9 ms·

Also by SR, in the last couple of weeks: - The Swedish healthcare company Kry has built a service for digital patient calls that has leaked doctors 'and patien

Also by SR, in the last couple of weeks: - The Swedish healthcare company Kry has built a service for digital patient calls that has leaked doctors 'and patients' contact information to Facebook. https://sverigesradio.se/artikel/health-service-marketed-as-secure-leaked-patient-information-to-facebook https://sverigesradio.se/artikel/health-service-marketed-as-... - The state-owned pharmacy chain Apoteket has sent detailed information about its online customers and their purchases to Facebook, Swedish Radio News can reveal. https://sverigesradio.se/artikel/pharmacy-passed-information-about-online-customers-to-facebook https://sverigesradio.se/artikel/pharmacy-passed-information... Why the f** is everyone sending our data to FB by default? It's not enough to uninstall FB; you can't even go buy prescription medicine without them knowing, apparently.

WesolyKubeczek 4y ago
On your smartphone, every other app will have Facebook SDK, whether for login or tracking or anything else at all.
- Zenst 4y ago
  Indeed, certainly makes application proxy filtering more of a must than a luxury for the wider consumer market in todays times. Though not sure (beyond rolling your own) what offerings are out there for consumers as focus seems to be VPN proxies.
  - Nextgrid 4y ago
    On iOS, "Lockdown Privacy" is a potential option.
- Nextgrid 4y ago
  Yep, so much for the GDPR. Despite this, I'm sure someone is going to throw the "enforcementtracker.com" link to "prove" that enforcement is sufficient.
- scns 4y ago
  On Android you can block trackers per app with TrackerControl. https://trackercontrol.org/ https://trackercontrol.org/
  - pmontra 4y ago
    I've been using Blockada for many years. I think it does the same thing with trackers, ads, etc.
- ChrisMarshallNY 4y ago
  Not on the ones I write, but I know that I'm an outlier. From what I have heard, the FB SDK has a bunch of nice UI candy, so folks may have used it, just so they can get the nice splitscreen, etc. (UISplitViewController is a nightmare. I suspect that SwiftUI may have some improvements to offer).
- coldcode 4y ago
  When I start as a mobile lead at GiantNonTechCorpYouWouldKnow, I was looking at one of the two apps I would be leading part of, just to get familiar I looked at all network connections it made and found it called Facebook. I asked product team why we pinged FB given the app it just for our business; they had no idea we even did that, and it was immediately ordered the FB SDK be removed from the app. I never did discover why it was there in the first place.
- pdimitar 4y ago
  Hence: Pi-Hole at home, and a on-device VPN that blocks 98% of all that crap. I am sure they can still get some info and that some requests slip through but I wish them luck building a coherent picture of me by a few scraps of random info.
bjoli 4y ago
was it SR or SVT that found the 1177/medicall calls on some kind of unsecured network storage? For those.outside of sweden, those are calls either with a doctor or with a nurse where you will divulge information that should be protected. That story was like a Trainwreck of unbelievable proportions. One bad decision after the other. Edit: apparentlt it was Computer Sweden: https://www.svt.se/nyheter/inrikes/2-7-miljoner-inspelade-samtal-till-1177-vardguiden-helt-oskyddade-pa-internet https://www.svt.se/nyheter/inrikes/2-7-miljoner-inspelade-sa... 2.7 million calls. 170000 hours.
- Hikikomori 4y ago
  Best part about this was their CEO trying to play it down, he put his feet in his mouth several times. He said that the recorded calls could not be accessed by regular people, you needed some special keyboard commando movement to get in the back door.
  - rekoil 4y ago
    Special keyboard commando movement: point a browser to a certain DNS. Only hackers can do this.
    - LinAGKar 4y ago
      But did they need to decode the HTML source code?
      - 3np 4y ago
        No, this was publicized by a respectable publication, not some criminal fly-by hacker operation. So no room for the CEO to press charges.
- medstrom 4y ago
  I knew I shouldn't have provided my personal identification number on those phone calls.
mekkkkkk 4y ago
The reason is almost always to be able to do conversion tracking. I.e. to follow the trail from a specific ad campaign to a completed purchase in order to evaluate the campaign performance. There are of course ways to do this while preserving anonymity of the individual customers, but it's way too easy to mess up and/or give in to the allure of providing too much detail in the quest to further evaluate user behavior. The tools are built to make it as easy as possible to provide as much data as possible about the users. Whether it's nefarious is debatable, but FB should definitely have some checks and balances on what they allow to be stored on their own platform.
- vanderZwan 4y ago
  > Whether it's nefarious is debatable Ok, I'll bite: try to debate how it isn't nefarious, because I sincerely cannot think of an argument.
  - FrenchDevRemote 4y ago
    I'll bite too. If you don't have superbowl ads money, or already have a huge following, data and A/B testing is probably the only way to be profitable while doing e-commerce on your own website Those are tools designed to market products, not handle super sensitive data, it's kind of like using hotjar to record sessions on your (super confidential) website to find pain points and bugs, only to whine that hotjar stores data about your users actions, that's the entire reason why you're a customer. I really don't get the fuss. I don't even get the point of advertising pharmacies, you don't need medicines to be advertised to you, it's even crazier that a part of the price of your meds would be "facebook ads budget" And tbh I have more trust in the reliability of the infrastructure behind FB ads than in the spaghetti PHP code written in 2005 by a contractor for those pharmacies, or in the windows XP/vista computers that their employees use. If I had to bet on who's getting hacked, I wouldn't bet on Facebook.
    - car_analogy 4y ago
      > If you don't have superbowl ads money, or already have a huge following, data and A/B testing is probably the only way to be profitable while doing e-commerce on your own website Then how did we manage to sell medicine or call doctors before this wonderful era of Facebook integration? Would without this Swedes simply go without healthcare?
code_duck 4y ago
After installing noscript I was amazed to see how many trackers my bank account had on their online service. I would think they could do their own analytics without potentially sending banking history to Google, Facebook and Adobe, but apparently not.
- b112 4y ago
  Your bank also wants to know what type of web sites you visit, how you are tagged, so they know how much of a credit risk you are. Maybe you have an 18% greater risk of default, if you visit sites about poker? Only the big boys have tracking on all sites, so only they can report back everyplace you visit. Of course, it doesn't matter if you were just doing research for a paper, you now pay higher interest rares. Banks also are one of the few places where your ID is 100% known upon login. So they are a perfect place to take loads of tracking info, and: - link it back to your real ID - your credit report - your physical address - your birth date - things like home ownership - all bills you pay - using debit or cc, where you shop They have an immense business model, where they link online tracking, to meatspace habits. As well, since your bank often gives you points credit cards, and stores cooperate for fee discounts, often individual purchases are known.
  - Nextgrid 4y ago
    I'm sure the banks would love to do this, but I'm not sure the trackers the GP mentioned actually share any of this data back to the site. Facebook stalks everyone for their own benefit but are usually pretty good about keeping that data to themselves.
_the_inflator 4y ago
This reminds me of mailing lists over 15 years ago that had at least one gmail account owner CC'ed in. Good bye privacy for the rest of us. ;)
type0 4y ago
This is anecdata, but apparently Fæcesbook is like a religion in Sweden so I'm not surprised.
usrn 4y ago
>Why the f* is everyone sending our data to FB by default? Facebook's libraries do it, lazy people use them without thinking. Using software carelessly is extremely dangerous.
- Nextgrid 4y ago
  Using malicious software is also dangerous.
  - usrn 4y ago
    If you're careless you won't know what you're using.
dalbasal 4y ago
>> Why the f* is everyone sending our data to FB by default? It's not enough to uninstall FB; you can't even go buy prescription medicine without them knowing, apparently. In a sense, because "control the default" is a tactic engrained deep in the DNA of many tech giants. Control the default, and dominate the data. The default is the easy option in live, practical contexts. You have to actively pursue an alternative. They're just in the same boat we're in. Data goes to data companies by default... anytime anyone does anything with data. If you use adwords, GA, FB advertising or whatnot... the default, ideal even, is that these get all the data. That way everything works best, and requires the least special effort and expertise.
astrange 4y ago
Maybe they assumed Swedish people don't care about hiding personal information, since tax returns are public? Or they're busy fighting each other over tvättstuga reservations?

WesolyKubeczek 4y ago

On your smartphone, every other app will have Facebook SDK, whether for login or tracking or anything else at all.

Zenst 4y ago
Indeed, certainly makes application proxy filtering more of a must than a luxury for the wider consumer market in todays times. Though not sure (beyond rolling your own) what offerings are out there for consumers as focus seems to be VPN proxies.
- Nextgrid 4y ago
  On iOS, "Lockdown Privacy" is a potential option.
Nextgrid 4y ago
Yep, so much for the GDPR. Despite this, I'm sure someone is going to throw the "enforcementtracker.com" link to "prove" that enforcement is sufficient.
scns 4y ago
On Android you can block trackers per app with TrackerControl. https://trackercontrol.org/ https://trackercontrol.org/
- pmontra 4y ago
  I've been using Blockada for many years. I think it does the same thing with trackers, ads, etc.
ChrisMarshallNY 4y ago
Not on the ones I write, but I know that I'm an outlier. From what I have heard, the FB SDK has a bunch of nice UI candy, so folks may have used it, just so they can get the nice splitscreen, etc. (UISplitViewController is a nightmare. I suspect that SwiftUI may have some improvements to offer).
coldcode 4y ago
When I start as a mobile lead at GiantNonTechCorpYouWouldKnow, I was looking at one of the two apps I would be leading part of, just to get familiar I looked at all network connections it made and found it called Facebook. I asked product team why we pinged FB given the app it just for our business; they had no idea we even did that, and it was immediately ordered the FB SDK be removed from the app. I never did discover why it was there in the first place.
pdimitar 4y ago
Hence: Pi-Hole at home, and a on-device VPN that blocks 98% of all that crap. I am sure they can still get some info and that some requests slip through but I wish them luck building a coherent picture of me by a few scraps of random info.

bjoli 4y ago

was it SR or SVT that found the 1177/medicall calls on some kind of unsecured network storage? For those.outside of sweden, those are calls either with a doctor or with a nurse where you will divulge information that should be protected. That story was like a Trainwreck of unbelievable proportions. One bad decision after the other. Edit: apparentlt it was Computer Sweden: https://www.svt.se/nyheter/inrikes/2-7-miljoner-inspelade-samtal-till-1177-vardguiden-helt-oskyddade-pa-internet https://www.svt.se/nyheter/inrikes/2-7-miljoner-inspelade-sa... 2.7 million calls. 170000 hours.

Hikikomori 4y ago
Best part about this was their CEO trying to play it down, he put his feet in his mouth several times. He said that the recorded calls could not be accessed by regular people, you needed some special keyboard commando movement to get in the back door.
- rekoil 4y ago
  Special keyboard commando movement: point a browser to a certain DNS. Only hackers can do this.
  - LinAGKar 4y ago
    But did they need to decode the HTML source code?
    - 3np 4y ago
      No, this was publicized by a respectable publication, not some criminal fly-by hacker operation. So no room for the CEO to press charges.
medstrom 4y ago
I knew I shouldn't have provided my personal identification number on those phone calls.

mekkkkkk 4y ago

The reason is almost always to be able to do conversion tracking. I.e. to follow the trail from a specific ad campaign to a completed purchase in order to evaluate the campaign performance. There are of course ways to do this while preserving anonymity of the individual customers, but it's way too easy to mess up and/or give in to the allure of providing too much detail in the quest to further evaluate user behavior. The tools are built to make it as easy as possible to provide as much data as possible about the users. Whether it's nefarious is debatable, but FB should definitely have some checks and balances on what they allow to be stored on their own platform.

vanderZwan 4y ago
> Whether it's nefarious is debatable Ok, I'll bite: try to debate how it isn't nefarious, because I sincerely cannot think of an argument.
- FrenchDevRemote 4y ago
  I'll bite too. If you don't have superbowl ads money, or already have a huge following, data and A/B testing is probably the only way to be profitable while doing e-commerce on your own website Those are tools designed to market products, not handle super sensitive data, it's kind of like using hotjar to record sessions on your (super confidential) website to find pain points and bugs, only to whine that hotjar stores data about your users actions, that's the entire reason why you're a customer. I really don't get the fuss. I don't even get the point of advertising pharmacies, you don't need medicines to be advertised to you, it's even crazier that a part of the price of your meds would be "facebook ads budget" And tbh I have more trust in the reliability of the infrastructure behind FB ads than in the spaghetti PHP code written in 2005 by a contractor for those pharmacies, or in the windows XP/vista computers that their employees use. If I had to bet on who's getting hacked, I wouldn't bet on Facebook.
  - car_analogy 4y ago
    > If you don't have superbowl ads money, or already have a huge following, data and A/B testing is probably the only way to be profitable while doing e-commerce on your own website Then how did we manage to sell medicine or call doctors before this wonderful era of Facebook integration? Would without this Swedes simply go without healthcare?

code_duck 4y ago

After installing noscript I was amazed to see how many trackers my bank account had on their online service. I would think they could do their own analytics without potentially sending banking history to Google, Facebook and Adobe, but apparently not.

b112 4y ago
Your bank also wants to know what type of web sites you visit, how you are tagged, so they know how much of a credit risk you are. Maybe you have an 18% greater risk of default, if you visit sites about poker? Only the big boys have tracking on all sites, so only they can report back everyplace you visit. Of course, it doesn't matter if you were just doing research for a paper, you now pay higher interest rares. Banks also are one of the few places where your ID is 100% known upon login. So they are a perfect place to take loads of tracking info, and: - link it back to your real ID - your credit report - your physical address - your birth date - things like home ownership - all bills you pay - using debit or cc, where you shop They have an immense business model, where they link online tracking, to meatspace habits. As well, since your bank often gives you points credit cards, and stores cooperate for fee discounts, often individual purchases are known.
- Nextgrid 4y ago
  I'm sure the banks would love to do this, but I'm not sure the trackers the GP mentioned actually share any of this data back to the site. Facebook stalks everyone for their own benefit but are usually pretty good about keeping that data to themselves.

_the_inflator 4y ago

This reminds me of mailing lists over 15 years ago that had at least one gmail account owner CC'ed in. Good bye privacy for the rest of us. ;)

type0 4y ago

This is anecdata, but apparently Fæcesbook is like a religion in Sweden so I'm not surprised.

usrn 4y ago

>Why the f* is everyone sending our data to FB by default? Facebook's libraries do it, lazy people use them without thinking. Using software carelessly is extremely dangerous.

Nextgrid 4y ago
Using malicious software is also dangerous.
- usrn 4y ago
  If you're careless you won't know what you're using.

dalbasal 4y ago

>> Why the f* is everyone sending our data to FB by default? It's not enough to uninstall FB; you can't even go buy prescription medicine without them knowing, apparently. In a sense, because "control the default" is a tactic engrained deep in the DNA of many tech giants. Control the default, and dominate the data. The default is the easy option in live, practical contexts. You have to actively pursue an alternative. They're just in the same boat we're in. Data goes to data companies by default... anytime anyone does anything with data. If you use adwords, GA, FB advertising or whatnot... the default, ideal even, is that these get all the data. That way everything works best, and requires the least special effort and expertise.

astrange 4y ago

Maybe they assumed Swedish people don't care about hiding personal information, since tax returns are public? Or they're busy fighting each other over tvättstuga reservations?