13 ms·

Why is it surprising or even remotely controversial that an app that people explicitly authorized to access their messages (informed consent) then proceeded to

Why is it surprising or even remotely controversial that an app that people explicitly authorized to access their messages (informed consent) then proceeded to access their messages? The app didn't have access to friends' messages, so I don't see what the issue is here, other than yet another clickbait headline.

monochromatic 9y ago
Why is it even possible for an app to request your Facebook messages though?
- CGamesPlay 9y ago
  You used to be able to build an alternative client using Facebook's published API.
- joe5150 9y ago
  I didn't think it was. The API docs have always said that the thread endpoint is only available to the developers of the app making the request. It's possible to get the contents of the inbox though. https://developers.facebook.com/docs/graph-api/reference/v2.12/thread https://developers.facebook.com/docs/graph-api/reference/v2....
- dec0dedab0de 9y ago
  I could imagine interesting apps designed to riff on your launguage patterns
- paxys 9y ago
  There are a lot of valid uses. Why would it be better for your data to be locked up and unexportable?
  - JetSpiegel 9y ago
    False equivalence. Exportable doesn't mean acessible to the world.
    - gtremper 9y ago
      But someone could pay you for your exported Facebook data (which can include data from friends such as your message history, etc). From my understanding, this is essentially what CA did. CA just obfuscated they were doing this by using the Facebook developer program to automate this process and Mechanical Turk to pay users to give them their data. I agree the Facebook developer program made it really easy to phish for this data.
    - dsacco 9y ago
      The commenter didn’t make that “false equivalence.” Their point is that there are valid reasons a user might want to allow an application to access their messages. For example, reddit’s API allows applications to access messages, which is useful for third party clients.
- downandout 9y ago
  It isn't...today. Remember, this app was deployed many years ago, prior to the 2014 API neutering.
- aianus 9y ago
  I trained my predictive keyboard on Android on my Facebook messages and emails.
sethbannon 9y ago
If a friend of yours authorized access to their messages, then the app would have access to your private messages with that friend.
- downandout 9y ago
  Only in the same way that apps that you authorize to work through Gmail also have access to your emails with other people. I just don’t see an issue here. The messages permission required explicit, separate consent from other permissions. There is not a single user that could argue that they didn’t understand that specific aspect of this app. This story is just a grab at clicks.
  - tzakrajs 9y ago
    If we have a private conversation, you shouldn't have the right to reproduce the contents of my contributions to the conversation.
    - downandout 9y ago
      Then you better go protest at Google's offices, because Gmail allows apps to interact with your email too.
      - propogandist 9y ago
        by using Gmail, you are allowing Google to scrape what might otherwise be private messages
        tzakrajs 9y ago
        Indeed, and I am going to stop using Gmail as a result of this thread.
        propogandist 9y ago
        not sure if you're being sarcastic, but you really should. Everyone should. It will cost about $5/mo [fastmail] to make it happen, unfortunately most people don't seem to assign much value to privacy.
tzakrajs 9y ago
By granting access to your messages, they are also implicitly gaining access to your friend's messages with you. All people should have an expectation of privacy that when they send a private message to someone, that someone does not have the right to disclose the conversation.
- forgotmysn 9y ago
  It's been years since anyone should have had that expectation.
  - ramy_d 9y ago
    That doesn't make it ok
- downandout 9y ago
  So you would also like to impose a ban on email forwarding then right? Because that means the person who received your message took it, and exposed it to others that you didn't authorize. I can tell you that at least in the US, legally, your position doesn't hold water. We're getting a little ridiculous here. There are valid complaints against Facebook in all of this - this just doesn't happen to be one of them.
  - Alex3917 9y ago
    > So you would also like to impose a ban on email forwarding then right? The difference is that email forwarding is part of the RFCs and IETF standards that define email, e.g.: https://www.ietf.org/rfc/rfc5322.txt https://www.ietf.org/rfc/rfc5322.txt https://tools.ietf.org/html/rfc5598 https://tools.ietf.org/html/rfc5598 http://arc-spec.org/ http://arc-spec.org/
    - downandout 9y ago
      What do RFC's have to do with his comment that he has an expectation of privacy when he sends people messages? Regardless, at least under US law, he's way off base.
mtgx 9y ago
But was it? "Informed" consent, that is? I think the new CONSENT Act, by one of the authors of the child-privacy law COPPA, looks quite promising to make these things much clearer for users. https://arstechnica.com/tech-policy/2018/04/facebook-would-need-your-consent-before-sharing-your-data-under-proposed-law/ https://arstechnica.com/tech-policy/2018/04/facebook-would-n... I watched the hearing and Zuckerberg kept evading questions about users "controlling data" responding with nonsense such as "Of course users control the data - they decide what to post on Facebook!" Completely omitting the issue about what happens to their data once third-party developers have access to it, even in the context of sharing something with friends (and not "the public"), or in this case private messages. And I agree with others here. Private messages should have never even been as part of a permission. I think now I understand why Facebook recently said that they see Messenger chat as "public". I thought it was just more of a metaphor, but they seem to be thinking of that quite literally. Your private messages on FB are no different than your public profile data to both Facebook and third-party developers. Oh and by the way, Facebook also recently admitted that most of its 2 billion users' profile data, including email and phone numbers, have been scraped off the website.
atwebb 9y ago
For people I've discussed with, the surprising part is that they can do anything with it. You and I know that (currently) if someone has the data, they'll scrape/manipulate it at will. I believe, a reasonable person, would expect the limits of the access grant to end with the purpose of the app (a quiz) and not extend any further. Most contracts/agreements have limits and this one is implicit in the working of the app. It is in no way clear that the app is earning it's money by selling/manipulating the data you're giving access to. Additionally, it's disingenuous to ignore that a subversive app will make up/add features in no way benefiting the end user but for the sole purpose of scraping messages. Intent is important, for some of these apps it is clear the only intent was to harvest data en masse. Yes the user agreed to grant some permissions so a quiz could be taken. It cannot and should not be ignored that the app developer purposefully did not disclose the true nature of the app. This wasn't an accident. They didn't trip and fall into the data. They made something appear benign when it was really cancerous.
- downandout 9y ago
  >Yes the user agreed to grant some permissions so a quiz could be taken. You had to authorize the messages permission separately from all other permissions. If you didn't want your messages accessed, you simply declined that permission. This one's on the user, not on anybody else.
  - jfrankamp 9y ago
    You're ignoring the 'reasonable person' argument which is important and forms a significant part of the legal system re: understanding contracts that you are signing. The reaction by the public and HN as a whole is perfectly justified. The permissions dialog is less interesting than the title of the app which wasn't "App to steal and repackage and sell your data you idiots!". In net, the app didn't tell the truth about itself, aided and abetted by Facebook's idiocy.
    - downandout 9y ago
      The permissions dialog is less interesting than the title of the app which wasn't "App to steal and repackage and sell your data you idiots!". The Obama For America app stole data from about 4x the number of profiles that this app did - about 200 million people, less than 1 million of whom gave them any form of consent, much less informed consent, as was given here with the messages permission. Do you have an issue with that app’s title?
downer63 9y ago
Because it takes a real piece of shit to ask a total retard: "Hey, buddy, can I stab you in the back?" ...and then blame the retard for bleeding out. As if a total fucking retard would ever say no.
- sctb 9y ago
  If you keep posting like this we'll ban the account. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
deleted 9y ago
[deleted]
RobLach 9y ago
Context and intent matter. If someone at a gas station asks me "hey could you give me $5 so I can buy some gas. I'm out of cash." and I give them the money. Then they proceed to fill up a can and go burn down a house. Should I be arrested as an accomplice? There was no indication that they would do that and if I knew there's no chance I would agree to give them anything. You'd have to find additional evidence that I consented to that action. In this case, I really doubt anyone knew that their data would be used in this way when all they wanted to do is take a quiz.
JoshMnem 9y ago
When it comes to permissions and electronic privacy, consumers don't understand how things work, so they aren't really giving consent. And many aspects of the modern Internet are designed to trick them.
- rando444 9y ago
  I think it's worth emphasizing how much people are being tricked. Users are only being asked for permission to their "messages", are given no further information, and can not proceed if they do not submit to the request. If you're a good hearted person, you assume that an app needs to use your messages for one specific purpose, much like some apps ask permission to your text messages just so they can automatically validate incoming sms code requests. Anyway.. So permission to access your messages could mean "we just need to do one thing" or it could mean "we're going to siphon up all of your private data" The generically worded option preys on the user to be trusting enough to give the other party the benefit of the doubt, which is not how the system should be handled and really is the entire focus of the GDPR being passed in Europe right now to prevent specifically this sort of thing from happening. Waving 'user consent' around as a reason to do nothing is the wrong approach.
- closeparen 9y ago
  Therefore we must regulate the internet to the tastes of the most paranoid person in existence, because anyone less paranoid is clearly incompetent to give consent?
Lionsion 9y ago
> Why is it surprising or even remotely controversial that an app that people explicitly authorized to access their messages (informed consent) then proceeded to access their messages? The app didn't have access to friends' messages, so I don't see what the issue is here, other than yet another clickbait headline. I'm not sure if we have enough details to say if this was informed consent or not. But I doubt it was informed consent if the messages were gathered by the Facebook app. Back when I had that app installed, Android did not support granular privacy. One day I got an update notification that said a new update would get the permission to read text messages. I believe the rational was so the app could automatically parse a text message confirmation code. Since I'm savvy, I never installed that update or any other update it ever again. Now it turns out Facebook used that permission to slurp up people's text messages into it profile of them. This wasn't informed consent: I wasn't honestly told what they would use the permission for, the request wasn't clear (just the standard android notice), and it was an all or nothing ask.
tjoff 9y ago
Because in the public if you mentioned the possibility you'd be accused of fearmongering. It is disheartening to see people label it clickbait, this is a very important message that needs to be embedded in the public.

monochromatic 9y ago

Why is it even possible for an app to request your Facebook messages though?

CGamesPlay 9y ago
You used to be able to build an alternative client using Facebook's published API.
joe5150 9y ago
I didn't think it was. The API docs have always said that the thread endpoint is only available to the developers of the app making the request. It's possible to get the contents of the inbox though. https://developers.facebook.com/docs/graph-api/reference/v2.12/thread https://developers.facebook.com/docs/graph-api/reference/v2....
dec0dedab0de 9y ago
I could imagine interesting apps designed to riff on your launguage patterns
paxys 9y ago
There are a lot of valid uses. Why would it be better for your data to be locked up and unexportable?
- JetSpiegel 9y ago
  False equivalence. Exportable doesn't mean acessible to the world.
  - gtremper 9y ago
    But someone could pay you for your exported Facebook data (which can include data from friends such as your message history, etc). From my understanding, this is essentially what CA did. CA just obfuscated they were doing this by using the Facebook developer program to automate this process and Mechanical Turk to pay users to give them their data. I agree the Facebook developer program made it really easy to phish for this data.
  - dsacco 9y ago
    The commenter didn’t make that “false equivalence.” Their point is that there are valid reasons a user might want to allow an application to access their messages. For example, reddit’s API allows applications to access messages, which is useful for third party clients.
downandout 9y ago
It isn't...today. Remember, this app was deployed many years ago, prior to the 2014 API neutering.
aianus 9y ago
I trained my predictive keyboard on Android on my Facebook messages and emails.

sethbannon 9y ago

If a friend of yours authorized access to their messages, then the app would have access to your private messages with that friend.

downandout 9y ago
Only in the same way that apps that you authorize to work through Gmail also have access to your emails with other people. I just don’t see an issue here. The messages permission required explicit, separate consent from other permissions. There is not a single user that could argue that they didn’t understand that specific aspect of this app. This story is just a grab at clicks.
- tzakrajs 9y ago
  If we have a private conversation, you shouldn't have the right to reproduce the contents of my contributions to the conversation.
  - downandout 9y ago
    Then you better go protest at Google's offices, because Gmail allows apps to interact with your email too.
    - propogandist 9y ago
      by using Gmail, you are allowing Google to scrape what might otherwise be private messages
      - tzakrajs 9y ago
        Indeed, and I am going to stop using Gmail as a result of this thread.
        propogandist 9y ago
        not sure if you're being sarcastic, but you really should. Everyone should. It will cost about $5/mo [fastmail] to make it happen, unfortunately most people don't seem to assign much value to privacy.

tzakrajs 9y ago

By granting access to your messages, they are also implicitly gaining access to your friend's messages with you. All people should have an expectation of privacy that when they send a private message to someone, that someone does not have the right to disclose the conversation.

forgotmysn 9y ago
It's been years since anyone should have had that expectation.
- ramy_d 9y ago
  That doesn't make it ok
downandout 9y ago
So you would also like to impose a ban on email forwarding then right? Because that means the person who received your message took it, and exposed it to others that you didn't authorize. I can tell you that at least in the US, legally, your position doesn't hold water. We're getting a little ridiculous here. There are valid complaints against Facebook in all of this - this just doesn't happen to be one of them.
- Alex3917 9y ago
  > So you would also like to impose a ban on email forwarding then right? The difference is that email forwarding is part of the RFCs and IETF standards that define email, e.g.: https://www.ietf.org/rfc/rfc5322.txt https://www.ietf.org/rfc/rfc5322.txt https://tools.ietf.org/html/rfc5598 https://tools.ietf.org/html/rfc5598 http://arc-spec.org/ http://arc-spec.org/
  - downandout 9y ago
    What do RFC's have to do with his comment that he has an expectation of privacy when he sends people messages? Regardless, at least under US law, he's way off base.

mtgx 9y ago

But was it? "Informed" consent, that is? I think the new CONSENT Act, by one of the authors of the child-privacy law COPPA, looks quite promising to make these things much clearer for users. https://arstechnica.com/tech-policy/2018/04/facebook-would-need-your-consent-before-sharing-your-data-under-proposed-law/ https://arstechnica.com/tech-policy/2018/04/facebook-would-n... I watched the hearing and Zuckerberg kept evading questions about users "controlling data" responding with nonsense such as "Of course users control the data - they decide what to post on Facebook!" Completely omitting the issue about what happens to their data once third-party developers have access to it, even in the context of sharing something with friends (and not "the public"), or in this case private messages. And I agree with others here. Private messages should have never even been as part of a permission. I think now I understand why Facebook recently said that they see Messenger chat as "public". I thought it was just more of a metaphor, but they seem to be thinking of that quite literally. Your private messages on FB are no different than your public profile data to both Facebook and third-party developers. Oh and by the way, Facebook also recently admitted that most of its 2 billion users' profile data, including email and phone numbers, have been scraped off the website.

atwebb 9y ago

For people I've discussed with, the surprising part is that they can do anything with it. You and I know that (currently) if someone has the data, they'll scrape/manipulate it at will. I believe, a reasonable person, would expect the limits of the access grant to end with the purpose of the app (a quiz) and not extend any further. Most contracts/agreements have limits and this one is implicit in the working of the app. It is in no way clear that the app is earning it's money by selling/manipulating the data you're giving access to. Additionally, it's disingenuous to ignore that a subversive app will make up/add features in no way benefiting the end user but for the sole purpose of scraping messages. Intent is important, for some of these apps it is clear the only intent was to harvest data en masse. Yes the user agreed to grant some permissions so a quiz could be taken. It cannot and should not be ignored that the app developer purposefully did not disclose the true nature of the app. This wasn't an accident. They didn't trip and fall into the data. They made something appear benign when it was really cancerous.

downandout 9y ago
>Yes the user agreed to grant some permissions so a quiz could be taken. You had to authorize the messages permission separately from all other permissions. If you didn't want your messages accessed, you simply declined that permission. This one's on the user, not on anybody else.
- jfrankamp 9y ago
  You're ignoring the 'reasonable person' argument which is important and forms a significant part of the legal system re: understanding contracts that you are signing. The reaction by the public and HN as a whole is perfectly justified. The permissions dialog is less interesting than the title of the app which wasn't "App to steal and repackage and sell your data you idiots!". In net, the app didn't tell the truth about itself, aided and abetted by Facebook's idiocy.
  - downandout 9y ago
    The permissions dialog is less interesting than the title of the app which wasn't "App to steal and repackage and sell your data you idiots!". The Obama For America app stole data from about 4x the number of profiles that this app did - about 200 million people, less than 1 million of whom gave them any form of consent, much less informed consent, as was given here with the messages permission. Do you have an issue with that app’s title?

downer63 9y ago

Because it takes a real piece of shit to ask a total retard: "Hey, buddy, can I stab you in the back?" ...and then blame the retard for bleeding out. As if a total fucking retard would ever say no.

sctb 9y ago
If you keep posting like this we'll ban the account. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

deleted 9y ago

[deleted]

RobLach 9y ago

Context and intent matter. If someone at a gas station asks me "hey could you give me $5 so I can buy some gas. I'm out of cash." and I give them the money. Then they proceed to fill up a can and go burn down a house. Should I be arrested as an accomplice? There was no indication that they would do that and if I knew there's no chance I would agree to give them anything. You'd have to find additional evidence that I consented to that action. In this case, I really doubt anyone knew that their data would be used in this way when all they wanted to do is take a quiz.

JoshMnem 9y ago

When it comes to permissions and electronic privacy, consumers don't understand how things work, so they aren't really giving consent. And many aspects of the modern Internet are designed to trick them.

rando444 9y ago
I think it's worth emphasizing how much people are being tricked. Users are only being asked for permission to their "messages", are given no further information, and can not proceed if they do not submit to the request. If you're a good hearted person, you assume that an app needs to use your messages for one specific purpose, much like some apps ask permission to your text messages just so they can automatically validate incoming sms code requests. Anyway.. So permission to access your messages could mean "we just need to do one thing" or it could mean "we're going to siphon up all of your private data" The generically worded option preys on the user to be trusting enough to give the other party the benefit of the doubt, which is not how the system should be handled and really is the entire focus of the GDPR being passed in Europe right now to prevent specifically this sort of thing from happening. Waving 'user consent' around as a reason to do nothing is the wrong approach.
closeparen 9y ago
Therefore we must regulate the internet to the tastes of the most paranoid person in existence, because anyone less paranoid is clearly incompetent to give consent?

Lionsion 9y ago

> Why is it surprising or even remotely controversial that an app that people explicitly authorized to access their messages (informed consent) then proceeded to access their messages? The app didn't have access to friends' messages, so I don't see what the issue is here, other than yet another clickbait headline. I'm not sure if we have enough details to say if this was informed consent or not. But I doubt it was informed consent if the messages were gathered by the Facebook app. Back when I had that app installed, Android did not support granular privacy. One day I got an update notification that said a new update would get the permission to read text messages. I believe the rational was so the app could automatically parse a text message confirmation code. Since I'm savvy, I never installed that update or any other update it ever again. Now it turns out Facebook used that permission to slurp up people's text messages into it profile of them. This wasn't informed consent: I wasn't honestly told what they would use the permission for, the request wasn't clear (just the standard android notice), and it was an all or nothing ask.

tjoff 9y ago

Because in the public if you mentioned the possibility you'd be accused of fearmongering. It is disheartening to see people label it clickbait, this is a very important message that needs to be embedded in the public.