7 ms·

In an odd twist, this is precisely what some tech critics have been pushing for—for consumers to be monetarily compensated for the data they're giving up to tec

by rlue 8y ago

In an odd twist, this is precisely what some tech critics have been pushing for—for consumers to be monetarily compensated for the data they're giving up to tech giants: https://news.ycombinator.com/item?id=17595564 https://news.ycombinator.com/item?id=17595564

larkeith 8y ago
One issue with this is brought up in the article: > “The fairly technical sounding ‘install our Root Certificate’ step is appalling,” Strafach tells us. “This hands Facebook continuous access to the most sensitive data about you, and most users are going to be unable to reasonably consent to this regardless of any agreement they sign, because there is no good way to articulate just how much power is handed to Facebook when you do this.”
- gruez 8y ago
  right, but considering most web traffic is encrypted nowadays, it's pretty much mandatory to do MITM to analyze traffic.
  - _jal 8y ago
    Perhaps that should be taken as a hint rather than a challenge.
  - morpheuskafka 8y ago
    But you can still get the domain/subdomain requested, which should be enough to find out service used and time/frequency of use. That will change with encrypted SNI (https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/), which is not yet mainstream, but large services Facebook is tracking have dedicated IP pools so that's not a barrier. So for the reported use case, "hey, tiktok looks good, let's find out how many people use it before we buy it out," it would seem that non-MITM would be plenty (and technically easier/lower resource to do, VPN could be kept on device and the pre-anonymized data sent up to the cloud, saving them server costs and bandwidth.
- travisoneill1 8y ago
  Why would people be unable to consent? "You give us full access to everything on your phone for money" is a way to articulate this to anybody.
  - gaius 8y ago
    Because it’s not transitive. If I send you a personal message, I didn’t consent to you giving that to Facebook who will use my phone number to add it to the shadow profile they keep on me. Facebook might as well pay in pieces of silver.
- fipple 8y ago
  I can easily imagine being poor enough to engage into this contract, despite knowing exactly what power this gives Facebook. Don't confuse desperation for ignorance.
  - morpheuskafka 8y ago
    How would someone have an iPhone, cell service, and a PayPal if they don't have $20 a month?
- dx034 8y ago
  Could they've achieved this another way? Still getting all the metadata for market research without a root certificate? If not, the step wasn't that appalling. Compensating people for information on their behaviour is nothing new. If you participate in a program to report daily purchases you probably give away as many information and yet it's not viewed as controversial. The fact that Facebook doesn't have a great track record is problematic but generally, I don't see a big issue.
- rlue 8y ago
  I agree that it's ethically dubious, and wasn't trying to defend the move by any means. However, I _would_ contend with the assertion that "there is no good way to articulate just how much power is handed to Facebook when you do this." Sure there is—just not one that would look good for Facebook.
untog 8y ago
But it's also paired with Facebook gaining unprecedented data access that they don't have on most users. Crazy.
mjamokeu33y 8y ago
The ethical problem here isn't related to compensation. It's the lack of informed consent for human subjects belonging to a vulnerable population.[1] This is bad juju. 1. https://en.wikipedia.org/wiki/Respect_for_persons https://en.wikipedia.org/wiki/Respect_for_persons
- dx034 8y ago
  That may be true for children (who should need parental consent which Facebook apparently asked for). But just because someone doesn't have a deep understanding of tech doesn't mean they can't consent. You can't exclude people from signing an agreement just because they don't have a CS degree.
duxup 8y ago
It seems unlikely that this pilot program would be the same as a production run, compensation wise.
randomsearch 8y ago
I think the common position is "Instagram should pay you for your photos" and "google translate should pay people for exploiting their translations", not "big companies should track everything you do and pay you a small amount of compensation".

by rlue 8y ago

larkeith 8y ago

One issue with this is brought up in the article: > “The fairly technical sounding ‘install our Root Certificate’ step is appalling,” Strafach tells us. “This hands Facebook continuous access to the most sensitive data about you, and most users are going to be unable to reasonably consent to this regardless of any agreement they sign, because there is no good way to articulate just how much power is handed to Facebook when you do this.”

gruez 8y ago
right, but considering most web traffic is encrypted nowadays, it's pretty much mandatory to do MITM to analyze traffic.
- _jal 8y ago
  Perhaps that should be taken as a hint rather than a challenge.
- morpheuskafka 8y ago
  But you can still get the domain/subdomain requested, which should be enough to find out service used and time/frequency of use. That will change with encrypted SNI (https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/), which is not yet mainstream, but large services Facebook is tracking have dedicated IP pools so that's not a barrier. So for the reported use case, "hey, tiktok looks good, let's find out how many people use it before we buy it out," it would seem that non-MITM would be plenty (and technically easier/lower resource to do, VPN could be kept on device and the pre-anonymized data sent up to the cloud, saving them server costs and bandwidth.
travisoneill1 8y ago
Why would people be unable to consent? "You give us full access to everything on your phone for money" is a way to articulate this to anybody.
- gaius 8y ago
  Because it’s not transitive. If I send you a personal message, I didn’t consent to you giving that to Facebook who will use my phone number to add it to the shadow profile they keep on me. Facebook might as well pay in pieces of silver.
fipple 8y ago
I can easily imagine being poor enough to engage into this contract, despite knowing exactly what power this gives Facebook. Don't confuse desperation for ignorance.
- morpheuskafka 8y ago
  How would someone have an iPhone, cell service, and a PayPal if they don't have $20 a month?
dx034 8y ago
Could they've achieved this another way? Still getting all the metadata for market research without a root certificate? If not, the step wasn't that appalling. Compensating people for information on their behaviour is nothing new. If you participate in a program to report daily purchases you probably give away as many information and yet it's not viewed as controversial. The fact that Facebook doesn't have a great track record is problematic but generally, I don't see a big issue.
rlue 8y ago
I agree that it's ethically dubious, and wasn't trying to defend the move by any means. However, I _would_ contend with the assertion that "there is no good way to articulate just how much power is handed to Facebook when you do this." Sure there is—just not one that would look good for Facebook.

untog 8y ago

But it's also paired with Facebook gaining unprecedented data access that they don't have on most users. Crazy.

mjamokeu33y 8y ago

The ethical problem here isn't related to compensation. It's the lack of informed consent for human subjects belonging to a vulnerable population.[1] This is bad juju. 1. https://en.wikipedia.org/wiki/Respect_for_persons https://en.wikipedia.org/wiki/Respect_for_persons

dx034 8y ago
That may be true for children (who should need parental consent which Facebook apparently asked for). But just because someone doesn't have a deep understanding of tech doesn't mean they can't consent. You can't exclude people from signing an agreement just because they don't have a CS degree.

duxup 8y ago

It seems unlikely that this pilot program would be the same as a production run, compensation wise.

randomsearch 8y ago

I think the common position is "Instagram should pay you for your photos" and "google translate should pay people for exploiting their translations", not "big companies should track everything you do and pay you a small amount of compensation".