5 ms·

Facebook tracks your private calls

169 points by daenz 9y ago

deleted 9y ago
[deleted]
cromwellian 9y ago
What IOS iPhone permission do grant the app that allows this? Is it "Allow Access to Contacts"? I mean, there's a difference between allowing say, an app to be able to lookup and dial a phone entry, and an app getting call logs They need to split that permission if it is combined with other stuff.
- domevent 9y ago
  remember one thing though: the phone OS (Android or, less likely, iOS) developers are as much at fault as FB on this one. From that and other comments it seems like this story may not apply to iOS?
  - hellofunk 9y ago
    I've had the FB app on my iPhone for years and I just checked the FB zip file download of user data, and my contact info html file is empty.
- eridius 9y ago
  None. It’s impossible for an app to get this info on iOS, at least, not without jailbreaking the device first. This story must be about Android.
- 0x0 9y ago
  Apps written by "mere mortals" probably can't get that information. But there's a whole API called "CoreTelephony" that's mostly gated behind an entitlement, http://iphonedevwiki.net/index.php/CoreTelephony.framework http://iphonedevwiki.net/index.php/CoreTelephony.framework I used to think Apple would never grant this entitlement to any other apps other than those that are builtin to iOS, but then there was that whole Uber framebuffer capture entitlement scandal...
  - sah2ed 9y ago
    Did the scandal actually happen? The articles I found only talked of the possibility for abuse by Uber. https://www.macrumors.com/2017/10/05/uber-removing-apple-granted-api/ https://www.macrumors.com/2017/10/05/uber-removing-apple-gra...
    - 0x0 9y ago
      The big deal isn't what uber did or did not do with their magic provisioning profile. It's the fact that Apple apparently sometimes hands out god-mode provisioning profiles to 3rd party developers at all.
- IBM 9y ago
  Pretty sure there's no API to access call logs. I know India's government wanted to create an app on iOS that could access that, purportedly for blocking spam, but Apple said no.
eterm 9y ago
I've often seen this permission rationalised as "Well apps need to suspend when a call is incoming", but why is ability to know if there is a call the same permissions as knowing every call made and for how long? Facebook may have been "given permission" but as people are discovering, it wasn't really actually given permission. This is why there is such a notion as informed consent, because giving permission isn't always as simple as agreeing to something.
deleted 9y ago
[deleted]
alex_young 9y ago
Apparently they serve your archive up on some dialup link or something. I just noticed my archive is available (no email received though), and it's going to take an hour to download 255 MB. On a 1G fiber link. I guess this kind of complies with the GDPR. Seems like FB probably has fast internet links somewhere.
- _xgw 9y ago
  It took me about 15 minutes to download my 2GB archive on a 30Mbps connection which seems normal to me.
- abirkill 9y ago
  As a counter-example, I requested mine about 20 minutes ago, received an e-mail confirming the request, received another e-mail 6 minutes later to say it was available for download, and the ~90MB download completed in under 10 seconds on my 150Mbps connection.
- austincheney 9y ago
  My archive was ready faster than I could log into my webmail and the massive 12kb archive downloaded in less than a second on the hotel internet.
Shywim 9y ago
Some replies say that the user should take a second look at what permissions they give, but in the case of Android apps the permission to use the Account Manager (used to register a service account like Facebook, Google, Twitter or any other things that need to synchronize in the background) is displayed as a "Contacts" permission to the user. So some apps like Facebook might synchronize or make other uses of contacts with their service accounts, but many other service don't do anything with contacts and doesn't EVEN request the actual contacts permission but their permission request is still displayed as "Contacts". How can the user be able to do responsible choices in giving apps permissions when the permissions layer of the OS make no sense?
- switch007 9y ago
  I may be misremembering/totally off base, but didn't Android go through some rounds of "simplifying" or "renaming" permissions over the years to basically obfuscate and confuse? (Or have they always been terrible?)
shapiro92 9y ago
Can we start putting some blame on the developers the product managers and in general the IT team behind the facebook Android App? Not only they executed it, they have thought of it, where to store it, how to download it etc. It is not just Zuckerberg who is at fault.
- alex_young 9y ago
  Doesn't Zuckerberg control FB? Didn't he also control it in all of it's past? All of the teams of people you mentioned work for him. They take direction from him, and ultimately the buck stops there.
  - ajross 9y ago
    The point wasn't that the buck shouldn't stop, it was that the fact that the buck passes someone isn't a defense. Lots of folks were involved in building this disaster, and they all share blame too. To Godwinize for clarity: Hitler wasn't the only war criminal in Nazi Germany.
  - kosei 9y ago
    If you think Zuck has knowledge of even 1% of what his 25,000+ employees do and the code they're writing, you're dreaming. He is still ultimately accountable, but it is unreasonable to assume that he is personally directing the efforts of the teams here.
  - colordrops 9y ago
    > it is not _just_ Zuckerberg who is at fault
- MBCook 9y ago
  How about Google? They didn’t do this on iOS because they can’t. Why the hell was this an option? Why wasn’t there a really big ‘holy hell are you sure you want to do this’ dialog box? How do normal apps even get to ask for this in the first place?
stevebmark 9y ago
edit: misread
- milesokeefe 9y ago
  Not sure how that relates to them tracking calls.
- bcherny 9y ago
  If FB (or any other app) could record your phone's mic without you knowing, that would be a GIANT security issue on Apple/Samsung/etc.'s part. As any app developer knows, you need to explicitly request permission to record, and the user sees a big red bar for the duration of the recording. Unless you're the NSA or something, you're not getting around that.
rukittenme 9y ago
I would recommend everyone download their archive. I just did. 1.8mb for me. All of it benign and boring. I honestly feel a little left out. But I did get to read a lot of conversations I forgot I had. It was fun to remember "the good old days".
torpfactory 9y ago
It should be clear to everyone now that Facebook is engaged in building a surveillance system which tracks every one of its users throughout their daily lives. Though others will disagree, this kind of behavior, especially done so without informing the user in full candor, is morally wrong. As I've advocated in other commentary on this site: Engineers at Facebook have a moral obligation either reform from the inside or quit. This kind of surveillance apparatus should not be built, by either government or private entities.
- Erlangolem 9y ago
  I agree. Now what about engineers at Google, especially with their drone program partnership with the DOD? How about engineers at Uber making cars that are unfit for the road?Engineers in general need to either grow a spine and a conscience fast, or they need enforced ethical standards. It’s. It just Facebook, although Facebook is particularly nasty, and there is no sign of people giving upon their cushy jobs to do the right thing. Mostly they seem happy to go public while babbling about how they’re “changing the world” as in that pitiful letter from DropBox.
  - cma 9y ago
    We need more legal protections for corporate whistleblowers.
    - kyrra 9y ago
      What part of a DoD contract requires whistleblowers? Are we going to arrest all of Lockheed Martin or Northrop Grumman?
  - empath75 9y ago
    I refused to even interview for Palantir when their recruiter called and have quit jobs in the past when I was asked to do something unethical. It’s not as if google or fb engineers can’t find jobs elsewhere.
  - Artemis2 9y ago
dotsh 9y ago
Do we really need to go over and over with this again? https://news.ycombinator.com/item?id=16656604 https://news.ycombinator.com/item?id=16656604 https://news.ycombinator.com/item?id=16652387 https://news.ycombinator.com/item?id=16652387
- lucb1e 9y ago
  That, and the 10 other facebook-related posts currently on the front page. I understand it's a huge revelation that facebook tracks people and shares the data in ways and for purposes which we weren't aware of, but the news has been nothing but facebook for a week now. For something that was mostly known already (we knew they had it, just not that it was applied in this way), it's getting a little tedious.
  - Zenst 9y ago
    Yes, it's like everybody is gaming the stock market options. Or finally the reality of social media is catching up with the populus all at once. I suspect the peak won't be reached until we read a court transcript with the quote "show us upon this dB schema were Facebook touched you".
starchild_3001 9y ago
My download archive has all my contacts' names & phone numbers stored. Wtf? Why do you need this information in your data servers Zuck?
- starchild_3001 9y ago
  I guess I now know how you recommend me those obscure "friends" like a recruiter from a company I didn't join, or my gardener etc. Totally uncalled for.
indigodaddy 9y ago
After this media blitz dies down, they'll likely soon just start directly sending this to the FB servers from the application, without leaving behind any localized files...

169 points by daenz 9y ago

deleted 9y ago

[deleted]

What IOS iPhone permission do grant the app that allows this? Is it "Allow Access to Contacts"? I mean, there's a difference between allowing say, an app to be able to lookup and dial a phone entry, and an app getting call logs They need to split that permission if it is combined with other stuff.

domevent 9y ago
remember one thing though: the phone OS (Android or, less likely, iOS) developers are as much at fault as FB on this one. From that and other comments it seems like this story may not apply to iOS?
- hellofunk 9y ago
  I've had the FB app on my iPhone for years and I just checked the FB zip file download of user data, and my contact info html file is empty.
eridius 9y ago
None. It’s impossible for an app to get this info on iOS, at least, not without jailbreaking the device first. This story must be about Android.
0x0 9y ago
Apps written by "mere mortals" probably can't get that information. But there's a whole API called "CoreTelephony" that's mostly gated behind an entitlement, http://iphonedevwiki.net/index.php/CoreTelephony.framework http://iphonedevwiki.net/index.php/CoreTelephony.framework I used to think Apple would never grant this entitlement to any other apps other than those that are builtin to iOS, but then there was that whole Uber framebuffer capture entitlement scandal...
- sah2ed 9y ago
  Did the scandal actually happen? The articles I found only talked of the possibility for abuse by Uber. https://www.macrumors.com/2017/10/05/uber-removing-apple-granted-api/ https://www.macrumors.com/2017/10/05/uber-removing-apple-gra...
  - 0x0 9y ago
    The big deal isn't what uber did or did not do with their magic provisioning profile. It's the fact that Apple apparently sometimes hands out god-mode provisioning profiles to 3rd party developers at all.
IBM 9y ago
Pretty sure there's no API to access call logs. I know India's government wanted to create an app on iOS that could access that, purportedly for blocking spam, but Apple said no.

eterm 9y ago

I've often seen this permission rationalised as "Well apps need to suspend when a call is incoming", but why is ability to know if there is a call the same permissions as knowing every call made and for how long? Facebook may have been "given permission" but as people are discovering, it wasn't really actually given permission. This is why there is such a notion as informed consent, because giving permission isn't always as simple as agreeing to something.

deleted 9y ago

[deleted]

alex_young 9y ago

Apparently they serve your archive up on some dialup link or something. I just noticed my archive is available (no email received though), and it's going to take an hour to download 255 MB. On a 1G fiber link. I guess this kind of complies with the GDPR. Seems like FB probably has fast internet links somewhere.

_xgw 9y ago
It took me about 15 minutes to download my 2GB archive on a 30Mbps connection which seems normal to me.
abirkill 9y ago
As a counter-example, I requested mine about 20 minutes ago, received an e-mail confirming the request, received another e-mail 6 minutes later to say it was available for download, and the ~90MB download completed in under 10 seconds on my 150Mbps connection.
austincheney 9y ago
My archive was ready faster than I could log into my webmail and the massive 12kb archive downloaded in less than a second on the hotel internet.

Shywim 9y ago

Some replies say that the user should take a second look at what permissions they give, but in the case of Android apps the permission to use the Account Manager (used to register a service account like Facebook, Google, Twitter or any other things that need to synchronize in the background) is displayed as a "Contacts" permission to the user. So some apps like Facebook might synchronize or make other uses of contacts with their service accounts, but many other service don't do anything with contacts and doesn't EVEN request the actual contacts permission but their permission request is still displayed as "Contacts". How can the user be able to do responsible choices in giving apps permissions when the permissions layer of the OS make no sense?

switch007 9y ago
I may be misremembering/totally off base, but didn't Android go through some rounds of "simplifying" or "renaming" permissions over the years to basically obfuscate and confuse? (Or have they always been terrible?)

shapiro92 9y ago

Can we start putting some blame on the developers the product managers and in general the IT team behind the facebook Android App? Not only they executed it, they have thought of it, where to store it, how to download it etc. It is not just Zuckerberg who is at fault.

alex_young 9y ago
Doesn't Zuckerberg control FB? Didn't he also control it in all of it's past? All of the teams of people you mentioned work for him. They take direction from him, and ultimately the buck stops there.
- ajross 9y ago
  The point wasn't that the buck shouldn't stop, it was that the fact that the buck passes someone isn't a defense. Lots of folks were involved in building this disaster, and they all share blame too. To Godwinize for clarity: Hitler wasn't the only war criminal in Nazi Germany.
- kosei 9y ago
  If you think Zuck has knowledge of even 1% of what his 25,000+ employees do and the code they're writing, you're dreaming. He is still ultimately accountable, but it is unreasonable to assume that he is personally directing the efforts of the teams here.
- colordrops 9y ago
  > it is not _just_ Zuckerberg who is at fault
MBCook 9y ago
How about Google? They didn’t do this on iOS because they can’t. Why the hell was this an option? Why wasn’t there a really big ‘holy hell are you sure you want to do this’ dialog box? How do normal apps even get to ask for this in the first place?

stevebmark 9y ago

edit: misread

milesokeefe 9y ago
Not sure how that relates to them tracking calls.
bcherny 9y ago
If FB (or any other app) could record your phone's mic without you knowing, that would be a GIANT security issue on Apple/Samsung/etc.'s part. As any app developer knows, you need to explicitly request permission to record, and the user sees a big red bar for the duration of the recording. Unless you're the NSA or something, you're not getting around that.

rukittenme 9y ago

I would recommend everyone download their archive. I just did. 1.8mb for me. All of it benign and boring. I honestly feel a little left out. But I did get to read a lot of conversations I forgot I had. It was fun to remember "the good old days".

torpfactory 9y ago

It should be clear to everyone now that Facebook is engaged in building a surveillance system which tracks every one of its users throughout their daily lives. Though others will disagree, this kind of behavior, especially done so without informing the user in full candor, is morally wrong. As I've advocated in other commentary on this site: Engineers at Facebook have a moral obligation either reform from the inside or quit. This kind of surveillance apparatus should not be built, by either government or private entities.

Erlangolem 9y ago
I agree. Now what about engineers at Google, especially with their drone program partnership with the DOD? How about engineers at Uber making cars that are unfit for the road?Engineers in general need to either grow a spine and a conscience fast, or they need enforced ethical standards. It’s. It just Facebook, although Facebook is particularly nasty, and there is no sign of people giving upon their cushy jobs to do the right thing. Mostly they seem happy to go public while babbling about how they’re “changing the world” as in that pitiful letter from DropBox.
- cma 9y ago
  We need more legal protections for corporate whistleblowers.
  - kyrra 9y ago
    What part of a DoD contract requires whistleblowers? Are we going to arrest all of Lockheed Martin or Northrop Grumman?
- empath75 9y ago
  I refused to even interview for Palantir when their recruiter called and have quit jobs in the past when I was asked to do something unethical. It’s not as if google or fb engineers can’t find jobs elsewhere.
- Artemis2 9y ago

dotsh 9y ago

Do we really need to go over and over with this again? https://news.ycombinator.com/item?id=16656604 https://news.ycombinator.com/item?id=16656604 https://news.ycombinator.com/item?id=16652387 https://news.ycombinator.com/item?id=16652387

lucb1e 9y ago
That, and the 10 other facebook-related posts currently on the front page. I understand it's a huge revelation that facebook tracks people and shares the data in ways and for purposes which we weren't aware of, but the news has been nothing but facebook for a week now. For something that was mostly known already (we knew they had it, just not that it was applied in this way), it's getting a little tedious.
- Zenst 9y ago
  Yes, it's like everybody is gaming the stock market options. Or finally the reality of social media is catching up with the populus all at once. I suspect the peak won't be reached until we read a court transcript with the quote "show us upon this dB schema were Facebook touched you".

starchild_3001 9y ago

My download archive has all my contacts' names & phone numbers stored. Wtf? Why do you need this information in your data servers Zuck?

starchild_3001 9y ago
I guess I now know how you recommend me those obscure "friends" like a recruiter from a company I didn't join, or my gardener etc. Totally uncalled for.

indigodaddy 9y ago

After this media blitz dies down, they'll likely soon just start directly sending this to the FB servers from the application, without leaving behind any localized files...