3 ms·

This is what everyone said they wanted after Cambridge Analytica! For platforms to exercise due diligence before allowing users to delegate their access to thir

This is what everyone said they wanted after Cambridge Analytica! For platforms to exercise due diligence before allowing users to delegate their access to third parties.

sam_lowry_ 2y ago
Before Cambridge Analytica I could get language stats for Belgium down to municipalities. These are illegal otherwise, but very useful for journalists reporting on political matters.
csinode 2y ago
Wasn't a significant part of the Cambridge Analytica scandal that Facebook gave them access to user data _without_ the user's consent?
- closeparen 2y ago
  In the same sense that if someone uses a third-party Google Drive client, the input of other collaborators on shared documents is exposed without their consent. (It was data about friends of users who authorized the application in Facebook's case).
- xp84 2y ago
  This is a fair thing to point out! I as a user feel I'm being much more respected when I'm allowed to use some independent client software of my choices, than being told that "for my own good" I must use the absolute abomination that is most of the software provided by Big Tech firms themselves. Like, thanks for your opinion, Google, but 90% of these "security audits" are about box checking and ass-covering. It's the technology equivalent of all of the silliest parts of the TSA process, meaning that it contributes nothing to security while employing a lot of people to do valueless work at the expense of those doing useful work.
- michaelt 2y ago
  IIRC the way Facebook's "platform" stuff worked was that when one user authorized an application, it got to see all their friends' data. Farmville had to be able to access your friends list to see who you could send a sheep to, you see. Nowerdays this seems like an incredibly dumb idea, sure, and personally I disabled it entirely the moment it came out. But we can cut them some slack, because back in ~2006 facebook was a new thing, for young people - and nobody was sure where this new "social media" thing was going to go. On top of that I believe Cambridge Analytica did the usual "personality test" trickery where you fill out a survey, then it won't show your result until you hand over your details and accept some legal mumbo-jumbo. So your Great Uncle wanted to know what harry potter character he was, clicked a consent button, and Cambridge Analytica got your PII.
- jsnell 2y ago
  Not as far as I know. Facebook provided a general API for apps, not some kind of data feed. The API required user consent from the app user, though almost certainly not informed consent. The API also provided too much data, in particular on the user's social graph, which is why a single user giving uninformed consent would lead to data being extracted for multiple others. But even if the app had informed users about intending to steal the social graph, most users would still have consented. They would not have read the text, or not cared. Just click ok until the computer lets you do what you wanted. So we really do know that the only way to safeguard the data is to design safe scoped APIs for the typical use cases, and keep dangerous unscoped APIs around only as an escape hatch with much stricter security and safety requirements.
- ensignavenger 2y ago
  Facebook users shared data with their friends. Those friends gave access to the data to CA. So like if you share a document with me and I then give CA access to my GDrive.
kmeisthax 2y ago
Yes, the situation superficially resembles Cambridge Analytica, but there's a few differences here. People aren't building detailed dossiers of themselves on Google Drive like they were on Facebook, and Transmit is a client app that is honest, open and up-front about how it uses your data - to move it in and out of Google Drive. To be clear, the problem with Cambridge Analytica was not Cambridge Analytica. The problem was - and still is - Facebook's habit of getting everyone to overshare and self-surveil. There needs to be some control and vetting over the apps that have access to your data but not so much that actually honest developers are quitting the game. My guess is that Google just doesn't want third-party clients (you can't shove "AI" or "Investor Advertising" into it), so they're slowly turning up the heat by abusing the data scare.
- jsnell 2y ago
  A lot of people will have substantially more sensitive data in their chosen cloud storage system (whether Drive, DropBox, OneDrive, iCloud) than on Facebook or any other social network. For example documents like ID scans, financial records, and medical records are going to be commonplace.
- mikeocool 2y ago
  It seems like if a nefarious actor built a seemingly helpful app that asked for Google Drive access and convinced some people to use it, they could do a lot worse than Cambridge Analytica. My Facebook account is largely limited to information that’s already largely public. I imagine there are Google Drive accounts out there with tax returns, health records, background checks, etc in them. Yes, this sucks that it puts road blocks for well meaning developers, but for the general public, it’s pretty hard to tell who is a well meaning developer and who isn’t. Also, inexperienced or careless well meaning developers can still accidentally put your data in a public internet facing DB.

This is what everyone said they wanted after Cambridge Analytica! For platforms to exercise due diligence before allowing users to delegate their access to third parties.

sam_lowry_ 2y ago

Before Cambridge Analytica I could get language stats for Belgium down to municipalities. These are illegal otherwise, but very useful for journalists reporting on political matters.

csinode 2y ago

Wasn't a significant part of the Cambridge Analytica scandal that Facebook gave them access to user data _without_ the user's consent?

closeparen 2y ago
In the same sense that if someone uses a third-party Google Drive client, the input of other collaborators on shared documents is exposed without their consent. (It was data about friends of users who authorized the application in Facebook's case).
xp84 2y ago
This is a fair thing to point out! I as a user feel I'm being much more respected when I'm allowed to use some independent client software of my choices, than being told that "for my own good" I must use the absolute abomination that is most of the software provided by Big Tech firms themselves. Like, thanks for your opinion, Google, but 90% of these "security audits" are about box checking and ass-covering. It's the technology equivalent of all of the silliest parts of the TSA process, meaning that it contributes nothing to security while employing a lot of people to do valueless work at the expense of those doing useful work.
michaelt 2y ago
IIRC the way Facebook's "platform" stuff worked was that when one user authorized an application, it got to see all their friends' data. Farmville had to be able to access your friends list to see who you could send a sheep to, you see. Nowerdays this seems like an incredibly dumb idea, sure, and personally I disabled it entirely the moment it came out. But we can cut them some slack, because back in ~2006 facebook was a new thing, for young people - and nobody was sure where this new "social media" thing was going to go. On top of that I believe Cambridge Analytica did the usual "personality test" trickery where you fill out a survey, then it won't show your result until you hand over your details and accept some legal mumbo-jumbo. So your Great Uncle wanted to know what harry potter character he was, clicked a consent button, and Cambridge Analytica got your PII.
jsnell 2y ago
Not as far as I know. Facebook provided a general API for apps, not some kind of data feed. The API required user consent from the app user, though almost certainly not informed consent. The API also provided too much data, in particular on the user's social graph, which is why a single user giving uninformed consent would lead to data being extracted for multiple others. But even if the app had informed users about intending to steal the social graph, most users would still have consented. They would not have read the text, or not cared. Just click ok until the computer lets you do what you wanted. So we really do know that the only way to safeguard the data is to design safe scoped APIs for the typical use cases, and keep dangerous unscoped APIs around only as an escape hatch with much stricter security and safety requirements.
ensignavenger 2y ago
Facebook users shared data with their friends. Those friends gave access to the data to CA. So like if you share a document with me and I then give CA access to my GDrive.

kmeisthax 2y ago

Yes, the situation superficially resembles Cambridge Analytica, but there's a few differences here. People aren't building detailed dossiers of themselves on Google Drive like they were on Facebook, and Transmit is a client app that is honest, open and up-front about how it uses your data - to move it in and out of Google Drive. To be clear, the problem with Cambridge Analytica was not Cambridge Analytica. The problem was - and still is - Facebook's habit of getting everyone to overshare and self-surveil. There needs to be some control and vetting over the apps that have access to your data but not so much that actually honest developers are quitting the game. My guess is that Google just doesn't want third-party clients (you can't shove "AI" or "Investor Advertising" into it), so they're slowly turning up the heat by abusing the data scare.

jsnell 2y ago
A lot of people will have substantially more sensitive data in their chosen cloud storage system (whether Drive, DropBox, OneDrive, iCloud) than on Facebook or any other social network. For example documents like ID scans, financial records, and medical records are going to be commonplace.
mikeocool 2y ago
It seems like if a nefarious actor built a seemingly helpful app that asked for Google Drive access and convinced some people to use it, they could do a lot worse than Cambridge Analytica. My Facebook account is largely limited to information that’s already largely public. I imagine there are Google Drive accounts out there with tax returns, health records, background checks, etc in them. Yes, this sucks that it puts road blocks for well meaning developers, but for the general public, it’s pretty hard to tell who is a well meaning developer and who isn’t. Also, inexperienced or careless well meaning developers can still accidentally put your data in a public internet facing DB.