6 ms·

>Facebook gave Amazon extended access to user data because it was... partnering with the social network on the launch of its Fire smartphone. So is this yet an

>Facebook gave Amazon extended access to user data because it was... partnering with the social network on the launch of its Fire smartphone. So is this yet another case of the media being incapable of distinguishing between transferring of data to third parties and displaying data on devices as an agent of the user, i.e. for the purpose of providing an integrated facebook experience? Until the media shows itself to be capable of making that distinction, I can't take these articles seriously.

b_tterc_p 8y ago
You’re quote doesn’t really prove that it was just giving access to amazon devices. Could go either way, no?
- SpicyLemonZest 8y ago
  Every other time the issue has come up, it's turned out that "access to user data" meant that the third party was allowed to ask the user for access to their data. In principle this could be the first time Facebook actually just tossed database dumps at Amazon, and in principle Amazon might have abused the access to steal user data for themselves. But neither of those possibilities seem likely or are supported by the described evidence.
  - basch 8y ago
    The only real one I can remember off the top of my head, where facebook giving access to data didnt turn out to be userbase hands over data on themselves and friend, was the Netflix and some others getting access to private messages. And even there, it wasnt nefarious, it was facebook trying to extend people features, like being able to send their friends spotify songs. https://www.theverge.com/2018/12/18/18147616/facebook-user-data-giveaway-nyt-apple-amazon-spotify-netflix https://www.theverge.com/2018/12/18/18147616/facebook-user-d...
  - mancerayder 8y ago
    Every other time the issue has come up, it's turned out that "access to user data" meant that the third party was allowed to ask the user for access to their data. Allowed to ask the user? Can you unwrap that for us?
    - SpicyLemonZest 8y ago
      To use most user-data-serving Facebook APIs, you need both authorization from the user whose data you’re reading and approval from Facebook itself for your app. Facebook has been accused of bad behavior when approving and denying apps, but they haven’t (as far has been reported) released any APIs to get user data without first asking the user.
      - ForHackernews 8y ago
        This is true, but I doubt most users understood exactly what they handed over when they clicked "log in with Facebook".
        alex_57_dieck 8y ago
        at least there's always a tldr (you know what exactly you are handing over in a few bullet points), especially when you think of all the contracts/fine prints/ToS you accept in life..
shkkmo 8y ago
Do you have some context to support your statement? How do you know what what "extended access to user data" means here?
- socialhack3r 8y ago
  This article helps explain it: https://medium.com/@six4three/how-facebook-sold-your-data-and-fooled-government-regulators-until-now-b8b3d41fb565 https://medium.com/@six4three/how-facebook-sold-your-data-an...
  - socialhack3r 8y ago
    UK Parliament's report has a sample agreement that Facebook had with companies that whitelisted them and gave them extended access to user data when they publicly represented that the APIs had been deprecated
devoply 8y ago
If you go and look at all the sites that have implemented Facebook Connect and their beacon you know there was a quid pro quo there. You don't know however the nature of the deal. But Facebook seems very generous with sharing your data with other large companies... as the data itself is worth pennies but scarfing much more of it from partners is worth billions.
- netsharc 8y ago
  It's so fucking aggravating that Facebook says "Don't worry, 3rd parties won't abuse the data, because that would be against the rules.". A friend of mine wanted to remove her name from all social media, she said there's one site left that seemed to just mirror FB, and my name was on it too, it seemed the creator managed to download all the data accessible to apps and he even claimed making that site wasn't against FB's agreement...
seattle_spring 8y ago
Users of HN also have a major problem understanding this distinction.
ForHackernews 8y ago
Is there any reason to think the companies given access didn't slurp up the Facebook data for themselves? Have any of them denied it or tried to qualify what they did with their access to the Facebook API? Back in the day, I was part of a team that built an app that used Facebook Connect/what they were then calling the "Graph API" for login, and our app certainly saved all the data that Facebook made available back into our own database.
- rhizome 8y ago
  I doubt they'd ever qualify or admit that, since caching pretty much any user data has always or nearly-always been against the API TOS.
  - ForHackernews 8y ago
    Are you sure about that? This is from the current version of https://developers.facebook.com/policy/ https://developers.facebook.com/policy/ > You may use Account Information in accordance with your privacy policy and other Facebook policies. All other data may not be transferred outside your app, except to your service provider (per, Section 3.7) who needs that information to provide services to your app. With the exception of Account Information, you may only maintain user data obtained from us for as long as necessary for your business purpose. I imagine some smart lawyers worked pretty hard on that. I imagine that most companies have their own smart lawyers who write "[their] privacy policy" to say "we can do whatever we want with your data...to provide you better service." I assume that your app's backend is the "service provider" in question. IANAL, but I read that as saying it's kosher with FB for your app to push data up to the mothership. The phrase "for as long as necessary for your business purpose" sure sounds like "indefinitely" to me. Maybe my business is still hoping to make some money from that data?
    - renaudg 8y ago
      This wording is almost certainly for GDPR compliance.

b_tterc_p 8y ago

You’re quote doesn’t really prove that it was just giving access to amazon devices. Could go either way, no?

SpicyLemonZest 8y ago
Every other time the issue has come up, it's turned out that "access to user data" meant that the third party was allowed to ask the user for access to their data. In principle this could be the first time Facebook actually just tossed database dumps at Amazon, and in principle Amazon might have abused the access to steal user data for themselves. But neither of those possibilities seem likely or are supported by the described evidence.
- basch 8y ago
  The only real one I can remember off the top of my head, where facebook giving access to data didnt turn out to be userbase hands over data on themselves and friend, was the Netflix and some others getting access to private messages. And even there, it wasnt nefarious, it was facebook trying to extend people features, like being able to send their friends spotify songs. https://www.theverge.com/2018/12/18/18147616/facebook-user-data-giveaway-nyt-apple-amazon-spotify-netflix https://www.theverge.com/2018/12/18/18147616/facebook-user-d...
- mancerayder 8y ago
  Every other time the issue has come up, it's turned out that "access to user data" meant that the third party was allowed to ask the user for access to their data. Allowed to ask the user? Can you unwrap that for us?
  - SpicyLemonZest 8y ago
    To use most user-data-serving Facebook APIs, you need both authorization from the user whose data you’re reading and approval from Facebook itself for your app. Facebook has been accused of bad behavior when approving and denying apps, but they haven’t (as far has been reported) released any APIs to get user data without first asking the user.
    - ForHackernews 8y ago
      This is true, but I doubt most users understood exactly what they handed over when they clicked "log in with Facebook".
      - alex_57_dieck 8y ago
        at least there's always a tldr (you know what exactly you are handing over in a few bullet points), especially when you think of all the contracts/fine prints/ToS you accept in life..

shkkmo 8y ago

Do you have some context to support your statement? How do you know what what "extended access to user data" means here?

socialhack3r 8y ago
This article helps explain it: https://medium.com/@six4three/how-facebook-sold-your-data-and-fooled-government-regulators-until-now-b8b3d41fb565 https://medium.com/@six4three/how-facebook-sold-your-data-an...
- socialhack3r 8y ago
  UK Parliament's report has a sample agreement that Facebook had with companies that whitelisted them and gave them extended access to user data when they publicly represented that the APIs had been deprecated

devoply 8y ago

If you go and look at all the sites that have implemented Facebook Connect and their beacon you know there was a quid pro quo there. You don't know however the nature of the deal. But Facebook seems very generous with sharing your data with other large companies... as the data itself is worth pennies but scarfing much more of it from partners is worth billions.

netsharc 8y ago
It's so fucking aggravating that Facebook says "Don't worry, 3rd parties won't abuse the data, because that would be against the rules.". A friend of mine wanted to remove her name from all social media, she said there's one site left that seemed to just mirror FB, and my name was on it too, it seemed the creator managed to download all the data accessible to apps and he even claimed making that site wasn't against FB's agreement...

seattle_spring 8y ago

Users of HN also have a major problem understanding this distinction.

ForHackernews 8y ago

Is there any reason to think the companies given access didn't slurp up the Facebook data for themselves? Have any of them denied it or tried to qualify what they did with their access to the Facebook API? Back in the day, I was part of a team that built an app that used Facebook Connect/what they were then calling the "Graph API" for login, and our app certainly saved all the data that Facebook made available back into our own database.

rhizome 8y ago
I doubt they'd ever qualify or admit that, since caching pretty much any user data has always or nearly-always been against the API TOS.
- ForHackernews 8y ago
  Are you sure about that? This is from the current version of https://developers.facebook.com/policy/ https://developers.facebook.com/policy/ > You may use Account Information in accordance with your privacy policy and other Facebook policies. All other data may not be transferred outside your app, except to your service provider (per, Section 3.7) who needs that information to provide services to your app. With the exception of Account Information, you may only maintain user data obtained from us for as long as necessary for your business purpose. I imagine some smart lawyers worked pretty hard on that. I imagine that most companies have their own smart lawyers who write "[their] privacy policy" to say "we can do whatever we want with your data...to provide you better service." I assume that your app's backend is the "service provider" in question. IANAL, but I read that as saying it's kosher with FB for your app to push data up to the mothership. The phrase "for as long as necessary for your business purpose" sure sounds like "indefinitely" to me. Maybe my business is still hoping to make some money from that data?
  - renaudg 8y ago
    This wording is almost certainly for GDPR compliance.