5 ms·

Option 3: No one read the terms of services, and 99% of the app users are not even aware of that, didn't even give it a passing thought.

swsieber 7y ago
This. Caught me by surprise but in retrospect, of course an app is going to slip this in.
mikeash 7y ago
That falls under the second option. Being capable of defending your privacy means understanding that you shouldn’t willingly give your personal info to random apps.
- Voloskaya 7y ago
  They didn't 'willingly' give anything. Like any app, you launch it and you accept the EULA. Then it asks you for permission to use your camera and for your contacts: it makes sense you want to take selfies and share them. That's it, now all your data belong to them. There is no functional difference between an app that will siphon all your private data and an app that won't. for the vast majority of users, at no point did they stop and ponder whether they were ok giving up their 'face' for a filter app. The only way to know would be to read the terms, and even then if you are not a lawyer you won't see the traps (e.g. understanding that "User Content" actually refers to your face).
  - fnordsensei 7y ago
    Assuming that the app is available in the EU, I wonder how this squares with the GDPR.
  - mikeash 7y ago
    This still lines up exactly with what I’m saying. Defending your privacy means you need to stop and ponder these things. People don’t know that they need to do this. You don’t need to read the terms. You “just” need to assume nefarious intent unless demonstrated otherwise.
    - somatic 7y ago
      People have reasonable expectations of privacy. They expect their phone calls not to be recorded. They expect that their emails are treated with the same inviolability as their letters were. They expect their letters to be as they were before the advent of technologies that governments are now using to mass record the contents of letters without opening them, of which technologies and practices they have no knowledge. All of these expectations, and many more, are now ritually violated in the most outrageous manner. It isn’t the responsibility of the individual to combat every violation of his person. Not only is it an unreasonable expectation for society’s “default setting” to be the casual violation of its citizens, but it’s also literally impossible for even the richest, smartest, and most diligent among us to avoid getting screwed... in some way... when there are so, so, SO many ways to get screwed. Because, in 2019, if your highest priority is NOT getting screwed, you might literally have to live alone in a cabin in the mountains. Which is why you can take your atomic-individual libertarian “oh you “just” need to somehow avoid every omnipresent feature of contemporary life” and take a fucking hike. I demand the right to walk to the grocery, buy a sandwich, walk to the park, eat the sandwich, and walk home, without having my minute-by-minute location invisibly and undetectably recorded and sent to ANY corp/gov, my purchase recorded and sent to ANY corp/gov, my face/gait/person scanned and analyzed by ANY corp/gov, etc. and so forth. And I should have to take no special action for any of this, because this is the default setting.
tictoc 7y ago
Are terms of service somewhat consistent in their language? And if that's the case, couldn't someone build something that scans Terms across products and summarize what exactly it is you are giving up by accepting the Terms?
- etxm 7y ago
  It sounds like you got a product idea. I know my uncle Doug would pay for it.
- zarq 7y ago
  https://tosdr.org/ https://tosdr.org/ -- it's not automated, but it's a start. Also FaceApp isn't listed.
godelski 7y ago
Option 4: what can you do with my face and name? That's just like you taking a picture of me in public. I know plenty of people that think this way.
MisterTea 7y ago
I think the problem is these systems are much more complex than the people realize. Technically minded people like those of us here understand the implications but they might not. That or they have too much trust in an increasingly untrustworthy world. It's just naivety really.
everdev 7y ago
Even if they did read it, there's no legal recourse for a state sponsored company that decides to write a good looking ToS and then just ignore it completely. Or, it's not hard to imagine this even bring a completely legit company. I'm sure it's easy enough now for the Russian government to find something wrong they did and demand to see all the data they collected. And finally, even if it's a legit company and they somehow have enough legal protection in Russia to about sharing data with the government, they're probably not the hardest security target in the world for any rogue operator to steal their data. Bottom line, don't put all your trust in a ToS.
- trevyn 7y ago
  Is there evidence they are actually state sponsored?
hanniabu 7y ago
There should be a rule that if a ToS is longer than 200 words then it requires a bullet point summary list at the top.
- mikeash 7y ago
  The trouble is, what happens when the summary is inaccurate or incomplete? If the summary takes precedence in that case, then the full ToS is meaningless and can be omitted, so you could simplify this to a rule requiring ToSs to be under 200 words. If the ToS takes precedence then the summary is meaningless.
  - etbebl 7y ago
    Instead of summarizing the terms, it could be like nutrition facts warnings. Cross certain lines in the actual terms and you're required to put "See full terms for what your personal data can be used for" or something. If the terms cross lines without putting the warnings, they can't be enforced. It would have to be not overly restrictive limits, or you'd end up with a prop-65-like scenario. Or hell, just make a standardized "Privacy Facts" panel.

swsieber 7y ago

This. Caught me by surprise but in retrospect, of course an app is going to slip this in.

mikeash 7y ago

That falls under the second option. Being capable of defending your privacy means understanding that you shouldn’t willingly give your personal info to random apps.

Voloskaya 7y ago
They didn't 'willingly' give anything. Like any app, you launch it and you accept the EULA. Then it asks you for permission to use your camera and for your contacts: it makes sense you want to take selfies and share them. That's it, now all your data belong to them. There is no functional difference between an app that will siphon all your private data and an app that won't. for the vast majority of users, at no point did they stop and ponder whether they were ok giving up their 'face' for a filter app. The only way to know would be to read the terms, and even then if you are not a lawyer you won't see the traps (e.g. understanding that "User Content" actually refers to your face).
- fnordsensei 7y ago
  Assuming that the app is available in the EU, I wonder how this squares with the GDPR.
- mikeash 7y ago
  This still lines up exactly with what I’m saying. Defending your privacy means you need to stop and ponder these things. People don’t know that they need to do this. You don’t need to read the terms. You “just” need to assume nefarious intent unless demonstrated otherwise.
  - somatic 7y ago
    People have reasonable expectations of privacy. They expect their phone calls not to be recorded. They expect that their emails are treated with the same inviolability as their letters were. They expect their letters to be as they were before the advent of technologies that governments are now using to mass record the contents of letters without opening them, of which technologies and practices they have no knowledge. All of these expectations, and many more, are now ritually violated in the most outrageous manner. It isn’t the responsibility of the individual to combat every violation of his person. Not only is it an unreasonable expectation for society’s “default setting” to be the casual violation of its citizens, but it’s also literally impossible for even the richest, smartest, and most diligent among us to avoid getting screwed... in some way... when there are so, so, SO many ways to get screwed. Because, in 2019, if your highest priority is NOT getting screwed, you might literally have to live alone in a cabin in the mountains. Which is why you can take your atomic-individual libertarian “oh you “just” need to somehow avoid every omnipresent feature of contemporary life” and take a fucking hike. I demand the right to walk to the grocery, buy a sandwich, walk to the park, eat the sandwich, and walk home, without having my minute-by-minute location invisibly and undetectably recorded and sent to ANY corp/gov, my purchase recorded and sent to ANY corp/gov, my face/gait/person scanned and analyzed by ANY corp/gov, etc. and so forth. And I should have to take no special action for any of this, because this is the default setting.

tictoc 7y ago

Are terms of service somewhat consistent in their language? And if that's the case, couldn't someone build something that scans Terms across products and summarize what exactly it is you are giving up by accepting the Terms?

etxm 7y ago
It sounds like you got a product idea. I know my uncle Doug would pay for it.
zarq 7y ago
https://tosdr.org/ https://tosdr.org/ -- it's not automated, but it's a start. Also FaceApp isn't listed.

godelski 7y ago

Option 4: what can you do with my face and name? That's just like you taking a picture of me in public. I know plenty of people that think this way.

MisterTea 7y ago

I think the problem is these systems are much more complex than the people realize. Technically minded people like those of us here understand the implications but they might not. That or they have too much trust in an increasingly untrustworthy world. It's just naivety really.

everdev 7y ago

Even if they did read it, there's no legal recourse for a state sponsored company that decides to write a good looking ToS and then just ignore it completely. Or, it's not hard to imagine this even bring a completely legit company. I'm sure it's easy enough now for the Russian government to find something wrong they did and demand to see all the data they collected. And finally, even if it's a legit company and they somehow have enough legal protection in Russia to about sharing data with the government, they're probably not the hardest security target in the world for any rogue operator to steal their data. Bottom line, don't put all your trust in a ToS.

trevyn 7y ago
Is there evidence they are actually state sponsored?

hanniabu 7y ago

There should be a rule that if a ToS is longer than 200 words then it requires a bullet point summary list at the top.

mikeash 7y ago
The trouble is, what happens when the summary is inaccurate or incomplete? If the summary takes precedence in that case, then the full ToS is meaningless and can be omitted, so you could simplify this to a rule requiring ToSs to be under 200 words. If the ToS takes precedence then the summary is meaningless.
- etbebl 7y ago
  Instead of summarizing the terms, it could be like nutrition facts warnings. Cross certain lines in the actual terms and you're required to put "See full terms for what your personal data can be used for" or something. If the terms cross lines without putting the warnings, they can't be enforced. It would have to be not overly restrictive limits, or you'd end up with a prop-65-like scenario. Or hell, just make a standardized "Privacy Facts" panel.