3 ms·

But... Facebook did expose that data, by allowing a researcher to gather data on 87 million users with no actual restrictions on what he could do with that data

by untog 8y ago

But... Facebook did expose that data, by allowing a researcher to gather data on 87 million users with no actual restrictions on what he could do with that data. The root cause here is Facebook. It feels like arguing semantics to say the narrative is "almost entirely false" because Facebook exposed that data to an individual who later exposed it to Cambridge Analytica. Arguably Facebook exposed data on far more than 87 million Facebook users - it exposed data on every single user it has.

SpicyLemonZest 8y ago
To be clear, the scenario was this. Facebook allowed people to voluntarily share their data with a large number of third-party apps, including one called "This Is Your Digital Life". This was a popular feature; lots of people wanted to share their data in order to get quiz results and such. The guy who created "This Is Your Digital Life" said the data was only for his academic research, but it was secretly for Cambridge Analytica. When the news reports that some company has exposed data, that normally means they set an S3 bucket to public or got hacked. I don't think many people would naturally describe the above scenario, where I voluntarily handed my Facebook data to a third party who lied about who they were, as "Facebook exposed your user data".
- untog 8y ago
  Some clarifications: - Facebook allowed people to share their data and the data of their friends with third parties. So there was no requirement for me to use My Digital Life, or to accept a single permission prompt, in order for the researcher to have access to my data. - people didn't "want to share their data", they wanted their quiz results. Was every bit of the data they provided required in order to get the quiz results? Doubtful. Were users aware that this data could be permanently stored outside of Facebook and used at a later point? Again, doubtful. > that normally means they set an S3 bucket to public or got hacked I'd argue that the combination of the above means that what Facebook did absolutely was equivalent to leaving an S3 bucket on public. Without absolutely any involvement by me, the researcher was able to access my personal data, and was given permission by someone whose understanding of what they were doing was, at best, dubious. Facebook knew all of this because they created the system it lived in, but didn't appear to consider the consequences, so yeah, I consider them responsible.
  - librish 8y ago
    But this is similar to any phone/email/contact book app will allow you to upload or manage your address book. Your friends could leak your email address or phone number by installing a malicious app and granting the permission, do you blame Google/Apple for this?
    - untog 8y ago
      For one, Google and Apple would remove an app from the App/Play Store if it was abusing those privileges. My Digital Life would never have passed App Store approval in the first place, since it in no way demonstrated why it needed the amount of personal information it requested. Facebook clearly had no such monitoring. Not to mention the scale of data is radically different. I'm not over the moon about someone uploading my phone number to an unknown service, but it's mild compared to someone uploading my phone number, friend network, wall posts, photos shared, likes, etc. etc. etc.
      - librish 8y ago
        I'm not so sure that it wouldn't have passed AppStore review back in 2011, this was way before most privacy crackdowns began. It is also the case that the app claimed that this data would be used to analyze "your digital life" AND that it would be collected for research purposes only. Play Store definitely would've let it through. As for the quality of the data. Right now any of your friends could have apps installed that are secretly leaking your private conversations with a third party and there is no realistic way for Apple or Google to know. That information seems more sensitive than what you linked. Why are you setting the bar higher for Facebook?
        untog 8y ago
        > Why are you setting the bar higher for Facebook? The difference is this: > there is no realistic way for Apple or Google to know. There was a way for Facebook to know. The tool was using their own API, so they knew exactly what was being fetched and how often. I'm also not sure why it matters. Let's say Apple and Google are just as bad, I don't particularly care. It doesn't make what Facebook did any less worthy of scrutiny.

by untog 8y ago

SpicyLemonZest 8y ago

To be clear, the scenario was this. Facebook allowed people to voluntarily share their data with a large number of third-party apps, including one called "This Is Your Digital Life". This was a popular feature; lots of people wanted to share their data in order to get quiz results and such. The guy who created "This Is Your Digital Life" said the data was only for his academic research, but it was secretly for Cambridge Analytica. When the news reports that some company has exposed data, that normally means they set an S3 bucket to public or got hacked. I don't think many people would naturally describe the above scenario, where I voluntarily handed my Facebook data to a third party who lied about who they were, as "Facebook exposed your user data".

untog 8y ago
Some clarifications: - Facebook allowed people to share their data and the data of their friends with third parties. So there was no requirement for me to use My Digital Life, or to accept a single permission prompt, in order for the researcher to have access to my data. - people didn't "want to share their data", they wanted their quiz results. Was every bit of the data they provided required in order to get the quiz results? Doubtful. Were users aware that this data could be permanently stored outside of Facebook and used at a later point? Again, doubtful. > that normally means they set an S3 bucket to public or got hacked I'd argue that the combination of the above means that what Facebook did absolutely was equivalent to leaving an S3 bucket on public. Without absolutely any involvement by me, the researcher was able to access my personal data, and was given permission by someone whose understanding of what they were doing was, at best, dubious. Facebook knew all of this because they created the system it lived in, but didn't appear to consider the consequences, so yeah, I consider them responsible.
- librish 8y ago
  But this is similar to any phone/email/contact book app will allow you to upload or manage your address book. Your friends could leak your email address or phone number by installing a malicious app and granting the permission, do you blame Google/Apple for this?
  - untog 8y ago
    For one, Google and Apple would remove an app from the App/Play Store if it was abusing those privileges. My Digital Life would never have passed App Store approval in the first place, since it in no way demonstrated why it needed the amount of personal information it requested. Facebook clearly had no such monitoring. Not to mention the scale of data is radically different. I'm not over the moon about someone uploading my phone number to an unknown service, but it's mild compared to someone uploading my phone number, friend network, wall posts, photos shared, likes, etc. etc. etc.
    - librish 8y ago
      I'm not so sure that it wouldn't have passed AppStore review back in 2011, this was way before most privacy crackdowns began. It is also the case that the app claimed that this data would be used to analyze "your digital life" AND that it would be collected for research purposes only. Play Store definitely would've let it through. As for the quality of the data. Right now any of your friends could have apps installed that are secretly leaking your private conversations with a third party and there is no realistic way for Apple or Google to know. That information seems more sensitive than what you linked. Why are you setting the bar higher for Facebook?
      - untog 8y ago
        > Why are you setting the bar higher for Facebook? The difference is this: > there is no realistic way for Apple or Google to know. There was a way for Facebook to know. The tool was using their own API, so they knew exactly what was being fetched and how often. I'm also not sure why it matters. Let's say Apple and Google are just as bad, I don't particularly care. It doesn't make what Facebook did any less worthy of scrutiny.