3 ms·

All Facebook apps at the time could request the same permissions as the CA apps - I know this because I built many of them for ad campaigns, such as contests an

All Facebook apps at the time could request the same permissions as the CA apps - I know this because I built many of them for ad campaigns, such as contests and games. A lot of game/contest mechanics relied on things like posting on friends' timelines, or your own timelines, etc. In my case there was no real interest from our customers in taking the data and doing something with it, but if the intent was there, it could have very easily been done. Furthermore, when my firm did security and pentesting projects, we routinely found exploits that could eventually lead to us getting the access tokens and secrets for their user database, or the app token and secret. If I had to guess - 70% of the game/contest applications that we audited had these vulnerabilities after they had been launched leading to companies approaching us us panicked, asking for help with users who were cheating. Many were aghast to learn of what could have potentially happened over and above rigging the leaderboards. It's not enough that there were apps out there who had the ability to get this data. It's also not enough that there were apps who wanted to get the data intentionally. You also have to consider the number of apps that had this data and had weak security. Someone could have just broken in, taken the keys, and taken their users' data that way. Nobody would have known. At best it may have emerged in Facebook's "auditing process" in 2017 that they conducted to see which apps performed these kinds of queries - does anyone believe they did this in good faith and disclosed 100% of such apps which looked at social graph, friend posts, messages, etc? I am pretty sure the Obama 2012 campaign did something similar with their outreach Facebook apps too, as it was reported in the press at the time (https://www.theguardian.com/world/2012/feb/17/obama-digital-data-machine-facebook-election https://www.theguardian.com/world/2012/feb/17/obama-digital-...) Most users were uninformed and blindly hit accept at the permissions screen because they could win a car or an iPad or a Playstation by entering the contests. In my view, the entire story was exaggerated and turned into a public spectacle, for very obvious reasons that nobody likes to admit to.

dane-pgp 6y ago
> In my view, the entire story was exaggerated and turned into a public spectacle, for very obvious reasons that nobody likes to admit to. Are you claiming that online advertising doesn't work, or that gathering large amounts of data about individual users to tailor ads to them doesn't increase the effectiveness of those ads?
- bhupy 6y ago
  > Are you claiming that online advertising doesn't work I'm not the GP, but I think the idea is that advertising isn't coercive. When I see an ad for a Swiffer WetJet, I'm not immediately compelled to go out and buy it against my will. I only buy it if it actually meets a need that I have. Ad-tech tries to guess who actually might be most likely to have that kind of a need and target advertising accordingly (eg it would be probably dumb to show a Peloton ad to a handicapped person, etc). > gathering large amounts of data about individual users to tailor ads to them doesn't increase the effectiveness of those ads? Is just a lot of words for "being able to find people that might agree with some ideas and showing them media that expresses those ideas". In a world with free expression, it's hard to see what the problem with that is. From where I sit, there appears to be opposition to the fact that there exists people who have the appetite for certain "bad" ideas, and the only way to blunt those peoples' democratic power is to curb the ability for them to be exposed to those viewpoints.
  - dane-pgp 6y ago
    > I'm not the GP Thank you for volunteering to clarify. I've upvoted you, but I disagree with your points, I'm afraid. > I think the idea is that advertising isn't coercive. I'm not sure what definition of "coercive" you want to use, but I think it is absolutely possible for an advert to lead to someone acting against their best interest. (The term "best interest" is also quite loaded, but we can at least acknowledge cases where someone's actions are influenced by an advert and they then go on to regret those actions). Perhaps a more concrete example would be cigarette advertising, which many societies have deemed somewhat "coercive" (albeit not as "coercive" as the nicotine itself). If these ads didn't encourage people to smoke, and merely assisted existing smokers in choosing the brand which best suited their needs, then I doubt they would need to be banned. > "being able to find people that might agree with some ideas and showing them media that expresses those ideas" While that sounds reasonable, I believe it misses some subtleties particularly in the case of elections. Firstly, people should have a right to know which entity is authoring these ideas, so that they can be held accountable and any past reputation and potential biases taken into account. Just as importantly, the public should know which ideas are being selectively broadcast by each campaign, as it is more than possible that a campaign presents mutually contradictory arguments to non-overlapping groups of people, which again should factor into the credibility of the campaign. If those concerns are taken into account (and the general concerns of people having their personal data used to target psychometrically-engineered adverts at them without their consent) then I have no objection to "bad" ideas being widely distributed.
BlueScreenDeath 6y ago
Wait, you mean Trump didn't HACK the election!

dane-pgp 6y ago

> In my view, the entire story was exaggerated and turned into a public spectacle, for very obvious reasons that nobody likes to admit to. Are you claiming that online advertising doesn't work, or that gathering large amounts of data about individual users to tailor ads to them doesn't increase the effectiveness of those ads?

bhupy 6y ago
> Are you claiming that online advertising doesn't work I'm not the GP, but I think the idea is that advertising isn't coercive. When I see an ad for a Swiffer WetJet, I'm not immediately compelled to go out and buy it against my will. I only buy it if it actually meets a need that I have. Ad-tech tries to guess who actually might be most likely to have that kind of a need and target advertising accordingly (eg it would be probably dumb to show a Peloton ad to a handicapped person, etc). > gathering large amounts of data about individual users to tailor ads to them doesn't increase the effectiveness of those ads? Is just a lot of words for "being able to find people that might agree with some ideas and showing them media that expresses those ideas". In a world with free expression, it's hard to see what the problem with that is. From where I sit, there appears to be opposition to the fact that there exists people who have the appetite for certain "bad" ideas, and the only way to blunt those peoples' democratic power is to curb the ability for them to be exposed to those viewpoints.
- dane-pgp 6y ago
  > I'm not the GP Thank you for volunteering to clarify. I've upvoted you, but I disagree with your points, I'm afraid. > I think the idea is that advertising isn't coercive. I'm not sure what definition of "coercive" you want to use, but I think it is absolutely possible for an advert to lead to someone acting against their best interest. (The term "best interest" is also quite loaded, but we can at least acknowledge cases where someone's actions are influenced by an advert and they then go on to regret those actions). Perhaps a more concrete example would be cigarette advertising, which many societies have deemed somewhat "coercive" (albeit not as "coercive" as the nicotine itself). If these ads didn't encourage people to smoke, and merely assisted existing smokers in choosing the brand which best suited their needs, then I doubt they would need to be banned. > "being able to find people that might agree with some ideas and showing them media that expresses those ideas" While that sounds reasonable, I believe it misses some subtleties particularly in the case of elections. Firstly, people should have a right to know which entity is authoring these ideas, so that they can be held accountable and any past reputation and potential biases taken into account. Just as importantly, the public should know which ideas are being selectively broadcast by each campaign, as it is more than possible that a campaign presents mutually contradictory arguments to non-overlapping groups of people, which again should factor into the credibility of the campaign. If those concerns are taken into account (and the general concerns of people having their personal data used to target psychometrically-engineered adverts at them without their consent) then I have no objection to "bad" ideas being widely distributed.

BlueScreenDeath 6y ago

Wait, you mean Trump didn't HACK the election!