5 ms·

If people are going to be mad at Facebook for allowing Cambridge Analytica to get access to user data by tricking users into providing access to their data on F

If people are going to be mad at Facebook for allowing Cambridge Analytica to get access to user data by tricking users into providing access to their data on Facebook by installing apps, they really ought to support Facebook in the effort to block these entities who are pulling the same scheme with chrome extensions.

tqi 6y ago
Yeah it's interesting to me that people are disregarding the parallels. Is Facebook responsible for keeping your (and your friends) data out of 3rd party hands or not? Maybe if the makers of these extensions were affiliated with GOP PACs... EDIT: Also to be clear, I do think it is Facebooks job/responsibility/obligation
- Reelin 6y ago
  > Is Facebook responsible for keeping your (and your friends) data out of 3rd party hands or not? They are responsible for the activity that they directly facilitate on their own platform. They have legal authority over the interactions they directly engage in (ie with users). They have no say (legally or otherwise) over what goes on outside the bounds of their own platform and thus no responsibility for it. Regulators, not individual actors, are the ones with authority over the broader ecosystem. GDPR and CCPA are examples of such. What's next, should Google be permitted to publish a ToS forbidding access to their services with non-Chrome browsers and then legally pursue other browser makers for facilitating the violation of their ToS?
ganzuul 6y ago
Not if you follow the money? CA was an FB customer, weren't they?
- shajznnckfke 6y ago
  My understanding is that CA got the data by building a free quiz app on Facebook’s platform (I don’t think FB was getting paid for that, correct me if I’m wrong). The difference is that the quiz app used Facebook’s developer-facing APIs to access the data, whereas these Chrome extensions are hijacking the user agent to access the data via Facebook’s browser-facing APIs. I don’t think it makes a difference as to whether Facebook ought to try to stop the data collection to prevent the another CA-type scandal, and to protect itself from the resulting uproar. The fact that the extension developers haven’t made any agreement with FB means that FB needs different legal tools to try to shut it down, and perhaps they won’t succeed.
  - ganzuul 6y ago
    A quick search indicates they have free plans up to a certain number of active users and then you need to call them. So apparently they keep their pricing secret.
asdfasgasdgasdg 6y ago
Not only that, but recognize that any location where people share information about themselves is susceptible to attacks like this. Even personal blogs. If you make it so that your friends can see things about you, and your friends are wont to install extensions, then you are vulnerable to this kind of attack. Decentralized open source solutions will not help with this problem. Quite the opposite: who will fund the lawsuit?
- shajznnckfke 6y ago
  Facebook had to dedicate some resources to even go looking for extensions like this. They only have 5000-10000 installs. IMO it demonstrates a change in the company’s attitude toward protecting user data from the old days of letting people download the entire social graph of the US. And there is a real trade-off here. 10 years ago everyone would be hating them for cracking down on the open web if they did this, and calling it anti-competitive to silo user data.
  - wolco2 6y ago
    Isn't that what they are doing. I'm not a big fan of facebook policing others while they horde data themselves.
    - asdfasgasdgasdg 6y ago
      They view themselves as an agent of their users. The users willingly give them data, with the intention of sharing it with a select audience. As the user's agent, one should generally abide by their wishes, and especially prevent the data from being shared further abroad than the user intended.
      - bredren 6y ago
        I’d argue most Facebook users do not know the difference between what FB does with their personal info and what this other organization does. For those that installed the extension, one is Facebook, one gives free gift cards. Both are “okay.” So I don’t see this as protecting users so much as ensuring no one else monetizes their data.
amelius 6y ago
But what if I want to periodically scrape my facebook data to migrate to a different platform?
- scared2 6y ago
  You can directly request it from the platform. No need to use a crappy extension.
  - amelius 6y ago
    Yes, but that only gives me my own data. I might want to export events to a different platform, including which of my friends go to these events. Also, I might want to read my friends' posts on a different client.
    - joshuamorton 6y ago
      That very quickly veers into territory that violates facebook's terms of service.
    - Shish2k 6y ago
      The “access your own data + your friends' data” API is exactly what Cambridge Analytica used to scrape everybody’s friends’ data
Reelin 6y ago
> tricking users into providing access to their data on Facebook by installing apps > same scheme with chrome extensions These are very different things. One took place via Facebook's own platform while the other did not. If their own platform officially allowed for third parties to collect user data, it is reasonable to complain about that being the case. If their own platform explicitly forbid collecting user data in such a manner but they stood by and let it happen anyway, it seems reasonable to object to that. I don't see how it's any of their business what a legitimate user does with their own data after it's been sent to them (ie the page loads). I suppose they could add a provision to their ToS disallowing such use; if a violation were discovered they could ban the user in question. But a third party almost certainly never agreed to such a ToS. It's not the existence of the program that violates the contract but rather a specific instance of its usage.
- anfilt 6y ago
  I agree. However, I suspect facebook is gonna try and claim some sort of tortious interference between the TOS the user agreed too.
- shajznnckfke 6y ago
  I think the dichotomy you’re pointing will affect Facebook’s legal tactics, but has no bearing on the privacy risk they need to defend against. In both cases, Facebook has an API that served data for some authorized client for a specific purpose (users browsing Facebook, users taking a quiz), but really there’s some entity pulling the strings and misusing the client to amass user data (collecting data associated with users who took the quiz, collecting data associated with users browsing on Facebook).

tqi 6y ago

Yeah it's interesting to me that people are disregarding the parallels. Is Facebook responsible for keeping your (and your friends) data out of 3rd party hands or not? Maybe if the makers of these extensions were affiliated with GOP PACs... EDIT: Also to be clear, I do think it is Facebooks job/responsibility/obligation

Reelin 6y ago
> Is Facebook responsible for keeping your (and your friends) data out of 3rd party hands or not? They are responsible for the activity that they directly facilitate on their own platform. They have legal authority over the interactions they directly engage in (ie with users). They have no say (legally or otherwise) over what goes on outside the bounds of their own platform and thus no responsibility for it. Regulators, not individual actors, are the ones with authority over the broader ecosystem. GDPR and CCPA are examples of such. What's next, should Google be permitted to publish a ToS forbidding access to their services with non-Chrome browsers and then legally pursue other browser makers for facilitating the violation of their ToS?

ganzuul 6y ago

Not if you follow the money? CA was an FB customer, weren't they?

shajznnckfke 6y ago
My understanding is that CA got the data by building a free quiz app on Facebook’s platform (I don’t think FB was getting paid for that, correct me if I’m wrong). The difference is that the quiz app used Facebook’s developer-facing APIs to access the data, whereas these Chrome extensions are hijacking the user agent to access the data via Facebook’s browser-facing APIs. I don’t think it makes a difference as to whether Facebook ought to try to stop the data collection to prevent the another CA-type scandal, and to protect itself from the resulting uproar. The fact that the extension developers haven’t made any agreement with FB means that FB needs different legal tools to try to shut it down, and perhaps they won’t succeed.
- ganzuul 6y ago
  A quick search indicates they have free plans up to a certain number of active users and then you need to call them. So apparently they keep their pricing secret.

asdfasgasdgasdg 6y ago

Not only that, but recognize that any location where people share information about themselves is susceptible to attacks like this. Even personal blogs. If you make it so that your friends can see things about you, and your friends are wont to install extensions, then you are vulnerable to this kind of attack. Decentralized open source solutions will not help with this problem. Quite the opposite: who will fund the lawsuit?

shajznnckfke 6y ago
Facebook had to dedicate some resources to even go looking for extensions like this. They only have 5000-10000 installs. IMO it demonstrates a change in the company’s attitude toward protecting user data from the old days of letting people download the entire social graph of the US. And there is a real trade-off here. 10 years ago everyone would be hating them for cracking down on the open web if they did this, and calling it anti-competitive to silo user data.
- wolco2 6y ago
  Isn't that what they are doing. I'm not a big fan of facebook policing others while they horde data themselves.
  - asdfasgasdgasdg 6y ago
    They view themselves as an agent of their users. The users willingly give them data, with the intention of sharing it with a select audience. As the user's agent, one should generally abide by their wishes, and especially prevent the data from being shared further abroad than the user intended.
    - bredren 6y ago
      I’d argue most Facebook users do not know the difference between what FB does with their personal info and what this other organization does. For those that installed the extension, one is Facebook, one gives free gift cards. Both are “okay.” So I don’t see this as protecting users so much as ensuring no one else monetizes their data.

amelius 6y ago

But what if I want to periodically scrape my facebook data to migrate to a different platform?

scared2 6y ago
You can directly request it from the platform. No need to use a crappy extension.
- amelius 6y ago
  Yes, but that only gives me my own data. I might want to export events to a different platform, including which of my friends go to these events. Also, I might want to read my friends' posts on a different client.
  - joshuamorton 6y ago
    That very quickly veers into territory that violates facebook's terms of service.
  - Shish2k 6y ago
    The “access your own data + your friends' data” API is exactly what Cambridge Analytica used to scrape everybody’s friends’ data

Reelin 6y ago

> tricking users into providing access to their data on Facebook by installing apps > same scheme with chrome extensions These are very different things. One took place via Facebook's own platform while the other did not. If their own platform officially allowed for third parties to collect user data, it is reasonable to complain about that being the case. If their own platform explicitly forbid collecting user data in such a manner but they stood by and let it happen anyway, it seems reasonable to object to that. I don't see how it's any of their business what a legitimate user does with their own data after it's been sent to them (ie the page loads). I suppose they could add a provision to their ToS disallowing such use; if a violation were discovered they could ban the user in question. But a third party almost certainly never agreed to such a ToS. It's not the existence of the program that violates the contract but rather a specific instance of its usage.

anfilt 6y ago
I agree. However, I suspect facebook is gonna try and claim some sort of tortious interference between the TOS the user agreed too.
shajznnckfke 6y ago
I think the dichotomy you’re pointing will affect Facebook’s legal tactics, but has no bearing on the privacy risk they need to defend against. In both cases, Facebook has an API that served data for some authorized client for a specific purpose (users browsing Facebook, users taking a quiz), but really there’s some entity pulling the strings and misusing the client to amass user data (collecting data associated with users who took the quiz, collecting data associated with users browsing on Facebook).