3 ms·

Do you know about the Amazon Silk web browser? If you log in to facebook in that browser, Amazon may download and store your friends' data on Amazon's servers.

Do you know about the Amazon Silk web browser? If you log in to facebook in that browser, Amazon may download and store your friends' data on Amazon's servers. And that's even without any agreement with facebook. I can think of a handful of Facebook-like experiences that would require an OS/device provider to store data on their servers, especially considering the constraints imposed on some devices (particularly older ones) and some OSes (particularly older ones and iOS). Let's take a concrete example. Let's say that Apple wants to support contact syncing across devices. It also wants to support contact importing through fb's device integrated api. Now, let's say that Apple actually implements that in such a way that it's encrypted end-to-end. Even in that case, Apple may have needed permission to store that data on their servers under whatever agreement the companies had and the Times could have written their story. But I feel like that case isn't that interesting. Let's consider the case where your contacts are stored unencrypted on Apple's servers, but only for 3 hours while actually syncing to a new device (kind of a silly approach to the contact syncing case, but is likely more reasonable for other things). There may be a reasonable argument against that, but I think that most people wouldn't agree with it. Also, that argument would apply much more strongly to Android's contacts permissions (which don't require any sort of contract around how developers use/store that data).

snowwrestler 8y ago
I run websites that get traffic from Amazon Silk browsers. I've never signed a data sharing agreement with Amazon. There's more going on in this story than a simple browsing proxy.
- cjhopman 8y ago
  > I run websites that get traffic from Amazon Silk browsers. I've never signed a data sharing agreement with Amazon. Of course not. Because the fact that a user agent like this has widespread access to the data that the user has access to is expected. The OS itself also has at least that same level of access (as it has control over the behavior of the user agent). We just all seem to assume that we can trust those entities to not misuse the data (in some cases the particular software we run may have privacy policies that cover how they use that data that we necessarily give them access to). > There's more going on in this story than a simple browsing proxy. There's nothing in the report that indicates that. In fact, most "simple browsing prox[ies]" have no data sharing agreement limiting how they use the information from your browsing, in the cases in this story they were all limited to "signed agreements that prevented people’s Facebook information from being used for any other purpose than to recreate Facebook-like experiences." and even further "our partnership and engineering teams approved the Facebook experiences these companies built". In addition, it sounds like in most of these instances, no data was even accessed or stored off the device (i.e. they had much less access than a proxy).
  - snowwrestler 8y ago
    > We just all seem to assume that we can trust those entities to not misuse the data I don't need to trust that entities will not misuse my data; I have legal documents on my websites that set out how entities may use the data that they download from my sites. The terms apply to my users and to any intermediary technology providers. For the Silk browser, I don't need a data sharing agreement with Amazon because my terms say that service providers like Amazon may not copy and store data from my website for their own purposes. Amazon Silk can access my site only for the purpose of helping the end user visit my site. I expressly exclude data sharing from my relationship with service providers and users. This is a standard part of website terms and conditions; here's an example from Facebook's terms of service: > You may not access or collect data from our Products using automated means (without our prior permission) or attempt to access data you do not have permission to access. And from their platform policy: > Data Collection and Use: If you are a Tech Provider for an entity, comply with the following: > a. Only use an entity's data on behalf of the entity (i.e., only to provide services to that entity and not for your own business purposes or another entity's purposes). Data sharing agreements are only necessary when another entity (i.e. Amazon the company) wants to store and use data separate from, and in addition to, the service they provide to end users. The existence of a "data sharing agreement" is proof that device manufacturers were collecting and storing user data, not just facilitating user access to Facebook. That's what "data sharing agreement" means. Further proof is that Facebook explicitly said that some companies collected and stored FB user data.

snowwrestler 8y ago

I run websites that get traffic from Amazon Silk browsers. I've never signed a data sharing agreement with Amazon. There's more going on in this story than a simple browsing proxy.

cjhopman 8y ago
> I run websites that get traffic from Amazon Silk browsers. I've never signed a data sharing agreement with Amazon. Of course not. Because the fact that a user agent like this has widespread access to the data that the user has access to is expected. The OS itself also has at least that same level of access (as it has control over the behavior of the user agent). We just all seem to assume that we can trust those entities to not misuse the data (in some cases the particular software we run may have privacy policies that cover how they use that data that we necessarily give them access to). > There's more going on in this story than a simple browsing proxy. There's nothing in the report that indicates that. In fact, most "simple browsing prox[ies]" have no data sharing agreement limiting how they use the information from your browsing, in the cases in this story they were all limited to "signed agreements that prevented people’s Facebook information from being used for any other purpose than to recreate Facebook-like experiences." and even further "our partnership and engineering teams approved the Facebook experiences these companies built". In addition, it sounds like in most of these instances, no data was even accessed or stored off the device (i.e. they had much less access than a proxy).
- snowwrestler 8y ago
  > We just all seem to assume that we can trust those entities to not misuse the data I don't need to trust that entities will not misuse my data; I have legal documents on my websites that set out how entities may use the data that they download from my sites. The terms apply to my users and to any intermediary technology providers. For the Silk browser, I don't need a data sharing agreement with Amazon because my terms say that service providers like Amazon may not copy and store data from my website for their own purposes. Amazon Silk can access my site only for the purpose of helping the end user visit my site. I expressly exclude data sharing from my relationship with service providers and users. This is a standard part of website terms and conditions; here's an example from Facebook's terms of service: > You may not access or collect data from our Products using automated means (without our prior permission) or attempt to access data you do not have permission to access. And from their platform policy: > Data Collection and Use: If you are a Tech Provider for an entity, comply with the following: > a. Only use an entity's data on behalf of the entity (i.e., only to provide services to that entity and not for your own business purposes or another entity's purposes). Data sharing agreements are only necessary when another entity (i.e. Amazon the company) wants to store and use data separate from, and in addition to, the service they provide to end users. The existence of a "data sharing agreement" is proof that device manufacturers were collecting and storing user data, not just facilitating user access to Facebook. That's what "data sharing agreement" means. Further proof is that Facebook explicitly said that some companies collected and stored FB user data.