8 ms·

The linked article https://freedom-to-tinker.com/2018/04/18/no-boundaries-for-facebook-data-third-party-trackers-abuse-facebook-login/ https://freedom-to-tinker

by btown 9y ago

The linked article https://freedom-to-tinker.com/2018/04/18/no-boundaries-for-facebook-data-third-party-trackers-abuse-facebook-login/ https://freedom-to-tinker.com/2018/04/18/no-boundaries-for-f... provides much more detail and links to source code, such as https://gist.github.com/englehardt/db3ecea255ccd6aa2b0cb73ca76257d6#file-be-init-js-L1229 https://gist.github.com/englehardt/db3ecea255ccd6aa2b0cb73ca... It's important to recognize that this is not an exploit or high-tech exfiltration: it's extremely well-documented in https://developers.facebook.com/docs/reference/javascript/FB.getLoginStatus https://developers.facebook.com/docs/reference/javascript/FB... and https://developers.facebook.com/docs/javascript/reference/FB.api https://developers.facebook.com/docs/javascript/reference/FB... - the Facebook library even assumes that potentially multiple scripts may be checking repeatedly, and caches accordingly. Facebook is incentivized to make it as easy as possible to integrate their login across the internet, and that entails removing any requirements such as server-side processing that would discourage every tag from including this code. Seeing this and being surprised is like watching a teen movie where the gossiper invites the entire school to listen in on the phone line while the protagonist is (unwisely) sharing a secret with them, and thinking as you watch, "that's totally out of character for the gossiper - even though they want to collect people's information themselves, there's no way they would invite other people to listen in as they're in the process of receiving that information."

Semirhage 9y ago
Seeing this and being surprised is like watching a teen movie where the gossiper invites the entire school to listen in on the phone line while the protagonist is (unwisely) sharing a secret with them, and thinking as you watch, "that's totally out of character for the gossiper - even though they want to collect people's information themselves, there's no way they would invite other people to listen in as they're in the process of receiving that information." Doesn’t that depend on who’s surprised? My parents would be shocked by this, people working in the software industry should be less shocked. I bet that a poll of 100 randomly selected people asking, “What does documentation mean in the context of software?” would discover that few knew the answer. Never mind actually reading the docs, or understanding their implications. Facebook goes to some trouble to ensure that only a small minority of people grasp the implications of how they’re monetizing their users.
JumpCrisscross 9y ago
> It's important to recognize that this is not an exploit or high-tech exfiltration: it's extremely well-documented This argument was used last time [1]. It didn't work then and it's a silly excuse now. Users gave Facebook their "name, email address, age range, gender, locale, and profile photo" [2]. Some of them marked those data private (i.e. only for friends). Those data were shared, without the users' informed consent, with third parties through the log-in function. Documenting a breach doesn't unmake it a breach. And a breach can be a breach without involving any technical exploits. This was a breach. > Seeing this and being surprised is like watching a teen movie where the gossiper... People didn't realize Facebook was selling their secrets. That may strike you as naïve. But it's this asymmetry, between specialists (e.g. Facebook employees and technologists at large) and non-specialists (i.e. most of Facebook's users), that drives the need for regulation. An analogy can be found in lemon laws [3]. We protect consumers from specialists (e.g. car salespersons) taking advantage of the customers' reasonable ignorance of cars. Facebook is selling the world lemons and mocking them for buying. [1] https://www.cbsnews.com/news/facebook-cambridge-analytica-was-it-a-data-breach https://www.cbsnews.com/news/facebook-cambridge-analytica-wa... [2] https://techcrunch.com/2018/04/18/login-with-facebook-data-hijacked-by-javascript-trackers/ https://techcrunch.com/2018/04/18/login-with-facebook-data-h... [3] https://en.wikipedia.org/wiki/Lemon_law https://en.wikipedia.org/wiki/Lemon_law
- 734786710934 9y ago
  > People didn't realize Facebook was selling their secrets. Facebook doesn't sell data, it sells ads.
  - JumpCrisscross 9y ago
    > Facebook doesn't sell data, it sells ads That sounds like selling data but with extra steps.
    - AznHisoka 9y ago
      They basically provide the data for free so you can buy more ads.
anonymouz 9y ago
So... a user using the "Login with Facebook" functionality on some website is supposed to have read the developer docs of Facebook, to be aware that some of his Facebook profile data will end up being shared with some random third-party tracker/ad-ware? The GDPR really can't come to soon. I hope it'll finally smite these crappy companies.
- dperfect 9y ago
  From a privacy standpoint, third-party scripts intercepting data is essentially no different from the "trusted" site explicitly sharing data with third parties. In both cases, the site using "Login with Facebook" is responsible for the data they gather/share, and that includes data gathered by any scripts they choose to embed on their site. End users might not understand the technical details, but one should assume that if you're giving company X access to your data, company X could potentially share that data with companies Y and Z. Company X's privacy policy should cover their use (and sharing) of the data in either case, and if they didn't anticipate companies Y and Z intercepting data when this is clearly documented as a possibility in Facebook's docs, then I agree - company X should be held accountable.
  - dbasedweeb 9y ago
    If you print out FB’s T&C’s, plus all of the layers of embedded links within links, it’s 87,000+ words. That is designed to be unreadable and incomprehensible, it’s an attempt to baffle. Even stupid people, illiterate people, and just plain lazy people don’t deserve to be taken advantage of. If you want to talk about what people “should” know, there’s s reasonable man statute, and it definitely doesn’t include what you’re describing.
    - dperfect 9y ago
      I agree with you on that. I'm just pointing out that the data isn't being shared with "some random third-party tracker/ad-ware" (it's either a conscious decision or a serious security mistake to include third-party scripts on your site). This particular method of "leaking data" shouldn't be treated any differently from direct, deliberate information sharing because it's not some kind of unanticipated "hack" as the story might sound.
vageli 9y ago
It's ridiculous to expect average people to have even a passing familiarity with Facebook developer documentation.
dang 9y ago
Ok, since that's the original source, we've switched the thread from https://news.ycombinator.com/item?id=16871054 https://news.ycombinator.com/item?id=16871054 to this one, which was posted earlier. Thanks!
- IBM 9y ago
  Why not just change the URL? That one had over 200 upvotes, this one will probably just fade off the front page in a few hours.
  - dang 9y ago
    This way is fairer to the original submitter, and it's a big enough story that it's unlikely to suffer in terms of rank or time on the front page.
    - cfadvan 9y ago
      I’m ok with this, the new article is unquestionably a better source.
- nashashmi 9y ago
  First time I have seen that happen. The comment posting timing has been reset unfortunately.
thisisit 9y ago
It's important to recognize that this is not an exploit or high-tech exfiltration: it's extremely well-documented in https://developers.facebook.com/docs/reference/javascript/FB.. https://developers.facebook.com/docs/reference/javascript/FB.... and https://developers.facebook.com/docs/javascript/reference/FB.. https://developers.facebook.com/docs/javascript/reference/FB.... - the Facebook library even assumes that potentially multiple scripts may be checking repeatedly, and caches accordingly. Facebook is incentivized to make it as easy as possible to integrate their login across the internet, and that entails removing any requirements such as server-side processing that would discourage every tag from including this code. Maybe I am reading this wrong but if Facebook makes an assumption which is inherently unsafe and publishes it. And then someone utilizes the unsafe assumption to siphon data, the ball is still in Facebook's court. They have to ensure that scripts cannot do this. Sure, this might make it difficult for anyone trying to develop using Facebook library. But that is still better than asking people to read T&C and ensuring data is not leaked.
fjsolwmv 9y ago
That's a bizarre analogy that doesn't add anything more than the description of Facebook you already gave. Is their a teen movie cliche I'm unaware of?

by btown 9y ago

Semirhage 9y ago

Seeing this and being surprised is like watching a teen movie where the gossiper invites the entire school to listen in on the phone line while the protagonist is (unwisely) sharing a secret with them, and thinking as you watch, "that's totally out of character for the gossiper - even though they want to collect people's information themselves, there's no way they would invite other people to listen in as they're in the process of receiving that information." Doesn’t that depend on who’s surprised? My parents would be shocked by this, people working in the software industry should be less shocked. I bet that a poll of 100 randomly selected people asking, “What does documentation mean in the context of software?” would discover that few knew the answer. Never mind actually reading the docs, or understanding their implications. Facebook goes to some trouble to ensure that only a small minority of people grasp the implications of how they’re monetizing their users.

JumpCrisscross 9y ago

> It's important to recognize that this is not an exploit or high-tech exfiltration: it's extremely well-documented This argument was used last time [1]. It didn't work then and it's a silly excuse now. Users gave Facebook their "name, email address, age range, gender, locale, and profile photo" [2]. Some of them marked those data private (i.e. only for friends). Those data were shared, without the users' informed consent, with third parties through the log-in function. Documenting a breach doesn't unmake it a breach. And a breach can be a breach without involving any technical exploits. This was a breach. > Seeing this and being surprised is like watching a teen movie where the gossiper... People didn't realize Facebook was selling their secrets. That may strike you as naïve. But it's this asymmetry, between specialists (e.g. Facebook employees and technologists at large) and non-specialists (i.e. most of Facebook's users), that drives the need for regulation. An analogy can be found in lemon laws [3]. We protect consumers from specialists (e.g. car salespersons) taking advantage of the customers' reasonable ignorance of cars. Facebook is selling the world lemons and mocking them for buying. [1] https://www.cbsnews.com/news/facebook-cambridge-analytica-was-it-a-data-breach https://www.cbsnews.com/news/facebook-cambridge-analytica-wa... [2] https://techcrunch.com/2018/04/18/login-with-facebook-data-hijacked-by-javascript-trackers/ https://techcrunch.com/2018/04/18/login-with-facebook-data-h... [3] https://en.wikipedia.org/wiki/Lemon_law https://en.wikipedia.org/wiki/Lemon_law

734786710934 9y ago
> People didn't realize Facebook was selling their secrets. Facebook doesn't sell data, it sells ads.
- JumpCrisscross 9y ago
  > Facebook doesn't sell data, it sells ads That sounds like selling data but with extra steps.
  - AznHisoka 9y ago
    They basically provide the data for free so you can buy more ads.

anonymouz 9y ago

So... a user using the "Login with Facebook" functionality on some website is supposed to have read the developer docs of Facebook, to be aware that some of his Facebook profile data will end up being shared with some random third-party tracker/ad-ware? The GDPR really can't come to soon. I hope it'll finally smite these crappy companies.

dperfect 9y ago
From a privacy standpoint, third-party scripts intercepting data is essentially no different from the "trusted" site explicitly sharing data with third parties. In both cases, the site using "Login with Facebook" is responsible for the data they gather/share, and that includes data gathered by any scripts they choose to embed on their site. End users might not understand the technical details, but one should assume that if you're giving company X access to your data, company X could potentially share that data with companies Y and Z. Company X's privacy policy should cover their use (and sharing) of the data in either case, and if they didn't anticipate companies Y and Z intercepting data when this is clearly documented as a possibility in Facebook's docs, then I agree - company X should be held accountable.
- dbasedweeb 9y ago
  If you print out FB’s T&C’s, plus all of the layers of embedded links within links, it’s 87,000+ words. That is designed to be unreadable and incomprehensible, it’s an attempt to baffle. Even stupid people, illiterate people, and just plain lazy people don’t deserve to be taken advantage of. If you want to talk about what people “should” know, there’s s reasonable man statute, and it definitely doesn’t include what you’re describing.
  - dperfect 9y ago
    I agree with you on that. I'm just pointing out that the data isn't being shared with "some random third-party tracker/ad-ware" (it's either a conscious decision or a serious security mistake to include third-party scripts on your site). This particular method of "leaking data" shouldn't be treated any differently from direct, deliberate information sharing because it's not some kind of unanticipated "hack" as the story might sound.

vageli 9y ago

It's ridiculous to expect average people to have even a passing familiarity with Facebook developer documentation.

dang 9y ago

Ok, since that's the original source, we've switched the thread from https://news.ycombinator.com/item?id=16871054 https://news.ycombinator.com/item?id=16871054 to this one, which was posted earlier. Thanks!

IBM 9y ago
Why not just change the URL? That one had over 200 upvotes, this one will probably just fade off the front page in a few hours.
- dang 9y ago
  This way is fairer to the original submitter, and it's a big enough story that it's unlikely to suffer in terms of rank or time on the front page.
  - cfadvan 9y ago
    I’m ok with this, the new article is unquestionably a better source.
nashashmi 9y ago
First time I have seen that happen. The comment posting timing has been reset unfortunately.

thisisit 9y ago

It's important to recognize that this is not an exploit or high-tech exfiltration: it's extremely well-documented in https://developers.facebook.com/docs/reference/javascript/FB.. https://developers.facebook.com/docs/reference/javascript/FB.... and https://developers.facebook.com/docs/javascript/reference/FB.. https://developers.facebook.com/docs/javascript/reference/FB.... - the Facebook library even assumes that potentially multiple scripts may be checking repeatedly, and caches accordingly. Facebook is incentivized to make it as easy as possible to integrate their login across the internet, and that entails removing any requirements such as server-side processing that would discourage every tag from including this code. Maybe I am reading this wrong but if Facebook makes an assumption which is inherently unsafe and publishes it. And then someone utilizes the unsafe assumption to siphon data, the ball is still in Facebook's court. They have to ensure that scripts cannot do this. Sure, this might make it difficult for anyone trying to develop using Facebook library. But that is still better than asking people to read T&C and ensuring data is not leaked.

fjsolwmv 9y ago

That's a bizarre analogy that doesn't add anything more than the description of Facebook you already gave. Is their a teen movie cliche I'm unaware of?