7 ms·

They weren’t selling data. It was a series of API integrations for popular sites that ended years ago. Users had to sign in to those services. I have way less t

They weren’t selling data. It was a series of API integrations for popular sites that ended years ago. Users had to sign in to those services. I have way less trust for our tech illiterate congress than I do for Facebook.

___alt 8y ago
It was unclear to users what they consented to when they signed in. Because Facebook doesn't give a damn about proper consent. The fact that Facebook botched it up is not less problematic than Facebook selling data because the outcome for users is more or less the same. Turns out "move fast and break things" is a shitty policy when it comes to privacy concerns.
- bg4 8y ago
  Sounds like we need another Facebook apology tour.
  - elliekelly 8y ago
    "We're sorry you misunderstood how we operate." - Zuckerberg
    - how_many_times 8y ago
      Zuckerberg to users:"You are all too stupid" Users are aghast. "Mark, that is utterly disrespectful. Say you are sorry!" Zuckerberg to users: "I am sorry that you are all too stupid"
  - kumarharsh 8y ago
    This strongly reminds me of that South Park episode which had the BP Oil CEO apologizing for fucking up. Over and over again. https://m.youtube.com/watch?v=WTsDqIcpHUc https://m.youtube.com/watch?v=WTsDqIcpHUc
- razakel 8y ago
  >It was unclear to users what they consented to when they signed in. I highly doubt anyone would consent to allowing third party companies to read their private messages if that was actually made clear to them.
  - ikeboy 8y ago
    Plenty of people installed Facebook apps that required permission to read all text messages
    - zyx321 8y ago
      Yes, but that doesn't mean that they consent to Facebook using that data. Whatsapp for example asks "read SMS" permission to verify your phone number. It also requires access to your contact list or else everyone's name will be shown as a phone number. The average user seems to assume that the information is used to provide the service and nothing more. The last person I asked if they were worried about how much information FB has about them replied something among the lines of "Yes, but it's only things that I deliberately chose to share." (paraphrased)
  - mikeash 8y ago
    I think this might be part of the problem. The idea of handing over your private messages to some random company is so absurd that the average person probably assumes that it couldn’t possibly be what they’re asking for. You’ll have to make the permission prompt really explicit to overcome that.
- ilovecaching 8y ago
  >The fact that Facebook botched it up is not less problematic than Facebook selling data because the outcome for users is more or less the same. Users signed in to services they already had accounts with, and therefore trusted, knowing they were enabling features they wanted to use with their data. These services were hand selected big name companies. This is a far cry from selling data to the highest bidder for profit.
wil421 8y ago
When I use a Google or Facebook account to sign into other services I do not expect private messages to be exposed. My likes, pages I follow and other relevant stuff would be expected. I do not expect a company to share my information to a 3rd party just because one of my friend consented.[1] Congress needs to lay the hammer down and come up with privacy rights akin to GDRP. [1]https://www.theverge.com/2018/12/18/18147616/facebook-user-data-giveaway-nyt-apple-amazon-spotify-netflix https://www.theverge.com/2018/12/18/18147616/facebook-user-d...
- malvosenior 8y ago
  It wasn't about signing up to the accounts using FB though (as far as I understand it). These were services that acted as clients for the private messaging so they could send media directly to your friends via FB messages. I could see the granularity being too low (maybe they should have only had access to messages created in that 3rd party service), but I don't think it was necessarily nefarious that they had blanket access to all private messages, that was just the most straight forward way to implement it during a time period when people were way more excited about open APIs then they were about strict privacy.
  - wil421 8y ago
    I was just using the sign in via FB or Google as an example of times where user might not know what they are consenting to. I wouldn’t assume this gives the 3rd party access to my emails. This is exactly where we need congress to step in and regulate personal data. I’ve built rest APIs at work and I almost always restrict this type of behavior. Why weren’t they only given access to create PMs and update PMs they create? No requests to pull all the PMs of a certain user.
    - miracle2k 8y ago
      You may well have been asked for explicit consent to message access. The New York Times is specifically vague about this. They could tell us what kind of access was asked for, but they do not even mention that any kind of access was asked for. Why?
amartya916 8y ago
"I have way less trust for our tech illiterate congress than I do for Facebook." That is a perfectly fine position for you to take. But if you consider that a majority of the citizenry also does not understand the ramifications of "API integrations", doesn't it seem like the Congress is reasonably representative of the population? And that in that case, recent revelations might lead them to being fed up?

___alt 8y ago

It was unclear to users what they consented to when they signed in. Because Facebook doesn't give a damn about proper consent. The fact that Facebook botched it up is not less problematic than Facebook selling data because the outcome for users is more or less the same. Turns out "move fast and break things" is a shitty policy when it comes to privacy concerns.

bg4 8y ago
Sounds like we need another Facebook apology tour.
- elliekelly 8y ago
  "We're sorry you misunderstood how we operate." - Zuckerberg
  - how_many_times 8y ago
    Zuckerberg to users:"You are all too stupid" Users are aghast. "Mark, that is utterly disrespectful. Say you are sorry!" Zuckerberg to users: "I am sorry that you are all too stupid"
- kumarharsh 8y ago
  This strongly reminds me of that South Park episode which had the BP Oil CEO apologizing for fucking up. Over and over again. https://m.youtube.com/watch?v=WTsDqIcpHUc https://m.youtube.com/watch?v=WTsDqIcpHUc
razakel 8y ago
>It was unclear to users what they consented to when they signed in. I highly doubt anyone would consent to allowing third party companies to read their private messages if that was actually made clear to them.
- ikeboy 8y ago
  Plenty of people installed Facebook apps that required permission to read all text messages
  - zyx321 8y ago
    Yes, but that doesn't mean that they consent to Facebook using that data. Whatsapp for example asks "read SMS" permission to verify your phone number. It also requires access to your contact list or else everyone's name will be shown as a phone number. The average user seems to assume that the information is used to provide the service and nothing more. The last person I asked if they were worried about how much information FB has about them replied something among the lines of "Yes, but it's only things that I deliberately chose to share." (paraphrased)
- mikeash 8y ago
  I think this might be part of the problem. The idea of handing over your private messages to some random company is so absurd that the average person probably assumes that it couldn’t possibly be what they’re asking for. You’ll have to make the permission prompt really explicit to overcome that.
ilovecaching 8y ago
>The fact that Facebook botched it up is not less problematic than Facebook selling data because the outcome for users is more or less the same. Users signed in to services they already had accounts with, and therefore trusted, knowing they were enabling features they wanted to use with their data. These services were hand selected big name companies. This is a far cry from selling data to the highest bidder for profit.

wil421 8y ago

When I use a Google or Facebook account to sign into other services I do not expect private messages to be exposed. My likes, pages I follow and other relevant stuff would be expected. I do not expect a company to share my information to a 3rd party just because one of my friend consented.[1] Congress needs to lay the hammer down and come up with privacy rights akin to GDRP. [1]https://www.theverge.com/2018/12/18/18147616/facebook-user-data-giveaway-nyt-apple-amazon-spotify-netflix https://www.theverge.com/2018/12/18/18147616/facebook-user-d...

malvosenior 8y ago
It wasn't about signing up to the accounts using FB though (as far as I understand it). These were services that acted as clients for the private messaging so they could send media directly to your friends via FB messages. I could see the granularity being too low (maybe they should have only had access to messages created in that 3rd party service), but I don't think it was necessarily nefarious that they had blanket access to all private messages, that was just the most straight forward way to implement it during a time period when people were way more excited about open APIs then they were about strict privacy.
- wil421 8y ago
  I was just using the sign in via FB or Google as an example of times where user might not know what they are consenting to. I wouldn’t assume this gives the 3rd party access to my emails. This is exactly where we need congress to step in and regulate personal data. I’ve built rest APIs at work and I almost always restrict this type of behavior. Why weren’t they only given access to create PMs and update PMs they create? No requests to pull all the PMs of a certain user.
  - miracle2k 8y ago
    You may well have been asked for explicit consent to message access. The New York Times is specifically vague about this. They could tell us what kind of access was asked for, but they do not even mention that any kind of access was asked for. Why?

amartya916 8y ago

"I have way less trust for our tech illiterate congress than I do for Facebook." That is a perfectly fine position for you to take. But if you consider that a majority of the citizenry also does not understand the ramifications of "API integrations", doesn't it seem like the Congress is reasonably representative of the population? And that in that case, recent revelations might lead them to being fed up?