11 ms·
Facebook Data Collected by Quiz App Included Private Messages
- deleted 9y ago[deleted]
- gressquel 9y agoyet Zuckerberg is testifying as I write, denying, dodging the responsibility and questions. I can't believe it, instead of laying down and confessing, he is trying to justify and blame everyone but Facebook.
- innagadadavida 9y agoHe has paid his dues to congress. What else do you expect?
- nsx147 9y agoHe accepted blame for quite a bit, and apologized (as he usually does) The part I don't understand about all of this is that, yes somewhere along the line someone made the decision that giving developers access to that data was ok...but they REMOVED access to it as soon as they realized what sharing that data meant. That's how startups are trained to behave, shoot first ask questions later. They made a mistake and corrected on their own, what more is there to ask? I guess it's more of an issue because of the nature of their business?
- pjc50 9y ago> they REMOVED access to it as soon as they realized what sharing that data meant. Did that unleak the data? No. It was a mistake, but it required a cleanup which wasn't achieved and wasn't made public. Ed Felten coined the phrase "Exxon Valdez of privacy" over a decade ago in anticipation of this: https://freedom-to-tinker.com/2006/06/12/exxon-valdez-privacy/ https://freedom-to-tinker.com/2006/06/12/exxon-valdez-privac...
- ngcazz 9y agoWow, that's an amazingly prescient post.
- pjc50 9y agoI'd suggest that people popularize the phrase "Exxon Valdez of Privacy" but that may be old enough that people have forgotten it. Maybe substitute "Deepwater Horizon" or "Fukushima". If you want even more prescient, go back fifteen years to see him post a link to https://www.wired.com/2003/01/google-10/ https://www.wired.com/2003/01/google-10/ "The company's growth spurt has spawned a host of daunting questions that no data-retrieval system can easily answer. Should Google play ball with repressive foreign governments? Refuse to link users to "hate" sites? Punish marketers who artificially inflate site rankings? Fight the Church of Scientology's attempts to silence critics? And what to do about the cache, Google's archive of previously indexed pages? " Whenever a colossal disaster happens, there is nearly always someone who was telling anyone who would listen what the problem was years in advance. Felten is not as famous as Schneier but just as important, and has been doing lots of important work such as fighting against electronic voting systems.
- drewmol 9y ago>what more is there to ask? (1) Make an ernest attempt to use ML, algorithms to identify their customers who are using those leaked datasets Facebook negligently exposed and help devalue the data, instead of eagerly selling them targeted advertising services? I don't know if they did this, but it sure seems doubtful. (2) Quickly and openly disclose the extent of the leaked data (3) Stop using manipulative and deliberately opaque TOS to enable ever more data collection I'm not being sarcastic or insincere, this is my honest opinion of that they could have done. I am continually surprised at how many people making $$$ in ad-tech/PII data mining and brokering seem niave to the fact that this type of behavior would inevitably result in exponential growth of user outrage
- hunt 9y ago> (1) Make an ernest attempt to use ML, algorithms to identify their customers who are using those leaked datasets Facebook negligently exposed and help devalue the data, instead of eagerly selling them targeted advertising services? I don't know if they did this, but it sure seems doubtful. How could they do that? The cat is out of the bag and FB aren't going to have any knowledge about where that data is now. Have there been reports of it getting out from CA? > (2) Quickly and openly disclose the extent of the leaked data I think some caution is a good idea, they don't want to get the numbers wrong - although they are making steps in the right direction with the message to 87 million on their news feeds.
- drewmol 9y agoTrue, it's not easy to do, and maybe it's not feasable to determine who is using the data. I don't know, maybe someone from Facebook will chime in on the issue, or leak some more info about company behavior. >I think some caution is a good idea, they don't want to get the numbers wrong - although they are making steps in the right direction with the message to 87 million on their news feeds. Totally agree with the second part, but ~4 years (only divulging the info when forced to during PR damage control mode) is well past being cautious. It's being cautious with the amount of damage the disclosure does to your profits, Equifax doesn't even wait that long.
- 9y ago
- pjc50 9y agoWhy would he confess? This is a post-truth post-consequences world.
- commandlinefan 9y agoI guess it depends on how you define "responsibility". On the one hand, he was the CEO, so he's responsible for everything. On the other hand, it doesn't look like any of this was deliberate - more like negligent. The question is whether or not the lack of attention to privacy crosses the line into _gross_ negligence or not.
- superioritycplx 9y agoNo committee in Congress has gotten more campaign contributions from Facebook's PAC than the one that will question CEO Mark Zuckerberg. https://twitter.com/USATODAY/status/981662712966066176 https://twitter.com/USATODAY/status/981662712966066176
- malvosenior 9y agoHow was this possible? I don't recall ever having access to private messages in the FB API. Was this ever available to developers?
- dranov 9y agoApparently, v1.0 of the Facebook Graph API could access users' private messages via the 'read_mailbox' API request [1]. This was deprecated when v2.0 launched. "Version 1.0 of the Graph API launched on April 21, 2010. It was deprecated in April 2014 and closed completely to legacy apps (ie, existing apps that used the API before April 2014) on April 30, 2015." [1] https://medium.com/tow-center/the-graph-api-key-points-in-the-facebook-and-cambridge-analytica-debacle-b69fe692d747 https://medium.com/tow-center/the-graph-api-key-points-in-th...
- b212 9y agoBut why? Why would anyone set up an API access to PRIVATE messages. That's crazy :o
- thinkingemote 9y agoA third party messaging client would need it
- liquidise 9y agoIf Adium, Pigeon, or another collective chat application needed that permission at the time to combine my facebook and AIM lists into a single application, i would have certainly understood it.
- spike021 9y agoOn one hand it's actually a fairly reasonable API. Imagine using third-party AIM clients a decade or more ago. Same kind of thing.
- ex3ndr 9y ago
- JumpCrisscross 9y ago“Private messages” as in those sent via Facebook Messenger, right? Not Secret Conversations, Facebook’s allegedly e2e messaging product [1]? [1] https://www.facebook.com/help/messenger-app/1084673321594605/ https://www.facebook.com/help/messenger-app/1084673321594605...
- airza 9y agoI don't think Facebook's e2e messenger existed at the time this took place.
- denzil_correa 9y agoYes - I don’t think “Secret Conversations” existed when the data was harvested from the Quiz App.
- blattimwind 9y agoWhen it comes to "social media" I'm not easily stumped, but I had to do a double take at that headline.
- supercarsw 9y agoLies lies lies from mouth of facebook. So sad.
- vowelless 9y agoIt's amazing that FB is up 4.5 percent.
- rootusrootus 9y agoIt makes sense. Investors perceive that based on today's hearings Facebook will continue to generate piles of cash. This is most likely correct.
- nhebb 9y agoHe's not under oath, [from what I've read] the majority of the committee members have received campaign donations from FB, and some committee members own FB stock. In other words, the market knows that this is a charade.
- joering2 9y agoWatching pretty much every hearing for last 8 years, it was shocking to me how nice, friendly and understanding they were. Other than Cruz, they all turned from daily wolves to sheep. Either it is campaign contribution or perhaps without understanding technology, most are afraid what Mark can learn about them running queries on their personal messengers. Never ever seen them so nice, including questions if he wants a break now to which crowd laughed; they treated him like he is 8 years old. Incredible! No wonder he shook his head smiling for more questions!
- ProAm 9y agoWhat's scary is that Cambridge Analytica is probably only one of hundreds, maybe thousands, of companies that had access to this type of data from Facebook. This is just the one we know about.
- gtremper 9y agoCambridge Analytica didn't pay to access this data. They got users to give it to them for free though Facebook's developer platform.
- ProAm 9y agoThanks for the correction, I thought CA paid for access to the data the test collected.
- gtremper 9y agoMy understanding is the "quiz app" was more of a phishing scheme to get users to share their Facebook data with Cambridge Analytica (including data that user had access to about their friends).
- mwarkentin 9y agoI believe they also paid users a small fee to install the quiz app via Mechanical Turk.
- gtremper 9y agoAs mwarkentin included, CA _did_ pay users via mechanical turk to install the quiz app. So they did pay the users directly for their data, but not facebook. It seems there is no way to completely stop this without facebook blocking people from exporting their own data. Since CA could just pay people to send them their exported facebook data.
- justsee 9y agoActually Cambridge Analytica licensed the data from GSR, according to their press release from earlier this week [1]. > A research company (GSR) licensed the data to us, which they legally obtained via a tool provided by Facebook. Hundreds of data firms have utilized Facebook data in a similar fashion. [1] https://ca-commercial.com/news/time-facts-not-conjecture-says-cambridge-analytica-chief https://ca-commercial.com/news/time-facts-not-conjecture-say...
- 734786710934 9y agoThe headline is misleading. The article isn't about Cambridge Analytica: "Because of an editing error, an earlier version of a headline with this article misidentified the entity that improperly harvested the personal information of up to 87 million Facebook users. The information was collected though a quiz app developed by the researcher Aleskandr Kogan, not by the consulting firm Cambridge Analytica." "It is not clear whether the direct messages were among the data eventually provided to Cambridge Analytica. In an interview on Tuesday, Mr. Kogan told The Times that the private messages were harvested from a limited number of people, likely “a couple thousand,” as part of a separate academic research project and never provided to Cambridge Analytica."
- eterm 9y agoIt's all part of the CA story: "Aleksandr Kogan, a Moldovan-born researcher from Cambridge University, admits harvesting the personal details of 30 million Facebook users via a personality app he developed. He then passed the data to Cambridge Analytica who assured him this was legal, he said. " From https://www.theguardian.com/uk-news/2018/mar/21/facebook-row-i-am-being-used-as-scapegoat-says-academic-aleksandr-kogan-cambridge-analytica https://www.theguardian.com/uk-news/2018/mar/21/facebook-row...
- paulie_a 9y agoFacebook has already updated the numbers from from 47 million to 80 something million. This is going going to go bigger than Yahoo scale: "all accounts and all data" pretty quickly
- 734786710934 9y agoThe data accessed here was from a smaller unrelated research study. The only thing it has in common with the larger CA leak is that it was done by the same researcher.
- paulie_a 9y agoThat's a pretty significant aspect. I'm sure he stole plenty more data in other unrelated studies
- hunt 9y agoThe article seems to spin it as being part of the CA study, apart from the small commentary towards the end. Has anyone seen the text of the message FB has shown to the affected 87 million and does it explicitly mention private messages?
- panarky 9y agoThe 84 million number is just for Cambridge Analytica. The real number is north of 2 billion. "Malicious actors have also abused these features to scrape public profile information by submitting phone numbers or email addresses they already have through search and account recovery." "Given the scale and sophistication of the activity we’ve seen, we believe most people on Facebook could have had their public profile scraped in this way." https://newsroom.fb.com/news/2018/04/restricting-data-access/ https://newsroom.fb.com/news/2018/04/restricting-data-access...
- remusrm 9y agowow
- simonswords82 9y agoCynical me feels that it's a hell of a coincidence Facebook is acknowledging this data leak just over a month before the GDPR legislation (and fines) drops on 25th May.
- osrec 9y agoI think you may be on to something. I've often heard guys like Goldman would be just on the right side of certain thresholds for penalties, just as new financial legislation is announced. Certainly makes me suspicious that they get fed information early and react to minimise their financial burden.
- pxeboot 9y agoThis wasn't a leak, it was a feature that existed on Facebook for several years before being removed.
- downandout 9y agoWhy is it surprising or even remotely controversial that an app that people explicitly authorized to access their messages (informed consent) then proceeded to access their messages? The app didn't have access to friends' messages, so I don't see what the issue is here, other than yet another clickbait headline.
- monochromatic 9y agoWhy is it even possible for an app to request your Facebook messages though?
- CGamesPlay 9y agoYou used to be able to build an alternative client using Facebook's published API.
- joe5150 9y agoI didn't think it was. The API docs have always said that the thread endpoint is only available to the developers of the app making the request. It's possible to get the contents of the inbox though. https://developers.facebook.com/docs/graph-api/reference/v2.12/thread https://developers.facebook.com/docs/graph-api/reference/v2....
- dec0dedab0de 9y agoI could imagine interesting apps designed to riff on your launguage patterns
- paxys 9y agoThere are a lot of valid uses. Why would it be better for your data to be locked up and unexportable?
- JetSpiegel 9y agoFalse equivalence. Exportable doesn't mean acessible to the world.
- deleted 9y ago[deleted]
- oh-kumudo 9y agoPrivate messages? There is ZERO excuse for such leak. It is either utterly incompetence or intentionally malicious. Facebook needs to be hold accountable, period.
- thirdsun 9y agoBy leak you mean people giving consent when presented with the list of permissions the app / quiz requested? I think the outrageous part is that app developers could get data of their users' friends - those are the people that never used the app or agreed to its permissions.
- alexeckermann 9y agoAround 2011+ we saw not only quiz apps but also offerings such as "See who views your profile" that would result in an OAuth authorisation. How long were those authorisations active before being revoked? How much data was exfiltrated, then and since, and to whom? If it wasn't for recent changes to authorisations being suspended after a period of time these tokens could be seemingly worth something to the right person. The root problem being, average users don't know what they're giving access to and know why its important to be critical of such access.
- lwansbrough 9y agoTitle should be: "Whoops, looks like you gave that one quiz app all your private messages too, you idiot!"
- bitrazor123 9y agoI am afraid the details and extent of breach may never come out
- diasp 9y agoThe alternative is open source and decentralised: https://diasporafoundation.org https://diasporafoundation.org
- throw2016 9y agoA neutral discussion on surveillance and adtech cannot happen here because of the makeup of the audience. It's undeniable too many people from the SV tech community are deeply vested in the business either as workers of Google, Facebook or part of the large multi billion dollar ad ecosystem. The fact is tech people made pompous claims about liberty and freedom and then sold out the moment they had personal gain. This is not their fault, the history of ethical posturing consistently plays out this way and capitalism incentives leaves little room for ethics making regulation the only workable option. The default reaction is thus to minimize accountability, blame others, apologism, hand waving or deny the issue altogether. Every discussion gets mired in the same basic first principles of freedom and privacy. If you can't behave ethically you have no basis to expect ethical behavior from others, or for an ethical society. You make the bed, you lie in it.
- deleted 9y ago[deleted]
- ivanhoe 9y agoUnfortunately for startups, I think that the only solution is to make it too expensive and complicated for the businesses to collect any unnecessary data. Like dealing with credit cards, no devs in their right mind would want to process CCs by themselves because it's such a huge risk and pain in the ass to be fully PCI compliant. We all outsource that part of the work to 3rd party processors because of the regulations. Why not do the same for the personal data, make it a very high risk for the business to process it directly and the majority will avoid dealing with anything that is not absolutely needed by their business model.
- beau 9y agoDo they mean "wall posts" or "messages"? Did Facebook ever produce an API that let any developer see private Messenger messages?