17 ms·

> We believe privacy is paramount and free speech essential, especially on social media. this, from their "technical difficulties" notice, should have been eno

> We believe privacy is paramount and free speech essential, especially on social media. this, from their "technical difficulties" notice, should have been enough for him to be fired on its own. requiring some users to provide government identification, building such weak security that anyone can read and archive private messages, and not stripping out damaging meta-data from media posts are three ways to not provide privacy. if this was truly their mission, then their platform was already doomed, and a full housecleaning of most of the leadership should probably be done, not just the CEO. I don't care what side of a political spectrum you come from, or whether you support the site's mission or what it became, these failures should be unacceptable in any company.

newman314 6y ago
FWIW, I recently found out that AirBnB now requires government id to be shared as verification after not having logged into AirBnB since 2014. I tried to delete my account but the option is not available or may be hidden behind the forced verification requirement.
- johnisgood 6y ago
  That is so typical. My experience with Discord: I need to login to my account to be able to delete it, except what if I cannot log into it?! At first they disabled it, then I e-mailed them requesting them to delete my account, but all they did was a soft-delete, of course. All of the private messages are still there, etc. Even if I were to delete my account myself, it would still leave all my messages intact. I guess my definition of delete is different from theirs. They think delete = disable without saying it is disabled. Of course not being able to re-create the account with the same e-mail just further proves it. All that "delete account" does is remove your profile photo, change your nick, and disable your account, nothing more. I cannot even request them to delete all my private messages. I tried. They just do not give a shit.
  - oaiey 6y ago
    Who owns the message? The sender or receiver? That is a question that bugs me once in a while.
    - pepa65 6y ago
      The receiver. It's the gift of communication..!
    - minsc__and__boo 6y ago
      I always thought removing the sender identification was a good middle ground. i.e. John Does said, "Hello world" -> [Removed] said, "Hello world"
      - simplecto 6y ago
        True, but the content of the message could contain identifying information. This is not an easy issue to solve.
        michaelmrose 6y ago
        Does the fact that I can change or delete this comment mean you, or hacker news have less right to it? If I delete it are you doing anything wrong by keeping a screenshot or even sharing it? If I reveal I'm a criminal is it any different? What If it's 10 years later and I've served my sentence? Does it matter if the crime is morally wrong or even illegal where you live? What it it's personal but not criminal, say I've come out as gay or a republican or a democrat or a communist. I think we would be foolish to rely on greater privacy than is provided by terms and conditions and logically we will only acquire more favorable terms by requiring them in law. You gave a good example When you discussed being unable to delete data pertaining to your account. I think on a one to one message your recipient has a right to a record of what you actually said I don't think allowing one side to edit it after the fact facilitates honest conversations nor does it much protect the person who reveals sensitive information to do so. You can already attest to what they revealed or keep a screenshot. I think on a many to many forum like this thread that people ought to be able to control what new users see but people who already received the initial version have a right to the information imparted to them. Basically I view a message as belonging to everyone who received it and the service ought to retain it as long as one person whom it belongs to wants to keep it. I can see good reason to selectively remove content that is illegal say child or revenge porn but I feel like further restrictions ought to fall on the ethical reasoning of the receiver not technology to answer the complex moral implications.
- lavishlatern 6y ago
  Pretty much all hotel chains require ID these days, even if you're paying with cash. There are also some state and local ordinances that require hotels to take ID of guests, so I doubt it's Airbnb's choice to do this. Deletion is another matter though.
  - Mauricebranagh 6y ago
    In the UK a few years ago when I wanted to stay on after a conference for a couple of days they demanded to see my passport.
- seattle_spring 6y ago
  How dare they try to verify people before allowing them to stay in a complete stranger's home.
  - kortilla 6y ago
    It’s not showing your ID that’s invasive, it’s the fact that this is now probably stored on a bunch of different systems and handled sloppily. There is no PCI standard for IDs. Just a super sensitive document loaded with PII that they’ll dump on S3 somewhere because it’s “required for business”. Don’t worry though, if you request to have it deleted I’m sure they’ll remove the link to the S3 url from their database. :/
    - Dirlewanger 6y ago
      Not Airbnb's fault, this is a failure of government and of the people for continuously voting in inept representatives.
      - pessimizer 6y ago
        It's odd that a hypothetical practice of AirBnB would be every single person's fault on the planet other than the people at AirBnB.
        deelowe 6y ago
        Are we still talking about factual comment of them requiring IDs or the completely unfounded speculation of them using it for all manner of things beyond regulatory compliance? The former is a fairly defensible position. PCI standards for this sort of data collection should be a government matter as they are the ones requiring this information to begin with. The latter isn't based on reality and not worth arguing about.
        kortilla 6y ago
        > government matter as they are the ones requiring this information to begin with. Source? I’m able to book hotels online without sending a picture of my ID.
- signal11 6y ago
  DigitalOcean does (or did?) this as well. To be able to create larger droplets, they’d ask you to send in a photo of yourself holding government-issued photo id. Anyone from DO reading this: I hope you shred those photos.
- gcbirzan 6y ago
  GDPR requires such an option. You could try to use a VPN to appear to be from the EU.
  - kube-system 6y ago
    I don’t think a VPN will fool them into thinking you are from the EU when you’ve submitted, say, a California ID.
- fwn 6y ago
  You can't just ask Airbnb to delete your account. The procedure to delete the account yourself that's explained all over the internet does not work, at least in europe. I requested the removal of my deactivated account four times over the course of 8 months via their email support. It was always the same script: first they purposefully confuse it with account deactivation and they confirm your removal, but formulated in a way in which it could also mean deactivated, then, after you answer to the ticket that what you meant is actual deletion, not deactivation, they tell you that they forwarded your request to someone who will delete your account and that they will write you once it's done. No change in approach changed their script in any way. > Ich habe deine Anfrage an jemanden aus meinem Team weitergeleitet, der dich dabei besser unterstützen kann. Der entsprechende Mitarbeiter wird sich in Kürze bei dir melden. Falls du in der Zwischenzeit weitere Fragen oder Bedenken hast, kannst du gerne auf diese E-Mail antworten ... then I waited six weeks and back to square one, since I could always still login to get the deactivated message. The offer to answer on the same ticket again is apparently untrue. ..at least they never answered again on the same ticket. What helped was not contacting support but instead pasting a comically formal erasure request (Article 17 of the GDPR) from the internet to dpo@airbn.. As far as I am able to validate, this did it.
  - tedmiston 6y ago
    The docs today claim one is able to self-delete - https://www.airbnb.com/help/article/240/how-do-i-deactivate-or-delete-my-account https://www.airbnb.com/help/article/240/how-do-i-deactivate-...
    - fwn 6y ago
      That page isn't new. There's several problems with it: 1. As far as I was able to see, this: > If you want to permanently close and delete your account, you can do this yourself through Manage your data. is not true. There was only a button to deactivate the account. I think that they show different pages depending on the user country and just didn't add account deletion for German accounts. 2. Once an account is deactivated, you need to contact them through /help/contact-us/ to reactivate it, but since you are not logged in, it immediately forwards you to /help/contact-us/logged-out, which tells you to either login or just browse their fluffy web help labyrinth. Google told me to use terms@airbnb.com, which was how I ended up reaching support. Support was a dead-end though. They claim to do it, but they apparently do not actually delete the account. 3. Even if it would've been possible, they claim to want to "verify your identity for security purposes" prior to acting on your deletion request (which I could not do anyway, as the function was absent). Hence, the GDPR method seems superior, given that it's actually available and they don't force you through an "identity verification", which is probably just there as additional friction to deter users from account deletion.
- freebuju 6y ago
  Same thing I have with Twitter. Won't let me login until I send them my gov id ala nudes (no chance in hell of me doing that) so I can't even delete the stupid account.
- ginko 6y ago
  I'm pretty sure I had to send in a photograph of my passport when I created my AirBnB account back in 2013.
- dazc 6y ago
  They will accept a fake id though, so long as it looks real enough. They are not a Govt agency and have no way of authenticating documents that they have no right to ask for.
- muro 6y ago
  Paypal does the same. They ask for government id and bank card to close my account (with zero balance).
- tedmiston 6y ago
  They have done this for a while, but I'm sure you could submit a GDPR request.
skynet-9000 6y ago
As someone who does deeply believe in and care about free speech (from all parties), I could not be in deeper agreement with you. (for non-native English speakers: I fully agree). Parler should not have been de-platformed. That was a clearly partisan act, and the truth would have come out shortly about the company's total lack of care for its users. Say what you will about Gab, but they never pulled any of those stunts. Looking forward to whatever the new solution is.
- riffic 6y ago
  > Parler should not have been de-platformed You obviously did not see the material that the company allowed to be posted on their services in contravention to their hosting provider's terms of services. Always abide by your host's AUP. Otherwise, you can get yeeted.
  - mansion7 6y ago
    Twitter uses AWS like Parler did. We've seen many, many calls to assassinate the previous president stand on Twitter, for years. We've seen actual calls for purges, political violence, and mass execution of Trump supporters on Twitter, also for years. We've seen planning of Antifa rioting, including how to hide oneself from police, raise money for the culprits, destroy property, create flammable materials for the purpose of arson, etc. This appears to be selective enforcement.
  - skynet-9000 6y ago
    > You obviously did not see the material that the company allowed to be posted on their services in contravention to their hosting provider's terms of services. Always abide by your host's AUP. AWS AUP: "You may not use.. or instruct others to use, the Services.. for any.. offensive use" "Offensive"? That word is so vague as to be meaningless. This turns into a dangerously simple attack. Just post something you know will offend someone. Et viola: you just killed a company. It's a lot cheaper and easier (and less likely to involve swat teams) than hiring some sketchy DDoS outfit.
    - 6y ago
kevin_thibedeau 6y ago
When Parler praises "free speech" they're really just using that as a cover for running a cheap Twitter clone with no investment in moderation. They exist to extract profit with minimum overhead.
- tehjoker 6y ago
  I know moderation is expensive, but how much of a cost is it to Twitter on the scale of their various expenses? Is Parler's idea a reasonable cost savings from a business perspective?
  - rodone 6y ago
    Is staffing your meat packing plant with sickly orphans a reasonable cost savings from a business perspective?
    - KMag 6y ago
      > Is staffing your meat packing plant with sickly orphans a reasonable cost savings from a business perspective? I think you're taking an overly negative tone with someone who appears to agree with you. GGP: It's a bad choice, but it saved a bunch of money. GP: I don't think it even saved much money, percentage wise, did it? And then your reply takes a very negative tone, as if the GP is suggesting that some amount of cost savings would have justified it. The GP is not suggesting that some amount of cost savings justifies what was done.
    - tehjoker 6y ago
      I'm a socialist. I'm just curious if Parler was more of an ideological or a business play. If it's a business play, then the ideological dressing could be interpreted as just a hook to get rubes onto the platform (though it could be both too).
  - NegativeLatency 6y ago
    Seems like some of the appeal was the lack of moderation
Lammy 6y ago
Just make your own website, as long as you've done it before and are intimately familiar with all the dangerous defaults built in to our collective tech. Perhaps they aimed too high too fast (dunno, never even went there), but I just can't bring myself to make beginner-shaming a core pillar of my criticism.
- bobthepanda 6y ago
  How many beginner websites require you to verify with your social and back and front scans of your license? There's beginner shaming and then there's going above and beyond with intrusive PII collection.
  - DetroitThrow 6y ago
    There's also the aspect this was a company founded by billionaires and FAANG engineers which means an even slightly reasonable person wouldn't classify the project as one made by "beginners".
- DetroitThrow 6y ago
  A company founded by billionaires and FAANG engineers, operating for multiple years, and having had millions of users shouldn't be... "Beginner shamed"... for creating services wildly irresponsible with user data? Small or "beginner" web payment companies are required to think more responsibly about user data; the state of Parler in January 2021 was ridiculous and users who were effectively doxxed should be outraged.
  - gabereiser 6y ago
    This. We should have higher standards to what we will tolerate from beginners. Teach and guide them to not make things open to the public. Mentor the next gen engineers on security. For god sakes check a jwt claim...
  - lawnchair_larry 6y ago
    You might not realize how many companies make this mistake and worse. Dropbox? LinkedIn? What is it you think was wildly irresponsible exactly? Not stripping exif data? Facebook did that too. And has had many account takeover bugs.
kyrra 6y ago
I do not believe any private posts were archived by the security researcher. From my understanding they were able to access all public posts, including ones that had previously been deleted (which was the bad part). The other security faux pas was that they did not scrub GPS metadata from images or videos at all.
- tpmx 6y ago
  That's correct: https://en.wikipedia.org/wiki/Parler#Content_scraping https://en.wikipedia.org/wiki/Parler#Content_scraping
jiveturkey 6y ago
that’s naive. a statement like that is just marketing, as much as “we take your privacy/security very seriously” after an incident. it has no or almost no connection to job performance of the C suite. FWIW, I agree there is zero question that he needed to be sent packing immediately.
jariel 6y ago
I don't think it's quite right. People on HN are so much into 'technical' issues. The notion 'The CEO must be fired' because he allows messages to be saved but the mission is privacy - is far too getting hung up on technicalities. What the Parler CEO essentially wanted was a free and open platform, free from general intrusion. That's it. It's not a Singal, or Telegram - it's not about Snowden level security. CEO's say all sorts of things all the time that are arguably inconsistent with the details of their reality, that's not a new phenom. He's essentially saying he wants a WhatsApp/Twitter/Signal type platform, where people aren't blocked for arbitrary reasons. He's not making statements about protection against state level actors. And Parler does moderate anyhow.
wiremine 6y ago
> requiring some users to provide government identification, building such weak security that anyone can read and archive private messages, and not stripping out damaging meta-data from media posts are three ways to not provide privacy. Exactly. They weren't really interested in true privacy or free speech, they were just using those keywords to attract customers.
- molbioguy 6y ago
  This is misleading. The ID requirements were there to provide a 'verified' account status similar to Twitter's blue check mark. It wasn't some arbitrary requirement. I bet Twitter requires this as well for the verified status.
  - germinalphrase 6y ago
    Could you post without providing that ID?
    - molbioguy 6y ago
      To the best of my knowledge, yes.
  - lallysingh 6y ago
    They shouldn't have had verified status.
    - SV_BubbleTime 6y ago
      Couldn’t they have done both? A verified status for the same reasons Twitter does, and properly handled the information. It should have been a verified account once and complete destruction of the submitted data. It obviously should never have been kept indefinitely and unencrypted.
      - lallysingh 6y ago
        If they could properly handle the data, they would have.

newman314 6y ago

FWIW, I recently found out that AirBnB now requires government id to be shared as verification after not having logged into AirBnB since 2014. I tried to delete my account but the option is not available or may be hidden behind the forced verification requirement.

johnisgood 6y ago
That is so typical. My experience with Discord: I need to login to my account to be able to delete it, except what if I cannot log into it?! At first they disabled it, then I e-mailed them requesting them to delete my account, but all they did was a soft-delete, of course. All of the private messages are still there, etc. Even if I were to delete my account myself, it would still leave all my messages intact. I guess my definition of delete is different from theirs. They think delete = disable without saying it is disabled. Of course not being able to re-create the account with the same e-mail just further proves it. All that "delete account" does is remove your profile photo, change your nick, and disable your account, nothing more. I cannot even request them to delete all my private messages. I tried. They just do not give a shit.
- oaiey 6y ago
  Who owns the message? The sender or receiver? That is a question that bugs me once in a while.
  - pepa65 6y ago
    The receiver. It's the gift of communication..!
  - minsc__and__boo 6y ago
    I always thought removing the sender identification was a good middle ground. i.e. John Does said, "Hello world" -> [Removed] said, "Hello world"
    - simplecto 6y ago
      True, but the content of the message could contain identifying information. This is not an easy issue to solve.
      - michaelmrose 6y ago
        Does the fact that I can change or delete this comment mean you, or hacker news have less right to it? If I delete it are you doing anything wrong by keeping a screenshot or even sharing it? If I reveal I'm a criminal is it any different? What If it's 10 years later and I've served my sentence? Does it matter if the crime is morally wrong or even illegal where you live? What it it's personal but not criminal, say I've come out as gay or a republican or a democrat or a communist. I think we would be foolish to rely on greater privacy than is provided by terms and conditions and logically we will only acquire more favorable terms by requiring them in law. You gave a good example When you discussed being unable to delete data pertaining to your account. I think on a one to one message your recipient has a right to a record of what you actually said I don't think allowing one side to edit it after the fact facilitates honest conversations nor does it much protect the person who reveals sensitive information to do so. You can already attest to what they revealed or keep a screenshot. I think on a many to many forum like this thread that people ought to be able to control what new users see but people who already received the initial version have a right to the information imparted to them. Basically I view a message as belonging to everyone who received it and the service ought to retain it as long as one person whom it belongs to wants to keep it. I can see good reason to selectively remove content that is illegal say child or revenge porn but I feel like further restrictions ought to fall on the ethical reasoning of the receiver not technology to answer the complex moral implications.
lavishlatern 6y ago
Pretty much all hotel chains require ID these days, even if you're paying with cash. There are also some state and local ordinances that require hotels to take ID of guests, so I doubt it's Airbnb's choice to do this. Deletion is another matter though.
- Mauricebranagh 6y ago
  In the UK a few years ago when I wanted to stay on after a conference for a couple of days they demanded to see my passport.
seattle_spring 6y ago
How dare they try to verify people before allowing them to stay in a complete stranger's home.
- kortilla 6y ago
  It’s not showing your ID that’s invasive, it’s the fact that this is now probably stored on a bunch of different systems and handled sloppily. There is no PCI standard for IDs. Just a super sensitive document loaded with PII that they’ll dump on S3 somewhere because it’s “required for business”. Don’t worry though, if you request to have it deleted I’m sure they’ll remove the link to the S3 url from their database. :/
  - Dirlewanger 6y ago
    Not Airbnb's fault, this is a failure of government and of the people for continuously voting in inept representatives.
    - pessimizer 6y ago
      It's odd that a hypothetical practice of AirBnB would be every single person's fault on the planet other than the people at AirBnB.
      - deelowe 6y ago
        Are we still talking about factual comment of them requiring IDs or the completely unfounded speculation of them using it for all manner of things beyond regulatory compliance? The former is a fairly defensible position. PCI standards for this sort of data collection should be a government matter as they are the ones requiring this information to begin with. The latter isn't based on reality and not worth arguing about.
        kortilla 6y ago
        > government matter as they are the ones requiring this information to begin with. Source? I’m able to book hotels online without sending a picture of my ID.
signal11 6y ago
DigitalOcean does (or did?) this as well. To be able to create larger droplets, they’d ask you to send in a photo of yourself holding government-issued photo id. Anyone from DO reading this: I hope you shred those photos.
gcbirzan 6y ago
GDPR requires such an option. You could try to use a VPN to appear to be from the EU.
- kube-system 6y ago
  I don’t think a VPN will fool them into thinking you are from the EU when you’ve submitted, say, a California ID.
fwn 6y ago
You can't just ask Airbnb to delete your account. The procedure to delete the account yourself that's explained all over the internet does not work, at least in europe. I requested the removal of my deactivated account four times over the course of 8 months via their email support. It was always the same script: first they purposefully confuse it with account deactivation and they confirm your removal, but formulated in a way in which it could also mean deactivated, then, after you answer to the ticket that what you meant is actual deletion, not deactivation, they tell you that they forwarded your request to someone who will delete your account and that they will write you once it's done. No change in approach changed their script in any way. > Ich habe deine Anfrage an jemanden aus meinem Team weitergeleitet, der dich dabei besser unterstützen kann. Der entsprechende Mitarbeiter wird sich in Kürze bei dir melden. Falls du in der Zwischenzeit weitere Fragen oder Bedenken hast, kannst du gerne auf diese E-Mail antworten ... then I waited six weeks and back to square one, since I could always still login to get the deactivated message. The offer to answer on the same ticket again is apparently untrue. ..at least they never answered again on the same ticket. What helped was not contacting support but instead pasting a comically formal erasure request (Article 17 of the GDPR) from the internet to dpo@airbn.. As far as I am able to validate, this did it.
- tedmiston 6y ago
  The docs today claim one is able to self-delete - https://www.airbnb.com/help/article/240/how-do-i-deactivate-or-delete-my-account https://www.airbnb.com/help/article/240/how-do-i-deactivate-...
  - fwn 6y ago
    That page isn't new. There's several problems with it: 1. As far as I was able to see, this: > If you want to permanently close and delete your account, you can do this yourself through Manage your data. is not true. There was only a button to deactivate the account. I think that they show different pages depending on the user country and just didn't add account deletion for German accounts. 2. Once an account is deactivated, you need to contact them through /help/contact-us/ to reactivate it, but since you are not logged in, it immediately forwards you to /help/contact-us/logged-out, which tells you to either login or just browse their fluffy web help labyrinth. Google told me to use terms@airbnb.com, which was how I ended up reaching support. Support was a dead-end though. They claim to do it, but they apparently do not actually delete the account. 3. Even if it would've been possible, they claim to want to "verify your identity for security purposes" prior to acting on your deletion request (which I could not do anyway, as the function was absent). Hence, the GDPR method seems superior, given that it's actually available and they don't force you through an "identity verification", which is probably just there as additional friction to deter users from account deletion.
freebuju 6y ago
Same thing I have with Twitter. Won't let me login until I send them my gov id ala nudes (no chance in hell of me doing that) so I can't even delete the stupid account.
ginko 6y ago
I'm pretty sure I had to send in a photograph of my passport when I created my AirBnB account back in 2013.
dazc 6y ago
They will accept a fake id though, so long as it looks real enough. They are not a Govt agency and have no way of authenticating documents that they have no right to ask for.
muro 6y ago
Paypal does the same. They ask for government id and bank card to close my account (with zero balance).
tedmiston 6y ago
They have done this for a while, but I'm sure you could submit a GDPR request.

skynet-9000 6y ago

As someone who does deeply believe in and care about free speech (from all parties), I could not be in deeper agreement with you. (for non-native English speakers: I fully agree). Parler should not have been de-platformed. That was a clearly partisan act, and the truth would have come out shortly about the company's total lack of care for its users. Say what you will about Gab, but they never pulled any of those stunts. Looking forward to whatever the new solution is.

riffic 6y ago
> Parler should not have been de-platformed You obviously did not see the material that the company allowed to be posted on their services in contravention to their hosting provider's terms of services. Always abide by your host's AUP. Otherwise, you can get yeeted.
- mansion7 6y ago
  Twitter uses AWS like Parler did. We've seen many, many calls to assassinate the previous president stand on Twitter, for years. We've seen actual calls for purges, political violence, and mass execution of Trump supporters on Twitter, also for years. We've seen planning of Antifa rioting, including how to hide oneself from police, raise money for the culprits, destroy property, create flammable materials for the purpose of arson, etc. This appears to be selective enforcement.
- skynet-9000 6y ago
  > You obviously did not see the material that the company allowed to be posted on their services in contravention to their hosting provider's terms of services. Always abide by your host's AUP. AWS AUP: "You may not use.. or instruct others to use, the Services.. for any.. offensive use" "Offensive"? That word is so vague as to be meaningless. This turns into a dangerously simple attack. Just post something you know will offend someone. Et viola: you just killed a company. It's a lot cheaper and easier (and less likely to involve swat teams) than hiring some sketchy DDoS outfit.
  - 6y ago

kevin_thibedeau 6y ago

When Parler praises "free speech" they're really just using that as a cover for running a cheap Twitter clone with no investment in moderation. They exist to extract profit with minimum overhead.

tehjoker 6y ago
I know moderation is expensive, but how much of a cost is it to Twitter on the scale of their various expenses? Is Parler's idea a reasonable cost savings from a business perspective?
- rodone 6y ago
  Is staffing your meat packing plant with sickly orphans a reasonable cost savings from a business perspective?
  - KMag 6y ago
    > Is staffing your meat packing plant with sickly orphans a reasonable cost savings from a business perspective? I think you're taking an overly negative tone with someone who appears to agree with you. GGP: It's a bad choice, but it saved a bunch of money. GP: I don't think it even saved much money, percentage wise, did it? And then your reply takes a very negative tone, as if the GP is suggesting that some amount of cost savings would have justified it. The GP is not suggesting that some amount of cost savings justifies what was done.
  - tehjoker 6y ago
    I'm a socialist. I'm just curious if Parler was more of an ideological or a business play. If it's a business play, then the ideological dressing could be interpreted as just a hook to get rubes onto the platform (though it could be both too).
- NegativeLatency 6y ago
  Seems like some of the appeal was the lack of moderation

Lammy 6y ago

Just make your own website, as long as you've done it before and are intimately familiar with all the dangerous defaults built in to our collective tech. Perhaps they aimed too high too fast (dunno, never even went there), but I just can't bring myself to make beginner-shaming a core pillar of my criticism.

bobthepanda 6y ago
How many beginner websites require you to verify with your social and back and front scans of your license? There's beginner shaming and then there's going above and beyond with intrusive PII collection.
- DetroitThrow 6y ago
  There's also the aspect this was a company founded by billionaires and FAANG engineers which means an even slightly reasonable person wouldn't classify the project as one made by "beginners".
DetroitThrow 6y ago
A company founded by billionaires and FAANG engineers, operating for multiple years, and having had millions of users shouldn't be... "Beginner shamed"... for creating services wildly irresponsible with user data? Small or "beginner" web payment companies are required to think more responsibly about user data; the state of Parler in January 2021 was ridiculous and users who were effectively doxxed should be outraged.
- gabereiser 6y ago
  This. We should have higher standards to what we will tolerate from beginners. Teach and guide them to not make things open to the public. Mentor the next gen engineers on security. For god sakes check a jwt claim...
- lawnchair_larry 6y ago
  You might not realize how many companies make this mistake and worse. Dropbox? LinkedIn? What is it you think was wildly irresponsible exactly? Not stripping exif data? Facebook did that too. And has had many account takeover bugs.

kyrra 6y ago

I do not believe any private posts were archived by the security researcher. From my understanding they were able to access all public posts, including ones that had previously been deleted (which was the bad part). The other security faux pas was that they did not scrub GPS metadata from images or videos at all.

tpmx 6y ago
That's correct: https://en.wikipedia.org/wiki/Parler#Content_scraping https://en.wikipedia.org/wiki/Parler#Content_scraping

jiveturkey 6y ago

that’s naive. a statement like that is just marketing, as much as “we take your privacy/security very seriously” after an incident. it has no or almost no connection to job performance of the C suite. FWIW, I agree there is zero question that he needed to be sent packing immediately.

jariel 6y ago

I don't think it's quite right. People on HN are so much into 'technical' issues. The notion 'The CEO must be fired' because he allows messages to be saved but the mission is privacy - is far too getting hung up on technicalities. What the Parler CEO essentially wanted was a free and open platform, free from general intrusion. That's it. It's not a Singal, or Telegram - it's not about Snowden level security. CEO's say all sorts of things all the time that are arguably inconsistent with the details of their reality, that's not a new phenom. He's essentially saying he wants a WhatsApp/Twitter/Signal type platform, where people aren't blocked for arbitrary reasons. He's not making statements about protection against state level actors. And Parler does moderate anyhow.

wiremine 6y ago

> requiring some users to provide government identification, building such weak security that anyone can read and archive private messages, and not stripping out damaging meta-data from media posts are three ways to not provide privacy. Exactly. They weren't really interested in true privacy or free speech, they were just using those keywords to attract customers.

molbioguy 6y ago
This is misleading. The ID requirements were there to provide a 'verified' account status similar to Twitter's blue check mark. It wasn't some arbitrary requirement. I bet Twitter requires this as well for the verified status.
- germinalphrase 6y ago
  Could you post without providing that ID?
  - molbioguy 6y ago
    To the best of my knowledge, yes.
- lallysingh 6y ago
  They shouldn't have had verified status.
  - SV_BubbleTime 6y ago
    Couldn’t they have done both? A verified status for the same reasons Twitter does, and properly handled the information. It should have been a verified account once and complete destruction of the submitted data. It obviously should never have been kept indefinitely and unencrypted.
    - lallysingh 6y ago
      If they could properly handle the data, they would have.