10 ms·

Facebook gave Spotify and Netflix access to users’ private messages

297 points by staz 8y ago

lourenchord 8y ago
So basically all of silicon valley is colluding together. Maybe it is time to regulate them and break them up.
- speps 8y ago
  Spotify is Swedish and their US HQ is in NY.
  - dagw 8y ago
    They still have a significant presence in Silicon Valley.
    - harryh 8y ago
      Not really. The bulk of their US workforce is in NYC.
- justaman 8y ago
  I think the major tech companies should be broken up. However its not 1982 anymore. The global market(mainly China) threw a money wrench into the system. If you break up Google, that's mostly to the benefit of the CPC which will results in a market that's potentially worse than the one we have now.
  - andy_ppp 8y ago
    By benefiting free society you strengthen yourself against the CPC IMO.
  - ardy42 8y ago
    > If you break up Google, that's mostly to the benefit of the CPC which will results in a market that's potentially worse than the one we have now. https://www.nytimes.com/2018/12/10/opinion/facebook-china-tech-competition.html https://www.nytimes.com/2018/12/10/opinion/facebook-china-te...: > Don’t Fall for Facebook’s ‘China Argument’ > America’s global dominance in technology requires fierce competition at home, not the coddling of monopolies. Also, the Great Firewall is a massive trade barrier, which I think would justify trade-retaliation against the companies protected by it if they somehow they gained ground in the US due to domestic tech-company regulation.
    - nindalf 8y ago
      How would trade retaliation even work? Software isn't that straightforward to tax. For example, say you 2 video games, one of which is Chinese owned (say League of Legends), the other is American owned (say Dota 2). Tell me what justified trade retaliation you would use to promote one over the other? Would you add a $0.01 tax to cosmetics? You can't do it. Of course it doesn't matter to the CPC what Tencent does with this game, because games are inconsequential. But if this wasn't Tencent's LoL, but rather WeChat we were talking about? At that point CPC policies, including censorship will be applied by Tencent. And what "trade-retaliation" will you use then?
  - bogomipz 8y ago
    >"If you break up Google, that's mostly to the benefit of the CPC which will results in a market that's potentially worse than the one we have now" No, this false equivalency is something that Big Tech have created now that they are looking at the very real possibility of regulation. Please don't propagate this disingenuous and self-serving bit of economic nationalism for these companies. It's also ironic that you mention Google in this context considering the existence Project Dragonfly.
- deweller 8y ago
  I can think of no better way to kill innovation than to regulate all technology companies. Look at the state of the telecommunications companies in the US as an example.
gdfasfklshg4 8y ago
Ironic that the site hosting this article does not give a real opt out to intrusive tracking (their privacy policy refers you to your browsers help menu to learn how to block their cookies!). Is this GDPR compliant?
petermcneeley 8y ago
"Giving Spotify, Netflix, and the Royal Bank of Canada the ability to read users’ private Facebook messages." Its RBC that is the interesting one here. Did anyone think we would live in a world where your bank has the ability to read your private messages between your friends? EDIT: Puer mentions below that this might just be a permissions issue and it doesnt mean that they actually read your private messages.
- agglomerative 8y ago
  And what, pray tell, were they checking up on? My gut is telling me it wasn't just about prospective credit worthiness analysis or placing advertising for retail products and services. Maybe debt collection and finding new ways to hunt down delinquent loan recipients? What else?
  - sevensor 8y ago
    Surely credit-worthiness is a scary enough thing for them to concentrate their private message data-mining on?
  - Puer 8y ago
    They needed those permissions to allow for sending/receiving of payments over Messenger. NYT is being intentionally misleading with what "permissions" mean here.
    - bunderbunder 8y ago
      Well, "needed" is a strong word. They wouldn't have needed the ability to read arbitrary private messages, just the ability to find out when PMs contain whatever signal is used to send a payment. If they got any more than that, it wasn't because of need, it was because someone at Facebook was being lazy and insufficiently respectful of user privacy.
    - IfOnlyYouKnew 8y ago
      They had access to those messages. That is what they wrote, and it is entirely correct. Nowhere does the article say they used that access in improper ways. The accusation isn’t that your neighbor stole money from your bank account. It’s that your roommate gave them your card and pin, without your consent or even knowledge. If you draw conclusions the journalists consciously did not make, that’s your error in reasoning, not theirs. To then claim insights into the thought process of an action that did not happen, I. e. your accusation of intent, just heightens the absurdity.
the_unknown 8y ago
...and RBC still won't let me use Google Pay - I have to download their apps and do tap-to-pay using it. Best part is that all my other cards are in Google Pay so I'm constantly needing to switch the 'default' tap app because of this. RBC - get out of the way!
Puer 8y ago
1) This is just a duplicate of the NYT article already on the front page 2) NYT seems to intentionally not elaborating on the "access to users' private messages" part and conflating app permissions to actually scanning, parsing, storing, deleting, modifying individual messages. Until disproven, it sounds like these are just standard app permissions needed to implement functions like song sharing in Messenger chat (in the case of Spotify), or sending payments over chat (in the case of RBC). This is disappointing journalism, to be honest. FB has done a lot of bad things and they deserve the negative press, but it does seem like NYT has some kind of personal agenda against the company and they aren't afraid of exploiting the tech ignorance of their readers to accomplish that goal. This is like publishing "Popular privacy extension uBlock Origin 'Accesses your tabs and browsing history'". Yeah. Because it needs those things to function: https://github.com/gorhill/uBlock/wiki/Permissions https://github.com/gorhill/uBlock/wiki/Permissions Anyone who's ever written an Android app or a Chrome extension should see right through this sensationalism.
- bluesign 8y ago
  Yeah it is standard permission but the situation is more like this. - Facebook had some messages API for developers ( which apps can act as messenger client ), some kind of allowing 3rd party messenger applications, those had all access to messages, conversations, contacts (friends) etc - Then Facebook deprecated this API - Probably after that, someone came up with this ideas about sharing stuff on messenger, (song on spotify case, movie on netflix etc etc) - Then someone in facebook figured out they can use this old API ( in the end they trust those names, they want to do minimal development for this stuff etc ) - So they whitelisted those apps for this deprecated API So basically they messed up, by giving unlimited access to messages of users to some whitelisted apps, instead of giving let's say selective permission to just to 'send some message' over messsages
- catacombs 8y ago
  > FB has done a lot of bad things and they deserve the negative press, but it does seem like NYT has some kind of personal agenda against the company and they aren't afraid of exploiting the tech ignorance of their readers to accomplish that goal. To say The New York Times and the multiple reporters covering the Facebook scandals all have a personal agenda to make Facebook look bad is delusional. The scandals started with Facebook, and the NYT, as well as other news organizations covering this story, are there to write about it. Moreover, the Times spoke to nearly 60 current and former employees. You'd think if they had an agenda they wouldn't talk to that many people to corroborate the facts. If the paper wanted to do a "hit piece," they'd just grab one of their columnists to write it and slap OPINION at the top of the story. A reminder for some people: Opinion is not the same as News. They are different departments that, in most newsrooms, do not dip in each others work. The Times' investigations team is one of the best in American journalism. I highly doubt the editors would publish a story as a middle finger to Facebook. If you think otherwise, I welcome specific examples of agenda- pushing stories, with exactly the thing they're pushing out that benefits them and not the public. Again, the scandals started with Facebook, and they're out now for every one to see. The old saying goes, "Don't do anything that you'd wouldn't want published on the front page of The New York Times."
kjar 8y ago
FB selling user's private information again: I feign surprise. This is getting old - It is their business model, what did you expect?
jonathanehrlich 8y ago
(disclosure: i used to work for FB). This article left out words like "publicly available information" and "user consent". Why?
- fredoliveira 8y ago
  I'm confused about what is publicly available information in private messages. Can you explain?
  - jonathanehrlich 8y ago
    I'm not sure either but i don't believe there is such a thing. No private message data was shared publicly.
    - fredoliveira 8y ago
      I mean, the articles don't suggest it was shared publicly :-) They suggest it was shared with specific companies - but that it was shared nevertheless. That sounds like a serious violation of users' privacy.
      - jonathanehrlich 8y ago
        If they did it without user consent, it would be an issue for sure.
        deleted 8y ago
        [deleted]
- retSava 8y ago
  If by "publicly available information" you mean the EULA, this can in practice not really be expected to be read and understood by the average user. A wall of text with vague remarks is par for such things. Add to this a constantly moving set of settings that change meaning over time (who can read this post now again?).
kbos87 8y ago
I have a problem with the way NYT is reporting on this whole thing. The most egregious sounding parts of this (eg giving Spotify and Netflix the ability to read your messages) sounds like it was entirely tangential to what those agreements were all about. It’s definitely something Facebook should be getting heat for, but there wasn’t some colluding agreement to let RBC mine their customers’ messages, as NYT makes it sound.
- IfOnlyYouKnew 8y ago
  Where does it say that RBC was mining customers’ messages? And how do you know they did not, when apparently they don’t care enough about users’ privacy to even inform them, and continued said practice even after getting lots of uncomfortable questions?
  - kbos87 8y ago
    They don’t need to say it. The way the headline reads and the story is architected is designed to hook readers by implying the worst.
    - IfOnlyYouKnew 8y ago
      So you’re now just making stuff up, then accusing the New York Times for lying to you?
- _jal 8y ago
  I have a problem with FB's two-faced bullshit, over multiple years, of lying through its teeth to the krill and selling them out with glee on the quiet. It is just who they are. This is why I blackhole their IP space. It is always a mistake, or really we were doing this less-awful sounding thing, it is complicated. And then it comes out that, yet again, it was actually worse that it seemed. Sometimes people change. In this case, it is pretty clear that Zuckerberg still thinks people who trust him are dumb fucks.
  - MaxBarraclough 8y ago
cantthinkofone 8y ago
My assumption, my hope really, is that FB gave away private messages in some sanitized and anonymized manner, because Spotify and Netflix was happy to pay for any insider marketing data they could receive about what relevant chat histories have to say about music or movies. NYT seems to be on the attack against FB out of some ideological motivation but the details they are presenting leaves out contextual information about how the data was processed before it was handed off. There's no question FB has been nothing but elusive and ink-spraying about this whole set of ordeals. It's one level of uncomfortable if FB is simply handing away sanitized data, it's another thing if you can just pay them and they will give you all the private posts of any given user without any sort of identity protection. The fact of the matter is FB's terms basically allow them absolute possession of whatever data you give them. So there is so much grey area and legal ambiguity that it has been allowed to work with, especially in the US which matters most for a US company. Europe has come around to the concept of citizen's rights to their own data. In some countries you can't even use websites unless they inform you they store cookies. At the end of the day, it's your responsibility who you give your data to.
- bogomipz 8y ago
  >"NYT seems to be on the attack against FB out of some ideological motivation" What ideology is that? The ideology of truth? The ideology of facts? The ideology of accountability and transparency? The ideology that one of the most power corporations in the world willfully failed to comply with a federal consent decree? Or that they lied to congress? You mean those ideologies? Did you miss the entire news story about how FB was used to influence the 2016 election? And as such it is very much a public interest story. And you want to suggest that reporting on such a public interest story by a newspaper of record is "an attack"?
cryptonector 8y ago
I wonder if Spotify and Netflix look at prospective hires' personal messages. That would be something else. That FB would give lots of user data to third parties is hardly surprising, nor is it shocking. That they'd give private messages to third parties (barring warrants) is shocking, though still not surprising.
0xmohit 8y ago
Although Zuckerberg might refrain from calling users "dumb fucks" any longer, it is evident that he continues to consider them so. It shouldn't be surprising that such networks will continue to monetize whatever they can. > "They trust me — dumb fucks," says Zuckerberg in one of the instant messages, first published by former Valleywag Nicholas Carlson at Silicon Alley Insider, and now confirmed by Zuckerberg himself in Jose Antonio Vargas's New Yorker piece. Zuckerberg now tells Vargas, "I think I've grown and learned a lot" since those instant messages. Source: https://gawker.com/5636765/facebook-ceo-admits-to-calling-users-dumb-fucks https://gawker.com/5636765/facebook-ceo-admits-to-calling-us...
korax 8y ago
Here is a point that I think hasn't been raised yet: You need consent from all parties messaging back and forth. One party consenting to Netflix/Spotify/etc accessing your chat messages, is not enough. I would hypothesize, that they didn't only grant access when all sides had consented, as the API was (supposedly) primarily used to share media with your friends, something that's pretty innocuous and shouldn't require "chat message read" access at all.
dang 8y ago
https://news.ycombinator.com/item?id=18712382 https://news.ycombinator.com/item?id=18712382

297 points by staz 8y ago

lourenchord 8y ago

So basically all of silicon valley is colluding together. Maybe it is time to regulate them and break them up.

speps 8y ago
Spotify is Swedish and their US HQ is in NY.
- dagw 8y ago
  They still have a significant presence in Silicon Valley.
  - harryh 8y ago
    Not really. The bulk of their US workforce is in NYC.
justaman 8y ago
I think the major tech companies should be broken up. However its not 1982 anymore. The global market(mainly China) threw a money wrench into the system. If you break up Google, that's mostly to the benefit of the CPC which will results in a market that's potentially worse than the one we have now.
- andy_ppp 8y ago
  By benefiting free society you strengthen yourself against the CPC IMO.
- ardy42 8y ago
  > If you break up Google, that's mostly to the benefit of the CPC which will results in a market that's potentially worse than the one we have now. https://www.nytimes.com/2018/12/10/opinion/facebook-china-tech-competition.html https://www.nytimes.com/2018/12/10/opinion/facebook-china-te...: > Don’t Fall for Facebook’s ‘China Argument’ > America’s global dominance in technology requires fierce competition at home, not the coddling of monopolies. Also, the Great Firewall is a massive trade barrier, which I think would justify trade-retaliation against the companies protected by it if they somehow they gained ground in the US due to domestic tech-company regulation.
  - nindalf 8y ago
    How would trade retaliation even work? Software isn't that straightforward to tax. For example, say you 2 video games, one of which is Chinese owned (say League of Legends), the other is American owned (say Dota 2). Tell me what justified trade retaliation you would use to promote one over the other? Would you add a $0.01 tax to cosmetics? You can't do it. Of course it doesn't matter to the CPC what Tencent does with this game, because games are inconsequential. But if this wasn't Tencent's LoL, but rather WeChat we were talking about? At that point CPC policies, including censorship will be applied by Tencent. And what "trade-retaliation" will you use then?
- bogomipz 8y ago
  >"If you break up Google, that's mostly to the benefit of the CPC which will results in a market that's potentially worse than the one we have now" No, this false equivalency is something that Big Tech have created now that they are looking at the very real possibility of regulation. Please don't propagate this disingenuous and self-serving bit of economic nationalism for these companies. It's also ironic that you mention Google in this context considering the existence Project Dragonfly.
deweller 8y ago
I can think of no better way to kill innovation than to regulate all technology companies. Look at the state of the telecommunications companies in the US as an example.

gdfasfklshg4 8y ago

Ironic that the site hosting this article does not give a real opt out to intrusive tracking (their privacy policy refers you to your browsers help menu to learn how to block their cookies!). Is this GDPR compliant?

petermcneeley 8y ago

"Giving Spotify, Netflix, and the Royal Bank of Canada the ability to read users’ private Facebook messages." Its RBC that is the interesting one here. Did anyone think we would live in a world where your bank has the ability to read your private messages between your friends? EDIT: Puer mentions below that this might just be a permissions issue and it doesnt mean that they actually read your private messages.

agglomerative 8y ago
And what, pray tell, were they checking up on? My gut is telling me it wasn't just about prospective credit worthiness analysis or placing advertising for retail products and services. Maybe debt collection and finding new ways to hunt down delinquent loan recipients? What else?
- sevensor 8y ago
  Surely credit-worthiness is a scary enough thing for them to concentrate their private message data-mining on?
- Puer 8y ago
  They needed those permissions to allow for sending/receiving of payments over Messenger. NYT is being intentionally misleading with what "permissions" mean here.
  - bunderbunder 8y ago
    Well, "needed" is a strong word. They wouldn't have needed the ability to read arbitrary private messages, just the ability to find out when PMs contain whatever signal is used to send a payment. If they got any more than that, it wasn't because of need, it was because someone at Facebook was being lazy and insufficiently respectful of user privacy.
  - IfOnlyYouKnew 8y ago
    They had access to those messages. That is what they wrote, and it is entirely correct. Nowhere does the article say they used that access in improper ways. The accusation isn’t that your neighbor stole money from your bank account. It’s that your roommate gave them your card and pin, without your consent or even knowledge. If you draw conclusions the journalists consciously did not make, that’s your error in reasoning, not theirs. To then claim insights into the thought process of an action that did not happen, I. e. your accusation of intent, just heightens the absurdity.

the_unknown 8y ago

...and RBC still won't let me use Google Pay - I have to download their apps and do tap-to-pay using it. Best part is that all my other cards are in Google Pay so I'm constantly needing to switch the 'default' tap app because of this. RBC - get out of the way!

Puer 8y ago

1) This is just a duplicate of the NYT article already on the front page 2) NYT seems to intentionally not elaborating on the "access to users' private messages" part and conflating app permissions to actually scanning, parsing, storing, deleting, modifying individual messages. Until disproven, it sounds like these are just standard app permissions needed to implement functions like song sharing in Messenger chat (in the case of Spotify), or sending payments over chat (in the case of RBC). This is disappointing journalism, to be honest. FB has done a lot of bad things and they deserve the negative press, but it does seem like NYT has some kind of personal agenda against the company and they aren't afraid of exploiting the tech ignorance of their readers to accomplish that goal. This is like publishing "Popular privacy extension uBlock Origin 'Accesses your tabs and browsing history'". Yeah. Because it needs those things to function: https://github.com/gorhill/uBlock/wiki/Permissions https://github.com/gorhill/uBlock/wiki/Permissions Anyone who's ever written an Android app or a Chrome extension should see right through this sensationalism.

bluesign 8y ago
Yeah it is standard permission but the situation is more like this. - Facebook had some messages API for developers ( which apps can act as messenger client ), some kind of allowing 3rd party messenger applications, those had all access to messages, conversations, contacts (friends) etc - Then Facebook deprecated this API - Probably after that, someone came up with this ideas about sharing stuff on messenger, (song on spotify case, movie on netflix etc etc) - Then someone in facebook figured out they can use this old API ( in the end they trust those names, they want to do minimal development for this stuff etc ) - So they whitelisted those apps for this deprecated API So basically they messed up, by giving unlimited access to messages of users to some whitelisted apps, instead of giving let's say selective permission to just to 'send some message' over messsages
catacombs 8y ago
> FB has done a lot of bad things and they deserve the negative press, but it does seem like NYT has some kind of personal agenda against the company and they aren't afraid of exploiting the tech ignorance of their readers to accomplish that goal. To say The New York Times and the multiple reporters covering the Facebook scandals all have a personal agenda to make Facebook look bad is delusional. The scandals started with Facebook, and the NYT, as well as other news organizations covering this story, are there to write about it. Moreover, the Times spoke to nearly 60 current and former employees. You'd think if they had an agenda they wouldn't talk to that many people to corroborate the facts. If the paper wanted to do a "hit piece," they'd just grab one of their columnists to write it and slap OPINION at the top of the story. A reminder for some people: Opinion is not the same as News. They are different departments that, in most newsrooms, do not dip in each others work. The Times' investigations team is one of the best in American journalism. I highly doubt the editors would publish a story as a middle finger to Facebook. If you think otherwise, I welcome specific examples of agenda- pushing stories, with exactly the thing they're pushing out that benefits them and not the public. Again, the scandals started with Facebook, and they're out now for every one to see. The old saying goes, "Don't do anything that you'd wouldn't want published on the front page of The New York Times."

kjar 8y ago

FB selling user's private information again: I feign surprise. This is getting old - It is their business model, what did you expect?

jonathanehrlich 8y ago

(disclosure: i used to work for FB). This article left out words like "publicly available information" and "user consent". Why?

fredoliveira 8y ago
I'm confused about what is publicly available information in private messages. Can you explain?
- jonathanehrlich 8y ago
  I'm not sure either but i don't believe there is such a thing. No private message data was shared publicly.
  - fredoliveira 8y ago
    I mean, the articles don't suggest it was shared publicly :-) They suggest it was shared with specific companies - but that it was shared nevertheless. That sounds like a serious violation of users' privacy.
    - jonathanehrlich 8y ago
      If they did it without user consent, it would be an issue for sure.
      - deleted 8y ago
        [deleted]
retSava 8y ago
If by "publicly available information" you mean the EULA, this can in practice not really be expected to be read and understood by the average user. A wall of text with vague remarks is par for such things. Add to this a constantly moving set of settings that change meaning over time (who can read this post now again?).

kbos87 8y ago

I have a problem with the way NYT is reporting on this whole thing. The most egregious sounding parts of this (eg giving Spotify and Netflix the ability to read your messages) sounds like it was entirely tangential to what those agreements were all about. It’s definitely something Facebook should be getting heat for, but there wasn’t some colluding agreement to let RBC mine their customers’ messages, as NYT makes it sound.

IfOnlyYouKnew 8y ago
Where does it say that RBC was mining customers’ messages? And how do you know they did not, when apparently they don’t care enough about users’ privacy to even inform them, and continued said practice even after getting lots of uncomfortable questions?
- kbos87 8y ago
  They don’t need to say it. The way the headline reads and the story is architected is designed to hook readers by implying the worst.
  - IfOnlyYouKnew 8y ago
    So you’re now just making stuff up, then accusing the New York Times for lying to you?
_jal 8y ago
I have a problem with FB's two-faced bullshit, over multiple years, of lying through its teeth to the krill and selling them out with glee on the quiet. It is just who they are. This is why I blackhole their IP space. It is always a mistake, or really we were doing this less-awful sounding thing, it is complicated. And then it comes out that, yet again, it was actually worse that it seemed. Sometimes people change. In this case, it is pretty clear that Zuckerberg still thinks people who trust him are dumb fucks.
- MaxBarraclough 8y ago

cantthinkofone 8y ago

My assumption, my hope really, is that FB gave away private messages in some sanitized and anonymized manner, because Spotify and Netflix was happy to pay for any insider marketing data they could receive about what relevant chat histories have to say about music or movies. NYT seems to be on the attack against FB out of some ideological motivation but the details they are presenting leaves out contextual information about how the data was processed before it was handed off. There's no question FB has been nothing but elusive and ink-spraying about this whole set of ordeals. It's one level of uncomfortable if FB is simply handing away sanitized data, it's another thing if you can just pay them and they will give you all the private posts of any given user without any sort of identity protection. The fact of the matter is FB's terms basically allow them absolute possession of whatever data you give them. So there is so much grey area and legal ambiguity that it has been allowed to work with, especially in the US which matters most for a US company. Europe has come around to the concept of citizen's rights to their own data. In some countries you can't even use websites unless they inform you they store cookies. At the end of the day, it's your responsibility who you give your data to.

bogomipz 8y ago
>"NYT seems to be on the attack against FB out of some ideological motivation" What ideology is that? The ideology of truth? The ideology of facts? The ideology of accountability and transparency? The ideology that one of the most power corporations in the world willfully failed to comply with a federal consent decree? Or that they lied to congress? You mean those ideologies? Did you miss the entire news story about how FB was used to influence the 2016 election? And as such it is very much a public interest story. And you want to suggest that reporting on such a public interest story by a newspaper of record is "an attack"?

cryptonector 8y ago

I wonder if Spotify and Netflix look at prospective hires' personal messages. That would be something else. That FB would give lots of user data to third parties is hardly surprising, nor is it shocking. That they'd give private messages to third parties (barring warrants) is shocking, though still not surprising.

0xmohit 8y ago

Although Zuckerberg might refrain from calling users "dumb fucks" any longer, it is evident that he continues to consider them so. It shouldn't be surprising that such networks will continue to monetize whatever they can. > "They trust me — dumb fucks," says Zuckerberg in one of the instant messages, first published by former Valleywag Nicholas Carlson at Silicon Alley Insider, and now confirmed by Zuckerberg himself in Jose Antonio Vargas's New Yorker piece. Zuckerberg now tells Vargas, "I think I've grown and learned a lot" since those instant messages. Source: https://gawker.com/5636765/facebook-ceo-admits-to-calling-users-dumb-fucks https://gawker.com/5636765/facebook-ceo-admits-to-calling-us...

korax 8y ago

Here is a point that I think hasn't been raised yet: You need consent from all parties messaging back and forth. One party consenting to Netflix/Spotify/etc accessing your chat messages, is not enough. I would hypothesize, that they didn't only grant access when all sides had consented, as the API was (supposedly) primarily used to share media with your friends, something that's pretty innocuous and shouldn't require "chat message read" access at all.

dang 8y ago

https://news.ycombinator.com/item?id=18712382 https://news.ycombinator.com/item?id=18712382