3 ms·
Some clarifications: - Facebook allowed people to share their data and the data of their friends with third parties. So there was no requirement for me to use
by untog 8y ago
Some clarifications:
- Facebook allowed people to share their data and the data of their friends with third parties. So there was no requirement for me to use My Digital Life, or to accept a single permission prompt, in order for the researcher to have access to my data.
- people didn't "want to share their data", they wanted their quiz results. Was every bit of the data they provided required in order to get the quiz results? Doubtful. Were users aware that this data could be permanently stored outside of Facebook and used at a later point? Again, doubtful.
> that normally means they set an S3 bucket to public or got hacked
I'd argue that the combination of the above means that what Facebook did absolutely was equivalent to leaving an S3 bucket on public. Without absolutely any involvement by me, the researcher was able to access my personal data, and was given permission by someone whose understanding of what they were doing was, at best, dubious. Facebook knew all of this because they created the system it lived in, but didn't appear to consider the consequences, so yeah, I consider them responsible.
- librish 8y agoBut this is similar to any phone/email/contact book app will allow you to upload or manage your address book. Your friends could leak your email address or phone number by installing a malicious app and granting the permission, do you blame Google/Apple for this?
- untog 8y agoFor one, Google and Apple would remove an app from the App/Play Store if it was abusing those privileges. My Digital Life would never have passed App Store approval in the first place, since it in no way demonstrated why it needed the amount of personal information it requested. Facebook clearly had no such monitoring. Not to mention the scale of data is radically different. I'm not over the moon about someone uploading my phone number to an unknown service, but it's mild compared to someone uploading my phone number, friend network, wall posts, photos shared, likes, etc. etc. etc.
- librish 8y agoI'm not so sure that it wouldn't have passed AppStore review back in 2011, this was way before most privacy crackdowns began. It is also the case that the app claimed that this data would be used to analyze "your digital life" AND that it would be collected for research purposes only. Play Store definitely would've let it through. As for the quality of the data. Right now any of your friends could have apps installed that are secretly leaking your private conversations with a third party and there is no realistic way for Apple or Google to know. That information seems more sensitive than what you linked. Why are you setting the bar higher for Facebook?
- untog 8y ago> Why are you setting the bar higher for Facebook? The difference is this: > there is no realistic way for Apple or Google to know. There was a way for Facebook to know. The tool was using their own API, so they knew exactly what was being fetched and how often. I'm also not sure why it matters. Let's say Apple and Google are just as bad, I don't particularly care. It doesn't make what Facebook did any less worthy of scrutiny.