15 ms·
Facebook Chats Are Being Scanned by a CIA Funded Company?
- hackread 12y agosite is offline pal
- higherpurpose 12y agoI wonder if the same happens for Whatsapp (for which I'm still waiting on them to make a public statement and privacy policy change for the adoption of end-to-end encryption).
- hackread 12y agothere is no doubt same happens for whatsapp.
- eeZi 12y agoIf it's true that they implemented end-to-end encryption (as it seems), it's unlikely that they do.
- higherpurpose 12y agoNothing is unlikely when they haven't even admitted in public that they have adopted it. At the moment end-to-end encryption on Whatsapp is nothing but vaporware.
- washadjeffmad 12y agoCould they call it end-to-end if the ends are the devices and the server (never cleartext, but they have the key)? Or, in combination with what is available through FB, is the metadata telling enough?
- Tech1 12y agoCan't read the article yet, but I'd put money on Palantir(1) (1) http://en.wikipedia.org/wiki/Palantir_Technologies http://en.wikipedia.org/wiki/Palantir_Technologies
- gerty 12y agoI did read through it and they tracked it back to Recorded Future [1]. [1] https://en.wikipedia.org/wiki/Recorded_Future https://en.wikipedia.org/wiki/Recorded_Future
- solaris999 12y agoWhy does wikipedia link them with Palantir (and vice versa)? Is it just because they seem to be providing similar products or is there more to it?
- kissickas 12y agoSomeone on the talk page brought up the same point. "The only discernible connection is that both had In-Q-Tel as an early investor, as did numerous other companies (none of which are listed as related, nor should be they be)." https://en.wikipedia.org/wiki/Talk:Recorded_Future https://en.wikipedia.org/wiki/Talk:Recorded_Future
- cubecul 12y agoWhat do you think Palantir does that would have them scanning FB chat?
- tolkienfanatic 12y agoPalantir does tons of government and military work.
- cubecul 12y agoDoesn't answer my question deeply enough.
- rjaco31 12y agoSome cached version or mirror available?
- r721 12y agoMirror: https://archive.today/U4D3v https://archive.today/U4D3v
- deleted 12y ago[deleted]
- whitehat2k9 12y agoYeah, but this is nothing new. I run several sites whose (non-public) links are regularly scanned by Facebook after someone types them in a chat. Presumably they're doing this to scan and flag malicious websites/pages.
- guava 12y agoThe key point here is that the links are scanned by a 3rd party who are not related to Facebook (as far as we know).
- onion2k 12y agoThey could be intercepting the traffic anywhere between the author's network and Facebook though, not necessarily with any complicity on the part Facebook.
- psykovsky 12y agoWhat about SSL? Doesn't facebook use it?
- jcrawfordor 12y agoThe third-party does threat intelligence... I don't see how it's unreasonable to think that Facebook has hired them to perform malware/scam detection on links sent through chat. Given Facebook's policy, someone has to do it.
- rmxt 12y agoThat seems like quite a generous interpretation. Yes, that is an ostensible reason for the scanning [1], but to imagine that that is all they are doing with the information gleaned from the scans seems a bit naive. I would posit that sender, recipient, link, time, the page's content, and the conversation's context are forever stored in a database somewhere, waiting to be fed into the data analysis/advertising program du jour at some point in the future. Who owns that database or where the information ends up is probably a trip down the rabbit hole, and the posted article is a first step into it. [1] Facebook policy on interstitials for malware/malicious links https://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766 https://www.facebook.com/notes/facebook-security/link-shim-p...
- discreditable 12y agoMirror: https://archive.today/U4D3v https://archive.today/U4D3v
- diminoten 12y agoThis was known already, at least the "your chats are being scanned". [0] [0] http://www.gamespot.com/articles/texas-teen-jailed-after-league-of-legends-argument/1100-6410871/
- morganvachon 12y agoThis particular article is talking about Facebook Messenger chats being scanned. The link you provided is talking about public Facebook comments that anyone can see, and in fact the kid was reported by a third party, not some shady surveillance company.
- diminoten 12y agoThis article is terrible, but the original article has been pulled off the local news site. It wasn't on someone's Wall, it was in a message to his friend.
- morganvachon 12y agoIf it truly is a factually incorrect article, why did you even post it, especially when it seems to have absolutely nothing to do with what you said?
- diminoten 12y agoBecause I didn't read it and assumed it wasn't factually incorrect. Mea culpa. :/
- lost_name 12y agoI don't think that was a chat being scanned. The article even states that a woman in Canada saw the post and called the police, it was probably just on his wall.
- profmonocle 12y agoYour article doesn't say anything about chats being scanned. > Jack Carter said a woman from Canada saw the posting, did a Google search for his addresses and when she noticed he lived near a school, called the police.
- po1nter 12y agoSince many are complaining that the website is down here's a mirror: http://i.imgur.com/B7shOez.png http://i.imgur.com/B7shOez.png
- stephengillie 12y agoThanks for this. Is it irony that sending a full-pixel render of markup is the opposite of the HTML idea? :p
- cies 12y agoI thought FB _is_ indirectly a CIA funded company. http://en.wikipedia.org/wiki/In-Q-Tel http://en.wikipedia.org/wiki/In-Q-Tel
- CPLX 12y agoThe sourcing for that Wikipedia citation seems very thin: http://www.nzherald.co.nz/technology/news/article.cfm?c_id=5&objectid=10456534 http://www.nzherald.co.nz/technology/news/article.cfm?c_id=5... It's hardly implausible, but is there any better, clearer source of this assertion?
- falcolas 12y agoHow about their own web page? > We identify, adapt, and deliver innovative technology solutions to support the missions of the Central Intelligence Agency and broader U.S. Intelligence Community. https://www.iqt.org/ https://www.iqt.org/
- guava 12y agoI think the user was questioning the link between In-Q-Tel and Facebook (rather than In-Q-Tel and the CIA).
- deleted 12y ago[deleted]
- CPLX 12y agoI checked and don't see any reference to Facebook on their portfolio page. Is there a mention on this site that I missed? https://www.iqt.org/portfolio/ https://www.iqt.org/portfolio/
- ctrl_freak 12y agoThe question isn't whether In-Q-Tel supports the CIA. It's whether Facebook was funded by In-Q-Tel, and even the article that Wikipedia uses as a citation doesn't seem too sure how strong of a connection there is: > The second round of funding into Facebook ($US12.7 million) came from venture capital firm Accel Partners. Its manager James Breyer was formerly chairman of the National Venture Capital Association, and served on the board with Gilman Louie, CEO of In-Q-Tel, a venture capital firm established by the Central Intelligence Agency in 1999. One of the company's key areas of expertise are in "data mining technologies".
- xenophonf 12y ago"Facebook privacy" is a misnomer. The sooner everyone considers it a public forum, the better.
- onderkalaci 12y agoagreed!
- bengali3 12y agoagreed. Maybe the courts haven't defined 'Private' yet? I'm not a user but is the word 'Private' pretty much removed from everything? wouldnt labeling something 'Private Chat' indicate that there are no unknown parties involved? I'm a fan of sites like: https://twofactorauth.org/ https://twofactorauth.org/ (credit to davis) that call out this kind of stuff and list competitors next to each other. Does anyone know of one similar for calling out privacy BS?
- testingonprod 12y agoAbsolutely, that's why everything I post is set to "Public" and the content is of the same nature.
- return0 12y agoIsn't the entire internet made by the army or sth? Thats why in my terrorist group, we use pigeons.
- cordite 12y agoThis happened to me before with someone I worked with. Saw some weird hits from California, the next day tons of stuff from Russia, china, eastern European counties I have never heard of before.. Now I just don't trust giving private info over such chats.
- malka 12y agoNever trust the pipe. Always encypt sensitive data.
- nardev 12y agoSomething that we all knew is there, but now they don't even hide.
- dheera 12y agoAt least Facebook (unlike WeChat or Whatsapp) supports XMPP, so we can independently implement an encryption layer. Only problem, as usual, is getting everyone to agree on a standard.
- JustSomeNobody 12y agoNo, the problem is that all the major players are moving towards proprietary messaging protocols. The problem that needs to be solved is one of having a fully encrypted, distributed messaging protocol (i.e.: no central server) with apps that are easy enough that gramma can use.
- dheera 12y agoI'm wondering if this trend of moving to proprietary protocols is because of business or because of technology. And it's not just messaging either. File storage are moving from standard calls like fopen() to using the Dropbox API or Google Drive API. Phone calls are moving from device-agnostic copper wire to Skype or Google Hangouts. Taxis are moving from wave your hand to proprietary Uber API to proprietary Lyft API. But then again, back in the day, competing products in a single market (e.g. Zip Drives vs. LS-120) were still sufficiently similar that it was possible to use a single API to access both (e.g. fopen()). Nowadays, competing products in the same market (e.g. Dropbox vs. Google Drive) are so different in implementation and feature set that it's inherently difficult to come up with a single extensible standard that covers both. So are we now in an age where everything will remain proprietary for a few decades due to technological limitations?
- JustSomeNobody 12y agoIt's so hard not to give a skeptics answer to this. When one hears FB, et al, talking about how many users they have, one can't help but think this is all business.
- jkire 12y agoThis. It's a shame that XMPP never really took off; even more so as a lot of people seem to be taking it as proof that no distributed chat system will ever take off. I think there are quite a lot of reasons end users would really like distributed chat, one of which is very much security. We need to learn why XMPP didn't take off and either a) fix it, or b) learn and move on. (Which is why I'm part of a team building http://matrix.org/ http://matrix.org/, check it out!) However, I don't necessarily think we're ever going to get to a world where everything is end-to-end encrypted. There will always be trade offs involved when using encryption, and sometimes the trade off aren't worth it (a stupid example being public group chats). It would be nice, however, if chat apps and protocols in general made it clearer what level of security is involved. Just like the average user is slowly getting to grips with HTTP vs HTTPS (thanks in part to the nice and simple padlock icon on most browsers), there's no reason that users can't be made aware of the security of a given conversation and medium. Facebook, for all its woes, is still easy/useful when trying to organize events, and I really don't care that much if they are spying on that. On the other hand I don't really use facebook messenger since I do care about those conversations. We need to empower average users to be able to make those same informed choices on who they trust with what.
- tagx 12y agoI wouldn't be so quick to assume foul play. Could it be some piece of software installed on the recipients browser/machine that is sending the links off somewhere to be scanned?
- lawlessone 12y agoTheir browser.
- matthewaveryusa 12y agothat would be easy to check and restrict on the client side.
- kefs 12y agoSame with Skype chats. Discussion from 700 days ago: https://news.ycombinator.com/item?id=5704574 https://news.ycombinator.com/item?id=5704574 http://www.h-online.com/security/news/item/Skype-with-care-Microsoft-is-reading-everything-you-write-1862870.html http://www.h-online.com/security/news/item/Skype-with-care-M...
- magicalist 12y agoI think the big differences here are that it's a third party scanning the IP address (though possibly one Facebook hired for security scanning, as someone else below guessed), but also that Skype chat was still being vaguely claimed as "secure" at the time, I believe. Facebook is up front about scanning chat messages for spam and they do the page screenshot thing.
- psykovsky 12y agoTop comment says facebook isn't hiring that company...
- magicalist 12y agoAh, yeah, that wasn't there when I posted my comment above.
- drethemadrapper 12y ago@kefs: I can't agree more. Here is it with Skype chats- https://defuse.ca/microsoft-reads-your-skype-messages.htm https://defuse.ca/microsoft-reads-your-skype-messages.htm
- agwa 12y agoQuestion: was the URL sent through Facebook chat an HTTPS URL? If it was, that would imply Facebook's involvement. But if it wasn't, it's possible that Facebook's scan was sniffed in transit and the URL was then sent over to the third party for scanning. I also assume from the timezone in your log that your server is outside the US. It would be interesting to test this with a link to a server located inside the US, to try to determine where the interception is taking place.
- techaddict009 12y agoFacebook is completely switched over https as far as I have used.
- agwa 12y agoYou're talking about the Facebook website, which is irrelevant to this discussion. If someone sends an insecure HTTP URL through Facebook chat, then Facebook has to make an insecure HTTP connection to that URL in order to scan it, which leaks the URL, even if the chat session was using HTTPS.
- deleted 12y ago[deleted]
- copsarebastards 12y agoAre you really claiming that an amoral company whose sole responsibility is to produce income made a deal to produce income at the expense of user privacy? How could anyone have seen this coming? If you trust your data to a company it will be sold. That goes for Facebook, Google, and any other major company.
- sp332 12y agoThat's not their sole responsibility. They also have laws to obey, and as the article points out, this behavior seems to violate their own ToS.
- copsarebastards 12y agoHave you seen anyone go to jail for siding with the surveillance state? Laws only apply if they are enforced. As for the ToS, I'm not sure you can say someone is bound by a set if rules they can change at any time without notice. They may have already changed the rules and simply not made the changes public.
- deleted 12y ago[deleted]
- sp332 12y agoThere's quite a large gap between having a responsibility to do something, and just being able to get away with it.
- psykovsky 12y agoI think the article points out the opposite, that you are being spied upon by Facebook itself and undisclosed third-parties and being told about it on facebooks' ToS.
- scott_karana 12y agoTo go a step beyond that, saying "amoral company" is redundant. ;)
- howlett 12y agoThat's the exact reason I built (open-source) Taniger [ https://www.taniger.com https://www.taniger.com ]
- Neetpeople 12y agoWhat level of an event would have to happen for people to stop using facebook? I'm just curious to the community's impression of the level of tolerance the general public has on these matters of privacy.
- eternalban 12y agoThe (then) CEO of Google Inc. loudly declared the (constitutional) legalese that the users of his company's product have "no reasonable expectation of privacy". The Supreme Court is perfectly clear as to what rights we have when we don't have "reasonable expectation of privacy". Finally, we are effectively coerced [in]to using these products -- unless you want to head to the woods and live the back to nature life. Game is over.
- eternalban 12y agoSilent down votes, really? Is this the new form of censorship? Speak up. Which of the above statements are not factual?
- psykovsky 12y agoI think it's your username.
- Kluny 12y agoYou might be factual, but it's a conversation killer. There's nothing I can do with this post other than nitpick the details - you haven't even cited sources. HackerNews is intended to promote conversation; hence, downvotes.
- eternalban 12y agoI don't know how you conduction conversations in real life, but if someone says something to me and I need more details, I ask. I don't tell them to shut up. :) 1 - http://www.theguardian.com/technology/2013/aug/14/google-gmail-users-privacy-email-lawsuit http://www.theguardian.com/technology/2013/aug/14/google-gma... 2 - http://www.consumerwatchdog.org/newsrelease/google-tells-court-you-cannot-expect-privacy-when-sending-messages-gmail-people-who-care http://www.consumerwatchdog.org/newsrelease/google-tells-cou... 3 - http://en.wikipedia.org/wiki/United_States_v._Jones_(2012)#Appeal http://en.wikipedia.org/wiki/United_States_v._Jones_(2012)#A... Now let's have a conversation.
- eternalban 12y ago"Like this page on Facebook". I seriously wonder about websites that target a select audience and duly notify the front companies of the intelligence community.
- Aoyagi 12y agoI find it interesting that people have problem with the law-enforcing organizations spying on them, but if megacorporations whose sole purpose is to make money off its user base, that's OK.
- DubiousPusher 12y agoThat's quite a generalization. I think there's been plenty of social anxiety generated by the knowledge that Google, Amazon, etc are mining our data. A lot of people have written at length about this subject.
- carc 12y agoI find it interesting that some people have a problem seeing the difference between willingly and knowingly giving data to a corporation in return for a service and a law-enforcing organization using that data without permission
- Aoyagi 12y agoWillingly and knowingly? How many people do you think know what everything Facebook, Google, Microsoft and others log and process about them? As far as I know, majority people believe that it's the omnipresent ads that make the service "free".
- login123 12y agoThat's true, most people don't. Does it mean those who do know about what is happening with their information/trust should keep quiet? May be (just an example), you might not have deep knowledge about cryptography, does it mean those who have the knowledge should not call out the problem when they find one?
- Aoyagi 12y agoNo, it doesn't mean anything like that. My point is that people are resentful about government (an entity that is supposed to work for them) gathering their data while at the same time not minding private businesses mining probably even more data -and- providing those data to gods know home many third parties. It's the disproportion of how much people care that surprises me.
- boomzilla 12y agoHas anyone here got experience with bitmessage? https://bitmessage.org/wiki/Main_Page https://bitmessage.org/wiki/Main_Page How good is it, in terms of latency and reliability?
- dmix 12y agoBitmessage doesn't scale well - almost by design. I'm sure it works fine for the occasional non-realtime message, like a voice-mail box. But if you are ok with alpha-quality software and want encrypted chat similar to IM/Facebook chat you should stick to something like Pond https://pond.imperialviolet.org/ https://pond.imperialviolet.org/
- ParanoidShroom 12y agoThis isn't so new, MS did the same back in the msn days.
- deleted 12y ago[deleted]
- sweis 12y agoHi everyone. I work on the security team at Facebook. While investigating the claims of this post, we've confirmed that Facebook doesn't use Recorded Future -- an open source aggregator of public data -- to scan any private content. That means we haven't partnered with or directed Recorded Future to scan anyone's message links. It's hard to tell precisely what's going on based on the amount of information in the post. It's possible that another interaction, including one that could be occurring on the client machine, is consuming the URL and generating this behavior. We'll update if any new information is discovered.
- neilwillgettoit 12y agoIt is known that you guys do regularly use Webroot to scan links in messages, so it's not a stretch that Recorded Future can be setup on a similar type program. http://www.eweek.com/security/facebook-webroot-expand-security-partnership http://www.eweek.com/security/facebook-webroot-expand-securi...
- sweis 12y agoThat was the Facebook AV Marketplace, which to my knowledge does not exist anymore. Here's the old post about it from 2012: https://www.facebook.com/notes/facebook-security/the-facebook-anti-virus-marketplace/10150672849230766 https://www.facebook.com/notes/facebook-security/the-faceboo...
- neilwillgettoit 12y agoDo you guys dump anonymized link data into https://threatexchange.fb.com/ https://threatexchange.fb.com/ ?
- themeek 12y agoThank you for contributing to the thread. I have had a lot of difficulty in the past discussing security and privacy concerns with your team - in particular a complain about the censorship of my linking leaked Snowden and Wikileaks documents and PDF scans of Islamic Extremist magazines (non-violent/gross content). Do you have a transparency document anywhere that you can link, so that we can understand what you as a representative can and will contribute to the conversation? Could you also provide some proof that you are a representative of Facebook security? Thank you again for your time.
- Thriptic 12y agoCoincidentally I just stumbled upon this service which integrates with FB chat to offer OTR encryption a few minutes ago: https://blog.crypto.cat/2014/05/cryptocat-now-with-encrypted-facebook-chat/ https://blog.crypto.cat/2014/05/cryptocat-now-with-encrypted... Anyone have any knowledge re: the legitimacy of this?
- deleted 12y ago[deleted]
- mattkrf 12y agoHi everyone - the team here at Recorded Future looked into this and dug into our logs to confirm what happened. Our systems followed this URL after it was posted on a public site. Our system constantly explores links published on the web. We've checked our logs and confirmed that this is what happened in this specific case. It's not related to any Facebook chat messages containing this link. Our system doesn't access that information.
- themeek 12y agoThank you for replying here. Can you give us more information including: - Proof you are from Recorded Future - The public URL at which you picked up the links - Any evidence you have that what you say happened indeed happened? That is specifically the log information you report on having investigated. Publishing this will allow the original publisher and independent analysis to corroborate your story. The more information you can publish to quell any doubts, if this is completely benign, the better for your company/Facebook/CIA.
- dmitrygr 12y agogot any proof of any of this? if the url is public, let's see it :)
- smokeyj 12y ago> Hi Andreas - I'm not saying it was posted publicly by you or someone in the Bosnadev team. Please contact me directly (matt at recordedfuture dot com) and I will share more details with you. You left this comment on Bosnadev's blog. Mind sharing with the rest of us?
- jcfrei 12y agoMaybe they posted the URL privately on some other platform (ie. slack, some instant messenger, whatsapp, who knows)? And recorded future got it from there?
- mattkrf 12y agoThat's basically right. Our system observed the URL elsewhere on the web - not on a private messaging service. We've offered to share those details with Bosnadev. RE: whether these comments really are from the RF team, we're about to post the same info on our own blog.
- ggchappell 12y agoA serious question: Can someone explain to me why this is an issue? Facebook chats are stored on the servers of a company that I have no control over, that is not funded by me, and that has repeatedly demonstrated a commitment to getting people to reveal things about themselves. And meanwhile the U.S. government is listening to our phone calls. Are Facebook chats read by the U.S. government? Of course they are -- even if the claims in this article are completely false. So, again, why is this an issue?
- themeek 12y agoThe reason here would be due to the implication the CIA may be involved. The CIA's charter (is supposed to) specifically prohibit domestic activity. Facebook is in PRISM and a myriad of other government programs - everything that is posted, uploaded or chatted there is tagged, filtered and alerted for activity that the US government may deem dangerous or may want to pursue for other reasons (DEA, aggregate understanding and persuasion/'engagement'). Agreed broadly that this wouldn't be completely new news (were it to be confirmed). Technical details and confirmation do help citizens to understand that surveillance/'bulk collection' is alive and well.
- ianstallings 12y agoFacebook is not restricted to the US and the CIA is allowed to spy on people inside the US in cases of counter-intel and terrorism.
- themeek 12y agoTrue. Good point. Though I think the implication here would be that the company in question is both domestic and not associated with said overseas groups. This would mean that, (without a warrant) the executive of the US government is performing searches of domestic data. Again that isn't anything new - although still profound.
- Ruwanfili 12y agoPlease help me to teach me how to hack any password
- mohe 12y agohttps://www.facebook.com/hakim.allal.16 https://www.facebook.com/hakim.allal.16
- mohe 12y agohttps://www.facebook.com/hakim.allal.16 https://www.facebook.com/hakim.allal.16
- mohe 12y agohttps://www.facebook.com/hakim.allal.16 https://www.facebook.com/hakim.allal.16
- mowahk 12y agoCome on, this shit storm is way out of proportion. If it hasn't occurred to you that using Facebook Chat is essentially like writing postcards, you're probably new to the internet game. There's a million secure alternatives out there, choose one. (Threema, Telegram, and Wickr are among the best.)
- legel 12y agoHere's the problem: Most people - anyone clueless about computers, and only vaguely informed on the state of our intelligence community - they do not "know" what you imply. Because, we do not "know", and therefore we cannot prove it to them. We are given bits, here and there. Who knows what bits are suppressed by which interpretations of this Patriot Act or that? Such a laizze-faire attitude about such potential for warrantless, unbounded, infinitely intelligent surveillance (and control, which it implies) is inconsiderate of most people, to say the least. To say the most, it could be fatally reckless for too many of us. "Come on": if a random link was crawled by a "threat intelligence agency" in an otherwise innocuous chat? That is outrageous, if true. To be clear, I recognize "hints" that have been posted (as opposed to proof) suggesting that, in fact, something like Pastebin.com was crawled. And, for some reason, the link that was allegedly private allegedly ended up on Pastebin. In any case, the authors of this thread were clearly not aware of such "sniffing" on their computers... to say the least. Maybe completely innocuous, and maybe not. But since we're on this Snowden/Citizenfour topic, let me at least be clear: I refuse to let the walls keep crumbling, if that's what we're really talking about. You can bet your ass that Benjamin Franklin was right: “They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.” I refuse to consciously and explicitly grant free reign to "Big Brother" - and reduce this to a "catch me if you can" survival of the "most evasive" - just because, you know, "national security" knows whats best for us. Who's security exactly? Who helped lobby to put whom in what directorship of what agency that deems it fit to keep this (slightly sensitive topic to Corporation X, Y, Z) confidential? The more you let the surveillance state grow - whatever respectable, admirable, necessary ideals it may have - the fewer and weaker your "million secure alternatives" will become. We must not reduce control of the future of our country to a cat and mouse game. We must be tigers ready to fight for what's right for everyone. And yes, everyone should decide this together - not just a few "intelligence analysts" (or worse, their bots) in a pretty little lab somewhere... Cheers!
- mowahk 12y agoCome on, this shit storm is way out of proportion. If it hasn't occurred to you that using Facebook Chat is essentially like writing postcards, you're probably new to the internet game. There's a million secure alternatives out there, choose one. (Threema, Telegram, and Wickr are among the best.)