controlled by a top-down authority, and you can only trade along it's finan... distribution network. Oh wow, what a shock. We remade cyberspace society to be just as centrally controlled as meatspace society. While meatspace became more constrained in an authoritarian way yet again in human history. Human society exists in a strange loop of "build walls that are used to oppress me."

feelin_googley 9y ago

"Not sure why people are so hung up on the "breach" vs "not a breach" debate." Wild guess (probably incorrect): http://web.archive.org/web/20170205180142/https://www.foley.com/state-data-breach-notification-laws/ http://web.archive.org/web/20170205180142/https://www.foley....

equalunique 9y ago

Is there anyone in advertising who wouldn't want this? I honestly don't see why this is a problem. Many people don't care about what gets shared but do care about the benefits it brings to their user experience.