9 ms·

I don’t get some of the concerns about this. Take the Facebook app that Huawei built using their special API access to offer Facebook on their devices. Their i

by varenc 8y ago

I don’t get some of the concerns about this. Take the Facebook app that Huawei built using their special API access to offer Facebook on their devices. Their implementation was supposed to store the Facebook data locally on the phone. Of course, there’s a concern here that Huawei, a company with strong ties to the Chinese government, could still be siphoning Facebook data off the phone despite that breaking their agreement with Facebook. But if you don’t trust the device manufacturer and their operating system, what does it matter? If Facebook existed solely as a mobile web app on the phones or as a Facebook Inc produced app, you still have to trust Huawei to not be siphoning off that data. If you don’t trust Huawei, you’re at risk regardless of whoever made the software you use on their phones. (The device manufacturer FB implementations that stored data on non-FB servers are a different situation though...)

lallysingh 8y ago
The threat is going from rather hypothetical to more and more concrete. The phone is an appliance that runs software. It would require some substantial effort to get around that barrier - reducing the risk of it actually happening. Now we're seeing that it didn't require any baked-in compromise in the hardware, firmware, or Android distribution. It's available via API.
- colechristensen 8y ago
  The difference is between having a window that's easy for a thief to break and giving the thief a key to your house and asking them to sign something promising not to steal. I would like, at least, for a thief to have to put some effort into it.
  - lallysingh 8y ago
    And a lot of thieves won't break the window.
  - lukeschlather 8y ago
    This is a really bad analogy, and misleading. A better analogy is like Facebook is a bank with safe deposit boxes. I give my key to my phone, and then my phone goes and gets something from the box for me. There is no window to break. My phone can take the key and send it to the phone manufacturer who can then get into my safe deposit box whenever they want. The only way having an API makes this easier is that the manufacturer's Facebook app is more obscure than the browser, but the manufacturer's browser can just as easily steal keys, and it's no more or less illegal.
    - tripzilch 8y ago
      Except that providing an API to a third party, without controls, makes Facebook complicit. They don't get to provide such an API to a third party and then disavow themselves of any responsibility what it is used for. Whereas if the manufacturer backdoors the browser of the phone to steal or siphon data from Facebook users, Facebook's only fault is creating the unnecessary data hazard itself (which is merely irresponsible instead of illegal in the US).
      - lukeschlather 8y ago
        As I understand it the API has controls. There's no fundamental difference between the APIs we're talking about and the web interface, except the API is easier to use programmatically.
debt 8y ago
It’s pretty negligent to sell or give access to a company, someone else’s personal data with a handshake and wink that they won’t turn around and do nefarious shit with it. So while you’re right, it’s also just kinda shitty and probably illegal or at the very least unethical.
- stephengillie 8y ago
  My current employer has to maintain records on what their customers do with the product after the sale; they're a chemical supply company and it's a federal law.
  - hexane360 8y ago
    Yes, but your current employer doesn't turn around and sell that info to any medium-to-high bidder. They also have a well defined and legitimate reason to use such data.
dnomad 8y ago
Huawei does not have "strong ties to the Chinese government." There is absolutely no concrete evidence that Huawei of such a relationship. Please stop spreading propaganda.
- woah 8y ago
  Is their management in China? If so couldn’t one argue that they are under the complete control of the Chinese government ?
  - dnomad 8y ago
    Ah, I see, simply being headquartered in China is enough to make them an arm of the Chinese government. That's some powerful projection. I mean, unlike the case with Huawei, there is extensive hard evidence of American telecom companies deliberately compromising their hardware to facilitate American spying. We know that the American government routinely intercepts American telecom equipment and compromises it [1]. We know that the NSA seems to conveniently have plenty of zero-days into Cisco hardware [2]. We know that all American ISPs and all major American technology companies provide the NSA with direct feeds for all their communication [3, 4]. So, it actually would be fair to say that all American technology and communication companies are under the complete control of the US government. But the strange thing is that despite numerous investigations by multiple intelligence agencies and NGO nobody has ever found any of the millions of devices Huawei exports each year to be compromised. But the less evidence that's found the more Americans insist Huawei's technology can't be trusted. There's never any evidence provided and, remarkably, nobody even claims to have evidence that they conveniently can't disclose. There's just a series of directives and pronouncements by the government and the media that obviously Huawei is an arm of the Chinese government until everybody -- well, at least all the Americans -- believe it. The moral of this story is that (1) like the accusations against Facebook, the accusations against Huawei are without merit [5] (2) the greatest threat to people's privacy and the integrity of global communication networks is and always has been the US government and (3) the American media will never, ever speak the truth about this simple fact until they are forced to by leaks. But please, continue to freak out about Facebook and Huawei. It's clear [1] https://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden https://www.theguardian.com/books/2014/may/12/glenn-greenwal... [2] https://arstechnica.com/information-technology/2016/08/cisco-confirms-nsa-linked-zeroday-targeted-its-firewalls-for-years/ https://arstechnica.com/information-technology/2016/08/cisco... [3] https://www.nytimes.com/2015/08/16/us/politics/att-helped-nsa-spy-on-an-array-of-internet-traffic.html https://www.nytimes.com/2015/08/16/us/politics/att-helped-ns..., https://www.thedailybeast.com/why-verizon-is-happy-to-help-obama-and-the-nsa-spy-on-americans https://www.thedailybeast.com/why-verizon-is-happy-to-help-o... [4] https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program) [5] Note here that unlike the US government Facebook has never, ever been caught doing anything illegal. While one can argue they over generously share data with firms like Cambridge Analytica etc. there's nothing remotely illegal about this thanks to America's extremely weak privacy laws. The reality is there are many, many companies doing far worse than Facebook but they're not based in SV so nobody cares.
thisisit 8y ago
This is one of the strangest defenses for Facebook - everything works as expected. Cambridge Analytica downloaded data? The API worked as expected and people should have been smarter to not share data. Facebook has special APIs for phone manufacturers? The API works as expected and people shouldn't buy phones from the manufacturers they don't trust. But, here's the thing - FB shouldn't have allowed this at all. In one part, security is about making things harder for people to break-in. Currently, manufacturers can use official API to siphon off data to non-FB servers. Sure, manufacturers could run some kind of MITM attack to achieve something similar. But having an official API is a strict no.
- zethraeus 8y ago
  >> people shouldn't buy phones from the manufacturers they don't trust. You're literally hosting your life on it. You should indeed not do this.
  - Hydraulix989 8y ago
    There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them. You can't rely on capitalism to resolve the Prisoner's Dilemma here. This is why Right to Repair legislation has become necessary, for example.
    - runesoerensen 8y ago
      > There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them Apple is a pretty good actor in this regard though, and they're clearly betting a lot on markets to realize the attractiveness of that. > This is why Right to Repair legislation has become necessary, for example. I'm not sure I see how a "bad" actor (maybe like Apple) in terms of the Right to Repair is relevant in the context of trusting device manufacturers. If anything I think Apple's (somewhat self-serving albeit not completely detached from reality) argument would be, and has been e.g. https://news.ycombinator.com/item?id=11047359 https://news.ycombinator.com/item?id=11047359, that their control of device repairs and servicing decreases the risk of malicious software or hardware components being installed.
IncRnd 8y ago
This isn't about apps putting buttons on devices or people trusting device manufacturers. FB has lied about how and when data gets disclosed, has intentionally not respected the privacy controls that users' set, and lied to Congress about the subject.
aqme28 8y ago
I have a hard time imagining Huawei siphoning data via MITM without someone noticing odd traffic and thoroughly nuking their PR. This is different.
fulafel 8y ago
The mechanism really matters a lot - think how it would look if a vendor kernel trojan was found siphoning FB data, vs "accidentally" sending off some official-api provided FB data to their statistics servers. "Trusting" or "not trusting" your phone is a very binary threat model. I don't think many tech-savvy people would say they fully trust their Android phone vendor. But you can count on the vendor's self interest to some extent, and basic competence in managing the risk to their reputation.
aaavl2821 8y ago
Once these issues become the focus of politicians, the technical details matter less. If public opinion is opposed to a particular issue, especially if that opposition is bipartisan, politicians will leverage that for political gain -- just look at zuckerbergs congressional hearings, was all about political points However, that doesn't mean they'll actually legislate anything with teeth, depending on other factors like lobbying etc. pharma is a great example of this -- universally hated industry at the moment, lots of lobbying power at the moment, and probably lots of people lobbying against them (this is speculation, but I imagine the American hospital association and AHIA probably are endorsing the drug pricing = cause of US high healthcare spend narrative). Strong bipartisan political opposition to an industry + strong lobbying by the defending industry = political actions that are all bark and no bite
jadedhacker 8y ago
The revolution is going to happen for stupid reasons, just like Louis XVI was executed after cooperating (mostly) with the revolutionaries for years. American politics and news takes are a form of heightened collective idiocy that leaves me convinced that we will only improve ourselves semi-consciously while stepping on a rake and having it nail us and the oppressed people of at least five other countries in the face. However, it's high time for Facebook to face intense regulatory scrutiny. Mark has been unfair to us for quite a while, so I'm going to yawn if he complains when the tables are turned. If FB gets broken up or its profits get reduced, Mark can replace his tear stained clothing with one of the identical replacements from the infinitely deep closet his billions constitute.
- linkmotif 8y ago
  > Mark has been unfair to us for quite a while What a huge statement you’ve buried here and then glossed over. This is the crux of everything, of course. I don’t agree with this statement, but hey, at the end everything comes down to this one notion.
aptwebapps 8y ago
FB's special manufacturer's API included access to some of your friends' data, in some cases even when they had refused permission for it to be shared, so the concern is not merely with data that would have been on your device in some form.
- mcny 8y ago
  What bothers me is that they don't allow me to download this data from Facebook's half assed takeout tool for experiment my Facebook data. Do I have access to my friends contact information they choose to share with me? No? Why does the BlackBerry app have permissions that I (in data export) don't?
wufufufu 8y ago
If this is an accurate tl;dr, then shouldn't facebook be liable for even allowing Huawei phones to access facebook at all even over 3rd party browsers? Any information going through any Chinese manufactured device might as well be at risk. All it takes is the Chinese government saying "hey Huawei, add a keylogger if you see the phone is activated on a US carrier". I'm trying to say facebook shouldn't be responsible.
blincoln 8y ago
I think the "the data was supposed to be stored on the phone" thing is a little misleading. I've never owned a Huawei phone, butwhen I looked at my Motorola phone five years ago[1], I found that it was getting Facebook data via a proxy service that Motorola had set up. This was probably partly as an abstraction layer, but do you really think no one in their marketing (or similar) department thought "as long as that data about their FB contacts is passing through our systems, maybe we should analyze it in some way"? Even if they weren't explicitly collecting it, it probably ended up cached on their servers somewhere, and it was typically sent over plaintext HTTP (even though FB supported HTTPS), so someone else could have easily collected it too. I've looked at a lot of mobile apps, and I don't think what Motorola was doing was at all unusual, but again, I haven't done a comprehensive analysis of other vendors. I do agree that the vendor could always configure the phone to explicitly upload anything to them even if something like the FB APIs were accessed directly, but IMO that seems less likely than siphoning off the data as it passes through their middleware. [1] https://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html https://www.beneaththewaves.net/Projects/Motorola_Is_Listeni...
- zaroth 8y ago
  So the basis of your argument is that you posit that device manufacturers are wiretapping their customers phones en masse (committing a felony)... but somehow this is a story about Facebook?

by varenc 8y ago

lallysingh 8y ago

The threat is going from rather hypothetical to more and more concrete. The phone is an appliance that runs software. It would require some substantial effort to get around that barrier - reducing the risk of it actually happening. Now we're seeing that it didn't require any baked-in compromise in the hardware, firmware, or Android distribution. It's available via API.

colechristensen 8y ago
The difference is between having a window that's easy for a thief to break and giving the thief a key to your house and asking them to sign something promising not to steal. I would like, at least, for a thief to have to put some effort into it.
- lallysingh 8y ago
  And a lot of thieves won't break the window.
- lukeschlather 8y ago
  This is a really bad analogy, and misleading. A better analogy is like Facebook is a bank with safe deposit boxes. I give my key to my phone, and then my phone goes and gets something from the box for me. There is no window to break. My phone can take the key and send it to the phone manufacturer who can then get into my safe deposit box whenever they want. The only way having an API makes this easier is that the manufacturer's Facebook app is more obscure than the browser, but the manufacturer's browser can just as easily steal keys, and it's no more or less illegal.
  - tripzilch 8y ago
    Except that providing an API to a third party, without controls, makes Facebook complicit. They don't get to provide such an API to a third party and then disavow themselves of any responsibility what it is used for. Whereas if the manufacturer backdoors the browser of the phone to steal or siphon data from Facebook users, Facebook's only fault is creating the unnecessary data hazard itself (which is merely irresponsible instead of illegal in the US).
    - lukeschlather 8y ago
      As I understand it the API has controls. There's no fundamental difference between the APIs we're talking about and the web interface, except the API is easier to use programmatically.

debt 8y ago

It’s pretty negligent to sell or give access to a company, someone else’s personal data with a handshake and wink that they won’t turn around and do nefarious shit with it. So while you’re right, it’s also just kinda shitty and probably illegal or at the very least unethical.

stephengillie 8y ago
My current employer has to maintain records on what their customers do with the product after the sale; they're a chemical supply company and it's a federal law.
- hexane360 8y ago
  Yes, but your current employer doesn't turn around and sell that info to any medium-to-high bidder. They also have a well defined and legitimate reason to use such data.

dnomad 8y ago

Huawei does not have "strong ties to the Chinese government." There is absolutely no concrete evidence that Huawei of such a relationship. Please stop spreading propaganda.

woah 8y ago
Is their management in China? If so couldn’t one argue that they are under the complete control of the Chinese government ?
- dnomad 8y ago
  Ah, I see, simply being headquartered in China is enough to make them an arm of the Chinese government. That's some powerful projection. I mean, unlike the case with Huawei, there is extensive hard evidence of American telecom companies deliberately compromising their hardware to facilitate American spying. We know that the American government routinely intercepts American telecom equipment and compromises it [1]. We know that the NSA seems to conveniently have plenty of zero-days into Cisco hardware [2]. We know that all American ISPs and all major American technology companies provide the NSA with direct feeds for all their communication [3, 4]. So, it actually would be fair to say that all American technology and communication companies are under the complete control of the US government. But the strange thing is that despite numerous investigations by multiple intelligence agencies and NGO nobody has ever found any of the millions of devices Huawei exports each year to be compromised. But the less evidence that's found the more Americans insist Huawei's technology can't be trusted. There's never any evidence provided and, remarkably, nobody even claims to have evidence that they conveniently can't disclose. There's just a series of directives and pronouncements by the government and the media that obviously Huawei is an arm of the Chinese government until everybody -- well, at least all the Americans -- believe it. The moral of this story is that (1) like the accusations against Facebook, the accusations against Huawei are without merit [5] (2) the greatest threat to people's privacy and the integrity of global communication networks is and always has been the US government and (3) the American media will never, ever speak the truth about this simple fact until they are forced to by leaks. But please, continue to freak out about Facebook and Huawei. It's clear [1] https://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden https://www.theguardian.com/books/2014/may/12/glenn-greenwal... [2] https://arstechnica.com/information-technology/2016/08/cisco-confirms-nsa-linked-zeroday-targeted-its-firewalls-for-years/ https://arstechnica.com/information-technology/2016/08/cisco... [3] https://www.nytimes.com/2015/08/16/us/politics/att-helped-nsa-spy-on-an-array-of-internet-traffic.html https://www.nytimes.com/2015/08/16/us/politics/att-helped-ns..., https://www.thedailybeast.com/why-verizon-is-happy-to-help-obama-and-the-nsa-spy-on-americans https://www.thedailybeast.com/why-verizon-is-happy-to-help-o... [4] https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program) [5] Note here that unlike the US government Facebook has never, ever been caught doing anything illegal. While one can argue they over generously share data with firms like Cambridge Analytica etc. there's nothing remotely illegal about this thanks to America's extremely weak privacy laws. The reality is there are many, many companies doing far worse than Facebook but they're not based in SV so nobody cares.

thisisit 8y ago

This is one of the strangest defenses for Facebook - everything works as expected. Cambridge Analytica downloaded data? The API worked as expected and people should have been smarter to not share data. Facebook has special APIs for phone manufacturers? The API works as expected and people shouldn't buy phones from the manufacturers they don't trust. But, here's the thing - FB shouldn't have allowed this at all. In one part, security is about making things harder for people to break-in. Currently, manufacturers can use official API to siphon off data to non-FB servers. Sure, manufacturers could run some kind of MITM attack to achieve something similar. But having an official API is a strict no.

zethraeus 8y ago
>> people shouldn't buy phones from the manufacturers they don't trust. You're literally hosting your life on it. You should indeed not do this.
- Hydraulix989 8y ago
  There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them. You can't rely on capitalism to resolve the Prisoner's Dilemma here. This is why Right to Repair legislation has become necessary, for example.
  - runesoerensen 8y ago
    > There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them Apple is a pretty good actor in this regard though, and they're clearly betting a lot on markets to realize the attractiveness of that. > This is why Right to Repair legislation has become necessary, for example. I'm not sure I see how a "bad" actor (maybe like Apple) in terms of the Right to Repair is relevant in the context of trusting device manufacturers. If anything I think Apple's (somewhat self-serving albeit not completely detached from reality) argument would be, and has been e.g. https://news.ycombinator.com/item?id=11047359 https://news.ycombinator.com/item?id=11047359, that their control of device repairs and servicing decreases the risk of malicious software or hardware components being installed.

IncRnd 8y ago

This isn't about apps putting buttons on devices or people trusting device manufacturers. FB has lied about how and when data gets disclosed, has intentionally not respected the privacy controls that users' set, and lied to Congress about the subject.

aqme28 8y ago

I have a hard time imagining Huawei siphoning data via MITM without someone noticing odd traffic and thoroughly nuking their PR. This is different.

fulafel 8y ago

The mechanism really matters a lot - think how it would look if a vendor kernel trojan was found siphoning FB data, vs "accidentally" sending off some official-api provided FB data to their statistics servers. "Trusting" or "not trusting" your phone is a very binary threat model. I don't think many tech-savvy people would say they fully trust their Android phone vendor. But you can count on the vendor's self interest to some extent, and basic competence in managing the risk to their reputation.

aaavl2821 8y ago

Once these issues become the focus of politicians, the technical details matter less. If public opinion is opposed to a particular issue, especially if that opposition is bipartisan, politicians will leverage that for political gain -- just look at zuckerbergs congressional hearings, was all about political points However, that doesn't mean they'll actually legislate anything with teeth, depending on other factors like lobbying etc. pharma is a great example of this -- universally hated industry at the moment, lots of lobbying power at the moment, and probably lots of people lobbying against them (this is speculation, but I imagine the American hospital association and AHIA probably are endorsing the drug pricing = cause of US high healthcare spend narrative). Strong bipartisan political opposition to an industry + strong lobbying by the defending industry = political actions that are all bark and no bite

jadedhacker 8y ago

The revolution is going to happen for stupid reasons, just like Louis XVI was executed after cooperating (mostly) with the revolutionaries for years. American politics and news takes are a form of heightened collective idiocy that leaves me convinced that we will only improve ourselves semi-consciously while stepping on a rake and having it nail us and the oppressed people of at least five other countries in the face. However, it's high time for Facebook to face intense regulatory scrutiny. Mark has been unfair to us for quite a while, so I'm going to yawn if he complains when the tables are turned. If FB gets broken up or its profits get reduced, Mark can replace his tear stained clothing with one of the identical replacements from the infinitely deep closet his billions constitute.

linkmotif 8y ago
> Mark has been unfair to us for quite a while What a huge statement you’ve buried here and then glossed over. This is the crux of everything, of course. I don’t agree with this statement, but hey, at the end everything comes down to this one notion.

aptwebapps 8y ago

FB's special manufacturer's API included access to some of your friends' data, in some cases even when they had refused permission for it to be shared, so the concern is not merely with data that would have been on your device in some form.

mcny 8y ago
What bothers me is that they don't allow me to download this data from Facebook's half assed takeout tool for experiment my Facebook data. Do I have access to my friends contact information they choose to share with me? No? Why does the BlackBerry app have permissions that I (in data export) don't?

wufufufu 8y ago

If this is an accurate tl;dr, then shouldn't facebook be liable for even allowing Huawei phones to access facebook at all even over 3rd party browsers? Any information going through any Chinese manufactured device might as well be at risk. All it takes is the Chinese government saying "hey Huawei, add a keylogger if you see the phone is activated on a US carrier". I'm trying to say facebook shouldn't be responsible.

blincoln 8y ago

I think the "the data was supposed to be stored on the phone" thing is a little misleading. I've never owned a Huawei phone, butwhen I looked at my Motorola phone five years ago[1], I found that it was getting Facebook data via a proxy service that Motorola had set up. This was probably partly as an abstraction layer, but do you really think no one in their marketing (or similar) department thought "as long as that data about their FB contacts is passing through our systems, maybe we should analyze it in some way"? Even if they weren't explicitly collecting it, it probably ended up cached on their servers somewhere, and it was typically sent over plaintext HTTP (even though FB supported HTTPS), so someone else could have easily collected it too. I've looked at a lot of mobile apps, and I don't think what Motorola was doing was at all unusual, but again, I haven't done a comprehensive analysis of other vendors. I do agree that the vendor could always configure the phone to explicitly upload anything to them even if something like the FB APIs were accessed directly, but IMO that seems less likely than siphoning off the data as it passes through their middleware. [1] https://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html https://www.beneaththewaves.net/Projects/Motorola_Is_Listeni...

zaroth 8y ago
So the basis of your argument is that you posit that device manufacturers are wiretapping their customers phones en masse (committing a felony)... but somehow this is a story about Facebook?