10 ms·

Cow Game Extracted Facebook Data

234 points by jameshart 9y ago

mnm1 9y ago
I'd be shocked, shocked to hear of any companies that didn't take data against Facebook's tos. I did a few Facebook integrations back in those days and none of my employers have one fuck about us violating tos. This wasn't exclusive to Facebook integrations either.
- matte_black 9y ago
  This goes beyond Facebook too. Any service where a TOS can be violated gets violated. Every company I’ve been in has violated some TOS before to access or do things that were not allowed. It’s just the way things are in this industry.
- gaius 9y ago
  The TOS is meant to be violated, so they can boot you at any point for any whimsical reason in the future. If it wasn’t it would be enforced in the code
  - Shish2k 9y ago
    How exactly does one enforce in the code a policy of "you can use the data you've collected for the purpose you stated, but you can't use it for any other purpose, nor share it"?
- fbimplementer 9y ago
  I worked at a large, well-known, consumer tech company on its Facebook integration. It absolutely did care about the Facebook TOS, had a contract with Facebook about what data could and could not be used and retained, and didn't share Facebook data beyond aggregated demographic information (age, gender, region). We were very careful not to do anything even remotely sketchy with the data. But this is the sort of company with a brand and something to lose, and a relationship with Facebook.
- kwillets 9y ago
  I implemented some of the TOS requirements at Zynga, and we did a lot of TOS vetting with the legal team. I personally nulled out some fields that TOS changes forbade, and AFAIK Zynga never had any interest in sharing or selling the data. However Facebook itself seemed willing to expand the TOS to extremes. At one point it was possible to get games that the user's friends were playing; I was amazed at whoever got them to agree to that.
zeta0134 9y ago
This website redirects away from the article after a short while if you run an ad blocker. I won't turn mine off, for reasons that ironically have to do with a distrust of third party tracking networks. EDIT: NoScript did the trick.
- jasonmp85 9y ago
  I've just stopped reading anything on The Atlantic. Sites that do such things are complicit in this problem.
  - chipperyman573 9y ago
    I see this comment all the time, what people often fail to realize is that if you won't turn off your ad-blocker, the website doesn't want you. You cost them a small amount of money to deliver the content (bandwith) and they invest a modest capital into creating the content (paying writers, etc), and you offer nothing in return. This doesn't mean you have to stay; if this behavior annoys you, don't read their content. But don't complain that their website is "sending you away", because that's exactly what they want. You laid out your demands (ignore the fact that I'm using an ad-blocker), and they're showing you the door.
    - Hallucinaut 9y ago
      I think people are fully aware, but they're claiming that sites do not have unique content or provide other value that would be enough to justify display of the ads, or they think that all sites should always find non-ad based revenue streams yet provide open access. Personally, I make a judgement call. On the Atlantic I got the ad block message recently and decided to switch it off as I find the content unique and well-written. They're not a news-aggregator or a spammer, their ads aren't that intrusive... I think it's a fair-call.
    - ballenf 9y ago
      Can you imagine if Walmart banned classes of visitors who were unlikely to purchase things even though they use the toilets?
bwang29 9y ago
The news title finally mentioned "brokers."Much have been talked about the ease of collecting and extracting data, I'm wondering when it comes to SELL data, how easy would that be and through what process a developer could find a broker? And at what price? Is there a way to find a list of these brokers? Would it be difficult for facebook to be aware all data brokers in the market and also at what price point, under what agreement and and estimated transactions volume?
- rhizome 9y ago
  It strikes me as a little distasteful to ask for a roadmap to that business model these days.
  - lainga 9y ago
    Do you find white-hat pentesters distateful, too?
    - rhizome 9y ago
      No.
- mattnewton 9y ago
  More importantly, can we have a rallying cry to regulate these data brokers? Often they aren’t even attempting to ask users permission, or even notify users of their existence in any way, before harvesting and repackaging data about them.
guelo 9y ago
This whole scandal is very weird to me. Everybody has known this about Facebook forever. Most people have gotten bit at one time or another with apps that spam their friends or do something else shady. And most people have learned to be wary of Facebook apps. Not that we shouldn't be outraged. I'm glad we finally have outrage. We should have all been outraged a long time ago.
- danso 9y ago
  > Everybody has known this about Facebook forever. This is not even remotely true, especially when it comes to the general population. I'm not trying to slam you here, I was of same mindset too, since at least 2009 (I stopped using API in 2013 and assumed things were clamped down). I don't want to be a nag on his, e.g. Mustnt assume everyone knows what you know! Rather, I think this is an advantageous mindset to have. Anything you know in your profession, especially when it comes to tech or data, you can assume plenty of people (including future customers) don't have a damn clue.
  - fareesh 9y ago
    I think the point here is that the media has failed in its responsibility to inform. If we knew, they knew, and the reason the public didn't know is because they media didn't turn this into prime time news, the way the Cambridge Analytica story has been positioned. That matters.
    - untog 9y ago
      Did the media know? The attention being given to the Cambridge Analytica story by the media suggests that this is a new finding to them. I think one of the societal problems we have right now is an overwhelming lack of tech literacy. It affects the media but also (and more importantly) government. People simply don't understand this stuff, and the problem isn't going to go away, because if you do have tech knowledge you can make far more money as a developer than you can as a journalist or politician.
      - 9y ago
throwaway84742 9y ago
Google must be sweating bullets right now. Every single Android app seems to require access to every single thing, and there are hundreds of thousands of them with a significant user base. Some do most certainly misuse the data they collect. Maybe a small percentage, but a small percentage of 100k is still a large number.
- leggomylibro 9y ago
  Google is in a bit of a different position. The most information that a malicious app on my friend's phone can access about me is what my friend has stored on their phone about me. Personal things like messaging history and contact information are certainly enough to build a 'social graph', but what Google does not let apps do is access the information that Google stores about me on their servers just because my friend has both my number and a greedy app on their phone.
  - aylmao 9y ago
    Different, but not better IMO, since Facebook solved the friend access problem in 2014 but Google apps still have this issue today. Moreover, Facebook can push updates instantly since it's a web API-- I hope Google has some way of changing this without requiring a full OS update. Also worth considering, Facebook is all about social and preference ("like") data, but live location is something you can get as a mobile app and a lot of stuff can be inferred from where you live/work/visit.
  - trendia 9y ago
    CA was able to extract a personality profile from just likes. Imagine what an app could do if they had access to your entire message history! (Why would anyone give apps access to their messages? So that they can send / receive special emoji, for example.)
    - leggomylibro 9y ago
      Well, messaging history is just an example; I'm not actually sure if that is something which apps are allowed to lift, but I figured I'd err on the extreme end. Either way, discrete and easy-to-digest information like 'likes' are exactly what they wouldn't have access to from Google, and honestly it seems like automated sentiment analyses are still very error-prone; large corpuses of text don't seem ideal for this sort of targeting.
deleted 9y ago
[deleted]
dictum 9y ago
Off topic, but since we're revisiting the skeletons of the past decade: Act I - https://www.theverge.com/2012/2/7/2782947/path-ios-app-user-information-collected-privacy https://www.theverge.com/2012/2/7/2782947/path-ios-app-user-... Act II - https://twitter.com/davemorin/status/976624270477545472 https://twitter.com/davemorin/status/976624270477545472
drcongo 9y ago
Link without an adblocker-wall: https://outline.com/wKv6uB https://outline.com/wKv6uB
- ng-user 9y ago
  Thanks, I appreciate it!
- discreditable 9y ago
  I worked around it by hitting the reader mode button as soon as the page loaded.
- leggomylibro 9y ago
  There's no 'adblock wall' if you have a script blocker such as NoScript, even with scripts from 'theatlantic.com' allowed. It is a bit tedious to manually allow js on websites to get them to work properly but...gee, just refer to the article's topic. Scripts from 'facebook.net' are somewhat ironically, but predictably, loaded with the page.
vanattab 9y ago
I am all for taking a look at these privacy issues and seeing if we can develop some new regulations to address these concerns but the way the media covers this story is a complete joke. Obama was labeled a political geniuses who was truly in-touch with the young generation when he used the Facebook graph api to micro target ads but when Trump campaign uses the exact same approach to micro target ads it is a despicable act that assisted in "theft" of the election. EDIT: In an attempt to protect my karma from those who have drunk far to much kool-aid I should point out I did not vote for Trump and I think he is a total clown. I just think the current clickbait/outrage media culture is far more a danger to the american values I cherish then 3 more years of this ass-hat.
- unfunco 9y ago
  I don't think it's a fair comparison, people weren't (or at least, fewer people were) screaming fake news back then. It's not micro-targeting or advertising that has people riled up, it's the way it is being been used.
  - vanattab 9y ago
    Exactly my point! People are not upset by "psychometric advertising" they are upset that the other side making use of the technique. If you honestly think both sides don't use the technique to engage in despicable disinformation campaigns you've probably already drank a fatal dose.
  - wu-ikkyu 9y ago
    The people seemingly screaming "fake news" the most in recent times are the same people vanattab is referring to as being misleading. People have always been screaming something synonomous to "fake news" against the other side.
- kevinh 9y ago
  Trump isn't mentioned once in this article, nor is any theft of an election.
  - 9y ago
newsat13 9y ago
"For years, these transmissions were even conducted unencrypted, until Facebook required apps to communicate with its service over a secure connection." Wow.
- JetSpiegel 9y ago
  There was even Firesheep at some point.
ggg9990 9y ago
The day I discovered all Likes were public I went and deleted all of them. God knows who got them before I did that (and I’m sure Facebook still uses them).
MikeGale 9y ago
Facebook's officially stated approach of "it's the user's decision" is right, in my view. The problem is that they were, and are, insincere in saying that. The user has no option to say NOPE I'm not giving you, that, that, that and that. No way to see what something does before giving them anything at all. If that was done right users would have the choice. Failing that Facebook is culpable. The trouble with the culpable or "rule of law" approach though is that it's up to politicians, maybe bored law enforcement people, maybe some bribery and corruption. i.e. it generally works poorly if at all, all too often it achieves the opposite. I say avoid legislation and give individuals their own control. Real control.

234 points by jameshart 9y ago

mnm1 9y ago

I'd be shocked, shocked to hear of any companies that didn't take data against Facebook's tos. I did a few Facebook integrations back in those days and none of my employers have one fuck about us violating tos. This wasn't exclusive to Facebook integrations either.

matte_black 9y ago
This goes beyond Facebook too. Any service where a TOS can be violated gets violated. Every company I’ve been in has violated some TOS before to access or do things that were not allowed. It’s just the way things are in this industry.
gaius 9y ago
The TOS is meant to be violated, so they can boot you at any point for any whimsical reason in the future. If it wasn’t it would be enforced in the code
- Shish2k 9y ago
  How exactly does one enforce in the code a policy of "you can use the data you've collected for the purpose you stated, but you can't use it for any other purpose, nor share it"?
fbimplementer 9y ago
I worked at a large, well-known, consumer tech company on its Facebook integration. It absolutely did care about the Facebook TOS, had a contract with Facebook about what data could and could not be used and retained, and didn't share Facebook data beyond aggregated demographic information (age, gender, region). We were very careful not to do anything even remotely sketchy with the data. But this is the sort of company with a brand and something to lose, and a relationship with Facebook.
kwillets 9y ago
I implemented some of the TOS requirements at Zynga, and we did a lot of TOS vetting with the legal team. I personally nulled out some fields that TOS changes forbade, and AFAIK Zynga never had any interest in sharing or selling the data. However Facebook itself seemed willing to expand the TOS to extremes. At one point it was possible to get games that the user's friends were playing; I was amazed at whoever got them to agree to that.

zeta0134 9y ago

This website redirects away from the article after a short while if you run an ad blocker. I won't turn mine off, for reasons that ironically have to do with a distrust of third party tracking networks. EDIT: NoScript did the trick.

jasonmp85 9y ago
I've just stopped reading anything on The Atlantic. Sites that do such things are complicit in this problem.
- chipperyman573 9y ago
  I see this comment all the time, what people often fail to realize is that if you won't turn off your ad-blocker, the website doesn't want you. You cost them a small amount of money to deliver the content (bandwith) and they invest a modest capital into creating the content (paying writers, etc), and you offer nothing in return. This doesn't mean you have to stay; if this behavior annoys you, don't read their content. But don't complain that their website is "sending you away", because that's exactly what they want. You laid out your demands (ignore the fact that I'm using an ad-blocker), and they're showing you the door.
  - Hallucinaut 9y ago
    I think people are fully aware, but they're claiming that sites do not have unique content or provide other value that would be enough to justify display of the ads, or they think that all sites should always find non-ad based revenue streams yet provide open access. Personally, I make a judgement call. On the Atlantic I got the ad block message recently and decided to switch it off as I find the content unique and well-written. They're not a news-aggregator or a spammer, their ads aren't that intrusive... I think it's a fair-call.
  - ballenf 9y ago
    Can you imagine if Walmart banned classes of visitors who were unlikely to purchase things even though they use the toilets?

bwang29 9y ago

The news title finally mentioned "brokers."Much have been talked about the ease of collecting and extracting data, I'm wondering when it comes to SELL data, how easy would that be and through what process a developer could find a broker? And at what price? Is there a way to find a list of these brokers? Would it be difficult for facebook to be aware all data brokers in the market and also at what price point, under what agreement and and estimated transactions volume?

rhizome 9y ago
It strikes me as a little distasteful to ask for a roadmap to that business model these days.
- lainga 9y ago
  Do you find white-hat pentesters distateful, too?
  - rhizome 9y ago
    No.
mattnewton 9y ago
More importantly, can we have a rallying cry to regulate these data brokers? Often they aren’t even attempting to ask users permission, or even notify users of their existence in any way, before harvesting and repackaging data about them.

guelo 9y ago

This whole scandal is very weird to me. Everybody has known this about Facebook forever. Most people have gotten bit at one time or another with apps that spam their friends or do something else shady. And most people have learned to be wary of Facebook apps. Not that we shouldn't be outraged. I'm glad we finally have outrage. We should have all been outraged a long time ago.

danso 9y ago
> Everybody has known this about Facebook forever. This is not even remotely true, especially when it comes to the general population. I'm not trying to slam you here, I was of same mindset too, since at least 2009 (I stopped using API in 2013 and assumed things were clamped down). I don't want to be a nag on his, e.g. Mustnt assume everyone knows what you know! Rather, I think this is an advantageous mindset to have. Anything you know in your profession, especially when it comes to tech or data, you can assume plenty of people (including future customers) don't have a damn clue.
- fareesh 9y ago
  I think the point here is that the media has failed in its responsibility to inform. If we knew, they knew, and the reason the public didn't know is because they media didn't turn this into prime time news, the way the Cambridge Analytica story has been positioned. That matters.
  - untog 9y ago
    Did the media know? The attention being given to the Cambridge Analytica story by the media suggests that this is a new finding to them. I think one of the societal problems we have right now is an overwhelming lack of tech literacy. It affects the media but also (and more importantly) government. People simply don't understand this stuff, and the problem isn't going to go away, because if you do have tech knowledge you can make far more money as a developer than you can as a journalist or politician.
    - 9y ago

throwaway84742 9y ago

Google must be sweating bullets right now. Every single Android app seems to require access to every single thing, and there are hundreds of thousands of them with a significant user base. Some do most certainly misuse the data they collect. Maybe a small percentage, but a small percentage of 100k is still a large number.

leggomylibro 9y ago
Google is in a bit of a different position. The most information that a malicious app on my friend's phone can access about me is what my friend has stored on their phone about me. Personal things like messaging history and contact information are certainly enough to build a 'social graph', but what Google does not let apps do is access the information that Google stores about me on their servers just because my friend has both my number and a greedy app on their phone.
- aylmao 9y ago
  Different, but not better IMO, since Facebook solved the friend access problem in 2014 but Google apps still have this issue today. Moreover, Facebook can push updates instantly since it's a web API-- I hope Google has some way of changing this without requiring a full OS update. Also worth considering, Facebook is all about social and preference ("like") data, but live location is something you can get as a mobile app and a lot of stuff can be inferred from where you live/work/visit.
- trendia 9y ago
  CA was able to extract a personality profile from just likes. Imagine what an app could do if they had access to your entire message history! (Why would anyone give apps access to their messages? So that they can send / receive special emoji, for example.)
  - leggomylibro 9y ago
    Well, messaging history is just an example; I'm not actually sure if that is something which apps are allowed to lift, but I figured I'd err on the extreme end. Either way, discrete and easy-to-digest information like 'likes' are exactly what they wouldn't have access to from Google, and honestly it seems like automated sentiment analyses are still very error-prone; large corpuses of text don't seem ideal for this sort of targeting.

deleted 9y ago

[deleted]

dictum 9y ago

Off topic, but since we're revisiting the skeletons of the past decade: Act I - https://www.theverge.com/2012/2/7/2782947/path-ios-app-user-information-collected-privacy https://www.theverge.com/2012/2/7/2782947/path-ios-app-user-... Act II - https://twitter.com/davemorin/status/976624270477545472 https://twitter.com/davemorin/status/976624270477545472

drcongo 9y ago

Link without an adblocker-wall: https://outline.com/wKv6uB https://outline.com/wKv6uB

ng-user 9y ago
Thanks, I appreciate it!
discreditable 9y ago
I worked around it by hitting the reader mode button as soon as the page loaded.
leggomylibro 9y ago
There's no 'adblock wall' if you have a script blocker such as NoScript, even with scripts from 'theatlantic.com' allowed. It is a bit tedious to manually allow js on websites to get them to work properly but...gee, just refer to the article's topic. Scripts from 'facebook.net' are somewhat ironically, but predictably, loaded with the page.

vanattab 9y ago

I am all for taking a look at these privacy issues and seeing if we can develop some new regulations to address these concerns but the way the media covers this story is a complete joke. Obama was labeled a political geniuses who was truly in-touch with the young generation when he used the Facebook graph api to micro target ads but when Trump campaign uses the exact same approach to micro target ads it is a despicable act that assisted in "theft" of the election. EDIT: In an attempt to protect my karma from those who have drunk far to much kool-aid I should point out I did not vote for Trump and I think he is a total clown. I just think the current clickbait/outrage media culture is far more a danger to the american values I cherish then 3 more years of this ass-hat.

unfunco 9y ago
I don't think it's a fair comparison, people weren't (or at least, fewer people were) screaming fake news back then. It's not micro-targeting or advertising that has people riled up, it's the way it is being been used.
- vanattab 9y ago
  Exactly my point! People are not upset by "psychometric advertising" they are upset that the other side making use of the technique. If you honestly think both sides don't use the technique to engage in despicable disinformation campaigns you've probably already drank a fatal dose.
- wu-ikkyu 9y ago
  The people seemingly screaming "fake news" the most in recent times are the same people vanattab is referring to as being misleading. People have always been screaming something synonomous to "fake news" against the other side.
kevinh 9y ago
Trump isn't mentioned once in this article, nor is any theft of an election.
- 9y ago

newsat13 9y ago

"For years, these transmissions were even conducted unencrypted, until Facebook required apps to communicate with its service over a secure connection." Wow.

JetSpiegel 9y ago
There was even Firesheep at some point.

ggg9990 9y ago

The day I discovered all Likes were public I went and deleted all of them. God knows who got them before I did that (and I’m sure Facebook still uses them).

MikeGale 9y ago

Facebook's officially stated approach of "it's the user's decision" is right, in my view. The problem is that they were, and are, insincere in saying that. The user has no option to say NOPE I'm not giving you, that, that, that and that. No way to see what something does before giving them anything at all. If that was done right users would have the choice. Failing that Facebook is culpable. The trouble with the culpable or "rule of law" approach though is that it's up to politicians, maybe bored law enforcement people, maybe some bribery and corruption. i.e. it generally works poorly if at all, all too often it achieves the opposite. I say avoid legislation and give individuals their own control. Real control.