3 ms·

Is there any evidence that has happened? That sounds like it goes directly against the APIs terms of service. If device manufacturers are doing that, they could

Is there any evidence that has happened? That sounds like it goes directly against the APIs terms of service. If device manufacturers are doing that, they could equally upload your passwords from the browser.

yayana 8y ago
>. If device manufacturers are doing that, they could equally upload your passwords from the browser. And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful. In OSes you can theoretically attack any app, but it is a pain to even debug them with different versions, changes to their custom storage formats, etc.. Unless they build an ABI, document which parts are stable and give it to you.
- cornholio 8y ago
  FB can tell you about it but there is no law mandating anti-hijack security features. Nevermind that the spyware can be inserted in the client itself or in the official gateway supplied by Huawei, necessary "for technical reasons", making it completely invisible. Once the manufacturer goes outside the licensed API and uses your credentials to do more than Facebook allows, it commits an actual crime against you in most jurisdictions.
  - yayana 8y ago
    I'm sure people will be investigating and finding a few examples of on phone API violations then transferred. My bet: no criminal cases. Facebook charging less than 50k for violation of an API contract on data that isn't theirs, if numbers are disclosed. No standing for users except in a class action that get $5 or less on a new phone or $2 or less as a check.
- lukeschlather 8y ago
  > And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful. With the API, presumably there's an auth token that is only stored on your device. Facebook should also be able to detect unusual access with an auth token. Really, the auth token makes it easier to detect funny business than a username/password.

yayana 8y ago

>. If device manufacturers are doing that, they could equally upload your passwords from the browser. And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful. In OSes you can theoretically attack any app, but it is a pain to even debug them with different versions, changes to their custom storage formats, etc.. Unless they build an ABI, document which parts are stable and give it to you.

cornholio 8y ago
FB can tell you about it but there is no law mandating anti-hijack security features. Nevermind that the spyware can be inserted in the client itself or in the official gateway supplied by Huawei, necessary "for technical reasons", making it completely invisible. Once the manufacturer goes outside the licensed API and uses your credentials to do more than Facebook allows, it commits an actual crime against you in most jurisdictions.
- yayana 8y ago
  I'm sure people will be investigating and finding a few examples of on phone API violations then transferred. My bet: no criminal cases. Facebook charging less than 50k for violation of an API contract on data that isn't theirs, if numbers are disclosed. No standing for users except in a class action that get $5 or less on a new phone or $2 or less as a check.
lukeschlather 8y ago
> And then fb should tell you about unusual accesses to your account unless the phone vendor is also your Telco and extremely careful. With the API, presumably there's an auth token that is only stored on your device. Facebook should also be able to detect unusual access with an auth token. Really, the auth token makes it easier to detect funny business than a username/password.