6 ms·

Google is in a bit of a different position. The most information that a malicious app on my friend's phone can access about me is what my friend has stored on t

Google is in a bit of a different position. The most information that a malicious app on my friend's phone can access about me is what my friend has stored on their phone about me. Personal things like messaging history and contact information are certainly enough to build a 'social graph', but what Google does not let apps do is access the information that Google stores about me on their servers just because my friend has both my number and a greedy app on their phone.

aylmao 9y ago
Different, but not better IMO, since Facebook solved the friend access problem in 2014 but Google apps still have this issue today. Moreover, Facebook can push updates instantly since it's a web API-- I hope Google has some way of changing this without requiring a full OS update. Also worth considering, Facebook is all about social and preference ("like") data, but live location is something you can get as a mobile app and a lot of stuff can be inferred from where you live/work/visit.
trendia 9y ago
CA was able to extract a personality profile from just likes. Imagine what an app could do if they had access to your entire message history! (Why would anyone give apps access to their messages? So that they can send / receive special emoji, for example.)
- leggomylibro 9y ago
  Well, messaging history is just an example; I'm not actually sure if that is something which apps are allowed to lift, but I figured I'd err on the extreme end. Either way, discrete and easy-to-digest information like 'likes' are exactly what they wouldn't have access to from Google, and honestly it seems like automated sentiment analyses are still very error-prone; large corpuses of text don't seem ideal for this sort of targeting.
- criley2 9y ago
  So these days Facebook requires you to sign a contract to get any significant data or permission any more. I don't think Google does that...
  - deleted 9y ago
    [deleted]
- skybrian 9y ago
  Graphs that connect users are not all the same. For example, it's much more common to follow relatives and people you know in real life on Facebook than on Twitter. (This is one of the reasons Google tried to build Google+: they were worried that not having a real social network would put them at a disadvantage.) It's all privacy leakage but it's not at all the same data. Facebook's graph is still noisy but it's better or at least different data than other companies have.
- Waterluvian 9y ago
  Was the personality profile any good? Otherwise I could make that claim about extracting a personality profile out of tea leaves.
- diyseguy 9y ago
  Seems to me they could make more fine grained permissions. E.g., I don't like that my javascript disabler Firefox plugin has permissions to 'Access data for all websites', 'Access browser tabs'.
cwkoss 9y ago
Can't apps view list of contacts?
- izacus 9y ago
  Not without explicit user permission, no.
mtgx 9y ago
They could extract pictures. In the future, once more devices have AI chips on board and maybe there's an API for seeing what's in the pictures, too, with ML, I could see developers abuse that, and extract all sorts of relevant info from people's phones. Regardless of how dangerous Android permissions are or aren't, I do agree with the larger point that Google is scared about what will happen to Facebook, because it knows those regulations or even a "privacy revolution" that may come in the wake of this will impact it, too. It's probably not even just this one event that will hurt Google. This sentiment has been growing over the past few years. If Google hasn't noticed it growing, then they are out of touch. If the anti-privacy trend continues, it will be bad news for Google, Amazon, Microsoft, and even Apple (which seems to be backtracking on some privacy features lately). I do hope that at the very least the anti-privacy trend pushes companies to limit data gathering and use new privacy-preserving tech that doesn't allow them to look at the data at all. And I hope they do that before it's too late (for them).
throwaway84742 9y ago
>> does not let apps do is access the information Neither does FB I believe. Otherwise their business model of knowing more about you than anybody else would fall apart.
- untog 9y ago
  The whole recent scandal is based around the fact that the FB API does allow apps to download all kinds of user information, and used to let them download data about their friends.
  - throwaway84742 9y ago
    Not “all kinds”. Users routinely approve the use of their friends list, and in this case, this is what was downloaded and data mined, in addition to user’s own profile information. I know this is too much nuance for a lay person to handle, but I expect more from HN readers. The scummy part was that the data was obtained using an app that’s unrelated to what the data was eventually used for, but Android is totally ripe for that as well.
    - untog 9y ago
      "all kinds" isn't exactly a scientifically defined term. Friends list an "profile information" is still very broad. The additional scummy part was that you could authorize FB to download that data for your friends as well as yourself, so your data might be consumed without you ever being aware of, or giving permission for it. As far as I'm aware Android has no such equivalent.
      - throwaway84742 9y ago
        >> could authorize FB to download that data for your friends I don’t believe this is true. You could authorize apps to download a very limited amount of info about your friends. If you have a reference to some authoritative source that proves the opposite, do share. Extraordinary claims demand extraordinary evidence, and all that.
canoebuilder 9y ago
the information that Google stores about me on their servers I've not seen anyone address this, but reading between the lines, many people seem to hold a view that the existence of these finely-grained personal data profiles at this massive scale is fine so long as they exist only on the servers of fb and goog, but why? What makes that acceptable or reasonable, besides the persuasiveness of large amounts of money? I think the clearest path forward is that no one should be creating these kinds of data profiles. I don't think a bot learning my route to work, or a doctor's appt(along with a swath of more "monetizable" personal info) so it can alert me to potential traffic delays is a reasonable trade-off for the massive societal problems the behaviour of creating these data profiles poses. If this data is such a monumental danger when it escapes the permeable confines of the fbs and the googs, then it shouldn't exist within these companies either, not just because as we've seen the confines are quite permeable, but also because the potential for negative use of the data doesn't change depending on who has access to it. It can be persuasively argued that simply creating and collecting these data profiles is itself a negative use of the data.
- skybrian 9y ago
  It might not be okay but it is different. At least in a technical discussion, we should be able to make distinctions rather than treating all data or all breaches the same.
- leggomylibro 9y ago
  I don't think it's acceptable, I just realize that I am powerless to stop it beyond supporting sweeping new regulatory frameworks, which I write to my Congresspeople about but what do you think they're going to do about it? Nothing. And for now, Google's services are worth the data they collect. Facebook's value proposition is comparatively laughable, which might be why so many people are so upset with the scope of how their data was used. And don't even get me started on how users, including those who have not signed up for the service, get tracked on massive swaths of 3rd-party sites if they don't take pains to prevent it - that's downright sinister.
calvinbhai 9y ago
I'm not an Android user, but I feel there's way more data accessible on Android for app developers than many people realize. Photos (on Android and iOS) contain a wealth of information, and any app having access to photos, can clearly figure out where you have been (based on photo's metadata containing GPS location), what you like to eat (if you take a lot of photos of food), where you like to hangout, time of day/week you do certain activities, purely based on image recognition. Any wonder why Google Lens is integrated in the Google Photos app? Add to that, the ability of identifying people from photos (Apple, Facebook and Google do it very well) and you can easily connect the dots, and it'll be hard to escape this kind of data digging, even if you are Jack Reacher. Even pro-privacy Apple doesn't do much in terms of access to photos on iOS. If I want to share one image on Whatsapp on iOS, I have to give Whatsapp access to Photo Album. And once the access is given, a superficial scan can provide WhatsApp full info of locations from my photos, in a few seconds (even if it is 20 GB of photos). Privacy on iOS in this aspect is bad. I can only imagine that Android is much worse.
- izacus 9y ago
  That's simply not true. Apps aren't allowed to access photos without permission on modern Android (6.0+) and you don't need to grant the app full access to photo album just to share an image. Androids intent system always handled these use cases better than iOS did.

aylmao 9y ago

Different, but not better IMO, since Facebook solved the friend access problem in 2014 but Google apps still have this issue today. Moreover, Facebook can push updates instantly since it's a web API-- I hope Google has some way of changing this without requiring a full OS update. Also worth considering, Facebook is all about social and preference ("like") data, but live location is something you can get as a mobile app and a lot of stuff can be inferred from where you live/work/visit.

trendia 9y ago

CA was able to extract a personality profile from just likes. Imagine what an app could do if they had access to your entire message history! (Why would anyone give apps access to their messages? So that they can send / receive special emoji, for example.)

leggomylibro 9y ago
Well, messaging history is just an example; I'm not actually sure if that is something which apps are allowed to lift, but I figured I'd err on the extreme end. Either way, discrete and easy-to-digest information like 'likes' are exactly what they wouldn't have access to from Google, and honestly it seems like automated sentiment analyses are still very error-prone; large corpuses of text don't seem ideal for this sort of targeting.
criley2 9y ago
So these days Facebook requires you to sign a contract to get any significant data or permission any more. I don't think Google does that...
- deleted 9y ago
  [deleted]
skybrian 9y ago
Graphs that connect users are not all the same. For example, it's much more common to follow relatives and people you know in real life on Facebook than on Twitter. (This is one of the reasons Google tried to build Google+: they were worried that not having a real social network would put them at a disadvantage.) It's all privacy leakage but it's not at all the same data. Facebook's graph is still noisy but it's better or at least different data than other companies have.
Waterluvian 9y ago
Was the personality profile any good? Otherwise I could make that claim about extracting a personality profile out of tea leaves.
diyseguy 9y ago
Seems to me they could make more fine grained permissions. E.g., I don't like that my javascript disabler Firefox plugin has permissions to 'Access data for all websites', 'Access browser tabs'.

cwkoss 9y ago

Can't apps view list of contacts?

izacus 9y ago
Not without explicit user permission, no.

mtgx 9y ago

They could extract pictures. In the future, once more devices have AI chips on board and maybe there's an API for seeing what's in the pictures, too, with ML, I could see developers abuse that, and extract all sorts of relevant info from people's phones. Regardless of how dangerous Android permissions are or aren't, I do agree with the larger point that Google is scared about what will happen to Facebook, because it knows those regulations or even a "privacy revolution" that may come in the wake of this will impact it, too. It's probably not even just this one event that will hurt Google. This sentiment has been growing over the past few years. If Google hasn't noticed it growing, then they are out of touch. If the anti-privacy trend continues, it will be bad news for Google, Amazon, Microsoft, and even Apple (which seems to be backtracking on some privacy features lately). I do hope that at the very least the anti-privacy trend pushes companies to limit data gathering and use new privacy-preserving tech that doesn't allow them to look at the data at all. And I hope they do that before it's too late (for them).

throwaway84742 9y ago

>> does not let apps do is access the information Neither does FB I believe. Otherwise their business model of knowing more about you than anybody else would fall apart.

untog 9y ago
The whole recent scandal is based around the fact that the FB API does allow apps to download all kinds of user information, and used to let them download data about their friends.
- throwaway84742 9y ago
  Not “all kinds”. Users routinely approve the use of their friends list, and in this case, this is what was downloaded and data mined, in addition to user’s own profile information. I know this is too much nuance for a lay person to handle, but I expect more from HN readers. The scummy part was that the data was obtained using an app that’s unrelated to what the data was eventually used for, but Android is totally ripe for that as well.
  - untog 9y ago
    "all kinds" isn't exactly a scientifically defined term. Friends list an "profile information" is still very broad. The additional scummy part was that you could authorize FB to download that data for your friends as well as yourself, so your data might be consumed without you ever being aware of, or giving permission for it. As far as I'm aware Android has no such equivalent.
    - throwaway84742 9y ago
      >> could authorize FB to download that data for your friends I don’t believe this is true. You could authorize apps to download a very limited amount of info about your friends. If you have a reference to some authoritative source that proves the opposite, do share. Extraordinary claims demand extraordinary evidence, and all that.

canoebuilder 9y ago

the information that Google stores about me on their servers I've not seen anyone address this, but reading between the lines, many people seem to hold a view that the existence of these finely-grained personal data profiles at this massive scale is fine so long as they exist only on the servers of fb and goog, but why? What makes that acceptable or reasonable, besides the persuasiveness of large amounts of money? I think the clearest path forward is that no one should be creating these kinds of data profiles. I don't think a bot learning my route to work, or a doctor's appt(along with a swath of more "monetizable" personal info) so it can alert me to potential traffic delays is a reasonable trade-off for the massive societal problems the behaviour of creating these data profiles poses. If this data is such a monumental danger when it escapes the permeable confines of the fbs and the googs, then it shouldn't exist within these companies either, not just because as we've seen the confines are quite permeable, but also because the potential for negative use of the data doesn't change depending on who has access to it. It can be persuasively argued that simply creating and collecting these data profiles is itself a negative use of the data.

skybrian 9y ago
It might not be okay but it is different. At least in a technical discussion, we should be able to make distinctions rather than treating all data or all breaches the same.
leggomylibro 9y ago
I don't think it's acceptable, I just realize that I am powerless to stop it beyond supporting sweeping new regulatory frameworks, which I write to my Congresspeople about but what do you think they're going to do about it? Nothing. And for now, Google's services are worth the data they collect. Facebook's value proposition is comparatively laughable, which might be why so many people are so upset with the scope of how their data was used. And don't even get me started on how users, including those who have not signed up for the service, get tracked on massive swaths of 3rd-party sites if they don't take pains to prevent it - that's downright sinister.

calvinbhai 9y ago

I'm not an Android user, but I feel there's way more data accessible on Android for app developers than many people realize. Photos (on Android and iOS) contain a wealth of information, and any app having access to photos, can clearly figure out where you have been (based on photo's metadata containing GPS location), what you like to eat (if you take a lot of photos of food), where you like to hangout, time of day/week you do certain activities, purely based on image recognition. Any wonder why Google Lens is integrated in the Google Photos app? Add to that, the ability of identifying people from photos (Apple, Facebook and Google do it very well) and you can easily connect the dots, and it'll be hard to escape this kind of data digging, even if you are Jack Reacher. Even pro-privacy Apple doesn't do much in terms of access to photos on iOS. If I want to share one image on Whatsapp on iOS, I have to give Whatsapp access to Photo Album. And once the access is given, a superficial scan can provide WhatsApp full info of locations from my photos, in a few seconds (even if it is 20 GB of photos). Privacy on iOS in this aspect is bad. I can only imagine that Android is much worse.

izacus 9y ago
That's simply not true. Apps aren't allowed to access photos without permission on modern Android (6.0+) and you don't need to grant the app full access to photo album just to share an image. Androids intent system always handled these use cases better than iOS did.