20 ms·
Facebook has been paying people to install a “Research” VPN
- minimaxir 8y agoThe HN title/article is slightly misleading with its use of "root access"; the iOS Enterprise Root certs give increased data access outside of an app (e.g. decrypted SSL traffic, like what this app was doing), but not "root access" in the Unix sense. You can play with them using mitmproxy to generate a Cert and intercept SSL traffic.
- merlincorey 8y agoIt is "root" in the sense of "root certificate"[0] which allows, potentially, the ability to MITM essentially any TLS connection transparently to the user. [0] https://en.wikipedia.org/wiki/Root_certificate https://en.wikipedia.org/wiki/Root_certificate
- saagarjha 8y agoAny non-pinned connection, since some apps employ certificate pinning on iOS and can't be intercepted without modifying their application binary. This is uncommon, though.
- minimaxir 8y agoA notable app that uses certificate pinning is Facebook.
- Skunkleton 8y agoPhew, I was worried that facebook would scrape my confidential communication with facebook.
- threeseed 8y ago"root access" has a different meaning than "root certificate"
- merlincorey 8y agoYes, I'm aware of that, which is why I "translated" for the article.
- 11sdmb8m 8y agoWe all know what "root access" means, and this is not it.
- joshstrange 8y agoAgreed, I thought this must be Android then I saw Apple in the article and got really confused. I understood later when I got the root certificate but I've installed a number of those and would never call it "root access". This just allows them to MitM all traffic even TLS.
- dang 8y agoOk, we changed the title to use representative language from the article, which is hopefully more accurate. (Submitted title was "Facebook pays teens to download research app with root access outside App Store".)
- userbinator 8y agoIndeed, for a second I thought Facebook had figured out a jailbreak and were paying people to try it out. That would certainly be very interesting news (and provoke even more divisiveness in the comments.) Fortunately, the title has been edited now to remove "root access".
- pinewurst 8y agoThe actual article title is "Facebook pays teens to install VPN that spies on them".
- lupire 8y agoAnd that's a sensationalist title, since it's not spying, it's consensual informed monitoring.
- minimaxir 8y ago> it's consensual informed monitoring. Which is complicated both legally and ethically when it's deliberately targeting teens.
- rhizome 8y agoSounds like what a lot of IRL spying is.
- bryan_w 8y agoIf someone is spying on you, they don't tend to identify themselves or get consent
- Gibbon1 8y agoAt least in the US generally contracts with minors aren't legally binding.
- supergauntlet 8y ago"it's not an explosion, it's a rapid oxidation event"
- bobsil1 8y agoRapid unscheduled disassembly
- sftwds 8y agoI... I... I just can’t even... What is Facebook thinking?? Shouldn’t a company which is already getting bad PR for its handling of private data be extra careful about how much personal data it gathers and what it does with it?
- karkisuni 8y agowhy would they? they have never faced any real consequences for doing this and it's insanely profitable.
- arctux 8y agoI'm emphatically not defending them here, but it may make sense from their perspective. They live and die by ad targeting and maintaining their monopoly power over social networks, both which requires large amounts of personal data. Knowing what apps teenagers have installed and how often those apps are used is instrumental in detecting an up and coming social media rival. Further, their only major competitor in the ads space is Google, which has access to this information via Android and its control over the Play Store. Plus, what are the teenagers going to do about it? Facebook also owns Instagram. I guess they could use Snapchat...
- taurath 8y agoYeah it makes sense, but the problem for their shareholders is their business model will constantly turn them into a huge boogeyman and they'll never recover goodwill that keeps their users stuck to the platform when competitors appear. Mass user migrations happen, and they can happen VERY fast. Wait until a whole country goes off of Facebook.
- vokep 8y agoWhen you have enough personal data to blackmail anyone who disagrees, you can go pretty damn far. Eventually they'll encounter a hero, someone important enough who says "fuck it" Its just speculation, that they're blackmailing anyone to make things happen, but anyone can see the incentive is there. Hard to imagine blackmail isn't just waiting to happen with that kinda data.
- 8y ago
- schappim 8y agoWhilst not technically correct (Facebook is not getting "root access" to the device), paying teens to install a VPN that spies on them is just gross!
- 734786710934 8y agoBeing opt-in and getting compensated are the two things I've seen people want from usage of their data. No one should have an issue with this since it does both.
- seba_dos1 8y agoThis happened right after Onavo was blocked - it's opt-in and with compensation only thanks to that.
- randomacct3847 8y agoThe fact that Facebook tried to hide their involvement by using intermediaries like “uTest” says something though, right?
- Wowfunhappy 8y agoRegardless of whether Facebook was also trying to deceive users specifically—which we'll never know—they likely wanted to deceive Apple. I'm not going to blame any developer for attempting to bypass Apple's stupid restrictions. Using intermediaries also allowed Facebook to technically not violate Apple's enterprise certificate contract (because the intermediaries were in violation instead).
- acct1771 8y agoWhen collecting data like this, best to leave it to the pros - whether they're internal, or you have to contract out.
- morpheuskafka 8y ago> Using intermediaries also allowed Facebook to technically not violate Apple's enterprise certificate contract (because the intermediaries were in violation instead). I actually though they would have done that, but it used the regular "iPhone Distribution: Facebook, Inc. (In-House)" cert, they didn't even create a shell entity and get a new one. Reports say Apple has revoked this cert, breaking all internal (legitimate) apps and possibly creating quite a bit of chaos for internal ops.{1} Their separate Apple Developer Program organization account, used to deploy TestFlight public and private betas and App Store apps, as well as local deployment to a small number of devices without Apple involvement for development testing, is not affected. The intermediaries may or may not face consequences if they have separate agreements with Apple, but they did not use any Apple products to do their part and have not violated anything with Apple. {1} https://www.theverge.com/2019/1/30/18203551/apple-facebook-blocked-internal-ios-apps https://www.theverge.com/2019/1/30/18203551/apple-facebook-b...
- sigfubar 8y agoWhat do we call an engineer who worked on this atrocity? Unemployable. I’d even go as far as blacklist anyone who continued working at Facebook after Cambridge Analytica.
- meroes 8y agoAll it takes is engineers to stop selling their skills to capitalists...
- chillacy 8y agoAll we have to do is change human nature and it just might work /s
- pandapower2 8y agoGuessing that there are plenty of employers who would take the opposite view. There are surely companies who want employees who will do stuff without complaining about a bunch of annoying ethical implications.
- 0x0 8y agoThose enterprise code signing certificates and provisioning profiles probably won't have much life left if Apple is awake at the wheel. Seems like a risky game to play, likely staking their appstore developer account at the same time. High stakes.
- eunoia 8y agoI really hope not. Enterprise distribution has been hugely useful as an internal tool at just about every company I have worked for. They seem to have broken the cardinal rule though. Namely the somewhat ambiguous "Don't use your Enterprise account to bypass the App Store."
- saagarjha 8y agoI'd be surprised if Apple got rid of enterprise distribution altogether rather than blacklisting Facebook's certificate.
- eunoia 8y agoAgreed. I'm curious if FB just doesn't have to play by the same rules? It would seem like the loss of FB Research's Enterprise cert would be a major pain for them.
- saagarjha 8y agoFacebook, like every other large company, has a separate set of rules, though for something like this I can't imagine Apple looking the other way. My expected outcome is that the current certificate is revokes, and Apple has a talk with their team, tells them to not do this, and allows them to request a new enterprise account.
- roguecoder 8y agoIf they ruin this for the rest of us, I will never forgive Facebook. I hope Apple comes down on them like a bag of bricks instead of f'king up my beta testing.
- burlesona 8y agoWho is surprised? This is Facebook’s DNA.
- aresant 8y agoSome of the highlights from Will Strafach, who did the actual app research for TechCrunch: #1 "they didn't even bother to change the function names, the selector names, or even the "ONV" class prefix. it's literally all just Onavo code with a different UI." #2 "the Root Certificate they have users install so that they can access any TLS-encrypted traffic they'd like." My editorializing - I have been suspicious of Facebook getting the "submarine" treatment (1) but the insane scuminess of #1 above, which essentially is a big fuck you to Apple, pretty well supports the recent view that FB will essentially break any rule that serves to further their own ends. via https://twitter.com/chronic/status/1090394419902197761 https://twitter.com/chronic/status/1090394419902197761 (1) http://www.paulgraham.com/submarine.html http://www.paulgraham.com/submarine.html
- varenc 8y agoSide note: This wouldn't get around cert-pinning? Even if a new trusted CA is installed on the system, an app implementing cert pinning still wouldn't trust this new CA. Seems that could be a wise move for Facebook's rivals that want to limit snooping. Edit: on 2nd thought even if Facebook can't decrypt a particular app's traffic, just knowing how many requests it makes, how large they are, and how often, could still provide some useful insights into an app's usage.
- saagarjha 8y agoAFAIK, yes. You would have to modify the application itself to disable certificate pinning.
- gcbw2 8y agoyou have root. Might be inconvenient but hardly impossible to modify files to drop your own pinned cert in other binaries.
- saagarjha 8y agoAs I've mentioned elsewhere in other threads, this app doesn't actually obtain root access (that is, it's not a jailbreak); the article/title is confusing a "root certificate" with "root access".
- saagarjha 8y agoApple should just pull their Enterprise certificate so the app stops working.
- Benjamin_Dobell 8y agoApple should pull their entire developer program account! This is insane abuse of either Enterprise signing or developer signing - it could be either depending on the setup process.
- joering2 8y agoAbsolutely. If you were done it, you would get your account suspended and boiler-plate emails explaining why and that that's their final decision. Since its Fuckbook, I am sure bunch of emails were exchanged with top-tier emps at Apple vs Facebook, bunch of apologies and life goes own. Wish Cook had balls and just pull the whole App out of AppStore.
- qwerty456127 8y ago> Facebook sidesteps the App Store and rewards teenagers and adults to download the Research app and give it root access But how? I didn't knew this is possible to do on iPhones except really old models. If it is I'd love to know how.
- saagarjha 8y agoThe article is misleading; the app does not have root access, it has access to web traffic via a trusted root certificate. The app is distributed outside the App Store through the enterprise developer program.
- eunoia 8y agoIt's worth noting that one of the main rules of these Enterprise accounts is that they are not to be used to bypass the App Store. For example, we use them to distribute frictionless test builds internally.
- saagarjha 8y agoYes, I know what the enterprise program is for; this is a clear violation of those rules. But Facebook is not getting root access to your device, as the title of this post and the article claims.
- eunoia 8y agoYeah I can tell you have experience with iOS code signing. I just wanted it to be clear to others that this is NOT the intended purpose of the Enterprise program.
- blattimwind 8y agoI'm looking forward to Apple revoking Facebook's access to it.
- seem_2211 8y agoThis all seems like a rerun of Uber - bad news on bad news compounding on bad news. Something is very rotten at Facebook and has been for a long time now.
- misiti3780 8y agoYa, and Uber had a change of leadership, lets hope something like that happens at facebook too.
- wmf 8y agoI guess the difference is that Zuck has over 60% voting control of Facebook so he can't be forced out.
- roguecoder 8y agoFacebook's record is the best argument for banning dual share classes: if you want to keep control of your company, you shouldn't be able to do that at the same time as selling most of it off. If you are running a public company, you should be accountable to your shareholders.
- swift532 8y agoI disagree, those shareholders know what they're getting into when they buy the stock. I do agree with just about 95% of criticism directed at Facebook, so this isn't me defending them specifically. I just don't see why dual share classes should be forbidden as long as people are properly informed when purchasing non voting ones. If I offered you 10% of my bakery's profits but told you explicitly that you'd have no voice in how I run it, it could be a good deal for both of us and we'd both know what we're getting into.
- roguecoder 8y agoIt's not about whether it's a "good deal" for the investors: it is that as a society allowing unaccountable business dudes to run roughshod over society isn't working out so well.
- adamnemecek 8y agoAre we out of the Facebook crisis yet? Do they not realize this is really not helping their case?
- rdl 8y agoWould joining FB as a Privacy Czar or whatever be a job one should rightly wish on a highly competent privacy person, or is it a new form of torture in Hades alongside Sisyphus and others?
- Despegar 8y agoA tiger can't change its stripes. Self-regulation doesn't work [1], they will bypass any rules they create for themselves whenever it's convenient to do so. The US needs to pass a GDPR-style privacy law. [1] https://theintercept.com/2018/11/29/google-china-censored-search/ https://theintercept.com/2018/11/29/google-china-censored-se...
- abraae 8y agoPerhaps a bit like Baghdad Bob's job as Saddam Hussein's Information Minister: https://en.wikipedia.org/wiki/Muhammad_Saeed_al-Sahhaf https://en.wikipedia.org/wiki/Muhammad_Saeed_al-Sahhaf
- myth_buster 8y ago> Facebook first got into the data-sniffing business when it acquired Onavo [..] to learn that WhatsApp was sending more than twice as many messages per day as Facebook Messenger [...] and to spot WhatsApp’s meteoric rise and justify paying $19 billion to buy the chat startup This makes a lot more sense now. At that time the tech sphere was surprised at the price tag which is expected as people outside Fb perhaps didn't have these metrics.
- beezischillin 8y agoI know that it's not really insider trading, but the concept really does sound similar..
- bob_theslob646 8y agoIt is actually crazy that this is not discussed more often. How they heck is this fair?
- beezischillin 8y agoI know, right? Spy on your competition without anyone's consent and then simply make them an offer they can't refuse...
- Wowfunhappy 8y agoThe fact that this exists makes me uncomfortable, but I'm having trouble pinpointing a reason why it's bad. People are opting into the data collection. Perhaps they don't know the full extent of what Facebook is tracking, but sideloading apps on iOS is not a one-tap process—anyone who used this had a sense of what they were doing. And, $20 per month is pretty substantial compensation. The way that Facebook is bypassing Apple's rules feels shady, but I've always felt those rules were user-hostile to begin with. I firmly believe that users should have control over their own devices, and that means letting users give information to companies if they so choose—especially if they're being financially compensated.
- saagarjha 8y ago> People Children, specifically. > Perhaps they don't know the full extent of what Facebook is tracking …is this not bad? > sideloading apps on iOS is not a one-top process—anyone who used this had some sense of what they were doing This is not sideloading; this is enterprise app distribution. Users are not self-signing this app. > And, $20 per month is pretty substantial compensation. For a child who doesn't know any better, maybe…
- deleted 8y ago[deleted]
- dymk 8y agoThey're not sending cash, it's a check or a deposit into a debit card. Not many "children" under the age of 16 have those. So many of the comments in this thread are literally "Think of the children!"
- titanomachy 8y agoReally? I think I opened my first bank account when I was 10 or so. My parents had to co-sign but other than that were not involved in it. I don't think this was very unusual, the bank even promoted a special free account for young people. I had summer jobs from the age of 12, would you expect me to shove the money under my mattress?
- buildbot 8y agoAt what point does Apple pull Facebook's developer licenses? as people have mentioned, this appears to be a violation of the enterprise account program.
- saagarjha 8y agoIt's important to note that Facebook has at least two "licenses" here: one is used to push their apps to the App Store, and another to sign enterprise apps (like this one). Pulling one should not affect the other.
- kerbs 8y agoBut to the point - this should at least result in a revocation of the Enterprise account.
- mklarmann 8y agoI wonder if Apple considers options to take the Facebook Apps out of the App Store.
- AnaniasAnanas 8y ago> Children, specifically. I fail to see how this is supposed to make it in any way worse.
- MBCook 8y agoChildren don’t have fully developed minds, can’t appreciate the consequences of their actions (especially in the long term) and are easy to manipulate with bribes ($20/mo). This isn’t a bunch of adults deciding to sell their privacy. It’s children who have no hope of understanding what they’re doing.
- bepvte 8y agoI doubt many of these kids understand that full conversations in most messaging apps can be viewed by a facebook employee with this installed
- TheSpiceIsLife 8y agoTo be fair, you could replace the word children with the word adult in your first paragraph and it would all still hold. Adults might have fully developed brains from a biology perspective, and I recognise this is what you meant, but I believe there is a strong argument to be made that many adults, myself included, are heavily lacking in the development of mind department. Mark Zuckerberg surely is, either that or he’s actually Satan. I definitely have an undeveloped appreciation of the consequences of my actions, and I’m easily manipulated. I’m rapidly approaching 40 laps around the sun! My greater point here is that I don’t find your argument for why it’s worse because children particularly compelling. Or, perhaps, insufficient. So I’ll replace with my own: Society at large has a long history of, and a cultural and biological evolutionary adaptation, to protect children more strongly than adults, because we are born vulnerable and take a long time to reach sexual reproductive age. We’ve only made it this far because we’re not descended from parents who let their kids stumble in to sabretooth tiger territory. (As an aside, I appreciate that the greatest threat to children’s health and development is their immediate family. But here we are). The worrying thing is, now the sabretooth tiger is a guy who’s surname translates from the mother tongue, German, to English as candy mountain, Google translate actually says “pile of sugar”, and comes with a family friendly large blue thumbs up symbol. So the threat is difficult to discern. I’d actually be more worried if I didn’t have a seizure like laughing fit every time I think about the whole scenario. It’s a coping mechanism I guess. I mean, is this really happening? I wish Bill Hicks was still alive! Aaah, he lives on through those who carry the flame!
- justfor1comment 8y agoWhat could be more ironic than your VPN spying on you? The very thing you use to avoid the watchful eye of elder siblings.
- Skunkleton 8y agoI think it is safe to assume that any free VPN is spying on you.
- userbinator 8y agoExcept the one you set up yourself... or rather, you can spy on yourself with that one, so your point still stands. ;-)
- Skunkleton 8y agoThe one you setup your self isn't free...right? But yeah, I tamper with DNS requests on my home network, so fair point lol.
- glitchc 8y agoI don’t know how I feel about this. On the one hand Facebook is working around Apple’s terms and conditions, and enticing underage kids to compromise their phones. On the other hand, there’s no law broken here, Apple’s terms and conditions are not generally fair to users, and the kids know all of their data is being tracked for money ( and presumably are happy with it). Plus, freedom to use the personal device you bought as you see fit is preferred to Apple deciding what you can and cannot have on your phone. So, how should I feel about this?
- joshstrange 8y ago> kids know all of their data is being tracked for money ( and presumably are happy with it) Do they though? Do they really understand what it means? Do they understand that that nude they sent to their GF/BF is now on a FB server and FB has FULL rights to have and use that (obviously not publish it but still)? Do they just not care? I really don't know, the last question kind of terrifies me TBH. My hope is they don't fully understand what they are giving up and "$20 is $20".
- glitchc 8y agoIt’s hard to gauge how much they really understand, but it’s also hard to gauge how much it really matters. I mean most of the data coming out of them is noise, really. They’re not buying houses or making major financial transactions. If this is worth doing, then $20 may even be their primary source of income, and there may not be too many legitimate ways of earning that income at that age, especially passively. Sounds like AllAdvantage.com (I had to look that up again) all over again. They tracked your internet usage and paid you money for it. My friends and I thought it was a good deal and had no compunctions about gaming it. I’m sure these kids are thinking the same thing, and our moral outrage is self-inflicted.
- bellerose 8y agoTo me this is a reflection of society at this point. Monitoring & tracking of online activity was something to be avoided when I was young. I can only assume something like this would harm the reputation back then and people would go elsewhere. Although, $20 per month makes me wonder if my past self would have cared and all my info would be data mined. I doubt in the end I went unexploited in some way and likely I missed out on little money that's now being offered because of more secure devices.
- joshstrange 8y agoThe group of people using this "App" by this can be broken up into 2 main groups: 1. Those who understand what they are signing away and need $20/mo more than they need privacy 2. Those who don't understand or don't understand fully what they are signing away and see it as free money Preying on either group is disgusting and wrong. I'm really interested to see what Apple does here, they have taken a hard line on privacy and I don't doubt they will kill this app but if FB wants to play wack-a-mole they WILL win (see iOS sideloading scene), for me the big question is will Apple take down the FB apps? We've seen Netflix, Uber, FB, Amazon, and more skirt the rules of the App Store in the past, they've barely gotten a slack on the wrist (in public at least). At what point does Apple take a real stand and say no? Cause so far $$$$$ has ALWAYS stopped them, I really do believe they care about privacy, I don't know know if the shareholders do. Edit: Typo
- KaoruAoiShiho 8y agoWait a sec, 2 is wrong but 1 sounds positive to me. For some people this money could be incredibly important.
- joshstrange 8y agoAre we, as a society, ok with people being desperate enough to need $20 more than privacy? Or maybe privacy isn't something we should care about or at least value as much as we do as a society. Maybe I'm wrong. I think I see the dangers down the road but maybe it's just a mirage and privacy will die and it won't be used against use by people in power or with money.
- scrollaway 8y ago> Are we, as a society, ok with people being desperate enough to need $20 more than privacy? This is not the question that's being asked here. The fact is, there are people like that, and for them, these things are great. They're not solutions, they're band-aids. But if you're not ok with the situation existing, removing band-aids isn't particularly productive.
- dorchadas 8y agoTangentially related, but his leads to an issue I try to stress this to my students all the damn time, but they just don't care. Like, they all try to download any free VPN that'll connect so they can play Fortnite during school, without ever looking to see what they give away. Hell, I'm not convinced they wouldn't consent even if it was told, as long as they get their fix while at school. There's a huge problem nobody wants to try to fix.
- snazz 8y agoFrom the students’ perspective, the reward is greater than the obscure potential consequence. I have certainly noticed this with adults, as well, so it seems like fairly basic human behavior.
- roguecoder 8y agoThe arms race between school administrators and people who wanted to connect to things they shouldn't has been going on for decades and is one of the major sources of sys admins. The problem here is that installing a VPN is far too easy and doesn't teach children where /etc/host is located.
- morpheuskafka 8y agoAt my school, they have default "teacher" for external events that use school facilities, usernames and passwords based on each school code that bypass all filters, but somehow no one has found it leading to insane workarounds. Sadly, people used to use web.archive.org as a workaround (like dude, just go home and look stuff up?) so they blocked it, which breaks a lot of research and sources on Wikipedia.
- morpheuskafka 8y agoTrue, but as long as they don't install a trusted root as well damage is still far more limited. Still a major privacy issue (and huge shout out to you for passing this knowledge on to my generation, sadly many of us really don't care) though. With this, however, the possibilities are really limitless. For example, the simple act of filling out a job application online, common for students to do, gives FB your SSN and enough info to open a line of credit. How was this data stored? Who at Facebook had access to the SSNs and nude photos and the like that was certainly collected with a program like this of any scale? Were the procedures to delete it? How were the systems secured? And while I doubt even FB would do this, a truly lawless bad actor could use those logins without tripping security alerts because you would have used one of their IPs to sign in before. Or an external actor, having access the data dumps, could sign up as a user and then make use of the VPN to easily pawn everyone's account. The more I think about this, the more outrageous it is. They may as well put cameras in your house and photocopy all your papers.
- zenexer 8y ago“Root access” and “root certificate” are entirely unrelated, but this article seems to conflate the two terms.
- echofavor 8y agoNeed more traffic to our website. Share your experience http://www.echofavor.com http://www.echofavor.com
- rlue 8y agoIn an odd twist, this is precisely what some tech critics have been pushing for—for consumers to be monetarily compensated for the data they're giving up to tech giants: https://news.ycombinator.com/item?id=17595564 https://news.ycombinator.com/item?id=17595564
- larkeith 8y agoOne issue with this is brought up in the article: > “The fairly technical sounding ‘install our Root Certificate’ step is appalling,” Strafach tells us. “This hands Facebook continuous access to the most sensitive data about you, and most users are going to be unable to reasonably consent to this regardless of any agreement they sign, because there is no good way to articulate just how much power is handed to Facebook when you do this.”
- gruez 8y agoright, but considering most web traffic is encrypted nowadays, it's pretty much mandatory to do MITM to analyze traffic.
- _jal 8y agoPerhaps that should be taken as a hint rather than a challenge.
- morpheuskafka 8y agoBut you can still get the domain/subdomain requested, which should be enough to find out service used and time/frequency of use. That will change with encrypted SNI (https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/), which is not yet mainstream, but large services Facebook is tracking have dedicated IP pools so that's not a barrier. So for the reported use case, "hey, tiktok looks good, let's find out how many people use it before we buy it out," it would seem that non-MITM would be plenty (and technically easier/lower resource to do, VPN could be kept on device and the pre-anonymized data sent up to the cloud, saving them server costs and bandwidth.
- 8y ago
- socrates1998 8y agoJesus christ Facebook are scumbags. I hope they get hit with billions of dollars in fines in the EU and it bankrupts them. Good riddance to this shitty ass company.
- dang 8y agoPlease don't post dross comments here, regardless of how angry you are about Facebook or anything else. It lowers the signal/noise ratio and we're hoping for better than that here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Edit: also, please don't post personal attacks as in https://news.ycombinator.com/item?id=19031623 https://news.ycombinator.com/item?id=19031623, regardless of how wrong another comment is.
- deleted 8y ago[deleted]
- nxc18 8y agoI don't see why Apple couldn't take down _all_ Facebook apps until they comply. It seems like Apple has the real power here.
- perfmode 8y agoIn the press, apple might wind up taking the blame if instagram were to become unavailable.
- sokoloff 8y agoWhat do Apple users want? Probably not to have Facebook, Messenger, and Instagram taken away from them on their devices...
- NeedMoreTea 8y agoProbably not to have Facebook piss all over their privacy. I suspect there's been enough revelations about FB practices that many users would support Apple if they blocked the main apps. For a temporary block anyway.
- sokoloff 8y agoMuch of the audience here is probably much more understanding of the situation and aligned with your (presumed) position, myself included. Most of the general population probably neither understands nor cares that much if someone is watching what sites they visit or other basic privacy items and if you make them choose between privacy (especially privacy of others) and being able to post a picture of their lunch, many will choose the latter.
- deleted 8y ago[deleted]
- rahoulb 8y agoI have had a LOT of conversations with non technical people about this recently. “My phone is listening to my conversations” is how it goes - people know this tracking is happening, they hate it and find it intensely creepy, they just don’t know the mechanism being used.
- Gioni06 8y agoI'm not a law expert, but IMO FB should seriously lawyer up. I can say that this kind of misconduct would almost certainly end up in court in Germany. A 13 years old consent with a cryptic data protection policy is not legally binding and luring kids in need of protection with money to give up fundamental rights can be viewed as an act of non-physical abuse.
- inetknght 8y agoAll words and rhetoric unless and until someone makes a complaint to the regulatory agency. I'm merely in the US; I'm not sure what agency would even protect my own friends and family from clear abuse.
- iGoog 8y agoIf you believe Facebook to have violated the law in your state, you can write your Attorney General and ask them to enforce the law or explain how Facebook is not in violation of the law.
- anonymous5133 8y agoI have this app installed on my phone. When you sign up you purposefully have to get consent from an adult to sign up as a minor.
- bencollier49 8y agoI'm not sure that works in law. A 13-year-old could click "consent" and not make a contract with FB.
- Gioni06 8y agoI agree. That can also be called "common law" in Germany. Contracts with people who are not entitled to sign contracts on their behalf are not considered legally binding. In that sense, it shall be treated as if there hasn't been a contract at all. The process is purposefully designed to get a signed contract as fast as possible. The technology to make proper ID (Age) verification is available, but my understanding is, that it is not used by facebook and its partners.
- mychael 8y agoWhat I want to know is: Why is Josh Constine still covering Facebook at TechCrunch? Is there no accountability for journalists who totally failed us? For context, he's the guy who was supposed to be covering Facebook over the last 10 years, but instead of hard hitting journalism, we got nothing more than press releases and pro-FB articles. See for yourself: https://www.google.com/search?q=Josh+constine+facebook+site:techcrunch.com https://www.google.com/search?q=Josh+constine+facebook+site:...
- dkrich 8y agoI think a lot has to do with media outlets like TechCrunch having an “oh shit” moment wherein they realize Facebook is taking their profit machine from them (advertising). He even admits as much in the Twitter comments where he posted this. If people at this point doubt that traditional media is waging war against Facebook as a means of survival and masquerading as a bastion of privacy as a means to an ends they are willfully delusional. These organizations show much more intrusive ads to me than Facebook. Also they treat Twitter with kid gloves because Twitter is useful for them to gain a following and disseminate their posts. Twitter has also shown me much more politically motivated ads recently than Facebook has.
- roguecoder 8y agoWhy aren't you using an ad blocker?
- artificial 8y agoWhat are your suggestions for blocking ads inside of the Twitter app?
- inetknght 8y agoDon't use the Twitter app.
- giornogiovanna 8y agoThere are browsers for Android that have ad-blockers (e.g. Firefox for Android). You can use Twitter's mobile website in one of these browsers.
- quickthrower2 8y agoFacebook. Preying on kids again.
- bsbechtel 8y agoAs an app developer, is there anything that can be done to prevent Facebook from spying on your traffic?
- spricket 8y agoCertificate pinning. And perhaps warning your users about potential baddies if someone tries to change it. Elsewhere in the article it mentions people were paid to screenshot their Amazon order history. Why would they do that if they could read all app traffic? My guess, Amazon is smart enough to use certificate pinning and/or not trust root certs
- willstrafach 8y agoYou could probably detect it by looking at the Common Name of the TLS certificate in use when making network connections. https://twitter.com/chronic/status/1090399087827083264?s=21 https://twitter.com/chronic/status/1090399087827083264?s=21
- malloreon 8y agoApple should remove all facebook apps from the app store till facebook employees decide evil isn't worth it.
- deleted 8y ago[deleted]
- ledriveby 8y agoIt sounds like an Internet equivalent of a Nielsen box?
- ilovecaching 8y agoOf course. Facebook doesn't have an app store like Google or Apple. You think Apple isn't using usage data from the app store to figure out where to invest resources? Apple is essentially stifling competition on their platform. Facebook's entire business relies on the success of its apps, which are at the mercy of Apple and Google's policies despite being competitiors in message, video, etc. Facebook paying for this data makes sense, and I see nothing wrong here.
- foota 8y agoI mean, I don't think apple is reading the TLS encrypted data of the applications they host.
- ilovecaching 8y agoOf course, they control the entire operating system and the app store. They don't need to figure out which apps your using by the traffic that's being sent. As per their policy: "We may also use personal information for internal purposes such as auditing, data analysis, and research to improve Apple’s products, services, and customer communications."
- skywhopper 8y agoEven if we accept your premise that OS vendors are inherently malicious actors rootkitting your devices, how does that justify Facebook’s own unethical activity?
- sarora27 8y agoIt doesnt...what the commenter won't acknowledge is that Facebook doesn't care about what anyone thinks is ethical or unethical...Facebook only cares about the Data you're giving them to harvest....this is pretty common with most Facebook employees i've interfaced with...General lack/disregard for anyone or anything that disagrees with the Facebook "mission" (Paycheck)
- 8y ago
- amluto 8y agoI wonder if a party at the remote end of the traffic that Facebook is monitoring could have valid grounds for damages against Facebook.
- warent 8y agoWell, this is the final straw for me. Facebook has been so repugnant lately that it's time to delete my account. Does anyone here recommend an alternative? Right now I'm considering Mastodon and MeWe. EDIT: I ultimately went with MeWe because it's more user-friendly to non-tech people i.e. most of my relatives.
- _bxg1 8y agoI just use Twitter. The only data you have to give it are a made-up username and a continual stream of nihilist jokes. It's great.
- ardy42 8y ago> Well, this is the final straw for me. Facebook has been so repugnant lately that it's time to delete my account. Don't delete your account. Just delete all your posts and change your profile pic to something that tells everyone you've ditched Facebook. It'll continually remind everyone you've left and make Facebook seem more like a dying community to those who are still on it. Then finally delete your account once it's as dead as MySpace.
- Negitivefrags 8y agoHow is this any different than how TV ratings are gathered?
- wklauss 8y agoThere's only one activity you do when watching TV and that is... watch TV. Even on SmartTV sets, the amount of data the screens can gather is limited in scope and quantity. There are all sorts of things you do with your smartphone and this VPN tracks all of them.
- Negitivefrags 8y agoPeople also agree to lower insurance premiums in exchange for having a GPS tracker installed on their car. I guess my point is that the concept of being directly paid to give up elements of privacy is a well established concept. I also think it's extremely patronising to the poor to assume that they don't understand what trade off they are making.
- supergauntlet 8y ago>People also agree to lower insurance premiums in exchange for having a GPS tracker installed on their car. and that should make you uncomfortable too! how on earth can you justify this with an equally insane analogue?
- fromMars 8y agoJust because it makes you uncomfortable doesn't mean it makes everyone uncomfortable. I agree with the previous user that it isn't that different than what Nielsen does to collect TV ratings. Maybe Facebook's execution here wasn't the best, i.e., I agree that a better device would have some limitations as to what kind of data it could access.
- throwawaymath 8y agoI don't know, I'm pretty okay with that... Why is, "I don't really care" not enough of a justification for you that I don't mind putting a GPS tracker on my car?
- sbr464 8y agoHow are they able to pay or contract with users under the age of 18? Or do they get parental consent. Not sure how that works. Referring to the 20/month, I assume under 18.
- judge2020 8y agoThe article goes into that, they compensate the parent with the $20/month.
- aboutruby 8y agoAny other company would have all their certificates revoked and certificates revoked
- jorblumesea 8y agoI don't get it, does FB need more negative press? Regardless of the true intentions, this looks bad.
- S_A_P 8y agowhen is “too far”? I’m certainly thinking that we are there, but when does most of the world get to that point?
- iGoog 8y agoHow is this not in violation of most wiretapping laws? Facebook is not the common carrier in these cases. Both parties of conversations with teens are not consenting to the wiretapping, which is not allowed in many US states. I’m not sure teenage consent is considered “consent” and the parents aren’t a party to the conversations Facebook is wiretapping. Facebook is both paying people and recording the electronic communications... So how the hell is this legal under current laws?
- modzu 8y agoim sure a disclaimer is in the eula (boo).. but if it were deemed illegal, i suspect fb would just pay the fines, or more likely, be given time to come into compliance with the law..
- iGoog 8y agoFB isn’t the service provider, they’re intercepting and recording private conversations they aren’t a party to... where not all the parties are consenting, and sometimes the party is not of age to consent... If it’s criminal, why should they be given “time”?
- modzu 8y agoi agree its not justice, but the answer is because they have power. you could download the vpn and then try to press charges. hope you have lots of money.
- bencollier49 8y agoA 13-year-old can't make a contract in law, certainly not in the UK. Was the app installed outside the US?
- jsty 8y agoIt's not quite that cut and dry in the UK[0], and the article mentions that parental consent was required. But if they were operating in the UK, I'm somewhat doubtful their disclosures as reported in the article could be classed as informed consent under GDPR given the "specific protection" children are provided [1]. [0] http://www.steinfeldlaw.co.uk/uploads/Are%20you%20contracting%20with%20a%20minor.pdf http://www.steinfeldlaw.co.uk/uploads/Are%20you%20contractin... [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-gdpr/what-should-our-general-approach-to-processing-children-s-personal-data-be/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- averros 8y agoZuckenberg: "They trust me. Dumb f*cks." As reported by: https://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5 https://www.businessinsider.com/well-these-new-zuckerberg-im...
- warent 8y agoI'm not happy with Facebook or Zuckerberg either but that message is so old that it's not even relevant anymore. Do I trust Facebook or Mark? No. Does it have any anything at all to do with that cringy text? No. I don't know about you but when thinking of all the crap I said over a decade ago it would be insane if someone tried making it out as if it somehow presently reflected on me in any way.
- dang 8y agoPlease keep tired tropes like this one well away from HN. It became tedious years ago, and this is a site to gratify curiosity. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- nightsd01 8y agoIsn’t this....kind of what the entire tech community has been PUSHING Facebook to do? Paying you for your data instead of acquiring it through shady means...? I’m sorry but...it’s not as if they’re using this data to do evil things. They’re trying to target advertisements. Whooptie doo. So evil.
- maxxxxx 8y agoMaybe I am getting old but I am really becoming more and more skeptical of anything that's coming out of Silicon Valley. Everything Google, Facebook and other ad-supported companies produce seems to be designed to do something behind the backs of users. If the trends continue these companies will soon have world-wide full surveillance of almost everything which then will be perfect infrastructure for dictatorships. And with the growth expectations these companies will have to do more and more sleazy stuff to keep growing.
- jsemrau 8y agoYou are not getting old. In the past SV solved the "hard" problems for the military. Now it's solving perceived first world problems
- randomsearch 8y agoThe problem is simple and relatively recent: advertising business models lead to unethical behaviour. That’s all. The worst companies are those most dependent on advertising.
- morpheuskafka 8y agoDamn, I tried DM'ing some security researchers about this a week ago, looks like I should have just sent it here. I've got some added details from my research into it. 1) Regarding distribution channels, I have only once had the program advertised, via an Instagram ad. I have my real age on Insta (I know, I know...) so targeting younger users may have played a role. I first saw the ad in June 2018, and decided to click through to see how bad it was from a security standpoint. IIRC I never installed it, but I got an email to my throwaway account a few weeks ago asking to reinstall, so I decided to give it a run-through for research. They refer to is as "Research Application," and avoid mentioning FB, their email the first time was facebookresearch@applause.com and it is now sent through a mailer with no mention of FB in email address. The contractor was Applause/uTest, they offered $10/month via PayPal (which <18 technically aren't allowed to have). Since uninstalling, they sent an email saying it hadn't heard from the app in 24-hours and you must participate 23/days month to be paid. 2) The install link is at https://m.facebook.com/facebook-study/f8854f1fb9f4f57bf0d861c03528ce4c/<unique_code> https://m.facebook.com/facebook-study/f8854f1fb9f4f57bf0d861..., and the IP used by the VPN is vpn-sjc1.v.facebook-program.com / 185.89.216.194. On iOS, the "Connect on Demand" feature is used to render the normal VPN off switch useless, one must uninstall the app or turn off COD on the VPN info page. Outgoing traffic goes through a regular FB IP (I wonder if any IP-based authentication on their systems might be weakened by doing this?). 3) I definitely agree with TechCrunch that this is an Apple ToS issue, however, they are wrong to say that FB "avoided TestFlight." TestFlight is for closed betas only, and this app is not a beta of anything, so it is patently ineligible. Interestingly, if Apple revokes their cert in response (as they due to shell company certs used for sideloading marketplaces), it would result in an immediate shutdown of all Facebook's legit internal apps, because Apple only (afaik) issues one cert to each DUNS number. Notably, the cert says "Facebook, Inc. (In-House)" not just "Facebook Research, Inc." so it looks like the main cert. I've sent a complaint to Apple Privacy about this, will report back if they reply. 3b) Apple's Enterprise Dev Program ToS[1] excludes from allowed internal apps those that are, "used, distributed, or otherwise made available to other companies, contractors (except for contractors who are developing the Internal Use Application for You on a custom basis and therefore need to use or have access to such Application), distributors, vendors, resellers, end-users or members of the general public." It does allow the use of written, binding agreements to enable contractors to use the app, but it seems doubtful that this would extend to those ostensibly participating in social research for a nominal compensation. 4) Most users need to be clearly told that installing a "trusted root" cert is the keys to the kingdom. Providing a normal VPN honestly wouldn't be that bad, as TLS protects everything but the domain name. So they could see "morpheuskafka made 200 requests to reddit.com in an hour," but not the content, much less my login and password. Most people who know what a VPN is are familiar with the idea of their network traffic being rerouted and monitored at the ISP level, but they could easily think they were installing the VPNs server certificate or a client certificate to access it. It's staggering to think that . Also remember that Facebook owns the certs for its own platforms, so they could (ethically) monitor your use of their own services w/out this. Remember "don't even give the IT people your password?" Fill out any login in form and FB has your password (and can use the same IP to sign in without raising suspicion). Job or college app? SSN, tax info, etc. Only e2e is safe. Notable, Caddy's MITM detector cannot detect this "research app." I hope they do revoke the signing cert, and will enjoy seeing all their internal apps stop working in the chaos. And I hope that Google and other large companies send password change warning to anyone who has logged in from these IPs. [1] https://download.developer.apple.com/Documentation/License_Agreements__Apple_Developer_Enterprise_Program/Apple_Developer_Enterprise_Program_License_Agreement_20181019.pdf https://download.developer.apple.com/Documentation/License_A... [can sign in with any Apple ID to view] Sorry for the long post, but this is truly outrageous.
- morpheuskafka 8y agoDidn't want to edit my already too long comment, but it's worth noting that on a closer read of the Apple Enterprise Terms, they state that they have the ability to notify users at 5.3: "[Facebook] understand and agree that Apple may notify end-users of Covered Products that are signed with Apple Certificates when Apple believes such action is necessary to protect the privacy, safety or security of end-users, or is otherwise prudent or necessary as determined in Apple’s reasonable judgment." We need to call on them to do so immediately and fully remove the profile, apps, and certs issued by this and any other programs of FB. I don't recall the app having any mechanism to filter EU/EEA nationals, so the GDPR shitshow is about to explode in Facebook's face as well.
- radicaldreamer 8y agoI’m sure this was approved by product counsel (most features go through legal reviews at large companies like Facebook) and was justified (even using the Enterprise certificate) by arguing that the teens are actually contractors working for Facebook who’re being paid and are have consented (along with their parents, if necessary).
- kevintb 8y agoHoly shit. This is beyond the pale.
- anonymous5133 8y agoI have this app installed on my phone and I have chosen to have it installed by choice. I am getting paid $20 amazon per month to have it installed. Why do I do this? Because I enjoy making side hustle money with my phones. This research app in particular is very useful to me because it is 100% passive. If you are concerned with privacy you can always just use a crap side phone to run the app.
- zjs 8y agoCould you summarize what you believe you're giving up in exchange for $20/month? (There's a thread about informed consent elsewhere in this discussion. I'd like to understand how informed you are about the risks associated with the app and certificate.)
- blub 8y agoIf you sell one of your kidneys, you could buy even more phones and increase your profits while at the same time screwing over Facebook by giving them mostly useless data. Just make sure you don't post your plan on HN from the phones, they are intercepting all internet communication after all.
- dx034 8y agoSelling a kidney is NOT the same as telling companies about your behavior. Organ transplants are extremely risky and should only be done if there's no other alternative. The risk of death is very real in those cases. I don't think that's true when you install a Facebook VPN. Some people value their personal data more than others. That's why no one should be forced into giving up their data (essentially what GDPR is for). But if they want, they can of course set a price for their data.
- lostlogin 8y ago> 100% passive. Can you explain what you mean by this? I wouldn’t like it because I would consider it to be watching me, and I don’t think that’s passive.
- 8y ago
- product50 8y agoWhat is the problem here? They are literally paying users to get their data. Seems like a fair tradeoff right?
- blub 8y agoThe problem is some things should not be for sale at all, otherwise we end up in some kind of undignified nightmare of a society. Human beings, body parts, privacy, those kind of things.
- product50 8y agoI think you need to recognize that for many people body parts and privacy are two extreme ends of the spectrum which they are willing to part for money. Honestly, I don’t get what is the issue with users literally opting into (for money) this service by Facebook and be willing to share what they are doing on their mobile device with them.
- blub 8y agoMany replies on this topic remind me of that joke with the wife that sends her programmer husband to buy eggs. As if we're having some silly contest where the smallest ambiguity or contradiction in criticizing Facebook completely negates their aberrant and anti-social behaviour. Obviously it's not the same thing, that was a list, a category of things which are in some way similar. If I include a dog, hippo and human in a list of creatures, would you complain that a human is not a dog? The issue is, they are selling something which they can never get back for a pittance, and that something can come back and harm them at any point for the rest of their lives. There is a reason privacy is a human right, its loss can deeply affect the lives of those that forfeit it or have it abused.
- the_reformation 8y agoAnd who will make this decision for me? You?
- 8y ago
- bashwizard 8y agoI'm curious what devs working at Facebook feel about the shitstorm surrounding Facebook the last couple of years. Do you still work there and is the money the only incentive for doing so? Would you jump the ship if you got the chance? Or are you ok with everything that Facebook does?
- dschuetz 8y agoFacebook certainly has established itself as a rouge data mining company.
- z3t4 8y agoThe most scary thing is that someone is willing to pay $20 /month for this data.
- shrimpx 8y agoA simple UI change like making the root certificate trusting UI look like you're about to do something extremely dangerous would likely stop a lot more users from giving their data away like this. But instead, Apple shows you a benign-looking "warning."
- loriverkutya 8y agoI'm really curious, how the average Facebook engineer feels about this data mining and when is the point when they think they should stop building tools to allow Facebook to do this.
- bschne 8y agoI recently came across a similar market research effort in Switzerland [1] after I noticed the VPN symbol in the status bar on a relative's iPhone when showing them something. I asked about why they (not very tech-savy otherwise) were using a VPN and was told they were participating in a market research project in exchange for some shopping gift cards. As is the case with FB, the research company installs a VPN and their own root certificate. Of course the implications are outlined in the fine print / data protection agreement when signing up, but I doubt most of the participants are aware of just how far the data collection they enable with this goes... [1] https://swissmediapanel.ch/ https://swissmediapanel.ch/ (Link in German)
- runeks 8y agoSeems to me like the law needs to be clearer about how to inform users in cases like these. Surely, it's deceptive to tell someone they're getting paid for installing a "market reasearch" app which actually records all online activity. Charging companies, who knowingly deceive users like this, with fraud sounds reasonable to me.
- bschne 8y agoI agree that the law should probably be changed, but for slightly different reasons. They are clearly informed that the app will track information regarding their online activities, device usage behavior and applications they use. I think the main issue is that users without a tech background are just not aware of the full implications of allowing a third party to collect this kind of data, even decrypting their HTTPS traffic and tracking everything they do online. The statement by Strafach in the original article sums it up quite nicely: “The fairly technical sounding ‘install our Root Certificate’ step is appalling,” Strafach tells us. “This hands Facebook continuous access to the most sensitive data about you, and most users are going to be unable to reasonably consent to this regardless of any agreement they sign, because there is no good way to articulate just how much power is handed to Facebook when you do this.”
- TheSpiceIsLife 8y ago
- axOve 8y agoFacebook gets more likable by the day.
- kstenerud 8y agoI recently had something similar on Google Fi. One day my phone had a pop-up offering to connect me to their beta VPN automatically for security. Of course, while connected to the VPN you can't connect to anything on the LAN, and I'm not sure how regular users would be able to disable the thing. And, of course, the problem of Google sniffing everything you do.
- sigi45 8y agoBut just a VPN itself shouldn't be a problem. No rootca no sniffing.
- Corrado 8y agoI have Google Fi and I'm not sure this is the same thing. The Google VPN doesn't install a root CA (AFAIK) and merely acts like a normal VPN. It does terminate at Google's servers so they can peek at your traffic, but not any more so than a traditional ISP. The "secure" VPN dialog only comes up for certain WiFi connections that Google has some knowledge about. For example, when I'm in Chick-fil-A I get the "Secure this connection?" dialog, but I never get it at home or work. I've never had a need to disable it to reach local resources, but I'm guessing you could turn off WiFi and turn it back on to rejoin the network and not accept the VPN connection. I've never had the need to do that so I don't know if it would work or not. :/
- kstenerud 8y agoNo, this was different from the automatic per-known-wifi connection securing that it normally does. It was an actual VPN, that I had to manually remove because I could no longer access anything on my LAN.
- Tepix 8y agoWhen using Google Fi, can't they look at all your traffic anyway even without an extra VPN?
- pavelludiq 8y agoYour phone doesn't just contain private data about you, it contains private data about people you know. Selling them out like this is a scumbag thing to do, not to mention it's probably a TOS violation of every service you interact with. FB basically solicited people unwittingly commit crimes on their behalf.
- lucb1e 8y agoThis is hardly different from all those ad supported platforms we use every day. For privacy invasion, you get compensation. Usually you get to use a service free of charge, in this case (because the invasion is worse) you get financial compensation. If you mind this, you should be honest with yourself and compare it to all the other deals you're striking with many services.
- cheschire 8y agoLet's put it this way, imagine if everything that you ever said in various businesses was recorded and publicly available. That's analogous to the "many services" you're referring to. Now imagine if people were being offered the chance to get some gift cards in exchange for strapping a microphone to their face 24/7, regardless of location. That's analogous to what's happening here. Anything you do, visit, etc, can be collected. Your bank app traffic, your location data that any app requests, the contents of your data voice calls over non-FB apps, etc.
- lucb1e 8y agoI understand the implications. But I don't see a fundamental difference between strapping a microphone over someone's mouth 24/7, and only strapping the mic on (or, more practically, turning it on) when the user uses certain applications. In both cases you're compensated and in the former we feel violated, and in the latter it's all fair game and business.
- nullandvoid 8y agoFor anyone reading this now good news - https://news.ycombinator.com/item?id=19033451 https://news.ycombinator.com/item?id=19033451
- josefresco 8y agoReminds me of those old "dial up" Internet access offers that offered to pay you to surf the web. Being a broke college kid, my friends and I quickly learned we could game the system by installing software that moved our mouse and clicked randomly. Made for a pleasant and sometimes shocking surprise when waking up in the morning and checking to see where your PC navigated to the previous night.
- degenerate 8y agoYes, AllAdvantage was the biggest: https://en.wikipedia.org/wiki/AllAdvantage https://en.wikipedia.org/wiki/AllAdvantage I only got paid $31 for a month. Even as a kid, it wasn't worth the effort required due to their constant updates. The real hidden gems were NetZero and K-Mart's BlueLight. Both were completely free dial-up internet providers, paid for by a banner ad program that was easy to hide with window killers. Netzero went on to acquire BlueLight and many other free internet providers, and eventually turned into a paid internet service: https://www.mybluelight.com/ https://www.mybluelight.com/
- josefresco 8y ago>I only got paid $31 for a month. Even as a kid, it wasn't worth the effort My exp exactly. >The real hidden gems were NetZero and K-Mart's BlueLight. Yes and Yes! Used both, both were a giant pain but fun to mess around with. Now that I'm thinking about it, I'm not sure why I bothered as our family had dialup (I was probably just bored)
- gerbilly 8y agoWhy are there always so many people willing to defend the oppressor? This story is full of people making apologias for facebook's shady behaviour. I just don't get the urge in some people to defend the rich and powerful. They don't need you to defend them, they are probably 100000x richer than all of us discussing this here put together. This is an honest question because I can't understand the motivation behind it. If you are one of those people defending facebook, why are you doing it?
- bob_theslob646 8y ago>This is an honest question because I can't understand the motivation behind it. How informed should the user be? What qualifies as an informed user? This is getting into some dangerous territory because it because implies so some sort of contract literacy.
- gerbilly 8y ago> This is getting into some dangerous territory because it because implies so some sort of contract literacy. We already have laws forbidding certain types of deceptive contracts. The average user can't be expected to understand the consequences of installing facebooks 'trusted' root certificate.
- hoppelhase 8y agoAny European people affected? How does this play with the GDPR? Are the user's over 16? Anyone tried to file a GDPR data request?
- scottmcdot 8y agoWhy has this been hidden from the front page?
- newscracker 8y agoIt's no surprise that over and over again, Facebook has shown us that it will stop doing some of the bad things it does only when it's caught red handed. Until then, the employees who work there won't have any ethical qualms and the company won't care much about the impact either. Every time some news like this comes out, the PR department probably shrugs its shoulders and says "What are the users gonna do now? Quit our platform? Where will they even go to?" and just laughs out loud. If a person were to adopt this behavior, we would call them a criminal. Facebook, on similar lines, is a criminal enterprise that hasn't been punished appropriately so far!