15 ms·
Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
- blibble 8y agounintentional my foot the code to implement that functionality didn't come from nowhere
- brianpgordon 8y agoApparently Facebook is claiming that the functionality came from a separate "import contacts" feature that used to exist. But I agree; the idea that the import logic could have slipped into the login process accidentally is ludicrous. Or at least it indicates an outrageous lack of care on Facebook's part.
- ludston 8y agoIt requires just one developer and a couple of reviewers to make poor choices. Which begs the question, how do you structure your organisation such that a foolish developer that only barely understands the change that they are making can't write code that makes arbitrary queries to particular data sets in unapproved contexts?
- a_imho 8y agoBut you actually say it requires negligence on part of multiple people. I find it very hard to apply Hanlon's razor in this case. Anyway, from my experience people do the stupidest/reckless things despite being told not to, just because there is no fear of backlash. Holding people liable for their actions could be a start, but who wants that? Also, don't hire foolish developers in the first place. Policing around pebkac is hard.
- hopler 8y agoHave you ever worked for an organization? 3 people making mistakes on a project, coupled with bystander effects, is par for the course. Being a million times wealthier isn't a million times smarter. We're still talking about how Boeing accidentally crashed a few jetplanes full of people, which required dozens of people to screw up.
- AnthonyMouse 8y agoStart by keeping the primary copy of the user's data on the user's own device so that the developers never have access to it to begin with. Then, if you ever have to hold a copy of the user's data, make sure it's encrypted by the client and your servers are never in possession of the plaintext. To access the user's data, your developers should have to intentionally crack the user's password. And if they attempt to do that they should be fired. Obviously this is not how Facebook works, but ideally it's how the thing that replaces Facebook will work.
- emerongi 8y agoThere should be a name for this sort of software design. It's not just encrypted/privacy-oriented or whatever. It's a software design with a clear contract on who owns the data: the user. E.g. Google Drive, which claims to take privacy seriously and also encrypts your data. But the data is not encrypted with a secret unknown to the server. How should my family members differentiate between the encryption Google claims it has and client-side encryption? For them it's all the same. Maybe we need some commonly understandable name that a regular user can look at and know that this software is data-agnostic.
- sonnyblarney 8y ago"Start by keeping the primary copy of the user's data on the user's own device" It's an organizational policy, procedural, ethics and legal question - not a technical one. They should have feature reviews before the code reviews. The feature review panel puts bounds on what the code can do.
- brianpgordon 8y agoI don't think you need a board to stop this specific case. It's pretty obvious that what they were doing is unacceptable. The problem must have been a pervasive culture of lack of respect for privacy at Facebook, not a single engineer who somehow just didn't know any better.
- sonnyblarney 8y ago
- Illniyar 8y agoThat's not exactly true, it depends on the architecture in use. For instance if using a Publish/Subscribe model, you could have had a service that listens to your email being connected, and since the only reason to connect your email was to upload contacts, it would upload contacts automatically. Later when login with email was added, the same event was sent but whomever added the event didn't know it would case the upload of contacts. That doesn't mean it wasn't shoddy craftsmanship, bad architecture, bad QA and probably bad communication later on, but it could have been by mistake (at least at first).
- deleted 8y ago[deleted]
- onli 8y agoIf the feature was using the fact that the user supplied the email password, parsing the emails for contacts or logging in with the password and getting the contact list, how on earth could that have been a part of an earlier import contact feature? Did they already ask users for their email password for that? If not this is a feature that needed special code, impossible to be an accident.
- javagram 8y ago> how on earth could that have been a part of an earlier import contact feature? Did they already ask users for their email password for that Yes they did. I remember people complaining about it many years ago. Here’s a page from 2012 describing it I found using google advanced search: https://smallbusiness.chron.com/import-email-facebook-44162.html https://smallbusiness.chron.com/import-email-facebook-44162.... > When you create a Facebook page for your business, you can import your email list of contacts directly into Facebook. From there, you can suggest your Facebook page directly to your customers. Facebook can interact with a range of email providers and only needs your email accounts's username and password to import your contacts. Here’s another from 2011 https://www.techwalla.com/articles/how-to-import-contacts-to-facebook https://www.techwalla.com/articles/how-to-import-contacts-to... > Type your email address and password for the Web-based email or instant-messaging service that you want to import into the dialog boxes and click "Find Friends."
- onli 8y agoThanks! Unbelievable that this existed.
- daemin 8y agoI believe "move fast and break things" is a quote often attributed to Facebook. In this case the automatic importing feature might have been something broken, or something working correctly with an excuse that it was "broken".
- clintonb 8y agoForget the contacts. People willingly gave Facebook their email passwords. Did Facebook also accidentally upload users' emails? Why would Yandex (from the screenshot) even permit this?
- jammygit 8y agoFirst they ask for email passwords. Then the new users assume Facebook won't comprehensively mine their emails. Then Facebook awkwardly gets caught uploading 1.5 million users' email contacts. It doesn't make sense for people to trust the service at all unless you assume one of two things: 1 - Despite all the outrage on hackernews, and the NWT stories, our neighbours down the street and family members still don't know how Facebook works or what is done with their data 2 - They don't care about their data privacy. I've heard this claim many times, but the people saying it often change their minds when they read more news stories. I really do think people have trouble assuming the worst about the intentions of others and are inclined to be trusting. edit: clarification
- p1esk 8y ago3 - those who know how fb works, assume the worst about its intentions, and still don’t care and keep using it
- darkpuma 8y ago> "I really do think people have trouble assuming the worst about the intentions of others and are inclined to be trusting." I think you hit the nail on the head. Even on HN, it's not uncommon to see a few comments on each negative story about facebook accusing the media of a conspiracy against Facebook; claiming that the media is wrongly maligning Facebook who is merely the unfortunate victim of a series of coincidental accidents. They have trouble accepting that a tech corporation like facebook actually might be rotten.
- AnthonyMouse 8y agoI think you see that more with other tech companies. There is a certain amount of anti-silicon valley sentiment in the media and as a result there are a lot of stories maligning tech companies in ways that aren't always fair. Especially when the media companies are campaigning for some kind of problematic legislation that the tech companies are on the other side of and so will take any excuse to try to make them look bad. Then there's Facebook, about which nobody has time to write a story maligning them unfairly because there is never that long between any of the stories maligning them fairly.
- 3xblah 8y agoCan someone use a throwaway e-mail address to sign up for Facebook? Once the e-mail address is validated, is there any further need for a valid e-mail address to continue using FB? Historical fact: Going back to the days when a university address was required, if the user created her Facebook account while at university and her e-mail address later expired when she graduated, FB did not disable the account. Unless one wants to get notifications and other FB crud via email, AFAIK there is no need for a working e-mail address to use FB.
- nvssj 8y agoJust use a throwaway email account AND keep it? At some point they might decide to lock you out if you log in from a different place, I think it's better if you keep the email account safe.
- 3xblah 8y agoHas been over ten years since email address no longer valid; still waiting to be "locked out".
- OrgNet 8y agoI created a temporary email on my domain to use for the Facebook account creation and then disabled it so I stop getting spammed.. I can always re-enable it if I ever need to.
- LinuxBender 8y agoYes. I use throw-away email addresses for everything. When a company gets popped or "accidentally" leak my email address, I simply add a header check and reject or discard them. I was on FB for 2 weeks when it started and I still see them in my logs from time to time trying to fish me back into the system.
- AmIDev 8y agoIn my experience, Nope. I wanted to create a FB account while giving as minimal data as possible. While it's possible to create an account using temporary emails / temporary phone numbers, FB eventually asks you to submit more details. This includes clicking verification links, uploading your photo, providing phone numbers etc. Even when I managed to do all these (using fake data), my accounts got disabled in few days. PS: when I used my email id associated with my FB account deleted back in ~2012, I found out it wasn't deleted. FB asked me to recognize pictures of my friends. So I believe no detail that ever passes the event horizon of facebook can ever leave it.
- skilled 8y agoThis one actually made me laugh. Talk about going the extra mile with their efforts.
- ghani 8y agoThis really seems like a big deal IMO.
- tonyjstark 8y agoNot for one second I believe this was unintentionally. After all data scandals where Facebook didn't actively care or even empowered the problem by not acting towards privacy. I think this company is inherently bad from the top and everyone working there is enabling them. Sure, it pays well. Problem is, most bigger companies do bad things. See VW and the emission scandal and I hope Winterkorn and other top managers goes to jail for that. Also I'm biased, for me Facebook and Instagram are pretty useless, the only useful product they have is Whatsapp...
- itronitron 8y agomove fast and take things
- maxheadroom 8y ago>Facebook says that it didn't mean to upload these contacts How can you not mean to? It's one thing to say that, were it something tangible, like paper, "Sorry, mate. These pages snuck in with the others. Sorry about that. We'll pull it out. No worries." Pulling contacts and uploading them is not a passive action but takes active action. >and is now in the process of deleting them. So, the question must then be asked: How do they differentiate the sources of contacts associated with an account, unless they're logging that, as well? If they're not logging that, then how are they, presumably, deleting those contacts? Are we taking bets on Facebook being in the news again, in a months' or so time, for being found to not have deleted them? :)
- javajosh 8y ago>How can you not mean to? Indeed. Expect the next headline to be, "Facebook 'unintentionally failed to delete' 1.5M people's contacts, which they'd previously unintentionally uploaded".
- coldcode 8y agoSo Facebook has no QA or Facebook has QA no one listens to? I imagine the latter.
- cobookman 8y agoProbably no qa. Lots of tech companies put qa on the developer
- mannykannot 8y ago> Pulling contacts and uploading them is not a passive action but takes active action. Action such as "accidentally" asking for email passwords. It is quite remarkable how these accidents line up just so. Grammar-checking programs should be flagging any use of "accident", "accidentally", "unintended" and "unintentionally" whenever they appear in the same sentence as "Facebook" and are not within quotes.
- deleted 8y ago[deleted]
- M2Ys4U 8y ago"unintentionally". Yeah, sure, whatever you say Zuck.
- temporar 8y agoThere is so much double speak right now in Corporate America, its sickening.
- moogly 8y agoAt least they seem to have a thesaurus at hand. Last month they "mistakenly" did something. https://nordic.businessinsider.com/facebook-old-posts-mark-zuckerberg-disappeared-2019-3?r=US&IR=T https://nordic.businessinsider.com/facebook-old-posts-mark-z...
- pndy 8y agoI have a feeling that the US govt agencies will benefit from this "unintentional" upload - if they didn't already.
- samcday 8y agoThe selfish part of me wishes that the media would stop reporting on the endless procession of privacy violations / attacks by Facebook. It doesn’t seem to change a damn thing (Facebook revenue, DAU, etc seem to just keep going up). All it does it make me depressed, watching as we all just aimlessly shuffle pathetically toward some surveillance capitalism dystopia.
- throwaway_9168 8y agoSince FB has gone out of their way to weaponize "friendship", my suggestion to everyone who actually likes to have some standards in their life and don't like to be manipulated like that is simple. Just do it back to them. "Unfriend" (IRL) everyone you know who works at Facebook and tell them you will "friend" them back once they leave the company.
- malms 8y agoOr maybe people could learn again "personal responsibility" and realize that everything they give to facebook is exactly like giving oyur life to any compagny like Coca Cola, and that these compagny can do pretty much anything with it within the limits of the "laws that are actually enforced", whose number is pretty much 0. Stop complaining, start taking responsibility.
- kaolti 8y agoYou're right and I appreciate your comment. You probably noticed taking responsibility is extremely unpopular nowadays in all aspects of life, most noticeable in politics probably.
- Lammy 8y agoNot everyone has the luxury to be able to discard their health insurance or work visa on a whim to suit your opinion of their employer.
- FakeComments 8y agoPeople aren’t entitled to commit cyber crimes, just because it’s a convenient way to pay the bills. So far as I can tell, this was Facebook exceeding authorized access to a computer system — at scale. If you or I did this, we’d be looking at felony charges.
- thecatspaw 8y agoI would never friend someone again who dropped me because of my employer
- peteretep 8y agoHonestly I don't understand why Zuck doesn't sell up at Facebook and use his considerable money and brains to move to philanthropy, like billg. His personal brand is going to continue to dive while he's the face of this bullshit.
- chimen 8y agoEgo.
- peteretep 8y agoThat feels like a good reason to go and cure malaria or something, and get out of the PR disaster snowball that Facebook is becoming
- hopler 8y agoZuckerberg, like billg, has no interest in philanthropy until his mortality and his wife are is staring him the face putting the fear of the afterlife in him.
- nathan_long 8y agoPresumably he enjoys running a powerful business built on privacy violation more than he thinks he'd enjoy philanthropy. The BS you refer to is his creation, not some accidental thing that happened to occur in his company without his intention.
- smt88 8y agoSaying "unintentionally" here is like saying you unintentionally stole someone's TV when they gave you their key to walk their dog. It takes extra work to upload those contacts, which means several managers and developers decided to do it and then spent time implementing it. For the FB employees reading this: what is your tipping point? Would you say no to that assignment?
- pixl97 8y ago>what is your tipping point? Would you say no to that assignment? When FB stops giving them a check. At least that has been my experience watching programmers at other companies. Unless ethically bound by regulation and law, few people seem to have ethics.
- swebs 8y ago>few people seem to have ethics Or maybe their set of ethics simply differs from yours. It is very subjective after all
- devnonymous 8y ago> It is very subjective after all Methinks that was what the OP was asking -- what is the tipping point ? Having differing ethics is fine but one can't just lean on that as a crutch when one has none.
- matz1 8y agoWhat tipping point? Maybe the engineer themselves who recommends the practice. Everyone have ethics but might be differ than you. As long as the practice meet their goal, from their perspective it works.
- dwighttk 8y agoI just tripped and a giant laser melted all the gold in Ft Knox which drained down a pipe into a storage container under my backyard.
- patrickg_zill 8y agoNothing will ever change until someone goes to jail, IMHO.
- mikro2nd 8y agoFB has said they'll be notifying the people whose contacts they "unintentionally" uploaded. How about notifying those contacts whose private details they illicitly obtained that their privacy has been compromised by Facebook - the innocents who signed up for FB and had their contact-list stolen (let's call it what it is) may or may not feel any moral obligation (more likely, don't even see the issue) to notify their friends/family/plumber whose details they "lost" to a thief.
- hopler 8y agoThat's right. Whenever a computer system is breached, it is the breacher's responsibility to notification the affected people, not the entity entrusted with the information. That's why it's generally agreed that Equifax did nothing wrong when credit data was accessed.
- PedroBatista 8y agoIt’s amazing what these companies can get away with without paying a single dime to anyone.
- dmix 8y agoPeople can sue if they can find some claim to real-life damages... You'd only need a small percentage of the 1.5 million people and FB would probably settle out of court.
- PedroBatista 8y agoHow about consumer and privacy laws? I know it varies from country to country but the government can sue and fine companies and people in order to protect it's citizens. I know I know.. I'm old fashioned like that.
- fencepost 8y agoHow about notifying those contacts whose private details they illicitly obtained that their privacy has been compromised Because there's a difference between "we screwed up and obtained this" and "we screwed up, obtained this, then used it. Hope our use didn't result in any problems for you."
- dwighttk 8y agoThe headline should use “asked” instead of “asks”
- yakubin 8y agoWhy would anyone just give a site their password to their email account? And to Facebook on top of that?
- Cthulhu_ 8y agoConvenience. That is, Facebook - and others, like Skype - tells new users that the easiest and quickest way to find your friends is to send them your contacts so they can cross-reference the users. And that, including me not paying attention, is how all my e-mail contacts got an email from facebook where I invited them to FB. That wasn't the intent!
- netsharc 8y agoInterestingly, WhatsApp (and Telegram, and Signal) don't even ask and just upload all your contacts' phone numbers (this is before Android had the prompt "Allow this app access to your contacts?). It's very convenient, and also very sad. Also sad is the fact that BlackBerry already had a fine-grained permissions systems pre-iPhone days, but it took iPhone and Android many many versions and years before they built such privacy controls (but yeah "We care about our costumer's privacy" - Apple). And Google didn't even care about privacy back then I remember the Google Maps app for BlackBerry just prompts you "Please give us all the permissions we want or this app will just exit now." on startup, when you've denied it a permission or two.
- elken 8y agoPermissions to read text messages is another one that gets me. I know not many people use SMS as their primary communication but how can you be so astonishingly blasé about your data to save typing in a code?
- Liquid_Fire 8y agoThankfully there is now the SMS Retriever API that lets you do this without having access to all messages, and the Play Store no longer allows apps that require this permission without SMS handling being a core functionality of the app.
- galfarragem 8y agoI'm pretty sure LinkedIn does or used to do the same.
- gpvos 8y agoStill does. The apparently popular German payment system Sofortüberweisung (now run by Klarna) even requests the password of your bank account.
- durnygbur 8y agoSOFORT quite explicitly ~scraps~ scrapes the entire available transaction history for „your convenience” (much more is available with access login and password actually). What a satisfaction when they tried to enter Polish market and the Polish finance controlling authorities shut them down before they managed to squeek. The famous German „privacy” it is.
- netsharc 8y agoThey claim it's to see that the customer is liquid enough, so more for the convenience of the seller. It's incredible that the banks tolerated this service even though they told their customers to not to give their credentials to a 3rd party. Or not just banks, how about the German Federal Office for Information Security. I wish the bank would just block accounts who they detect used the service with an error like "We think your credentials have been compromised" (then again the stupid customer will think it's the bank who got breached). Or give them a fine of e.g. 100 Euro for breaching their user agreement. Then again, this would lose them so many pissed-off customers.
- lsaferite 8y agoThe idea of handing over my banking password to any third party is crazy. Mind you, I'd love an API that I could use to easily pull all of my banking details into my local system. There are a few ways to do this currently, but nothing simple, open, and standard. P.S. As you seem to be a non-native English speaker, the word you wanted to use was "scrapes" not "scraps".
- hluska 8y agoAt some point, some government is going to have to step in and stop Facebook. Five years ago, I would not have believed that I would have supported government action. Now, I’m afraid for the future if there is no intervention.
- swebs 8y agoHave you read the Prism papers? Governments love this mass data collection since it makes their job so much easier.
- hluska 8y agoWell yeah, I’m sure they do, but at what cost? The same data collection that government loves so much has been misused to throw elections and genuinely cast doubt upon the democratic process. Ultimately, creating this big giant drag nets has only empowered companies to demonstrate a complete lack of regard for humanity. If that’s security, I no longer want to be secure.
- codedokode 8y ago> The same data collection that government loves so much has been misused to throw elections If this is done in favor of the current government, then they probably won't mind.
- hluska 8y agoI am sad by how incredibly accurate this statement is. Great comment, but geez, let me put my head back in the sand...:)
- askmike 8y agoIt only makes the job of intelligence agencies easier, a tiny part of an government. And one that wouldn't play any role in intervening in a company like proposed.
- Cthulhu_ 8y ago
- rezeroed 8y agoThe incessant stories about Facebook are beyond tedious. I don't even know how to complain about this. I suppose it would be nice if we could somewhere officially label Facebook as dodgy rubbish, and abandon everyone who continues to knowingly use it to suffer the expected consequences, and never have to read another unsurprising article about them ever again.
- hysan 8y agoWhile they are deleting the imported contacts, that doesn’t undo any potential shadow profiles they generated, any training to their ML models that associate users (relationships), or any training to their advertising models. I believe Facebook doesn’t care about the contacts themselves. They wanted all of these collarary benefits that the general public will not be thinking about.
- johnisgood 8y agoWhy does it ask for your e-mail password to begin with? It is sad that there are 1.5M people out there (and probably more) that actually gave them their password. Scary.
- u801e 8y agoWhy are companies even asking users to provide passwords for unrelated services? For example, when I added an external account on Etrade, they gave me the option of same day verification of that account if I provided them my online banking account credentials. This practice opens up a significant potential for abuse and should be illegal.
- matt4077 8y agoIs this question rhetorical? Your online banking is known to be verified, therefore another company can piggyback on that verification.
- u801e 8y agoYes, but that doesn't mean that someone else needs my credentials to verify it. They should have their own independent method of verification. Do I need to give you my online banking's user name and password in order for you to send me money?
- dingaling 8y agoThey can't really 'piggyback' since disclosing your account authentication details is against the ToS of the bank.
- throwawaymanbot 8y agoWe will look back on these times and realize how morally and ethically corrupt Facebook was and is, especially under this "Leadership". This is why Facebook should be broken up. Its not just dangerous to Democracy, its an actual menace.
- carnagii 8y ago18 USC 1030 (a)(4) (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030 A criminal investigation into whether or not this was really accidental would be entirely warranted here. If there was intent to access this information without authorized access that is criminal.
- matt4077 8y agoNot a lawyer, but at least in my jurisdiction, fraud requires a monetary loss by the victim. Generally, civil law is better suited for this sort of thing, no matter how good a pitchfork feels in your hand. As but one of the reasons, the required standard of proof is much lower.
- raverbashing 8y ago> Not a lawyer, but at least in my jurisdiction, fraud requires a monetary loss by the victim. Note this is not a state law as quoted, but it's the USC
- dmitryminkovsky 8y agoThere’s got to be a monetary loss here. If there isn’t precedent for calculating that loss, such precedent should be established. Our email contacts are valuable, especially at 150m user scale. We could have all banded together and sold them, had Facebook not stolen them. These users should be compensated.
- matt4077 8y ago“150m user scale” is an expression speaking to Facebook’s gain, not to any users’ loss. What’s needed is serious privacy legislation, not creative reinterpretation.
- dmitryminkovsky 8y ago
- javagram 8y agoThis seems like a case similar to the Google WiFi data collection. Code written for one reason was reused in a different project without understanding what it would do. Here’s an example page from 2011 talking about facebook’s old feature to import contacts via providing them your email username and password. This was at a point when many web mail services didn’t offer an OAuth API to do this, so it did make some sense at the time. It was still safer to do a csv export and then import, but much easier for users to provide the password directly. https://www.techwalla.com/articles/how-to-import-contacts-to-facebook https://www.techwalla.com/articles/how-to-import-contacts-to... > Type your email address and password for the Web-based email or instant-messaging service that you want to import into the dialog boxes and click "Find Friends."
- matt4077 8y agoI thought of this as well. One difference, at least subjectively, is that Google seems to make far fewer of such mistakes. Just as with people, it’s sometimes difficult to judge them for a single act. Only by aggregating behavior over time can we learn of their true character. And Facebook’s rotten.
- oldjokes 8y agoAre they just flat out teaching people how to be super deceptive and how to tactically play stupid in MBA programs nowadays?
- rchaud 8y agoYou're really attributing this to the MBA boogeyman, when Zuck the l33t coder dropout almost certainly had to sign off on a move like this?
- nathan_long 8y agoI don't recall ever hearing that Facebook made a mistake which decreased the amount of data they collected or their usage thereof. Can anyone provide an example?
- hhanesand 8y agoI get what you’re getting at here, but I don’t think it would be reported in the general media as it’s not a privacy violation.
- jefftk 8y agoI'm sure Facebook has had bugs that broke various forms of data collection, or missed data they could have collected. We wouldn't hear about it, but it would be surprising if it hadn't happened.
- blauditore 8y agoThis may be an unpopular opinion, but things like this happen. Someone gets the task to implement a login and either doesn't realize they should be using OAuth or is simply too lazy to do so. Next, someone has the idea to suggest friends, so let's grab some email contacts for that purpose. That stuff happens all the time at small companies. While it's certainly bad practice, it's often not evil intent, but just lack of technical skills (for the former issue) and missing sense for potential privacy issues (for the latter). In case of a large company like Facebook, one could expect they'd have processes and education in place to prevent such incidents, but I guess this happened a while back when FB was much smaller than it is now.
- ascendantlogic 8y ago> This may be an unpopular opinion, but things like this happen. Yes, and at Facebook in the context of data gathering they seem to happen ALL THE TIME. So if they did actually care about privacy they'd make changes to curb these sort of "mistakes", but taken in aggregate the relentless "bugs" show a pattern of willful malevolence.
- flokie 8y ago"Next, someone has the idea to suggest friends, so let's grab some email contacts for that purpose." You're joking right?
- ajuc 8y agoThey broke the law. They should pay. "Accidentally" is irrelevant here, even if you believe them.
- Balgair 8y agoI'd buy that excuse back in 2008. But it's been over a decade of these types of reports about FB and their behavior. FB should be asymptoting towards good ethical standards and software practices. These reports should be getting more and more rare. Instead, they seem to be growing exponentially away from good ethics and practices [0]. It feels like it's getting worse, faster, not less worse and slower. Here's a partial list : https://en.wikipedia.org/wiki/Criticism_of_Facebook https://en.wikipedia.org/wiki/Criticism_of_Facebook [0] Yes, I'm being a bit hyperbolic with the graph analogies.
- justanegg 8y agowhat if you had a petabyte of contacts. would that DDOS facebook?
- dsfyu404ed 8y agoThis is like the app version of "sorry honey, I totally didn't mean to stick it your butt but it was dark". Facebook knew exactly what they were doing but they're playing dumb because it's less insulting to the recipient that way and they feel that will minimize the response.
- lbotos 8y agoRelated: WhatsApp on iOS recently updated, and now will only show phone numbers for contacts UNLESS I upload my contacts. In the UI if I click on a number it will take me to the profile where I can see that users name ~Tom, but wow, waddamove... Have we reached the point where FB can't make any more money until they go deeper or is this just drag-net "data is the new oil"
- dingaling 8y agoIt's the same on Android, with Contacts permission blocked it will show only numbers except for groups. Furthermore it won't let you start a chat with anyone unless it can access your contacts to find them. However there's a great little app on F-Droid called 'Open in Whatsapp' that lets you start a chat with any arbitrary phone number.
- aswanson 8y agoI find it astonishing people are still on fb, and even moreso that people that are still on there have the slightest expectation that their data will be handled with care & respect for their privacy.
- 1024core 8y agoDidn't LinkedIn get sued for this, many years ago?
- 1024core 8y agoThe only way FB will change its ways is if (a) good engineers stop joining them, and (b) good engineers at FB start leaving. This will threaten their entire growth prospectives and finally bring about change. I was having discussions with FB recruiter and some of their senior managers. I just informed them that I won't be pursuing that anymore. FB engineers who are on HN: why are you still there? You can make similar money at several other companies without sacrificing your soul!
- ahoy 8y ago> You can make similar money at several other companies without sacrificing your soul! I'm not so sure. Certainly Google, Amazon, et al are just as bad as facebook.
- marquis-chacha 8y agoWho's the "et al" there? Microsoft and Apple would be the logical successors, but I don't think most people would consider them "just as bad as Facebook".
- save_ferris 8y agoRegulation is much more realistic, IMO. The tech industry worships money and those who make it, and there are plenty of engineers who'd take the FB compensation package in a heartbeat, regardless of FB's public image problem. This idea that the public will act together morally to stop corporate malfeasance while sacrificing their good fortunes isn't that realistic. Look at the FB shareholder situation. Lots of shareholders are angry at Zuck but can't do anything about it. None of them seem particularly interested in selling their shares because they don't want to have to pay for his bad behavior.
- dangero 8y agoHow is LinkedIn not under more scrutiny right now? They used to ask for my email password all the time along with re-asking for access to contacts at EVERY LOGIN. I know this isn’t a contest, but I always felt LinkedIn was twice as scummy as fb.
- ajuc 8y agoEU will slap Facebook's ass so hard over this :)
- nemacol 8y agoI hate it when I accidentally write some code to crawl email accounts for data and accidentally upload that data. Accidentally deploy that code to production, hide the opt-out button, and forget to post a disclaimer. Gosh darn it! I'm just a mess without my morning coffee. If I don't get a good cup of joe in the AM I could do something reckless and random... like violate the privacy of millions of people! OOPS! You know what I'm talking about! Right! ... right? ...
- rchaud 8y agoFB's public comments about these remind me a lot of the "5 Standard Excuses" scene in the '80s BBC sitcom Yes Minister, where a civil servant lists the best CYA mea culpas for politicians to use when something goes wrong. 1. It occurred before certain important facts were known, and couldn’t happen again 2. It was an unfortunate lapse by an individual, which has now been dealt with under internal disciplinary procedures. 3. There is a perfectly satisfactory explanation for everything, but security forbids its disclosure. 4. It has only gone wrong because of heavy cuts in staff and budget which have stretched supervisory resources beyond their limits. 5. it was a worthwhile experiment, now abandoned, but not before it had provided much valuable data and considerable employment.
- cyphar 8y agoFor those who haven't seen the clip, [1]. Yes Minister is a brilliant piece of satire (though it does have a somewhat unfortunate Thatcher-esque streak when it comes to discussion of unions -- though it would've been difficult to avoid ridiculing unions in satire from the 1980s). [1]: https://www.youtube.com/watch?v=6Y4PEqvk0Jg https://www.youtube.com/watch?v=6Y4PEqvk0Jg
- spork12 8y agoWhy do think ridiculing unions is bad?
- cyphar 8y agoI don't think ridicule is bad at all (and their episodes which were quite heavy on the union-bashing had quite a few nuggets of truth in their ridicule of middle management overruling common sense). But focusing on unions as the source of the problem is shifting the focus of criticism away from the actual source of issues -- austerity. The workers (and thus the unions) were opposing government policies that were hurting them. Funnily enough (though unsurprisingly), strike rates as well as union membership fell under Thatcher because of her union reforms (which removed much of their bargaining power) -- and so the commonly held view of daily strikes in the 1980s (something Yes Minister capitalises on) isn't really an accurate portrayal. By laying criticism on one and not the other, Yes Minister showed their Thatcher bias. And it's not at all a stretch to say they had a Thatcher bias -- Thatcher herself said that Yes Minister was her favourite show. So while Yes Minister was very heavily critical of the civil service, they weren't fundamentally critical of the views of the government. Thatcher was very strong on civil service reform too.
- tsycho 8y agoAnd if we consider Facebook's normal modus operandi: Today it's 1.5 million, a week or two later, they will say it was 15 million and 2 months later, they will say it was 150 million+. Don't give access to your contacts, location, emails and photos to not just FB, but also WhatsApp and Instagram. If you must use them, try doing so from incognito browser windows. Facebook has proven time and again it cannot be trusted.
- kerng 8y agoPhones need better features to entirely prevent these things - so apps can't trick the user. I want no application to have access, something like Incognito mode for all apps basically. The permission dialogues are typically not very helpful to make a meaningful decision and apps don't function at all without certain permissions. So why not allow to "fake" contacts,storage,location,etc... Majority of apps are just spyware anyware.
- low_key 8y agoThis could be done previously with on custom Android builds with XPrivacy (an XPosed module). It worked quite well for a long time, but tended to be quite a burden to maintain through OS updates. Starting with Oreo or so it no longer worked, but there was another similar module that had much of its functionality. It could even go as far as exposing a subset of your address book to an app. So, for example, when I wanted to use WhatsApp I could just show it the 3 contacts that I wanted it to see. The operating system should sandbox every app and by default provide it fake data for everything. The user should say what they really want to allow the app to access. I eventually switched to an iPhone and just don't install many apps.
- nacs 8y agoiOS has a prompt before your address book/contacts are shared with any app and apps will always work without it (required by dev guidelines). However note that this article is not referring to the Facebook mobile app accessing the mobile contacts -- this is about their service logging into a person's email service (like GMail) and downloading their email contacts.
- pluma 8y agoPost-GDPR this is "unintentionally" and they try to make amends. Pre-GDPR that would just have been a "happy accident" and they'd just have swept it under the rug.
- kerng 8y agoHow is this not a crime? They trick you to get your password, then steal your contacts. Seems like typical malware.
- OnlyRepliesToBS 8y ago$1 for every bit of personal information, per user, per day
- jwilk 8y agoRelated: https://news.ycombinator.com/item?id=19559617 https://news.ycombinator.com/item?id=19559617 (Facebook Asking for Some New Users' Email Passwords)
- deleted 8y ago[deleted]
- m3kw9 8y agoAt this point is what ever, they gonna violate your privacy as they please, with any excuse
- james246 8y agoLinkedIn pulled something similar a few years back. At the time, I was using the same password for both my email and LinkedIn account, and found that people from my email address book were showing up as suggested connections. I can only assume "consent" for this was buried in the T&Cs.
- shereadsthenews 8y agoYeah people always forget this! LinkedIn is super-shady and what they were doing was the darkest of all patterns.
- helloindia 8y agoIn case of Linkedin, they do ask for consent. But, even if you didn't allow it to export your contacts, other people may have allowed it, linking their linkedin profile with your email address. LinkedIn then shows them to you as suggested connections. This personally bothered me for a while then.
- gyaniv 8y agoCan't someone file a class action lawsuit against Facebook? I mean, it's nice that they are deleting the information now, but they clearly did something wrong, and by basic standards, they should be punished. And the deleting the stolen information isn't punishment, and since they probably won't delete any new ad targeting information they gathered as a conclusion from the contacts, they are still profiting from it, so the punishment should be more then just a small fine (that I hope they get). I'm just sick of them (and other companies) "accidentally" doing something wrong, and barely get a slap on the wrist.
- deleted 8y ago[deleted]
- faxi 8y agoThere already is a $78B class action lawsuit against Facebook over the Cambridge Analytica scandal. $1000 per American whose information was harvested. It's hard to google for however.
- logrott 8y agoI work in UX and this isn't unintentional. The copy "Facebook doesn't save your password" proves this was intentional. I'm sure the PMs there are all drinking the cool-aid and are rewarded in getting as much data from the user as possible.
- 1f60c 8y agoThe age of “Facebook” and “accidentally” is (should be) long past.
- Rafuino 8y agoSo, when is the FTC going to actually bring down the hammer on FB for violating the consent agreement? There's no way this was "unintentional." At $40,000 per user per day [1], even at just one day of violation, that's a $60 billion fine FB should be liable for. "Under the settlement, Facebook agreed to get consent from users before sharing their data with third parties," so this seems to be EXACTLY in violation of that agreement. [1] https://www.cnet.com/news/facebooks-ftc-consent-decree-deal-what-you-need-to-know/ https://www.cnet.com/news/facebooks-ftc-consent-decree-deal-... *Edit: on second thought, it should be even higher, as each of the 1.5M users had multiple contacts uploaded. So, for example, let's say 1 user had 150 contacts who were not part of the other 1.5M users who had contacts uploaded. That alone should be a violation of the consent rights of those 150 people, so $6 million per day. If every one of the 1.5 million people had, on average, 150 contacts exclusive of the other 1.5 million people who had contact info uploaded, that's a $9 trillion liability for one day of violation. The FTC has been toothless on this for quite some time now, so I'm expecting no significant action as FB lawyers will defend that no one had data shared with "third parties," technically. Well, shouldn't my contact info shared by a friend with FB be a consent violation as FB is a "third party" from my perspective?
- will_brown 8y agoAlso Let’s see a list of the various FTC settlements with FB. And a list of FTC employees who worked on those settlements now working for big tech. I know one FTC employee who worked on the 2011 FTC/FB settlement (which required FB to obtain independent 3rd party audits certifying their privacy program for 20 years...never mind the subsequent violations and settlements) is now “head of privacy” for a certain social networking company.
- elmo2you 8y agoMaybe I'm just ignorant, but I do not really see how this violates the FTC agreement, because it covers Facebook sharing user data (stored/tracked/gathered by Facebook) with third parties. However, what Facebook did is far worse than violating that agreement. Facebook gained accessed to user data on third party systems, to which they should never have had access. They gained this (unauthorized) access (at best without clear consent) on a false pretense (disguising as security related requirement). Then they imported user data, with no relationship to their stated goal/requirement, into their platform. Associative contact information is a highly valuable commodity to any company involved in marketing and social media. I've seen a lot of people argue how this could have been the result of a laps of oversight, but that sounds like arguing how a gem stone trader might have "accidentally" stolen a large quantity of rough gem stones, while claiming to not have known their value. Even if theoretically possible, it's extremely unlikely that nobody within Facebook knew/realized the value of this data. Either way, Facebook gained access to highly valuable assets. Even in the unlikely event of sincere lack of oversight, it would demonstrate a level of incompetence that warrants them to still be held criminally liable. Moreover, Facebook might actually have outright violated the Computer Fraud and Abuse Act (CFAA), in particular the "access in excess of authorization" part, but I'm not sure.
- dastx 8y agoThey say they're going to delete it, but are they really though? How are they gonna prove it?
- mrhappyunhappy 8y agoKinda off topic but I find it incredibly worrying the lack of privacy people have online when it comes to advertising. There is creepy retargeting and then there is retargeting to specific individuals. Right now I can find just about anyone’s email, seed them with an ad pixel, show them hyperpersonalized landing pages and follow them online knowing exactly who they are, allowing me to tailor ads to individual level. If that doesn’t creep you out, what would?
- kjar 8y agoIn the prescient words of Britney Spears - “Oops I did it again”
- jbverschoor 8y agoThis ai thing sure is smart these days. Uploading email contacts withour anyone knowing
- spork12 8y agoFacebook is entitled to that data anyway.
- Not_anchovie 8y agoAm I wrong in thinking "unintentionally" is only there because they claimed it was accidental? Accidental possibly in the same way that a woman is accidentally washing her hair so she doesn't have to answer the door. There is a question of how accidental accidental really is.
- Navarr 8y agoI think a quote from The LEGO Movie sums it up best: > You accidentally, expertly, carefully took the entire top off of that tower?
- randyrand 8y agoSimilarly, google has been publishing my mailing address on the "Maps" app for decades and I've yet to see bloggers write about it. Publishing mailing addresses worse since that is a physical location in addition to being mail location.
- untog 8y agoTo be blunt: when I'm hiring for a developer and interview who worked for Facebook as an applicant I'm going to have a lot of questions about exactly what they worked on. There's no way a feature like this created by accident, the developers who put it together knew exactly what they were doing, and did it anyway.
- ggggtez 8y agoAgain?
- qwertox 8y agoBy now we all know how Mark Zuckerberg rolls. "Dumb fucks" wasn't just an episode, that's his character. He'd probably be a good friend of Martin Shkreli if he wouldn't care that much about what others think of him.
- OrgNet 8y agoI'm glad that Zucky's comment finally came up but I'm surprised that it took this long..
- chicob 8y agoI guess that to the average users, every single incremental step seems innocuous. The complete picture, however, is not foreseeable to them. If the full scheme of Facebook's business strategy (and other companies' as well, for that matter) were clear enough, a mass exodus would take place. I'm still hoping a mass exodus takes place some day, or at least, like Roger McNamee has suggested, log and data deletion is enforced in some way. This has to stop. Even if there is some temporary outrage, these companies remain unaccountable and get away with whatever they want. From now on, I think I'll stop replying to emails provided by companies whose trust I've long lost and use only Protonmail's encrypted link feature.
- Ayesh 8y agoIf you have a bunch of photos 9f Mr. Zuck with a frowned, sad, confused, etc face, sell them! With the amount 9fbstories popping up, one could make a decent income out of them.