6 ms·

That shouldn't be a surprise. At an old job with far smaller user base, we used to do something very similar and while the shadow profiles were not materialized

That shouldn't be a surprise. At an old job with far smaller user base, we used to do something very similar and while the shadow profiles were not materialized in the form of actual profiles, the amount of data you can gather about someone just by having his/her number pop up in the contact list of several of your actual users is staggering: full name, workplace, city/neighborhood where they live, their partners, their hobbies and all sorts of things which you generally should not know. And we are not talking people who have their entire life published online, but people with little to no online visibility. Assuming that facebook is not doing something similar considering that their main business comes from profiling and modeling user behavior is just naive.

matchagaucho 5y ago
Seriously. Once a mobile app is granted access to contacts, it has your entire social graph. Every app since 2012 has been building these shadow social graphs.
- spullara 5y ago
  Well before 2012. Started as soon as you could access the address book through an API - not just on the phone. First one that got a lot of bad press was Plaxo which launched in 2002.
  - scoot 5y ago
    Not forgetting sixdegrees.com (1997-2000). Sure, it didn't access your address book directly, but it did abuse your social graph. In my memory Plaxo was connected somehow (same founder?), but it's a long time ago, so I might be mistaken.
    - chaostheory 5y ago
      Amazon bought six degrees
- hutzlibu 5y ago
  "Every app since 2012 has been building these shadow social graphs." No, not every app. There are still open source apps who usually do not do this and there are probably also some proprietary ones with ethics who have not given into it. But that this is the default and there is no big outcry is probably because allmost no one outside tech circles understands anything of it, or just throw their hands in the air.
- kingcharles 5y ago
  And these get immediately sold on. I often buy contacts from online resellers who have obtained them through your number being in someone else's contacts who allowed an app to upload their whole address book.
- lmkg 5y ago
  Fun fact: Whatsapp (Facebook) was recently fined 75 million Euros for this practice under GDPR. To be pedantic, that was one part of a 225-million-Euro fine. But that practice was specifically broken out as one of the line items, with a dollar amount attached. And to be more pedantic, the fine wasn't for the practice itself. It was for failing to provide notice to the users whose contact info was harvested. In theory, this practice is acceptable under GDPR if the app immediately informs the user whose contact issue was harvested, and gives them an opportunity to reject. The 225-million-euro fine is still the second-largest fine issued under GDPR, after Amazon's. The 75-million-euro line item were an individual fine, it would be the fourth-largest after (one of) Google's.
  - CursedUrn 5y ago
    Does that mean Facebook will stop doing it? I find that hard to believe. I doubt the EU understands Facebook's code or servers enough to judge if they're complying.
    - digisign 5y ago
      With 200+ million it sounds like they'll be able to hire a developer.
      - hutzlibu 5y ago
        There definitely is technical competence within the EU and also within the burocratic institutions. The thing is just, that the people in charge only listen to them, when it is convenient.
        pc86 5y ago
        As an American I have to wonder what it's like to have technical competence within your bureaucratic institutions. We can't even get bureaucratic competence, technical competence is completely out of the question.
        5y ago
A4ET8a8uTh0 5y ago
That got me curious. How would hobbies be inferred? Is it merely from association?
- shimon 5y ago
  Presumably association including temporal association around events that are described by others. If I text <shadow friend> frequently around the time I post about frisbee games and bluegrass concerts, odds are they are engaged in those types of activities with me.
- Mezzie 5y ago
  Examples (and this is why I'm so picky about giving apps Contacts access): * Friends that I went to graduate school with. Just based on our degrees (MLISes) and career titles, which are pretty public, and the fact that we keep in contact suggests certain types of hobbies we have in common. * I grew up partially in some pretty rural areas, as did my sister. So which people my sister keeps in contact with from back then and what they're into is a pretty good indication of what she likes. Otherwise, why would they be in her contacts? Basically, if your contacts have less scrupulous information practices than you regarding hobbies (e.g. your friend tells FB EVERYTHING) and they're in your phone, it's pretty easy with that info to peg you as 'Greg's friend from rock-climbing club who probably goes out with all of them for craft beer afterwards.'
- axegon_ 5y ago
  Just like anything else: contact name "John airsoft team". It is a circumstantial but accurate assumption in most cases. For example I'm currently on the second hand market for a car, scroll through my contacts and you'd easily work out what I'm looking for
andrei_says_ 5y ago
Wait, does the Facebook client have access to one’s contacts?
- scarface74 5y ago
  If you explicitly give the app access. Unfortunately, it doesn’t matter. Your contacts may still give the app access. When I left my previous company, I gave a few coworkers my phone numbers. Within 24 hours they showed up as suggestions on FB.
- sli 5y ago
  It does and uploads them regularly unless you disable it. https://www.facebook.com/help/355489824655936/ https://www.facebook.com/help/355489824655936/
- alx__ 5y ago
  Not by default, but they aggressively ask for access to it. It's usually framed as helping you find your friends already on Facebook.
- restingrobot 5y ago
  If you have the app on your phone, or any app that uses their sdk, yes.
  - ornornor 5y ago
    > any app that uses their sdk Do you mean any app that has a “login with fb” button?
- kube-system 5y ago
  Looks like it: https://m.facebook.com/help/210676372433246 https://m.facebook.com/help/210676372433246
Ansil849 5y ago
> That shouldn't be a surprise. This has nothing to do with it being a "surprise". That doesn't justify the action, the erosion of privacy. If your car gets broken into in a bad neighborhood, it not being a surprise doesn't justify the break-in.
- axegon_ 5y ago
  I'm by no means justifying their actions but I'm acknowledging that it's not a precedent or isolated case. I don't have a Facebook account but I'm well aware they have tons and tons of data on me, even if I've blocked all Facebook traffic from my devices. The fact that they have so much data about me is to no fault of my own but an unpreventable circumstance. The only thing I can realistically do is just shrug it off

matchagaucho 5y ago

Seriously. Once a mobile app is granted access to contacts, it has your entire social graph. Every app since 2012 has been building these shadow social graphs.

spullara 5y ago
Well before 2012. Started as soon as you could access the address book through an API - not just on the phone. First one that got a lot of bad press was Plaxo which launched in 2002.
- scoot 5y ago
  Not forgetting sixdegrees.com (1997-2000). Sure, it didn't access your address book directly, but it did abuse your social graph. In my memory Plaxo was connected somehow (same founder?), but it's a long time ago, so I might be mistaken.
  - chaostheory 5y ago
    Amazon bought six degrees
hutzlibu 5y ago
"Every app since 2012 has been building these shadow social graphs." No, not every app. There are still open source apps who usually do not do this and there are probably also some proprietary ones with ethics who have not given into it. But that this is the default and there is no big outcry is probably because allmost no one outside tech circles understands anything of it, or just throw their hands in the air.
kingcharles 5y ago
And these get immediately sold on. I often buy contacts from online resellers who have obtained them through your number being in someone else's contacts who allowed an app to upload their whole address book.
lmkg 5y ago
Fun fact: Whatsapp (Facebook) was recently fined 75 million Euros for this practice under GDPR. To be pedantic, that was one part of a 225-million-Euro fine. But that practice was specifically broken out as one of the line items, with a dollar amount attached. And to be more pedantic, the fine wasn't for the practice itself. It was for failing to provide notice to the users whose contact info was harvested. In theory, this practice is acceptable under GDPR if the app immediately informs the user whose contact issue was harvested, and gives them an opportunity to reject. The 225-million-euro fine is still the second-largest fine issued under GDPR, after Amazon's. The 75-million-euro line item were an individual fine, it would be the fourth-largest after (one of) Google's.
- CursedUrn 5y ago
  Does that mean Facebook will stop doing it? I find that hard to believe. I doubt the EU understands Facebook's code or servers enough to judge if they're complying.
  - digisign 5y ago
    With 200+ million it sounds like they'll be able to hire a developer.
    - hutzlibu 5y ago
      There definitely is technical competence within the EU and also within the burocratic institutions. The thing is just, that the people in charge only listen to them, when it is convenient.
      - pc86 5y ago
        As an American I have to wonder what it's like to have technical competence within your bureaucratic institutions. We can't even get bureaucratic competence, technical competence is completely out of the question.
        5y ago

A4ET8a8uTh0 5y ago

That got me curious. How would hobbies be inferred? Is it merely from association?

shimon 5y ago
Presumably association including temporal association around events that are described by others. If I text <shadow friend> frequently around the time I post about frisbee games and bluegrass concerts, odds are they are engaged in those types of activities with me.
Mezzie 5y ago
Examples (and this is why I'm so picky about giving apps Contacts access): * Friends that I went to graduate school with. Just based on our degrees (MLISes) and career titles, which are pretty public, and the fact that we keep in contact suggests certain types of hobbies we have in common. * I grew up partially in some pretty rural areas, as did my sister. So which people my sister keeps in contact with from back then and what they're into is a pretty good indication of what she likes. Otherwise, why would they be in her contacts? Basically, if your contacts have less scrupulous information practices than you regarding hobbies (e.g. your friend tells FB EVERYTHING) and they're in your phone, it's pretty easy with that info to peg you as 'Greg's friend from rock-climbing club who probably goes out with all of them for craft beer afterwards.'
axegon_ 5y ago
Just like anything else: contact name "John airsoft team". It is a circumstantial but accurate assumption in most cases. For example I'm currently on the second hand market for a car, scroll through my contacts and you'd easily work out what I'm looking for

andrei_says_ 5y ago

Wait, does the Facebook client have access to one’s contacts?

scarface74 5y ago
If you explicitly give the app access. Unfortunately, it doesn’t matter. Your contacts may still give the app access. When I left my previous company, I gave a few coworkers my phone numbers. Within 24 hours they showed up as suggestions on FB.
sli 5y ago
It does and uploads them regularly unless you disable it. https://www.facebook.com/help/355489824655936/ https://www.facebook.com/help/355489824655936/
alx__ 5y ago
Not by default, but they aggressively ask for access to it. It's usually framed as helping you find your friends already on Facebook.
restingrobot 5y ago
If you have the app on your phone, or any app that uses their sdk, yes.
- ornornor 5y ago
  > any app that uses their sdk Do you mean any app that has a “login with fb” button?
kube-system 5y ago
Looks like it: https://m.facebook.com/help/210676372433246 https://m.facebook.com/help/210676372433246

Ansil849 5y ago

> That shouldn't be a surprise. This has nothing to do with it being a "surprise". That doesn't justify the action, the erosion of privacy. If your car gets broken into in a bad neighborhood, it not being a surprise doesn't justify the break-in.

axegon_ 5y ago
I'm by no means justifying their actions but I'm acknowledging that it's not a precedent or isolated case. I don't have a Facebook account but I'm well aware they have tons and tons of data on me, even if I've blocked all Facebook traffic from my devices. The fact that they have so much data about me is to no fault of my own but an unpreventable circumstance. The only thing I can realistically do is just shrug it off