9 ms·

Good time to remind that Facebook has previously intentionally bypassed permission dialogs to gather data without user permission: https://assets.documentcloud

by asenk 7y ago

Good time to remind that Facebook has previously intentionally bypassed permission dialogs to gather data without user permission: https://assets.documentcloud.org/documents/5433555/Note-by-Chair-and-Selected-Documents-Ordered.pdf#Page=11 https://assets.documentcloud.org/documents/5433555/Note-by-C...

baot 7y ago
I also noticed they've started resetting the notification settings I set through the Android settings menu for Messenger. I didn't know this was supposed to be possible.
- Daniel_sk 7y ago
  I think the developer can change the notification channel ID (which they use to group similar notifications and the user can disable a specific channel) and then you basically start with a channel without previous settings. You would have to disable all notifications for an app completely (not just a specific type) to prevent this for the future.
  - bigiain 7y ago
    Or, you know, delete the demonstrated-untrustworthy app from your device...
    - moooo99 7y ago
      Thats what bothers me the most about my Samsung phone. Facebook came preinstalled and I cannot uninstall it. I can only deactivate (whatever that means). I don't use facebook, I actually never did. Its not the fact that I'm loosing a few MBs of storage that really bothers me, it's the fact that this is the facebook app.
      - dangus 7y ago
        You can uninstall it using ADB, even without rooting. Not a consumer-friendly solution but I’m throwing that out there in case you want to try it.
        moooo99 7y ago
        I think I'll try that. I guess that'll work for LinkedIn/Office as well? However, not sure if the BYOD policy will like that.
    - Daniel_sk 7y ago
      I don't have it on my phone and I don't see a reason for a native app for facebook. The mobile website works good enough if I need to check something (sadly it's heavily used also by companies and newspapers in my country) and messenger works through https://mbasic.facebook.com/messages/ https://mbasic.facebook.com/messages/
  - baot 7y ago
    That's actually what I ended up doing to 'fix' it. It's disappointing, yet not surprising, to learn it's intentional subversion of the API.
nealdt 7y ago
Also nice reminder about that lovely photo of Zuck with a sticker covering up his webcam. Now why would he do something like that ... ?
- vonmoltke 7y ago
  I do it. My wife does it. My sister does it. The cameras at Bloomberg all had shutters, and I used it there as well. It's just good (paranoid?) OPSEC to defend against remote takeover exploits.
  - pc86 7y ago
    How does tape over a camera prevent remote takeover specifically?
    - vonmoltke 7y ago
      It doesn't, obviously, and I never said it did. It prevents the camera from being used to surreptitiously record useful information when a machine has been remotely compromised. It's the same reason nothing with a transmitter is permitted in classified areas without specific authorization. Preventing a remote takeover is effectively impossible, but these steps reduce the usefulness of such an action (which is part of the defense against them).
      - pc86 7y ago
        > > > It's just good (paranoid?) OPSEC to defend against remote takeover exploits. > > > [Camera shutters are] just good (paranoid?) OPSEC to defend against remote takeover exploits. > > > [Camera shutters are] ... good ... [defense] against remote takeover exploits. Clearly I misunderstood your intent, but the comment does seem to indicate what I thought.
        vonmoltke 7y ago
        Nothing there says or indicates anything about preventing takeovers. Preventing is a strict subset of defending against.
gaius_baltar 7y ago
> Good time to remind that Facebook has previously intentionally bypassed permission dialogs to gather data without user permission: I wonder if the camera app leaves some by-product that the Facebook app can exploit to derive some data that the user would not usually give to FB. Perhaps it initializes the GPS without being prompted (as camera uses it for geotagging). Or maybe it checks for the time required to enable the camera, comparing with previous attempts in a kind of A/B test, so it can know if the camera was being used for another app?
grzte 7y ago
How does one "bypass a permission dialog"? What's the permission dialog for, if it can be "bypassed"?
- Wowfunhappy 7y ago
  By finding a bug or oversight in how the dialog was implemented.

by asenk 7y ago

baot 7y ago

I also noticed they've started resetting the notification settings I set through the Android settings menu for Messenger. I didn't know this was supposed to be possible.

Daniel_sk 7y ago
I think the developer can change the notification channel ID (which they use to group similar notifications and the user can disable a specific channel) and then you basically start with a channel without previous settings. You would have to disable all notifications for an app completely (not just a specific type) to prevent this for the future.
- bigiain 7y ago
  Or, you know, delete the demonstrated-untrustworthy app from your device...
  - moooo99 7y ago
    Thats what bothers me the most about my Samsung phone. Facebook came preinstalled and I cannot uninstall it. I can only deactivate (whatever that means). I don't use facebook, I actually never did. Its not the fact that I'm loosing a few MBs of storage that really bothers me, it's the fact that this is the facebook app.
    - dangus 7y ago
      You can uninstall it using ADB, even without rooting. Not a consumer-friendly solution but I’m throwing that out there in case you want to try it.
      - moooo99 7y ago
        I think I'll try that. I guess that'll work for LinkedIn/Office as well? However, not sure if the BYOD policy will like that.
  - Daniel_sk 7y ago
    I don't have it on my phone and I don't see a reason for a native app for facebook. The mobile website works good enough if I need to check something (sadly it's heavily used also by companies and newspapers in my country) and messenger works through https://mbasic.facebook.com/messages/ https://mbasic.facebook.com/messages/
- baot 7y ago
  That's actually what I ended up doing to 'fix' it. It's disappointing, yet not surprising, to learn it's intentional subversion of the API.

nealdt 7y ago

Also nice reminder about that lovely photo of Zuck with a sticker covering up his webcam. Now why would he do something like that ... ?

vonmoltke 7y ago
I do it. My wife does it. My sister does it. The cameras at Bloomberg all had shutters, and I used it there as well. It's just good (paranoid?) OPSEC to defend against remote takeover exploits.
- pc86 7y ago
  How does tape over a camera prevent remote takeover specifically?
  - vonmoltke 7y ago
    It doesn't, obviously, and I never said it did. It prevents the camera from being used to surreptitiously record useful information when a machine has been remotely compromised. It's the same reason nothing with a transmitter is permitted in classified areas without specific authorization. Preventing a remote takeover is effectively impossible, but these steps reduce the usefulness of such an action (which is part of the defense against them).
    - pc86 7y ago
      > > > It's just good (paranoid?) OPSEC to defend against remote takeover exploits. > > > [Camera shutters are] just good (paranoid?) OPSEC to defend against remote takeover exploits. > > > [Camera shutters are] ... good ... [defense] against remote takeover exploits. Clearly I misunderstood your intent, but the comment does seem to indicate what I thought.
      - vonmoltke 7y ago
        Nothing there says or indicates anything about preventing takeovers. Preventing is a strict subset of defending against.

gaius_baltar 7y ago

> Good time to remind that Facebook has previously intentionally bypassed permission dialogs to gather data without user permission: I wonder if the camera app leaves some by-product that the Facebook app can exploit to derive some data that the user would not usually give to FB. Perhaps it initializes the GPS without being prompted (as camera uses it for geotagging). Or maybe it checks for the time required to enable the camera, comparing with previous attempts in a kind of A/B test, so it can know if the camera was being used for another app?

grzte 7y ago

How does one "bypass a permission dialog"? What's the permission dialog for, if it can be "bypassed"?

Wowfunhappy 7y ago
By finding a bug or oversight in how the dialog was implemented.