7 ms·
Snapchat Employees Abused Data Access to Spy on Users
- smn1234 7y agoyet again the excuse is made, in defense of abusing data access privileges, that ... "logging isn't perfect"
- paulcole 7y agoReally shocked by the allegations. Has any unethical behavior like this ever happened in a Silicon Valley startup before? Would there have been any way to see this coming?
- deathanatos 7y agoUber and their "God Mode"/"God View" comes to mind. E.g.: https://www.forbes.com/sites/kashmirhill/2014/10/03/god-view-uber-allegedly-stalked-users-for-party-goers-viewing-pleasure/#2ca421b63141 https://www.forbes.com/sites/kashmirhill/2014/10/03/god-view...
- paulcole 7y agoHuh, you always hear so much about the good Uber is doing it’s hard to accept that’s a true story.
- deathanatos 7y ago> the good Uber is doing (Edit: seems I'm a victim of Poe's Law. Oh well. In case anyone is sincerely wondering, I've left the below. Not sure I agree w/ such unmarked sarcasm though; I think there are a good number of people in SV trying to act ethically w/ consumer data.) You're kidding me, right? I have nearly an opposite impression of Uber as a company: Uber's self-driving car killed a woman while the human was not paying attention at the wheel[1]; IDK what the end result of this was, but at the time it was scandalous for a. the driver not paying attention and b. the car not noticing the human basically at all, until it was basically about to make impact. (Whatever sensors/sensor processing was happening failed entirely. IIRC, the Lidar company basically stated their stuff would have seen the human, and it was Uber's software that ignored that signal. The NTSB investigated it, but IDK what the resolution was.) There was a long history of sexual workplace harassment scandals ("In August 2018, Uber agreed to pay a total of $7 million to 480 workers to settle claims of gender discrimination, harassment and hostile work environment."[3]; the former CEO resigned over similar allegations). There's been numerous reports of them skirting or flat out ignoring the law in many jurisdictions. The incident where a driver refused to service someone with a service animal. Allegations over their treatment of drivers (that they're mislead in how much they can earn; that they're banned for even the slightest of transgressions; their classification as contractors and not employees, but they're not allowed to set their own rates by logging when the price isn't worth their while[2]). The Greyball thing[3]: > Uber developed an internal software tool called Greyball, which uses data collected from the Uber mobile app other means, to avoid giving rides to certain individuals. The tool was used starting in 2014. By showing "ghost cars" driven by fake drivers to the targeted individuals in the Uber mobile app, and by giving real drivers a means to cancel rides requested by those individuals, Uber was able to avoid giving rides to known law enforcement officers in areas where its service is illegal. [1]: https://www.theguardian.com/technology/2018/mar/19/uber-self-driving-car-kills-woman-arizona-tempe https://www.theguardian.com/technology/2018/mar/19/uber-self... [2]: https://www.theregister.co.uk/2019/05/20/lyft_uber_surge_pricing/ https://www.theregister.co.uk/2019/05/20/lyft_uber_surge_pri... (not sure if this is the best source) [3]: https://en.wikipedia.org/wiki/Uber#Criticism https://en.wikipedia.org/wiki/Uber#Criticism [4]: https://en.wikipedia.org/wiki/Poe%27s_law https://en.wikipedia.org/wiki/Poe%27s_law
- JamesBarney 7y agoBoth of his posts are sarcastic.
- paulcole 7y agoPlease, it’s called shitposting.
- maxxxxx 7y ago"Would there have been any way to see this coming?" Stuff like this is pretty much guaranteed to happen in places that sit on a lot of data. The only question is whether it get noticed and then published.
- parliament32 7y agoStronger audit controls are the way to go for deterring this kind of abuse. Having an audit log of all privileged access, and having a different department review it (employee X accessed user Y's data, which LE request was this for?) isn't necessarily a huge burden: LE requests aren't frequent enough to justify not doing this.
- rcfox 7y agoWasn't the ability to access Facebook users' profiles one of the (unofficial?) perks of working there in the early days? Also, the CEO of Reddit was caught editing user comments. https://www.reddit.com/r/announcements/comments/5frg1n/tifu_by_editing_some_comments_and_creating_an/ https://www.reddit.com/r/announcements/comments/5frg1n/tifu_...
- mfatica 7y agoCertain subreddits have changed their "edit" button to "spez" to remind people of this abuse.
- savethefuture 7y agoThey should have deleted their subreddits and move else where after that...
- mfatica 7y agoThere's no other site with the large community that reddit has
- devindotcom 7y agoI think the other comments under you are evidence of something like Poe's Law at work.
- kovacs 7y agoLuckily Snapchat isn't in SV so the record of zero unethical behavior in SV remains in tact.
- aphextron 7y agoWoosh
- X-Istence 7y agoThis post really needs a /s on it for full effect.
- AlexandrB 7y agoI think without an /s it acts as a great sieve, sorting between the idealists and the cynics. Personally, I got the satire right away (cynic).
- paulcole 7y agoI’m getting a lot more serious replies on it than I hoped lol.
- painfulSerious 7y agoI think HN is kind of past its expiration date...
- skybrian 7y agoNot sure why you're surprised. Startups often don't have much in the way of insider controls for data in their database at launch. Debugging production issues when you don't have root can be pretty inconvenient. Employees are trusted and insider threats tend not to be part of the threat model until they have more employees and more to lose. But Snapchat has been around a while and clearly does have some internal controls over this. Not good enough, apparently.
- sctb 7y agoYou're more than welcome to express an opinion about patterns of unethical behavior, but you'll have to do it much more substantively and thoughtfully than this. We've asked you many times to please increase the information in your posts—could you please try? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- dev_throw 7y agoI understand that centralized systems are much more efficient than P2P when it comes to high bandwidth communication. But as of today, it would be possible to create a completely decentralized Snapchat (signed ephemeral videos that are shared between two parties). The routing would be the only non-trivial component of this, but it could be solved with a DHT. Why do we continue to trade convenience for privacy? Such a solution would protect from most third parties, including government requests. As someone without much knowledge of implementing decentralized communication, am I missing some knowledge, or is it solely lack of interest?
- noobermin 7y agoThe users of Snapchat don't know about this so how would they know to stop using it because of it?
- stevewodil 7y agoWhat happens when one peer doesn't have internet access for a moment and a snapchat is delivered at that moment? How do you build "retries" into a decentralized infrastructure? If no server is storing the content, couldn't someone fill up my phone storage simply by sending me videos repeatedly? The infrastructure forces my phone to instantly download the content, because no one is paying for storage of it before it gets routed to me right? These are genuine questions because I don't understand everything either
- jsharf 7y agoIt wouldn't make sense for your phone to be part of a P2P network. It's only connected to your radio tower, and not really anything else. Also, you could define a maximum file limit size, and at that point your phone would be considered backed up, and then if no other route is found, the transfer is cancelled after a certain timeout.
- dev_throw 7y agoWell, these days a lot of phones are part of P2P networks such as BitTorrent, so that's not a blocker.
- deleted 7y ago[deleted]
- bschelsea 7y agoComplying with legal requests, fighting child pornography is not optional. Unless you are of course Mastodon etc. I don’t understand the article it quotes unnamed “former” employees who might very well could have been the ones who got fired for improper access.
- thrower123 7y agoIf SnapChat is storing anything, they have to be sitting on one of the biggest collections of underaged nudity in the world. I've never figured out how they get around that problem without the FBI being at their throat.
- procinct 7y agoCan you explain your statement about Mastodon? I’m out of the loop on that one
- alanh 7y agoi think the implication is that a platform need not police its content if it is truly p2p and not actually storing or responsible for the content on it. with mastodon, the company is not running the servers people connect to in order to use mastodon, iirc.
- londons_explore 7y agoRumour is Snapchat is one of the world's biggest repositories of child porn, and they don't do much about it because it's mostly sent by the children themselves and core to their business. I would estimate 100 million pictures of underage genitals go in or out of Snapchats account on Google servers every day. Google nearly kicked them off the platform for it, but money spoke too loudly...
- crapchat 7y agoColor me just so incredibly surprised.
- microcolonel 7y agoI think Hacker News should start displaying "(duh)" at the end of headlines about things that should have been obvious, or which could safely be presumed in lieu of evidence to the contrary.
- malvosenior 7y agoI’ve heard early (~2008) Facebook employees bragging about this type of thing. They used to specifically look at who was looking at other people’s pages (aka “stalking” them). They were absolutely doing this for purely personal reasons and thought it was cool enough to brag about it at parties.
- matmann2001 7y agoOf course they did.
- deytempo 7y agoWhat is always strange is how everyone expects the default is this Not happening. People are often bored and nosy and if given the opportunity, they will spy on each other. All primates do this.
- alanh 7y agowell… clearly employees Should Not do this. Here's what you aren’t seeing, if I may: Consumers see the end product. They intuit rules based on what they see. I only see pictures and videos sent to me, and then they are gone. From this their mental model becomes No one can see media that is not sent to them, and the media is gone after it has been seen. This is strikingly different from the way a developer at Snapchat models the world: We run a big warehouse full of data and media. We present this media to users based on logic that prevents arbitrary non-admin users from seeing others' content and from experiencing that content repeatedly. Oh, and we should eventually get around to writing that cronjob to delete old media. And once we rule the world, we can spend time playing with end-to-end encryption, maybe. People aren’t stupid (mostly). They are just ignorant (in the literal sense). They are extrapolating in a way that makes sense in a physical world but not in the digital world. The clearest analogy is that of actual dice vs. video gambling or the virtual spinner in a free-to-play game. With actual dice, what you see is what you get: fair odds. But that virtual wheel is 'weighted' to end on the worthless prize right after the jackpot space nearly every time.
- busymom0 7y agoJust a few days ago, I read about how Facebook fired employees who were using internal data to stalk women. I am going to assume this is the case for all social media: https://www.vice.com/en_us/article/bjp9zv/facebook-employees-look-at-user-data https://www.vice.com/en_us/article/bjp9zv/facebook-employees...