4 ms·

Is this a violation of the computer fraud and abuse act? It seems to me like it might be because they're literally breaking out of a sandbox and viewing data fr

Is this a violation of the computer fraud and abuse act? It seems to me like it might be because they're literally breaking out of a sandbox and viewing data from other apps. Other cases of that (like breaking out of VMs on a cloud provider) are clear violations. Sometimes people see violations of the law by a big corporation against people as less bad than when a single person does the same thing, but that's unreasonable -- if anything the former is more harmful due to potential for scale.

deleted 1y ago
[deleted]
spencerflem 1y ago
I'm with you fwiw. But I wouldn't hold my breath waiting for a conviction.
- gleenn 1y ago
  Why is this de-facto the case for so many things? Is it a matter of finding a lawyer? Do these enforcement agencies just not care or don't have enough resources to battle Meta? It's exhausting that this gets repeated so often but for no apparent reason. I understand that the fine might not be large enough to stop them but it feels like all these things just get swept under the rug and gross violations of privacy which are against the law never get actioned. (Edit: forgot a word)
  - rgreek42 1y ago
    There's only one law in America: capital accumulation shall not be impeded.
  - jrs235 1y ago
    This administration is more interested in using executive agencies to advance a political power consolidating agenda not protecting consumers and citizens from corporate abuse and villains of privacy. Mega corporations and government (US Executive branch) are getting in bed and partnering to exploit data to maintain and expand power and control. Where and when the US Constitution protects citizens and prevents the government from doing an action, the government will lean on mega corporations to enforce their policy in the private sector. Social credit, like communist China na, is coming to the US. While the GOP has been resurrecting McCarthyism, they have been stoking the fears to make them a reality. Projection at it's finest. The hypocrisy is mind blowing and the cognitive dissonance in those that way up the FUD extremely strong and empowering for the malicious "elites" using it.
  - input_sh 1y ago
    FTC's yearly budget is under half a billion, companies can simply throw more lawyers at a problem until the next election. Rinse and repeat. Case in point, FTC did start an antitrust lawsuit against Facebook in December 2020 and the trial finally started last month. Hence, Zuckerberg being at the inauguration, getting rid of fact-checkers etc.
  - MangoToupe 1y ago
    Nobody wants to kill the golden goose. EDIT: well, that's probably not true, there are probably many people working for e.g. the FTC that would love to go after big companies. This is certainly true for the CFPB. But collectively, there's very little will from either party to do so. I mean, a large portion of congress holds Meta stock; some got rich off it.
  - 01HNNWZ0MV43FF 1y ago
    A Five Whys might be appropriate. Why won't Meta be punished for this? Because they won't be convicted. Why won't they be convicted? Because the court system is corrupt, trials are expensive, and Meta has more money to throw behind lawyers than anyone who cares to sue them. Why is the court system corrupt? Because corruption is spreading through every aspect of the US government, as corruption, like black mold in a kitchen sink, tends to do when not actively fought. Why are trials expensive? Because the law is complicated and there isn't much support for privacy, so this isn't open-and-shut like a murder case, it would be a long drag-out fight between the few people with little money who care about privacy, and a huge corporation powered by the fear and apathy and helplessness of billions of people. Why does Meta have so much money? Because nobody stopped them when it would have been easy. Because corruption of democracy and erosion of privacy have been ongoing for decades, maybe forever. Why isn't corruption being actively fought? The working class (Net worth under say 5 million) are on back foot against it. Nobody has time to vote, protest, organize, unionize, run for office, fix things, help the homeless, when you can't afford a damned thing, when a pregnancy is a career-ending problem, when you can't even get an abortion safely in many states, when you're one ambulance bill from a "not a debtor's prison" constructed debtor's prison. Why isn't there much support for privacy? Same reasons, plus public education lags behind on this issue. Tech moved very fast the last few decades, and there's no public education for adults, so people don't really get sat down and told what the risk is of mass surveillance. The stories get written, sometimes, but not listened to. Nothing very serious gets done when you can always flip channels and see something funny, which is what Meta and TikTok sell to people. You can always flip channels and tune out, and it might take years to say to yourself "I think I have a crippling Internet addiction". What's the actionable? 1. Always fight anyway. Get stuff off of Meta. Publish Own Site, Syndicate Elsewhere. Help friends get away. Do what you can. 2. Do things in physical reality. 3. Vote in every god-damned election you can vote in. Vote blue even if it's a shit sandwich, because most Americans are stuck under FPTP voting, and life is better under Democrats, do I need to explain the word "gradient" to a website full of startup hackers?
  - sneak 1y ago
    Prosecutorial discretion is tremendous. This won't be enforced against Meta because Meta is huge and powerful. If you become huge and powerful, many of the laws stop applying to you, because prosecutors know it's frowned upon to attack the ownership class.
ajross 1y ago
I think it's sort of unclear if "breaking out of a sandbox" is what's happening. Obviously no one expects this to be happening. But the features are known, and mostly desired, things: * Apps can open local TCP/UDP ports on the device to talk to each other. That's good, often. It's a valuable capability, just like access to shared storage is. And it doesn't leak any info the app doesn't want to leak. * Apps can get a reasonably unique fingerprint for the device they're running on. Again, that's desired: backends want to know who they're talking to, and that it's not a MitM or hijacked account. * Browsers can talk to those local servers too. Again, this seems useful to me, as long as native apps have capabilities that web apps lack, they should be able to offer them as extensions to the web API. So basically we have a situation where Facebook's native app tells Facebook's web app (or rather Facebook's web code being distributed by Facebook's partner sites) what machine it's operating on (and maybe some more details about the history, like user account cookies, etc...), in contravention of the user's expectations about what they told the partner site to store about them. It's that last bit that's the bad part. But it's not really about device security as I see it. Facebook broke the spirit of the cookie tracking rule, but not the letter.
- Nextgrid 1y ago
  Malware also takes advantage of known and useful features. Being able to read and write your files (to steal or encrypt them), being able to open sockets (to connect to the C&C server) and so on. Which is why we generally look at the intention rather than how it was achieved technically.
- abeyer 1y ago
  > Browsers can talk to those local servers too. Again, this seems useful to me, as long as native apps have capabilities that web apps lack, they should be able to offer them as extensions to the web API. Not sure if I agree on that one... at a minimum I think that should be behind a user consent prompt.
  - ajross 1y ago
    Maybe, but it's worth pointing out that even that wouldn't prevent the exploit in question. Facebook didn't have to transfer this cookie locally, the app and web site could just as easily have exchanged it via some RESTful API server somewhere (well, on the same origin as the Facebook JS in question). The reason they didn't do that is pure obscurity: if they blasted a tracking cookie over the internet they would have been caught faster. Trying to design "security" features by pushing the "obscurity" boundary around is usually wasted effort.
deleted 1y ago
[deleted]
paxys 1y ago
I don't see how. Everything they are doing is explicitly allowed by the OS. If there is a violation it is under privacy and data collection laws.
- ImPostingOnHN 1y ago
  Is it explicitly allowed by the user? Every working system vulnerability is explicitly allowed by the code, or else it wouldn't work.
- freejazz 1y ago
  > Everything they are doing is explicitly allowed by the OS Do you mean that the OS provides for this possibility in a technical sense? Or do you mean that the OS explicitly gave them permission to do this exact thing (and that permission was from the user?). That something is technical possible isn't what makes something not a violation of the computer fraud and abuse act. Similarly, leaving my front door unlocked doesn't mean you aren't trespassing.
sneak 1y ago
No, those sorts of laws don't apply to the ownership class, generally speaking.
senkora 1y ago
This question sent me down a Wikipedia tangent, where I learned a new term that I plan to start using, “Organi-cultural deviance”: > Organi-cultural deviance is a recent philosophical model used in academia and corporate criminology that views corporate crime as a body of social, behavioral, and environmental processes leading to deviant acts. > This reflects the view that corporate cultures may encourage or accept deviant behaviors that differ from what is normal or accepted in the broader society. https://en.m.wikipedia.org/wiki/Corporate_crime https://en.m.wikipedia.org/wiki/Corporate_crime In other words, whether or not what Facebook is doing is a crime, they are doing it because their corporate culture fundamentally believes that it is okay and acceptable for them to do it, even though wider society doesn’t agree. And that’s the justification for filing criminal charges against organizations. It is the culture of the organization that encourages criminal acts, so the organization itself should be charged, and dissolved (the corporate death penalty) if necessary.
threecheese 1y ago
It appears that a Meta app is communicating with a Meta client library and shipping Meta-sourced cookies, which from a Cookie Consent perspective should apply only to the first party hosting the JavaScript and using the cookie, and from a Meta Ads client is still true. So the Bad Actor argument is that Meta is collecting this data widely for many first parties (Meta customers), but wouldn’t they have this anyway? If they aren’t allowing two First Parties to know about each others user data, then aren’t they aligning with legal frameworks?

deleted 1y ago

[deleted]

spencerflem 1y ago

I'm with you fwiw. But I wouldn't hold my breath waiting for a conviction.

gleenn 1y ago
Why is this de-facto the case for so many things? Is it a matter of finding a lawyer? Do these enforcement agencies just not care or don't have enough resources to battle Meta? It's exhausting that this gets repeated so often but for no apparent reason. I understand that the fine might not be large enough to stop them but it feels like all these things just get swept under the rug and gross violations of privacy which are against the law never get actioned. (Edit: forgot a word)
- rgreek42 1y ago
  There's only one law in America: capital accumulation shall not be impeded.
- jrs235 1y ago
  This administration is more interested in using executive agencies to advance a political power consolidating agenda not protecting consumers and citizens from corporate abuse and villains of privacy. Mega corporations and government (US Executive branch) are getting in bed and partnering to exploit data to maintain and expand power and control. Where and when the US Constitution protects citizens and prevents the government from doing an action, the government will lean on mega corporations to enforce their policy in the private sector. Social credit, like communist China na, is coming to the US. While the GOP has been resurrecting McCarthyism, they have been stoking the fears to make them a reality. Projection at it's finest. The hypocrisy is mind blowing and the cognitive dissonance in those that way up the FUD extremely strong and empowering for the malicious "elites" using it.
- input_sh 1y ago
  FTC's yearly budget is under half a billion, companies can simply throw more lawyers at a problem until the next election. Rinse and repeat. Case in point, FTC did start an antitrust lawsuit against Facebook in December 2020 and the trial finally started last month. Hence, Zuckerberg being at the inauguration, getting rid of fact-checkers etc.
- MangoToupe 1y ago
  Nobody wants to kill the golden goose. EDIT: well, that's probably not true, there are probably many people working for e.g. the FTC that would love to go after big companies. This is certainly true for the CFPB. But collectively, there's very little will from either party to do so. I mean, a large portion of congress holds Meta stock; some got rich off it.
- 01HNNWZ0MV43FF 1y ago
  A Five Whys might be appropriate. Why won't Meta be punished for this? Because they won't be convicted. Why won't they be convicted? Because the court system is corrupt, trials are expensive, and Meta has more money to throw behind lawyers than anyone who cares to sue them. Why is the court system corrupt? Because corruption is spreading through every aspect of the US government, as corruption, like black mold in a kitchen sink, tends to do when not actively fought. Why are trials expensive? Because the law is complicated and there isn't much support for privacy, so this isn't open-and-shut like a murder case, it would be a long drag-out fight between the few people with little money who care about privacy, and a huge corporation powered by the fear and apathy and helplessness of billions of people. Why does Meta have so much money? Because nobody stopped them when it would have been easy. Because corruption of democracy and erosion of privacy have been ongoing for decades, maybe forever. Why isn't corruption being actively fought? The working class (Net worth under say 5 million) are on back foot against it. Nobody has time to vote, protest, organize, unionize, run for office, fix things, help the homeless, when you can't afford a damned thing, when a pregnancy is a career-ending problem, when you can't even get an abortion safely in many states, when you're one ambulance bill from a "not a debtor's prison" constructed debtor's prison. Why isn't there much support for privacy? Same reasons, plus public education lags behind on this issue. Tech moved very fast the last few decades, and there's no public education for adults, so people don't really get sat down and told what the risk is of mass surveillance. The stories get written, sometimes, but not listened to. Nothing very serious gets done when you can always flip channels and see something funny, which is what Meta and TikTok sell to people. You can always flip channels and tune out, and it might take years to say to yourself "I think I have a crippling Internet addiction". What's the actionable? 1. Always fight anyway. Get stuff off of Meta. Publish Own Site, Syndicate Elsewhere. Help friends get away. Do what you can. 2. Do things in physical reality. 3. Vote in every god-damned election you can vote in. Vote blue even if it's a shit sandwich, because most Americans are stuck under FPTP voting, and life is better under Democrats, do I need to explain the word "gradient" to a website full of startup hackers?
- sneak 1y ago
  Prosecutorial discretion is tremendous. This won't be enforced against Meta because Meta is huge and powerful. If you become huge and powerful, many of the laws stop applying to you, because prosecutors know it's frowned upon to attack the ownership class.

ajross 1y ago

I think it's sort of unclear if "breaking out of a sandbox" is what's happening. Obviously no one expects this to be happening. But the features are known, and mostly desired, things: * Apps can open local TCP/UDP ports on the device to talk to each other. That's good, often. It's a valuable capability, just like access to shared storage is. And it doesn't leak any info the app doesn't want to leak. * Apps can get a reasonably unique fingerprint for the device they're running on. Again, that's desired: backends want to know who they're talking to, and that it's not a MitM or hijacked account. * Browsers can talk to those local servers too. Again, this seems useful to me, as long as native apps have capabilities that web apps lack, they should be able to offer them as extensions to the web API. So basically we have a situation where Facebook's native app tells Facebook's web app (or rather Facebook's web code being distributed by Facebook's partner sites) what machine it's operating on (and maybe some more details about the history, like user account cookies, etc...), in contravention of the user's expectations about what they told the partner site to store about them. It's that last bit that's the bad part. But it's not really about device security as I see it. Facebook broke the spirit of the cookie tracking rule, but not the letter.

Nextgrid 1y ago
Malware also takes advantage of known and useful features. Being able to read and write your files (to steal or encrypt them), being able to open sockets (to connect to the C&C server) and so on. Which is why we generally look at the intention rather than how it was achieved technically.
abeyer 1y ago
> Browsers can talk to those local servers too. Again, this seems useful to me, as long as native apps have capabilities that web apps lack, they should be able to offer them as extensions to the web API. Not sure if I agree on that one... at a minimum I think that should be behind a user consent prompt.
- ajross 1y ago
  Maybe, but it's worth pointing out that even that wouldn't prevent the exploit in question. Facebook didn't have to transfer this cookie locally, the app and web site could just as easily have exchanged it via some RESTful API server somewhere (well, on the same origin as the Facebook JS in question). The reason they didn't do that is pure obscurity: if they blasted a tracking cookie over the internet they would have been caught faster. Trying to design "security" features by pushing the "obscurity" boundary around is usually wasted effort.

deleted 1y ago

[deleted]

paxys 1y ago

I don't see how. Everything they are doing is explicitly allowed by the OS. If there is a violation it is under privacy and data collection laws.

ImPostingOnHN 1y ago
Is it explicitly allowed by the user? Every working system vulnerability is explicitly allowed by the code, or else it wouldn't work.
freejazz 1y ago
> Everything they are doing is explicitly allowed by the OS Do you mean that the OS provides for this possibility in a technical sense? Or do you mean that the OS explicitly gave them permission to do this exact thing (and that permission was from the user?). That something is technical possible isn't what makes something not a violation of the computer fraud and abuse act. Similarly, leaving my front door unlocked doesn't mean you aren't trespassing.

sneak 1y ago

No, those sorts of laws don't apply to the ownership class, generally speaking.

senkora 1y ago

This question sent me down a Wikipedia tangent, where I learned a new term that I plan to start using, “Organi-cultural deviance”: > Organi-cultural deviance is a recent philosophical model used in academia and corporate criminology that views corporate crime as a body of social, behavioral, and environmental processes leading to deviant acts. > This reflects the view that corporate cultures may encourage or accept deviant behaviors that differ from what is normal or accepted in the broader society. https://en.m.wikipedia.org/wiki/Corporate_crime https://en.m.wikipedia.org/wiki/Corporate_crime In other words, whether or not what Facebook is doing is a crime, they are doing it because their corporate culture fundamentally believes that it is okay and acceptable for them to do it, even though wider society doesn’t agree. And that’s the justification for filing criminal charges against organizations. It is the culture of the organization that encourages criminal acts, so the organization itself should be charged, and dissolved (the corporate death penalty) if necessary.

threecheese 1y ago

It appears that a Meta app is communicating with a Meta client library and shipping Meta-sourced cookies, which from a Cookie Consent perspective should apply only to the first party hosting the JavaScript and using the cookie, and from a Meta Ads client is still true. So the Bad Actor argument is that Meta is collecting this data widely for many first parties (Meta customers), but wouldn’t they have this anyway? If they aren’t allowing two First Parties to know about each others user data, then aren’t they aligning with legal frameworks?