8 ms·

This is one of the strangest defenses for Facebook - everything works as expected. Cambridge Analytica downloaded data? The API worked as expected and people s

This is one of the strangest defenses for Facebook - everything works as expected. Cambridge Analytica downloaded data? The API worked as expected and people should have been smarter to not share data. Facebook has special APIs for phone manufacturers? The API works as expected and people shouldn't buy phones from the manufacturers they don't trust. But, here's the thing - FB shouldn't have allowed this at all. In one part, security is about making things harder for people to break-in. Currently, manufacturers can use official API to siphon off data to non-FB servers. Sure, manufacturers could run some kind of MITM attack to achieve something similar. But having an official API is a strict no.

zethraeus 8y ago
>> people shouldn't buy phones from the manufacturers they don't trust. You're literally hosting your life on it. You should indeed not do this.
- Hydraulix989 8y ago
  There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them. You can't rely on capitalism to resolve the Prisoner's Dilemma here. This is why Right to Repair legislation has become necessary, for example.
  - runesoerensen 8y ago
    > There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them Apple is a pretty good actor in this regard though, and they're clearly betting a lot on markets to realize the attractiveness of that. > This is why Right to Repair legislation has become necessary, for example. I'm not sure I see how a "bad" actor (maybe like Apple) in terms of the Right to Repair is relevant in the context of trusting device manufacturers. If anything I think Apple's (somewhat self-serving albeit not completely detached from reality) argument would be, and has been e.g. https://news.ycombinator.com/item?id=11047359 https://news.ycombinator.com/item?id=11047359, that their control of device repairs and servicing decreases the risk of malicious software or hardware components being installed.
    - TheForumTroll 8y ago
      Apple is not a "Pretty good actor". Better than some, yes, but good? No.
      - ladzoppelin 8y ago
        Honestly, Apple's privacy move over the years is genius. Its going to be a long time, maybe never, before I buy something besides an iPhone. I don't even like Phones(in general) that much and Apples aggressive cable policies drive me insane but this is getting really scary.
        reitanqild 8y ago
        That was an unusually balanced perspective in a debate that usually tends to lack much nuance here. FWIW I'm partially in the same boat: I like Apple the company and I'm happy for everyone that likes and uses their products but I'm kind of incompatible myself.
- osrec 8y ago
  True, but let's say you bought a DSLR camera, wouldn't it irritate you if the manufacturer was secretly uploading your pictures elsewhere for others to use against you? To most, such practises would seem beyond intrusive. I sort of feel that this is what's happened here, albeit, in a subtler manner.
  - archgoon 8y ago
    Is there any evidence that has happened? That sounds like it goes directly against the APIs terms of service. If device manufacturers are doing that, they could equally upload your passwords from the browser.
    - yayana 8y ago
      >. If device manufacturers are doing that, they could equally upload your passwords from the browser. And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful. In OSes you can theoretically attack any app, but it is a pain to even debug them with different versions, changes to their custom storage formats, etc.. Unless they build an ABI, document which parts are stable and give it to you.
      - cornholio 8y ago
        FB can tell you about it but there is no law mandating anti-hijack security features. Nevermind that the spyware can be inserted in the client itself or in the official gateway supplied by Huawei, necessary "for technical reasons", making it completely invisible. Once the manufacturer goes outside the licensed API and uses your credentials to do more than Facebook allows, it commits an actual crime against you in most jurisdictions.
        yayana 8y ago
        I'm sure people will be investigating and finding a few examples of on phone API violations then transferred. My bet: no criminal cases. Facebook charging less than 50k for violation of an API contract on data that isn't theirs, if numbers are disclosed. No standing for users except in a class action that get $5 or less on a new phone or $2 or less as a check.
- pasquinelli 8y ago
  just because something is true doesn't make it a good defense of facebook.
- adjkant 8y ago
  What if your friend does this and gets your data, even though you got the safe phone. Do we now have to be aware and affected by the technology choices of all of our friends? The problem here is that you are affected by not just your decision but the decisions of anyone who has access to your data on Facebook.
ribosometronome 8y ago
How can Facebook protect your data from a hostile phone manufacturer?
- wavefunction 8y ago
  They can... not enter into agreements to share data with them as is detailed in this article? Is this a trick question?
  - Kalium 8y ago
    You're completely right. Facebook should not have created APIs that could be used to re-implement a Facebook application. They most certainly should not have made such APIs available to companies that are anything less than completely trustworthy in every possible way. Facebook's error was in believing that anyone outside Facebook could be trusted to author an app. I expected they know better now.
jimmies 8y ago
>people shouldn't buy phones from the manufacturers they don't trust. People shouldn't put their pictures , and relationship status, and whom they know, and what they think, and where they go, and what they talk in private about, to a private company's service that they don't trust. Oh, except for, they do.
- smt88 8y ago
  Companies shouldn't intentionally mislead users about privacy and data use. They should be either trustworthy or held accountable for deceiving consumers. A large part of GDPR's value is killing these misleading practices by exposing them.
  - arcbyte 8y ago
    Facebook never mislead anybody about how their data was being used. That's a lie the media is feeding everyone for some reason.
    - smt88 8y ago
      Zuck recently said their legal contracts required data to be deleted and therefore it was. That's directly misleading.
- welly 8y ago
  I hear nothing about people not trusting Facebook, other than from those who don't use it. But plenty of people who either trust them or don't care either way who do put their personal data and photographs on Facebook. It's only when stories such as Cambridge Analytica make the news that they then realise how their data is being used. Who are you talking about that in one breath say they don't trust Facebook and in the next go and put their data on their servers?
merinowool 8y ago
So if I consent for my data to be transferred, why I should be prevented from that?
- deleted 8y ago
  [deleted]
DiffEq 8y ago
Facebook wanted to do this so everything did work as expected, they have been doing it for a long time and built it precisely to be used just as Cambridge Analytica used it. The only problem came when it was used to help Trump. When it was used to help the Obama campaign nobody batted an eye. Facebook is a political agenda and getting more people involved and helping their favored campaigns is something they were very interested in doing; that is why they allowed this - not realizing it would bite them back. https://www.investors.com/politics/editorials/facebook-data-scandal-trump-election-obama-2012/ https://www.investors.com/politics/editorials/facebook-data-...
deleted 8y ago
[deleted]
calimac 8y ago
exactly, great points. the commenter seemed to infer the carriers are using network stack to access the data. that point is twisting the truth and omitting the key fact that facebook delivers this information via a well documented api. facebook can't fool everyone every time.

zethraeus 8y ago

>> people shouldn't buy phones from the manufacturers they don't trust. You're literally hosting your life on it. You should indeed not do this.

Hydraulix989 8y ago
There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them. You can't rely on capitalism to resolve the Prisoner's Dilemma here. This is why Right to Repair legislation has become necessary, for example.
- runesoerensen 8y ago
  > There aren't a whole lot of (i.e. _any_) good actors because the market does not incentivize them Apple is a pretty good actor in this regard though, and they're clearly betting a lot on markets to realize the attractiveness of that. > This is why Right to Repair legislation has become necessary, for example. I'm not sure I see how a "bad" actor (maybe like Apple) in terms of the Right to Repair is relevant in the context of trusting device manufacturers. If anything I think Apple's (somewhat self-serving albeit not completely detached from reality) argument would be, and has been e.g. https://news.ycombinator.com/item?id=11047359 https://news.ycombinator.com/item?id=11047359, that their control of device repairs and servicing decreases the risk of malicious software or hardware components being installed.
  - TheForumTroll 8y ago
    Apple is not a "Pretty good actor". Better than some, yes, but good? No.
    - ladzoppelin 8y ago
      Honestly, Apple's privacy move over the years is genius. Its going to be a long time, maybe never, before I buy something besides an iPhone. I don't even like Phones(in general) that much and Apples aggressive cable policies drive me insane but this is getting really scary.
      - reitanqild 8y ago
        That was an unusually balanced perspective in a debate that usually tends to lack much nuance here. FWIW I'm partially in the same boat: I like Apple the company and I'm happy for everyone that likes and uses their products but I'm kind of incompatible myself.
osrec 8y ago
True, but let's say you bought a DSLR camera, wouldn't it irritate you if the manufacturer was secretly uploading your pictures elsewhere for others to use against you? To most, such practises would seem beyond intrusive. I sort of feel that this is what's happened here, albeit, in a subtler manner.
- archgoon 8y ago
  Is there any evidence that has happened? That sounds like it goes directly against the APIs terms of service. If device manufacturers are doing that, they could equally upload your passwords from the browser.
  - yayana 8y ago
    >. If device manufacturers are doing that, they could equally upload your passwords from the browser. And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful. In OSes you can theoretically attack any app, but it is a pain to even debug them with different versions, changes to their custom storage formats, etc.. Unless they build an ABI, document which parts are stable and give it to you.
    - cornholio 8y ago
      FB can tell you about it but there is no law mandating anti-hijack security features. Nevermind that the spyware can be inserted in the client itself or in the official gateway supplied by Huawei, necessary "for technical reasons", making it completely invisible. Once the manufacturer goes outside the licensed API and uses your credentials to do more than Facebook allows, it commits an actual crime against you in most jurisdictions.
      - yayana 8y ago
        I'm sure people will be investigating and finding a few examples of on phone API violations then transferred. My bet: no criminal cases. Facebook charging less than 50k for violation of an API contract on data that isn't theirs, if numbers are disclosed. No standing for users except in a class action that get $5 or less on a new phone or $2 or less as a check.
pasquinelli 8y ago
just because something is true doesn't make it a good defense of facebook.
adjkant 8y ago
What if your friend does this and gets your data, even though you got the safe phone. Do we now have to be aware and affected by the technology choices of all of our friends? The problem here is that you are affected by not just your decision but the decisions of anyone who has access to your data on Facebook.

ribosometronome 8y ago

How can Facebook protect your data from a hostile phone manufacturer?

wavefunction 8y ago
They can... not enter into agreements to share data with them as is detailed in this article? Is this a trick question?
- Kalium 8y ago
  You're completely right. Facebook should not have created APIs that could be used to re-implement a Facebook application. They most certainly should not have made such APIs available to companies that are anything less than completely trustworthy in every possible way. Facebook's error was in believing that anyone outside Facebook could be trusted to author an app. I expected they know better now.

jimmies 8y ago

>people shouldn't buy phones from the manufacturers they don't trust. People shouldn't put their pictures , and relationship status, and whom they know, and what they think, and where they go, and what they talk in private about, to a private company's service that they don't trust. Oh, except for, they do.

smt88 8y ago
Companies shouldn't intentionally mislead users about privacy and data use. They should be either trustworthy or held accountable for deceiving consumers. A large part of GDPR's value is killing these misleading practices by exposing them.
- arcbyte 8y ago
  Facebook never mislead anybody about how their data was being used. That's a lie the media is feeding everyone for some reason.
  - smt88 8y ago
    Zuck recently said their legal contracts required data to be deleted and therefore it was. That's directly misleading.
welly 8y ago
I hear nothing about people not trusting Facebook, other than from those who don't use it. But plenty of people who either trust them or don't care either way who do put their personal data and photographs on Facebook. It's only when stories such as Cambridge Analytica make the news that they then realise how their data is being used. Who are you talking about that in one breath say they don't trust Facebook and in the next go and put their data on their servers?

merinowool 8y ago

So if I consent for my data to be transferred, why I should be prevented from that?

deleted 8y ago
[deleted]

DiffEq 8y ago

Facebook wanted to do this so everything did work as expected, they have been doing it for a long time and built it precisely to be used just as Cambridge Analytica used it. The only problem came when it was used to help Trump. When it was used to help the Obama campaign nobody batted an eye. Facebook is a political agenda and getting more people involved and helping their favored campaigns is something they were very interested in doing; that is why they allowed this - not realizing it would bite them back. https://www.investors.com/politics/editorials/facebook-data-scandal-trump-election-obama-2012/ https://www.investors.com/politics/editorials/facebook-data-...

deleted 8y ago

[deleted]

calimac 8y ago

exactly, great points. the commenter seemed to infer the carriers are using network stack to access the data. that point is twisting the truth and omitting the key fact that facebook delivers this information via a well documented api. facebook can't fool everyone every time.