14 ms·

Facebook Knows How to Track You Using the Dust on Your Camera Lens

403 points by huntermeyer 8y ago

edoo 8y ago
I really don't get these patents. How can you patent ifchecks on data if it is ascribed to an abstract process.
userbinator 8y ago
or if lens scratches or dust were detectable in the same spots on the photos, revealing the photos were taken by the same camera With the prevalence of mobile phones, whose camera lenses are likely to be exposed to a lot more "scrubbing" than a professional/dedicated camera, I suspect this might not work so well.
- jnnnthnn 8y ago
  Wouldn't it possible for it to work better if it is the case that more dense scrubbing patterns are complex enough to differentiate one camera from the other, and that such an algorithm can pick up on that?
  - vuln 8y ago
    I agree. It seems to me that everyone's scrubbing would be different thus pretty unique.
    - lucideer 8y ago
      I thought the point was more about variance over time. Surely a camera would need to have consistent patterns over time for this to work?
- mc32 8y ago
  But it’s more part of an identifying composit “fingerprint” than as an individual unique identifier.
- meowface 8y ago
  What do you mean exactly by scrubbing?
vlovich123 8y ago
What's the news story here? Tech companies file innumerable number of patents without implementing them to cover the space in case they get sued so they can retaliate. Realistically this patent wouldn't actually be useful in practice for the proposed application but would be useful if written carefully enough to countersue for unrelated applications of the tech.
- vertexFarm 8y ago
  What? You're saying companies file patents on tech they don't intend on using so they don't get sued by patent trolls for their non-use of some other preexisting patent? That doesn't make sense on any level. And if you don't think such a thing would be useful to a company like this (if it could really be made to work) you aren't using your imagination properly.
  - sprayk 8y ago
    > What? You're saying companies file patents on tech they don't intend on using so they don't get sued by patent trolls for their non-use of some other preexisting patent? That doesn't make sense on any level. Why does that not make sense? This has been the case at every job I've worked withe patent filing incentives. You get a few thousand dollars for coming up with an idea and going through the motions of writing the technical parts of the patent. The patent doesn't have to have anything to do with the business, they just want it for defense, and to increase value of a potential sale of the company.
    - vertexFarm 8y ago
      Okay, I get that it adds value to the company. But what do you mean by defense? How is filing patents that you don't intend to produce so you can win legal battles any different from patent trolling?
      - ALittleLight 8y ago
        The "defense" part is that big company X with a large patent portfolio might sue you for infringing on a patent - unless you have a large patent portfolio because then if they sue you, your lawyers can review everything they're doing and compare it to your patent portfolio and find ways to sue them. This is something like mutually assured destruction. It seems preposterous to me, but this is also the basic idea I've got from working at multiple big companies where they have training meetings to explain these things. You're very much encouraged to come up with ideas and submit them for the lawyers to look at and possibly patent even if it has no applicability to anything you're doing.
pxeboot 8y ago
by comparing the accelerometer and gyroscope readings of each phone, the data could identify when people were facing each other or walking together. More evidence we need far more privacy controls in mobile operating systems.
- gdulli 8y ago
  I've always been floored that people leave their location services turned on by default. I have mine on for no more than a few minutes a month. I only turn it on when I'm in an unfamiliar location, don't have my bearings, and looking at the map alone isn't enough to help without GPS.
  - crb002 8y ago
    Some people see the glass half full as they have evidence of their movements as an alibi should they need it.
    - smelendez 8y ago
      Or a fake alibi if you're sufficiently determined. Go fishing in a secluded area regularly to establish a pattern. Then go hide your phone there one day, do crime, come back and get phone.
    - TuringNYC 8y ago
      Or half empty -- as evidence they were somewhere unfortunate (doing something totally benign and unrelated.)
      - drusepth 8y ago
        Why would this be a concern? At worst, you're somewhere unfortunate (doing something benign and unrelated) and someone brings you in for questioning about it. Wouldn't they do that in many cases even if your GPS was off (for example, from seeing you on cameras or other means)? It seems better to be able to bring in as many people as possible to get whatever information is needed to help with whatever situation was unfortunate in the first place. If asked, it's not like you're going to lie and say you were somewhere else if your GPS was off. This way, you at least have proof you were exactly where you said you were.
api 8y ago
I've come to believe that privacy "by design" is impossible in the hyper-connected age. There are too many vectors for tracking, linking, and de-anonymization and software in general is too insecure. The only solution to the privacy problem is legislation. My favorite idea is HIPAA type regulations for intimate personal data like audio, location, etc. Leak location data? That will be $10,000 per incident where an incident is one record per person on a given day. This would transform data like this into a liability rather than an asset, pushing companies to store it only long enough to perform a given service and to develop cryptographically blinded systems whenever possible to cut exposure. As it stands all the economic incentives encourage all vendors (even small indy apps) to maximize privacy invasion at every opportunity.
- mc32 8y ago
  I usually come down on the libertarian side of things, but given the virtual monopoly by way of network effects, I do think some legislation for user derived data is necessary. These folk are not going to self regulate and waive potential revenue if they are not made to. I’d go so far as declare them “near utilities”.
  - JumpCrisscross 8y ago
    > I’d go so far as declare them “near utilities” Plastic surgeons are bound by HIPAA. They do not provide essential services. Similarly, we can regulate social networks without ensconcing them into our society’s fabric as utilities.
    - mc32 8y ago
      Interestingly, though I’m loath to insinuate they are an authority on anything, the UN has declared Internet access and access to information and dissemination a basic human right. “[The UN] condemns unequivocally measures to intentionally prevent or disrupt access to or dissemination of information online”. It appears they believe it’s close to being a utility, and I’d argue in a way it has become close enough to need oversight as such.
a-dub 8y ago
I'm not really sure if that's a scary facebook thing or merely just an inconvenient reality of the world we live in now. There's quite a few papers out on fingerprinting/identifying cameras from images taken with them using intrinsics (dust, scratches, slight offset of image sensor with respect to lens).
- rhizome 8y ago
  I'm not really sure if that's a scary facebook thing or merely just an inconvenient reality of the world we live in now. These aren't mutually exclusive. The reality of the world may just be acquiring more scary things, and ones that are created for profit.
  - ralusek 8y ago
    Is something being created for profit scarier/worse? I'm personally far more concerned about government surveillance programs that I have no option but to participate in.
    - AlexandrB 8y ago
      I'm always confused by comments like this. Not only is corporate surveillance always one NSL away from being used by the government, but corporations aren't democracies. As a user I can't vote on what data Facebook choses to collect. Facebook's shadow profiles also put to rest the idea that you get to choose whether or not to participate in corporate surveillance.
      - BigJono 8y ago
        Ask me and the other citizens of Australia what democracy has done to save us from government mass surveiallance. It may possibly be one of the worst guards against it. 99% of the population don't understand it and don't give a shit. Co-incidently that's the only reason Facebook and Google get away with it too, or it'd be far more profitable for them to back off and play the "we value your privacy" PR card. Literally the only difference is that Facebook is headed by software engineers and governments are headed by a bunch of people with tons of power and no knowledge. You tell me which is more dangerous. You can't act ethically if you don't even understand the domain you're acting in.
pdxww 8y ago
This is smart. Unethical, but smart.
- remarkEon 8y ago
  Indeed. I'm wishing for a "dumb" social networking company, where the people who run it are idiots and I don't have to worry about this kind of invasive engineering (I long ago deleted my Facebook). There's always twitter, I suppose.
  - xena 8y ago
    Mastodon seems to be the balance I've been liking.
  - abootstrapper 8y ago
    Can we not have smart ethical people? When did getting away with unethical or unlawful behavior become associated with “smart?”
    - ravenstine 8y ago
      Seems pretty rare. Most people want the money and prestige that comes from working for Facebook or Google. It's easy to be a rebel when you've got nothing to lose.
    - remarkEon 8y ago
      It's always been associated with smart? I think the point you were trying to make is that I shouldn't directly tie intelligence with unethical behavior (i.e. all smart people are unethical), and you're right. That said, my point remains ... in this age the unethical exploits will by definition be discovered and implemented by intelligent individuals.
- vertexFarm 8y ago
  Lots of that going around these days. Always reminds me of part of the speech at the end of The Great Dictator. "We think too much and feel too little. More than machinery we need humanity. More than cleverness we need kindness and gentleness. Without these qualities, life will be violent and all will be lost."
aasasd 8y ago
I'm pretty sure Google and other large networks also build 'shadow profiles' on users to figure out who they are, who they're connected to, etc. And I wonder if this shady profiling data should be available for users to download under e.g. GDPR. Because it sounds to me like it should, but isn't.
- hedora 8y ago
  If any europeans with spare time and no Facebook account are reading this, get a lawyer (maybe related to the EFF, or not), and send a GPDR request. When it comes back “no data”, record yourself signing up for a FB account, since at that point, they’ll list suggested contacts that cover pretty much everyone you know. (Even if this doesn’t work as I predict, it’d document what they’re doing for gpdr compliance.)
  - mehrdadn 8y ago
    Why does that require having a profile on you in particular? They could be saving all the data from everyone else (e.g. their contacts, their search queries, etc.) and dynamically assembling it when you make an account to make you recommendations. They don't have to be doing anything related to you in particular.
- netsharc 8y ago
  I recall someone asked the Zuckholebot about shadow profiles in one of those hearings, and he avoided answering the question... Something about "my team will get back to you on thay, Senator.".
anonytrary 8y ago
Jokes on them, I have electrical tape on my camera lens. Something I learned from Facebook's CEO, ironically.
- nixpulvis 8y ago
  I'd love to see people spending >$1,000 on a new iPhone "for the camera", only to cover it with electrical tape. This sounds like something out of Silicon Valley.
  - paulryanrogers 8y ago
    It is rather amazing that smartphone cameras are so feature packed, yet still lack a lens cover. Something as old as cameras themselves.
    - nixpulvis 8y ago
      Old cameras didn't exactly fit in your pocket, and didn't have sapphire glass... Though I do think it would be nice to have a hardware (iris?) way to close off the camera. Some laptops have this, though I'm sad mine doesn't.
      - deleted 8y ago
        [deleted]
      - walterbell 8y ago
        They are available for phones and laptops, e.g. https://www.amazon.com/gp/product/B07B66VZ97/ https://www.amazon.com/gp/product/B07B66VZ97/
        sky_rw 8y ago
        +1 these are awesome. I have them on all my devices.
        _emacsomancer_ 8y ago
deleted 8y ago
[deleted]
bredren 8y ago
New to some but this is regurgitated content as these patents were reported on long ago.
vertexFarm 8y ago
Gross. Oh well, another one for the already massive pile of unreasonably greasy facebook creeping. Massively parallel automated stalking. This shit needs to be regulated soon. A lot of the people being data-fucked are not actually people who have signed a EULA or anything, and it's getting more and more dubious that this is readily-available information "in the public square" that has no reasonable expectation of privacy. In my opinion at least, as if that's worth anything. Also forgive me if I don't 100% take their word for it that none of this shit has been implemented except a few tests in 2015. These companies are never forthcoming with the truth around these matters of privacy and security. Ever. Any breach, any shady practice is denied until it's not possible to deny anymore. Why should they be truthful? It can only bring bad PR and there has literally never been consequences for lying about it.
nlh 8y ago
I was talking to a friend today who said, fairly succinctly, that Facebook's single biggest problem is that they Totally and Royally Suck(TM) at PR. I wonder what would happen if they were just straightforward about this. "Friends you May Know is really cool! We use your phone's location data and do cross-checks on your address book to make the most intelligent suggestions. We even use some unique features of your camera to figure out if you know people!" They don't have to give away the store, but they could certainly avoid the creepy "try and guess what ridiculously creepy stuff we're doing to suggest friends" game.
- dgzl 8y ago
  Being upfront would bring more press... Alternatively, how many of your friends are going to read this article?
  - beatgammit 8y ago
    Would it? The press likes to jump on surprising news, and if everything is upfront, there's not much to report on. They could even make a way to opt out if people complain (and few would actually opt out), which would save face in the media. I don't use Facebook because I value my privacy, and I'd probably have less success convincing people to leave the platform if they were upfront about the stuff they do. People care a lot less about their privacy than PR firms seem to realize...
- drb91 8y ago
  Actually enumerating what data might be used for strikes me as incredibly unlikely. They could also come up with a more substantial business model.
- drdaeman 8y ago
  > Friends you May Know is really cool! I've got over 9000 suggestions and not a single accurate one. Maybe they have the best technology and all the data out there, but I'm skeptical they can really use all the data they supposedly have on me. Same goes for any targeted advertisement, not just Facebook. Some come close (based on simple topic preferences), but in all those years I've yet to see any large number of the actually useful ones. All those data mining and AI-driven targeting seem to utterly fail, suggesting me to buy a second TV after I've just already got a new one. Or subscribe to Grammarly (every second YouTube pre-roll, seriously?!), when I've already bought that.
smelendez 8y ago
Is this actually a common scenario? Facebook users who aren't friends but upload photos taken with the same camera?
sonnyblarney 8y ago
Ok, this is definitely bad news upon bad news ... but you have to concede it's pretty cool. Outside the scope of actually doing this: you wish you had of thought of it!
mehrdadn 8y ago
> “We’ve often sought patents for technology we never implement, and patents should not be taken as an indication of future plans.” How is this possible? Wasn't it a requirement of a patent grant that you actually try to put it to use?
jcoffland 8y ago
> or if lens scratches or dust were detectable in the same spots on the photos, revealing the photos were taken by the same camera. This seems pretty useless. The only scenario where it gives FB more information is where person A takes a picture, gives it to person B through some route other than FB and then person B posts it on FB. Any other scenario and FB does not need to compare dust specks.
- bad_user 8y ago
  But this happens quite often, like every time people get together.
  - jcoffland 8y ago
    Your saying people who use FB regularly share photos outside of FB and then upload someone else's photos to FB? I'm not saying it doesn't happen, just that it's not the normal path. I think people who use FB generally share photos with their friends who are also on FB, through FB.
    - bad_user 8y ago
      Not in my experience and I have many friends outside of tech circles, since I'm not living in a tech bubble. When people get together group photos happen, or photos that you want, made with somebody else's phone. The result is basically dozens of photos out of which only the best 2 or 3 get shared on Facebook. And in general Facebook is not how those photos get shared. Not even its Messenger because it has annoying size limits, which matter for videos. If I were to guess, out of Facebook's properties, WhatsApp is probably the most popular photo sharing app by volume ;-)
- TOMDM 8y ago
  There is another compelling usecase. I feel there is no reason to expect Facebook would be content with data hosted on just their platform. With camera fingerprinting, they could be relatively sure who you are on other platforms like Twitter, VK, Youtube etc in cases where the user doesn't use the same email/name.
qsdevacc 8y ago
Disabling locations services doesn't stop all forms of location tracking.
aleem 8y ago
From a comment I had left on a related thread, > Though very uncanny, this is rather easy to extrapolate even using the basic facets FB has available. But the most overlooked is photos. They are offline beacons and are to offline tracking what websites are to online tracking. For example you and a group of 10 other people took photos at the same location which FB sees as a small gathering of intimate friends. It will need to qualify the location is not a public restaurant to be sure its an intimate gathering. The chances of you connecting with that person are then really high. And if you are and the other person are in each others photos, then it's almost a certainty you will end up connecting on FB should FB recommend the connection. The more connected FB's network is, the more it can extrapolate based on commonalities from the first degree graph of your network. It's also the reason why Google is betting so heavy on photos and offering free unlimited storage -- remember, there's no such thing as a free lunch. Google wants to build a social network graph based on location and facial recognition to draw on proximity. With AI this will get even more uncanny. For example a wedding will have a certain photography profile (number of pics taken, the time of day, the location and venue based on Google Maps or past photographing histroy, the lighting in the photos, etc). Once you throw AI into the mix you realize Google doesn't need to draw out any conclusions. It can throw all these parameters into the AI engine and draw up proximity. In this case, Google or FB will not be able to tell you how they drew the connection, because even they won't know. All you can assume is the AI engine will take dozens of parameters today and hundreds tomorrow. Google's deep investment in AI infrastructure is a bigger testament to this.
- aorav 8y ago
  Can you substantiate any of what you present as facts with actual sources?
  - deleted 8y ago
    [deleted]
- deanCommie 8y ago
  > In this case, Google or FB will not be able to tell you how they drew the connection, because even they won't know. All you can assume is the AI engine will take dozens of parameters today and hundreds tomorrow. Sure there are ways to implement systems like this where you can't understand what they are doing. Just like you can launch websites and webservices without any metrics, monitors, or logging. But why would you? It requires more work, and it makes the underlying architecture more complicated but any sensible organization with a good engineering excellence fundamentals would ensure they can introspect and debug the outputs of any production algorithm.
the-watchtower 8y ago
I am going to go out on a limb and say that this crosses the line from "invasion of privacy" to "just plain evil." Seriously: this is the type of stuff that you expect to find in state-sponsored malware, not software that's forced onto the majority of consumers.
- brokenmachine 8y ago
  > not software that's forced onto the majority of consumers I agree with you on your other points, but not "forced". I've left Facebook and encourage anyone who cares about privacy at all to do the same.
dompydumpy 8y ago
So we'll regulate facebook maybe?
xg15 8y ago
Pardon for the somewhat OT post, but the quotes about patent use in the article made me realize once again that I don't get how the patent system works. > [Facebook:] "We’ve often sought patents for technology we never implement, and patents should not be taken as an indication of future plans." > “A lot of patents are filed at the idea stage rather than the actuality stage,” said Ranieri by phone. “A tech company that files a patent has, hopefully, at least thought about how to do it. You’d hope they could implement it if asked, but it doesn’t mean they have done so before.” So if registering a patent neither requires that I actually intend to make use of the idea, nor that I even knew how to do it, what keeps me from patenting moonshots such as "A general framework for DNA-editing based cancer therapies" or "A method to construct a moon base using a mix of on-site material and material sourced from earth" and start raking in cash once someone else figures out the details and actually wants to do it?
- cm2012 8y ago
  Companies do this all the time. Amazon succesfully patented a 1 click buy button, for god's sake.
  - lolc 8y ago
    Though they actually used that one and it worked well. Not to say it wasn't an absurd patent.
- ndnxhs 8y ago
  What stops you doing that is the organisation trying to construct a moon base has more money than you so your patents don't apply anymore.
- ztjio 8y ago
  You and the person mentioning 1-click are definitely off base on patent understanding. It's true that you don't have to actually try to do the thing you patent nor that it has to actually work. However, a patent isn't an idea. It's a specific description of HOW to do accomplish something. So your "general framework for DNA-editing based on cancer therapies" will have to include statements describe the actual process. Sometimes patents have fairly vague statements here, but, those are rarely defensible. More commonly, they balance specificity with generality. For 1-click have a look at the patent claims https://worldwide.espacenet.com/publicationDetails/claims?CC=US&NR=5960411A&KC=A&FT=D&ND=&date=19990928&DB=&locale=en_EP https://worldwide.espacenet.com/publicationDetails/claims?CC... This is not simply saying "oh, we invented the idea of a single click buying experience, nobody else can do it now." It is saying HOW they did (or would do) it and the reason Apple licensed that patent is because they did it the same way. If someone did it in a way not described in the patent, it wouldn't be covered by the patent even if the outcome was the same. For example, the patent specifically says the server system knows info about the user. Today, you can go to many websites and 2-click order a product using Apple Pay where the server knows nothing about you. If we ignored good security practices, this could be 1 click (just skip the verification pop-up, the rest would work fine.) The patent (if it were still valid, which it is not due to expiration) would not cover this. Now, one can still always dispute the specificity of a patent. And reading 1-click claims as a software developer, some of it may still feel "obvious," but, the reality is nobody did it before Amazon. So how obvious was it really? They go far enough to describe that the system already knew things about the user, that there was an identifier sent to relate to that info, that a single action of some kind was taken, that the system was displaying info about the product, etc. So in your cancer therapy example, you would need a similar description of how it would work. Not down to the explicit details, but, enough to set it apart from any other similar method or approach to the same outcome.
tim333 8y ago
Clickbait headline. The closest they get to it is >One filed in 2015 describes a technique that would connect two people through the camera metadata associated with the photos they uploaded. It might assume two people knew each other if the images they uploaded looked like they were titled in the same series of photos—IMG_4605739.jpg and IMG_4605742, for example—or if lens scratches or dust were detectable in the same spots on the photos, revealing the photos were taken by the same camera. ie facebook mentioned the concept of tracking you by the dust on your lens. No evidence that they can actually do it.
antaviana 8y ago
With the gyroscope and accelerometer feature implemented, you will be able to friend with someone who stole your phone.
josefresco 8y ago
Imagine being at a bar, and a guy engages you in conversation. You try your best to indicate you're not interested, and your friends help shoo him away. Then, that night when we gets home Facebook tells him your name and suggests you connect. Creepy AF (and not the guy)
- IshKebab 8y ago
  If they are using the dust on your camera apparently you'd have to both take photos with the same camera and then upload them to your respective accounts. Then facebook will correlate the dust and learn you are friends. I don't see that happening... ever. Even if it were possible (I'm pretty sure dust and scratches on a camera lens aren't in focus...).
  - brokenmachine 8y ago
    It could also be the sensor, say if certain pixels were slightly less sensitive than the surrounding ones. You could run statistical analysis of the image and spot the similarities.
nkkollaw 8y ago
We leave in scary times.
clubm8 8y ago
Facebook's Achilles's Heel is it doesn't know the strength of your connections. There's lots of data points, but they currently do a poor job of parsing them. Unfortunately given their recent privacy struggles it may be difficult for them to leverage their dataset to answer that question without driving off users.
OnlyRepliesToBS 8y ago
lol we do what we must because we can

403 points by huntermeyer 8y ago

edoo 8y ago

I really don't get these patents. How can you patent ifchecks on data if it is ascribed to an abstract process.

or if lens scratches or dust were detectable in the same spots on the photos, revealing the photos were taken by the same camera With the prevalence of mobile phones, whose camera lenses are likely to be exposed to a lot more "scrubbing" than a professional/dedicated camera, I suspect this might not work so well.

jnnnthnn 8y ago
Wouldn't it possible for it to work better if it is the case that more dense scrubbing patterns are complex enough to differentiate one camera from the other, and that such an algorithm can pick up on that?
- vuln 8y ago
  I agree. It seems to me that everyone's scrubbing would be different thus pretty unique.
  - lucideer 8y ago
    I thought the point was more about variance over time. Surely a camera would need to have consistent patterns over time for this to work?
mc32 8y ago
But it’s more part of an identifying composit “fingerprint” than as an individual unique identifier.
meowface 8y ago
What do you mean exactly by scrubbing?

vlovich123 8y ago

What's the news story here? Tech companies file innumerable number of patents without implementing them to cover the space in case they get sued so they can retaliate. Realistically this patent wouldn't actually be useful in practice for the proposed application but would be useful if written carefully enough to countersue for unrelated applications of the tech.

vertexFarm 8y ago
What? You're saying companies file patents on tech they don't intend on using so they don't get sued by patent trolls for their non-use of some other preexisting patent? That doesn't make sense on any level. And if you don't think such a thing would be useful to a company like this (if it could really be made to work) you aren't using your imagination properly.
- sprayk 8y ago
  > What? You're saying companies file patents on tech they don't intend on using so they don't get sued by patent trolls for their non-use of some other preexisting patent? That doesn't make sense on any level. Why does that not make sense? This has been the case at every job I've worked withe patent filing incentives. You get a few thousand dollars for coming up with an idea and going through the motions of writing the technical parts of the patent. The patent doesn't have to have anything to do with the business, they just want it for defense, and to increase value of a potential sale of the company.
  - vertexFarm 8y ago
    Okay, I get that it adds value to the company. But what do you mean by defense? How is filing patents that you don't intend to produce so you can win legal battles any different from patent trolling?
    - ALittleLight 8y ago
      The "defense" part is that big company X with a large patent portfolio might sue you for infringing on a patent - unless you have a large patent portfolio because then if they sue you, your lawyers can review everything they're doing and compare it to your patent portfolio and find ways to sue them. This is something like mutually assured destruction. It seems preposterous to me, but this is also the basic idea I've got from working at multiple big companies where they have training meetings to explain these things. You're very much encouraged to come up with ideas and submit them for the lawyers to look at and possibly patent even if it has no applicability to anything you're doing.

pxeboot 8y ago

by comparing the accelerometer and gyroscope readings of each phone, the data could identify when people were facing each other or walking together. More evidence we need far more privacy controls in mobile operating systems.

gdulli 8y ago
I've always been floored that people leave their location services turned on by default. I have mine on for no more than a few minutes a month. I only turn it on when I'm in an unfamiliar location, don't have my bearings, and looking at the map alone isn't enough to help without GPS.
- crb002 8y ago
  Some people see the glass half full as they have evidence of their movements as an alibi should they need it.
  - smelendez 8y ago
    Or a fake alibi if you're sufficiently determined. Go fishing in a secluded area regularly to establish a pattern. Then go hide your phone there one day, do crime, come back and get phone.
  - TuringNYC 8y ago
    Or half empty -- as evidence they were somewhere unfortunate (doing something totally benign and unrelated.)
    - drusepth 8y ago
      Why would this be a concern? At worst, you're somewhere unfortunate (doing something benign and unrelated) and someone brings you in for questioning about it. Wouldn't they do that in many cases even if your GPS was off (for example, from seeing you on cameras or other means)? It seems better to be able to bring in as many people as possible to get whatever information is needed to help with whatever situation was unfortunate in the first place. If asked, it's not like you're going to lie and say you were somewhere else if your GPS was off. This way, you at least have proof you were exactly where you said you were.

api 8y ago

I've come to believe that privacy "by design" is impossible in the hyper-connected age. There are too many vectors for tracking, linking, and de-anonymization and software in general is too insecure. The only solution to the privacy problem is legislation. My favorite idea is HIPAA type regulations for intimate personal data like audio, location, etc. Leak location data? That will be $10,000 per incident where an incident is one record per person on a given day. This would transform data like this into a liability rather than an asset, pushing companies to store it only long enough to perform a given service and to develop cryptographically blinded systems whenever possible to cut exposure. As it stands all the economic incentives encourage all vendors (even small indy apps) to maximize privacy invasion at every opportunity.

mc32 8y ago
I usually come down on the libertarian side of things, but given the virtual monopoly by way of network effects, I do think some legislation for user derived data is necessary. These folk are not going to self regulate and waive potential revenue if they are not made to. I’d go so far as declare them “near utilities”.
- JumpCrisscross 8y ago
  > I’d go so far as declare them “near utilities” Plastic surgeons are bound by HIPAA. They do not provide essential services. Similarly, we can regulate social networks without ensconcing them into our society’s fabric as utilities.
  - mc32 8y ago
    Interestingly, though I’m loath to insinuate they are an authority on anything, the UN has declared Internet access and access to information and dissemination a basic human right. “[The UN] condemns unequivocally measures to intentionally prevent or disrupt access to or dissemination of information online”. It appears they believe it’s close to being a utility, and I’d argue in a way it has become close enough to need oversight as such.

a-dub 8y ago

I'm not really sure if that's a scary facebook thing or merely just an inconvenient reality of the world we live in now. There's quite a few papers out on fingerprinting/identifying cameras from images taken with them using intrinsics (dust, scratches, slight offset of image sensor with respect to lens).

rhizome 8y ago
I'm not really sure if that's a scary facebook thing or merely just an inconvenient reality of the world we live in now. These aren't mutually exclusive. The reality of the world may just be acquiring more scary things, and ones that are created for profit.
- ralusek 8y ago
  Is something being created for profit scarier/worse? I'm personally far more concerned about government surveillance programs that I have no option but to participate in.
  - AlexandrB 8y ago
    I'm always confused by comments like this. Not only is corporate surveillance always one NSL away from being used by the government, but corporations aren't democracies. As a user I can't vote on what data Facebook choses to collect. Facebook's shadow profiles also put to rest the idea that you get to choose whether or not to participate in corporate surveillance.
    - BigJono 8y ago
      Ask me and the other citizens of Australia what democracy has done to save us from government mass surveiallance. It may possibly be one of the worst guards against it. 99% of the population don't understand it and don't give a shit. Co-incidently that's the only reason Facebook and Google get away with it too, or it'd be far more profitable for them to back off and play the "we value your privacy" PR card. Literally the only difference is that Facebook is headed by software engineers and governments are headed by a bunch of people with tons of power and no knowledge. You tell me which is more dangerous. You can't act ethically if you don't even understand the domain you're acting in.

pdxww 8y ago

This is smart. Unethical, but smart.

remarkEon 8y ago
Indeed. I'm wishing for a "dumb" social networking company, where the people who run it are idiots and I don't have to worry about this kind of invasive engineering (I long ago deleted my Facebook). There's always twitter, I suppose.
- xena 8y ago
  Mastodon seems to be the balance I've been liking.
- abootstrapper 8y ago
  Can we not have smart ethical people? When did getting away with unethical or unlawful behavior become associated with “smart?”
  - ravenstine 8y ago
    Seems pretty rare. Most people want the money and prestige that comes from working for Facebook or Google. It's easy to be a rebel when you've got nothing to lose.
  - remarkEon 8y ago
    It's always been associated with smart? I think the point you were trying to make is that I shouldn't directly tie intelligence with unethical behavior (i.e. all smart people are unethical), and you're right. That said, my point remains ... in this age the unethical exploits will by definition be discovered and implemented by intelligent individuals.
vertexFarm 8y ago
Lots of that going around these days. Always reminds me of part of the speech at the end of The Great Dictator. "We think too much and feel too little. More than machinery we need humanity. More than cleverness we need kindness and gentleness. Without these qualities, life will be violent and all will be lost."

aasasd 8y ago

I'm pretty sure Google and other large networks also build 'shadow profiles' on users to figure out who they are, who they're connected to, etc. And I wonder if this shady profiling data should be available for users to download under e.g. GDPR. Because it sounds to me like it should, but isn't.

hedora 8y ago
If any europeans with spare time and no Facebook account are reading this, get a lawyer (maybe related to the EFF, or not), and send a GPDR request. When it comes back “no data”, record yourself signing up for a FB account, since at that point, they’ll list suggested contacts that cover pretty much everyone you know. (Even if this doesn’t work as I predict, it’d document what they’re doing for gpdr compliance.)
- mehrdadn 8y ago
  Why does that require having a profile on you in particular? They could be saving all the data from everyone else (e.g. their contacts, their search queries, etc.) and dynamically assembling it when you make an account to make you recommendations. They don't have to be doing anything related to you in particular.
netsharc 8y ago
I recall someone asked the Zuckholebot about shadow profiles in one of those hearings, and he avoided answering the question... Something about "my team will get back to you on thay, Senator.".

anonytrary 8y ago

Jokes on them, I have electrical tape on my camera lens. Something I learned from Facebook's CEO, ironically.

nixpulvis 8y ago
I'd love to see people spending >$1,000 on a new iPhone "for the camera", only to cover it with electrical tape. This sounds like something out of Silicon Valley.
- paulryanrogers 8y ago
  It is rather amazing that smartphone cameras are so feature packed, yet still lack a lens cover. Something as old as cameras themselves.
  - nixpulvis 8y ago
    Old cameras didn't exactly fit in your pocket, and didn't have sapphire glass... Though I do think it would be nice to have a hardware (iris?) way to close off the camera. Some laptops have this, though I'm sad mine doesn't.
    - deleted 8y ago
      [deleted]
    - walterbell 8y ago
      They are available for phones and laptops, e.g. https://www.amazon.com/gp/product/B07B66VZ97/ https://www.amazon.com/gp/product/B07B66VZ97/
      - sky_rw 8y ago
        +1 these are awesome. I have them on all my devices.
      - _emacsomancer_ 8y ago

deleted 8y ago

[deleted]

bredren 8y ago

New to some but this is regurgitated content as these patents were reported on long ago.

vertexFarm 8y ago

Gross. Oh well, another one for the already massive pile of unreasonably greasy facebook creeping. Massively parallel automated stalking. This shit needs to be regulated soon. A lot of the people being data-fucked are not actually people who have signed a EULA or anything, and it's getting more and more dubious that this is readily-available information "in the public square" that has no reasonable expectation of privacy. In my opinion at least, as if that's worth anything. Also forgive me if I don't 100% take their word for it that none of this shit has been implemented except a few tests in 2015. These companies are never forthcoming with the truth around these matters of privacy and security. Ever. Any breach, any shady practice is denied until it's not possible to deny anymore. Why should they be truthful? It can only bring bad PR and there has literally never been consequences for lying about it.

nlh 8y ago

I was talking to a friend today who said, fairly succinctly, that Facebook's single biggest problem is that they Totally and Royally Suck(TM) at PR. I wonder what would happen if they were just straightforward about this. "Friends you May Know is really cool! We use your phone's location data and do cross-checks on your address book to make the most intelligent suggestions. We even use some unique features of your camera to figure out if you know people!" They don't have to give away the store, but they could certainly avoid the creepy "try and guess what ridiculously creepy stuff we're doing to suggest friends" game.

dgzl 8y ago
Being upfront would bring more press... Alternatively, how many of your friends are going to read this article?
- beatgammit 8y ago
  Would it? The press likes to jump on surprising news, and if everything is upfront, there's not much to report on. They could even make a way to opt out if people complain (and few would actually opt out), which would save face in the media. I don't use Facebook because I value my privacy, and I'd probably have less success convincing people to leave the platform if they were upfront about the stuff they do. People care a lot less about their privacy than PR firms seem to realize...
drb91 8y ago
Actually enumerating what data might be used for strikes me as incredibly unlikely. They could also come up with a more substantial business model.
drdaeman 8y ago
> Friends you May Know is really cool! I've got over 9000 suggestions and not a single accurate one. Maybe they have the best technology and all the data out there, but I'm skeptical they can really use all the data they supposedly have on me. Same goes for any targeted advertisement, not just Facebook. Some come close (based on simple topic preferences), but in all those years I've yet to see any large number of the actually useful ones. All those data mining and AI-driven targeting seem to utterly fail, suggesting me to buy a second TV after I've just already got a new one. Or subscribe to Grammarly (every second YouTube pre-roll, seriously?!), when I've already bought that.

smelendez 8y ago

Is this actually a common scenario? Facebook users who aren't friends but upload photos taken with the same camera?

sonnyblarney 8y ago

Ok, this is definitely bad news upon bad news ... but you have to concede it's pretty cool. Outside the scope of actually doing this: you wish you had of thought of it!

mehrdadn 8y ago

> “We’ve often sought patents for technology we never implement, and patents should not be taken as an indication of future plans.” How is this possible? Wasn't it a requirement of a patent grant that you actually try to put it to use?

jcoffland 8y ago

> or if lens scratches or dust were detectable in the same spots on the photos, revealing the photos were taken by the same camera. This seems pretty useless. The only scenario where it gives FB more information is where person A takes a picture, gives it to person B through some route other than FB and then person B posts it on FB. Any other scenario and FB does not need to compare dust specks.

bad_user 8y ago
But this happens quite often, like every time people get together.
- jcoffland 8y ago
  Your saying people who use FB regularly share photos outside of FB and then upload someone else's photos to FB? I'm not saying it doesn't happen, just that it's not the normal path. I think people who use FB generally share photos with their friends who are also on FB, through FB.
  - bad_user 8y ago
    Not in my experience and I have many friends outside of tech circles, since I'm not living in a tech bubble. When people get together group photos happen, or photos that you want, made with somebody else's phone. The result is basically dozens of photos out of which only the best 2 or 3 get shared on Facebook. And in general Facebook is not how those photos get shared. Not even its Messenger because it has annoying size limits, which matter for videos. If I were to guess, out of Facebook's properties, WhatsApp is probably the most popular photo sharing app by volume ;-)
TOMDM 8y ago
There is another compelling usecase. I feel there is no reason to expect Facebook would be content with data hosted on just their platform. With camera fingerprinting, they could be relatively sure who you are on other platforms like Twitter, VK, Youtube etc in cases where the user doesn't use the same email/name.

qsdevacc 8y ago

Disabling locations services doesn't stop all forms of location tracking.

aleem 8y ago

From a comment I had left on a related thread, > Though very uncanny, this is rather easy to extrapolate even using the basic facets FB has available. But the most overlooked is photos. They are offline beacons and are to offline tracking what websites are to online tracking. For example you and a group of 10 other people took photos at the same location which FB sees as a small gathering of intimate friends. It will need to qualify the location is not a public restaurant to be sure its an intimate gathering. The chances of you connecting with that person are then really high. And if you are and the other person are in each others photos, then it's almost a certainty you will end up connecting on FB should FB recommend the connection. The more connected FB's network is, the more it can extrapolate based on commonalities from the first degree graph of your network. It's also the reason why Google is betting so heavy on photos and offering free unlimited storage -- remember, there's no such thing as a free lunch. Google wants to build a social network graph based on location and facial recognition to draw on proximity. With AI this will get even more uncanny. For example a wedding will have a certain photography profile (number of pics taken, the time of day, the location and venue based on Google Maps or past photographing histroy, the lighting in the photos, etc). Once you throw AI into the mix you realize Google doesn't need to draw out any conclusions. It can throw all these parameters into the AI engine and draw up proximity. In this case, Google or FB will not be able to tell you how they drew the connection, because even they won't know. All you can assume is the AI engine will take dozens of parameters today and hundreds tomorrow. Google's deep investment in AI infrastructure is a bigger testament to this.

aorav 8y ago
Can you substantiate any of what you present as facts with actual sources?
- deleted 8y ago
  [deleted]
deanCommie 8y ago
> In this case, Google or FB will not be able to tell you how they drew the connection, because even they won't know. All you can assume is the AI engine will take dozens of parameters today and hundreds tomorrow. Sure there are ways to implement systems like this where you can't understand what they are doing. Just like you can launch websites and webservices without any metrics, monitors, or logging. But why would you? It requires more work, and it makes the underlying architecture more complicated but any sensible organization with a good engineering excellence fundamentals would ensure they can introspect and debug the outputs of any production algorithm.

the-watchtower 8y ago

I am going to go out on a limb and say that this crosses the line from "invasion of privacy" to "just plain evil." Seriously: this is the type of stuff that you expect to find in state-sponsored malware, not software that's forced onto the majority of consumers.

brokenmachine 8y ago
> not software that's forced onto the majority of consumers I agree with you on your other points, but not "forced". I've left Facebook and encourage anyone who cares about privacy at all to do the same.

dompydumpy 8y ago

So we'll regulate facebook maybe?

xg15 8y ago

Pardon for the somewhat OT post, but the quotes about patent use in the article made me realize once again that I don't get how the patent system works. > [Facebook:] "We’ve often sought patents for technology we never implement, and patents should not be taken as an indication of future plans." > “A lot of patents are filed at the idea stage rather than the actuality stage,” said Ranieri by phone. “A tech company that files a patent has, hopefully, at least thought about how to do it. You’d hope they could implement it if asked, but it doesn’t mean they have done so before.” So if registering a patent neither requires that I actually intend to make use of the idea, nor that I even knew how to do it, what keeps me from patenting moonshots such as "A general framework for DNA-editing based cancer therapies" or "A method to construct a moon base using a mix of on-site material and material sourced from earth" and start raking in cash once someone else figures out the details and actually wants to do it?

cm2012 8y ago
Companies do this all the time. Amazon succesfully patented a 1 click buy button, for god's sake.
- lolc 8y ago
  Though they actually used that one and it worked well. Not to say it wasn't an absurd patent.
ndnxhs 8y ago
What stops you doing that is the organisation trying to construct a moon base has more money than you so your patents don't apply anymore.
ztjio 8y ago
You and the person mentioning 1-click are definitely off base on patent understanding. It's true that you don't have to actually try to do the thing you patent nor that it has to actually work. However, a patent isn't an idea. It's a specific description of HOW to do accomplish something. So your "general framework for DNA-editing based on cancer therapies" will have to include statements describe the actual process. Sometimes patents have fairly vague statements here, but, those are rarely defensible. More commonly, they balance specificity with generality. For 1-click have a look at the patent claims https://worldwide.espacenet.com/publicationDetails/claims?CC=US&NR=5960411A&KC=A&FT=D&ND=&date=19990928&DB=&locale=en_EP https://worldwide.espacenet.com/publicationDetails/claims?CC... This is not simply saying "oh, we invented the idea of a single click buying experience, nobody else can do it now." It is saying HOW they did (or would do) it and the reason Apple licensed that patent is because they did it the same way. If someone did it in a way not described in the patent, it wouldn't be covered by the patent even if the outcome was the same. For example, the patent specifically says the server system knows info about the user. Today, you can go to many websites and 2-click order a product using Apple Pay where the server knows nothing about you. If we ignored good security practices, this could be 1 click (just skip the verification pop-up, the rest would work fine.) The patent (if it were still valid, which it is not due to expiration) would not cover this. Now, one can still always dispute the specificity of a patent. And reading 1-click claims as a software developer, some of it may still feel "obvious," but, the reality is nobody did it before Amazon. So how obvious was it really? They go far enough to describe that the system already knew things about the user, that there was an identifier sent to relate to that info, that a single action of some kind was taken, that the system was displaying info about the product, etc. So in your cancer therapy example, you would need a similar description of how it would work. Not down to the explicit details, but, enough to set it apart from any other similar method or approach to the same outcome.

tim333 8y ago

Clickbait headline. The closest they get to it is >One filed in 2015 describes a technique that would connect two people through the camera metadata associated with the photos they uploaded. It might assume two people knew each other if the images they uploaded looked like they were titled in the same series of photos—IMG_4605739.jpg and IMG_4605742, for example—or if lens scratches or dust were detectable in the same spots on the photos, revealing the photos were taken by the same camera. ie facebook mentioned the concept of tracking you by the dust on your lens. No evidence that they can actually do it.

antaviana 8y ago

With the gyroscope and accelerometer feature implemented, you will be able to friend with someone who stole your phone.

josefresco 8y ago

Imagine being at a bar, and a guy engages you in conversation. You try your best to indicate you're not interested, and your friends help shoo him away. Then, that night when we gets home Facebook tells him your name and suggests you connect. Creepy AF (and not the guy)

IshKebab 8y ago
If they are using the dust on your camera apparently you'd have to both take photos with the same camera and then upload them to your respective accounts. Then facebook will correlate the dust and learn you are friends. I don't see that happening... ever. Even if it were possible (I'm pretty sure dust and scratches on a camera lens aren't in focus...).
- brokenmachine 8y ago
  It could also be the sensor, say if certain pixels were slightly less sensitive than the surrounding ones. You could run statistical analysis of the image and spot the similarities.

nkkollaw 8y ago

We leave in scary times.

clubm8 8y ago

Facebook's Achilles's Heel is it doesn't know the strength of your connections. There's lots of data points, but they currently do a poor job of parsing them. Unfortunately given their recent privacy struggles it may be difficult for them to leverage their dataset to answer that question without driving off users.

OnlyRepliesToBS 8y ago

lol we do what we must because we can