8 ms·

“Among the revelations was that Facebook obtained data from multiple partners for a controversial friend-suggestion tool called “People You May Know.” The feat

“Among the revelations was that Facebook obtained data from multiple partners for a controversial friend-suggestion tool called “People You May Know.” The feature, introduced in 2008, continues even though some Facebook users have objected to it, unsettled by its knowledge of their real-world relationships. Gizmodo and other news outlets have reported cases of the tool’s recommending friend connections between patients of the same psychiatrist, estranged family members, and a harasser and his victim. Facebook, in turn, used contact lists from the partners, including Amazon, Yahoo and the Chinese company Huawei — which has been flagged as a security threat by American intelligence officials — to gain deeper insight into people’s relationships and suggest more connections, the records show.” Well, that explains some of the conspiracy-mongering that was so rampant around this feature. Facebook (probably) wasn’t secretly recording your phone calls etc. They didn’t need to - they were getting streams of data from other partners. “Facebook also allowed Spotify, Netflix and the Royal Bank of Canada to read, write and delete users’ private messages, and to see all participants on a thread” Uhhhh, excuse me?

JumpCrisscross 8y ago
> Royal Bank of Canada to read, write and delete users’ private messages, and to see all participants on a thread There's a settlement out there for anyone with a Facebook account who was turned down for a loan by RBC. No chance RBC wants its dirty laundry aired in a Fair Housing suit.
- stonecraftwolf 8y ago
  Why would RBC even expose themselves to this liability? What was the point? With every single one of these companies I am...baffled, that anyone thought this was a good idea, but in this situation especially it makes zero sense. All that liability for what possible upside?
  - 1999 8y ago
    I think this was intended to be a customer support channel and they had to be able to delete the messages containing bank info after a certain amount of time. I had read something about it, I don't think carte blanche access to users' messages was sought or given, it was just support conversations. I didn't use it so this is like my memory of 2nd hand info.
    - NoPicklez 8y ago
      I used to work in Social Media customer support using a well known platform, in a large telecommunications company. We could only access the private message history containing the conversations we had had with the individual, nothing else. You think people care about their personal data, you should see what type of information they provide through private messaging platforms. Including through public posts, it's shocking.
      - retSava 8y ago
        Well, sure, there are always people that act against their own best objective interest but the case here is that Facebook is making a bad decision for them, and also not informing about it other than in broad, hard-to-grok language.
  - mlb_hn 8y ago
    One reason would be that RBC was allowing people to send money from its app via Messenger - http://www.rbc.com/newsroom/news/2013/20131211-facebook.html http://www.rbc.com/newsroom/news/2013/20131211-facebook.html
mlb_hn 8y ago
> Spotify, which could view messages of more than 70 million users a month, still offers the option to share music through Facebook Messenger. Not sure why the others needed it
- sneak 8y ago
  Spotify doesn’t need to read your DMs to let you message share links, either.
  - mlb_hn 8y ago
    That's what that article had - on Googling it looks like Spotify makes suggestions in messenger when talking about music as well. https://www.theverge.com/2017/8/14/16143354/facebook-messenger-spotify-recommendations-find-music https://www.theverge.com/2017/8/14/16143354/facebook-messeng...
AlexandrB 8y ago
> Facebook also allowed Spotify, Netflix and the Royal Bank of Canada to read, write and delete users’ private messages, and to see all participants on a thread. At this point it’s hard to dispute that at Facebook “private” is synonymous with “public” for most practical purposes.
- sneak 8y ago
  Shared under NDA with business relationships is not “public” for the common use of the term. Although I agree with your sentiment, your statement isn’t really accurate. Otherwise I would be able to read Spotify users’ facebook DMs, and I can’t.
  - AlexandrB 8y ago
    You’re kidding, right? If I send a “private” message, but everybody from law enforcement to my bank has access to it, it’s not private. It’s public knowledge as far as any background checks or loan applications are concerned. By contrast, if my bank worked out a deal with Bell where they get to record my all phone conversations they would still be committing a felony in almost all jurisdictions, NDA or not. That’s a reasonable example of “private” communications.
    - kerng 8y ago
      You have a very good point, and in an ideal world that's what one would expect. Unfortunately our mindset has to change and we have to be way more suspicious on what companies do with our "private" data.
    - pvg 8y ago
      It’s public knowledge as far as any background checks or loan applications are concerned. You give permission for those and the data accessed is often not public. There are degrees of privacy - what you're trying to do make up your own definition of 'public' and then have message board fights about it. It's not really a sensible position, let alone interesting conversation.
skybrian 8y ago
One possibility would be that Facebook users were supposed to be able to read, write, and delete their own chat messages via custom chat clients built by Spotify, Netflix, and so on. If so, the New York Times is throwing shade on Facebook basically for not being enough of a walled garden. I hope their journalists are not that confused?
- InclinedPlane 8y ago
  That would grant the app access to those permissions, not the companies. Oh hey, would you look at that: https://www.theverge.com/2017/8/14/16143354/facebook-messenger-spotify-recommendations-find-music https://www.theverge.com/2017/8/14/16143354/facebook-messeng...
  - skybrian 8y ago
    I'm a bit worried that some journalists (and some readers) no longer care to make any distinction between an app having access for legitimate reasons that respect users' intentions and the whole company having access to do whatever they like. At least, they don't explain it well.
    - thaumasiotes 8y ago
      The distinction doesn't exist in practical terms. The company controls the behavior of the app; the fact that an app has access for legitimate reasons doesn't mean that any given use of the access was for legitimate reasons.
      - skybrian 8y ago
        I don't think this article made the case that the access granted was unreasonable.
    - UncleMeat 8y ago
      Mark my words. There is going to be an article that grossly misunderstands oauth and tells people that facebook, twitter, etc, are all giving access user information to third party's willy nilly and that there is an entire system widely used across the web for encouraging this sort of behavior.
thinkloop 8y ago
> to read, write and delete users’ private messages I wonder if the delete permission was by accident or whether these companies were actively deleting private messages - craziness.
- ceejayoz 8y ago
  Facebook's permissions scopes have never been that granular - if you get approved for a permission it's generally access to create, edit, view, and delete all in one.
  - Puer 8y ago
    (Citation needed)
    - ceejayoz 8y ago
      It's a little hard to cite now - most of the user-level permissions are gone, or are behind a "This permission is restricted to a limited set of partners and usage requires prior approval by Facebook" restriction. They've clamped down repeatedly on how much data comes out of the API - you used to get full info on friends, then just their names and IDs, then that list wound up filtered to just other friends who'd authorized the same app. It used to be extremely wide-open.
conanthe 8y ago
There was also version for politicians "animals you may own" that's why Facebook has not shit down yet.
jonathankoren 8y ago
"Facebook would like access to your contacts. Do you agree? YES no" Address book import and triangle closing drives the most PYMK features across every social network. It's a gold mine, and that's why everything wants it.
Spooky23 8y ago
I’m always puzzled by the need people have to try to dispel the notion that Facebook listens to ambient audio or conversations. They are the bad guys. They didn’t need to steal Android phone logs either, but they did.
- jackvalentine 8y ago
  I just wish there was a way to figure out _why_ I'm getting some ads, to dispel that fear. On Instagram last weekend I and a friend were shown a number of ads for Chandon sparking wine after I bought a bottle, and someone else at the party also did and we talked about it. Both of us insist we didn't google sparkling wine, Chandon, or anything we think relevant... it really does on the face of it appear Facebook had listened to us.
  - harmmonica 8y ago
    If you purchased the wine with a credit card then Facebook has the ability through agreements with other data providers/aggregators to connect it back to your Facebook, Instagram, etc account. Source: I know someone who is in biz dev at one of said companies and sells this type of “profile” data to Facebook and countless other companies. If you purchased with cash then sure does sound like they were somehow listening.
    - jackvalentine 8y ago
      Hmm, I did. But her bottle was a leftover from a wedding several months ago (because we're connected on IG perhaps? Seems like quite the stretch though). Also surely advertising the same wine I just bought to me is... dodgy ROI at best? It'll remain a mystery forever.
      - thaumasiotes 8y ago
        At least wine is a consumable. Compare the thread on how Amazon will relentlessly advertise you the same refrigerator you just purchased.
  - 8y ago
sachinmonga 8y ago
RE: Royal Bank of Canada, their access to the Messages API was specifically to let people send money to their friends via Messenger through the RBC app. In Canada, the only way method for P2P money transfer is through a system called Interac, which relies on email addresses. Using Facebook Login + Messenger was a big improvement since it's harder to accidentally send money to the wrong person.
ardy42 8y ago
> Well, that explains some of the conspiracy-mongering that was so rampant around this feature. Facebook (probably) wasn’t secretly recording your phone calls etc. They didn’t need to - they were getting streams of data from other partners. I really wish there was a law requiring real disclosure of such customer/user-data sharing agreements with enough detail to know what's actually happening. The disclosures should include things like schemas, example records, and reasonable names for data receiptients (e.g. Amazon Inc., not Sunshine Data Brokers II Inc., an unacknowledged subsidiary of Amazon). There's no way to make an informed choice about using a particular service or dealing with a particular company without that.
- munchbunny 8y ago
  GDPR makes a pretty good attempt at that.
kevin_thibedeau 8y ago
It's not exactly nefarious to query friends of friends in the same geographical area. The problem is people willingly constructing a social graph without care for the consequences. G+ theoretically enabled this sort of isolation but in practice it is too much work to maintain separation. The only way to win is not to play at all.
pmarreck 8y ago
> Gizmodo and other news outlets have reported cases of the tool’s recommending friend connections between patients of the same psychiatrist, estranged family members, and a harasser and his victim. Geez, and I thought I was annoyed with mere former bosses showing up who I didn't part on good terms with

JumpCrisscross 8y ago

> Royal Bank of Canada to read, write and delete users’ private messages, and to see all participants on a thread There's a settlement out there for anyone with a Facebook account who was turned down for a loan by RBC. No chance RBC wants its dirty laundry aired in a Fair Housing suit.

stonecraftwolf 8y ago
Why would RBC even expose themselves to this liability? What was the point? With every single one of these companies I am...baffled, that anyone thought this was a good idea, but in this situation especially it makes zero sense. All that liability for what possible upside?
- 1999 8y ago
  I think this was intended to be a customer support channel and they had to be able to delete the messages containing bank info after a certain amount of time. I had read something about it, I don't think carte blanche access to users' messages was sought or given, it was just support conversations. I didn't use it so this is like my memory of 2nd hand info.
  - NoPicklez 8y ago
    I used to work in Social Media customer support using a well known platform, in a large telecommunications company. We could only access the private message history containing the conversations we had had with the individual, nothing else. You think people care about their personal data, you should see what type of information they provide through private messaging platforms. Including through public posts, it's shocking.
    - retSava 8y ago
      Well, sure, there are always people that act against their own best objective interest but the case here is that Facebook is making a bad decision for them, and also not informing about it other than in broad, hard-to-grok language.
- mlb_hn 8y ago
  One reason would be that RBC was allowing people to send money from its app via Messenger - http://www.rbc.com/newsroom/news/2013/20131211-facebook.html http://www.rbc.com/newsroom/news/2013/20131211-facebook.html

mlb_hn 8y ago

> Spotify, which could view messages of more than 70 million users a month, still offers the option to share music through Facebook Messenger. Not sure why the others needed it

sneak 8y ago
Spotify doesn’t need to read your DMs to let you message share links, either.
- mlb_hn 8y ago
  That's what that article had - on Googling it looks like Spotify makes suggestions in messenger when talking about music as well. https://www.theverge.com/2017/8/14/16143354/facebook-messenger-spotify-recommendations-find-music https://www.theverge.com/2017/8/14/16143354/facebook-messeng...

AlexandrB 8y ago

> Facebook also allowed Spotify, Netflix and the Royal Bank of Canada to read, write and delete users’ private messages, and to see all participants on a thread. At this point it’s hard to dispute that at Facebook “private” is synonymous with “public” for most practical purposes.

sneak 8y ago
Shared under NDA with business relationships is not “public” for the common use of the term. Although I agree with your sentiment, your statement isn’t really accurate. Otherwise I would be able to read Spotify users’ facebook DMs, and I can’t.
- AlexandrB 8y ago
  You’re kidding, right? If I send a “private” message, but everybody from law enforcement to my bank has access to it, it’s not private. It’s public knowledge as far as any background checks or loan applications are concerned. By contrast, if my bank worked out a deal with Bell where they get to record my all phone conversations they would still be committing a felony in almost all jurisdictions, NDA or not. That’s a reasonable example of “private” communications.
  - kerng 8y ago
    You have a very good point, and in an ideal world that's what one would expect. Unfortunately our mindset has to change and we have to be way more suspicious on what companies do with our "private" data.
  - pvg 8y ago
    It’s public knowledge as far as any background checks or loan applications are concerned. You give permission for those and the data accessed is often not public. There are degrees of privacy - what you're trying to do make up your own definition of 'public' and then have message board fights about it. It's not really a sensible position, let alone interesting conversation.

skybrian 8y ago

One possibility would be that Facebook users were supposed to be able to read, write, and delete their own chat messages via custom chat clients built by Spotify, Netflix, and so on. If so, the New York Times is throwing shade on Facebook basically for not being enough of a walled garden. I hope their journalists are not that confused?

InclinedPlane 8y ago
That would grant the app access to those permissions, not the companies. Oh hey, would you look at that: https://www.theverge.com/2017/8/14/16143354/facebook-messenger-spotify-recommendations-find-music https://www.theverge.com/2017/8/14/16143354/facebook-messeng...
- skybrian 8y ago
  I'm a bit worried that some journalists (and some readers) no longer care to make any distinction between an app having access for legitimate reasons that respect users' intentions and the whole company having access to do whatever they like. At least, they don't explain it well.
  - thaumasiotes 8y ago
    The distinction doesn't exist in practical terms. The company controls the behavior of the app; the fact that an app has access for legitimate reasons doesn't mean that any given use of the access was for legitimate reasons.
    - skybrian 8y ago
      I don't think this article made the case that the access granted was unreasonable.
  - UncleMeat 8y ago
    Mark my words. There is going to be an article that grossly misunderstands oauth and tells people that facebook, twitter, etc, are all giving access user information to third party's willy nilly and that there is an entire system widely used across the web for encouraging this sort of behavior.

thinkloop 8y ago

> to read, write and delete users’ private messages I wonder if the delete permission was by accident or whether these companies were actively deleting private messages - craziness.

ceejayoz 8y ago
Facebook's permissions scopes have never been that granular - if you get approved for a permission it's generally access to create, edit, view, and delete all in one.
- Puer 8y ago
  (Citation needed)
  - ceejayoz 8y ago
    It's a little hard to cite now - most of the user-level permissions are gone, or are behind a "This permission is restricted to a limited set of partners and usage requires prior approval by Facebook" restriction. They've clamped down repeatedly on how much data comes out of the API - you used to get full info on friends, then just their names and IDs, then that list wound up filtered to just other friends who'd authorized the same app. It used to be extremely wide-open.

conanthe 8y ago

There was also version for politicians "animals you may own" that's why Facebook has not shit down yet.

jonathankoren 8y ago

"Facebook would like access to your contacts. Do you agree? YES no" Address book import and triangle closing drives the most PYMK features across every social network. It's a gold mine, and that's why everything wants it.

Spooky23 8y ago

I’m always puzzled by the need people have to try to dispel the notion that Facebook listens to ambient audio or conversations. They are the bad guys. They didn’t need to steal Android phone logs either, but they did.

jackvalentine 8y ago
I just wish there was a way to figure out _why_ I'm getting some ads, to dispel that fear. On Instagram last weekend I and a friend were shown a number of ads for Chandon sparking wine after I bought a bottle, and someone else at the party also did and we talked about it. Both of us insist we didn't google sparkling wine, Chandon, or anything we think relevant... it really does on the face of it appear Facebook had listened to us.
- harmmonica 8y ago
  If you purchased the wine with a credit card then Facebook has the ability through agreements with other data providers/aggregators to connect it back to your Facebook, Instagram, etc account. Source: I know someone who is in biz dev at one of said companies and sells this type of “profile” data to Facebook and countless other companies. If you purchased with cash then sure does sound like they were somehow listening.
  - jackvalentine 8y ago
    Hmm, I did. But her bottle was a leftover from a wedding several months ago (because we're connected on IG perhaps? Seems like quite the stretch though). Also surely advertising the same wine I just bought to me is... dodgy ROI at best? It'll remain a mystery forever.
    - thaumasiotes 8y ago
      At least wine is a consumable. Compare the thread on how Amazon will relentlessly advertise you the same refrigerator you just purchased.
- 8y ago

sachinmonga 8y ago

RE: Royal Bank of Canada, their access to the Messages API was specifically to let people send money to their friends via Messenger through the RBC app. In Canada, the only way method for P2P money transfer is through a system called Interac, which relies on email addresses. Using Facebook Login + Messenger was a big improvement since it's harder to accidentally send money to the wrong person.

ardy42 8y ago

> Well, that explains some of the conspiracy-mongering that was so rampant around this feature. Facebook (probably) wasn’t secretly recording your phone calls etc. They didn’t need to - they were getting streams of data from other partners. I really wish there was a law requiring real disclosure of such customer/user-data sharing agreements with enough detail to know what's actually happening. The disclosures should include things like schemas, example records, and reasonable names for data receiptients (e.g. Amazon Inc., not Sunshine Data Brokers II Inc., an unacknowledged subsidiary of Amazon). There's no way to make an informed choice about using a particular service or dealing with a particular company without that.

munchbunny 8y ago
GDPR makes a pretty good attempt at that.

kevin_thibedeau 8y ago

It's not exactly nefarious to query friends of friends in the same geographical area. The problem is people willingly constructing a social graph without care for the consequences. G+ theoretically enabled this sort of isolation but in practice it is too much work to maintain separation. The only way to win is not to play at all.

pmarreck 8y ago

> Gizmodo and other news outlets have reported cases of the tool’s recommending friend connections between patients of the same psychiatrist, estranged family members, and a harasser and his victim. Geez, and I thought I was annoyed with mere former bosses showing up who I didn't part on good terms with