Facebook Is Not the Internet's Only Privacy Villain

https://choosetoencrypt.com/news/facebook-is-not-internets-privacy-villain/

by searchencrypt • 8 years ago

264 132 8 years ago

stewofkc7• 8 years ago

It's not news that Facebook is gathering and storing TONS of information about its users (and even non-users). Google, Amazon, Apple, Microsoft are all guilty of the same thing.

dlp211• 8 years ago

The difference is the extent to which those companies make that data accessible to third parties.

Disclaimer: I work for Google

ocdtrekkie5• 8 years ago

What is the actual difference between Google/Facebook and "third parties"? Google actively uses information it gets about me in ways I don't approve of, and generally can't opt out of without stopping use of the services entirely.

Sure, Cambridge Analytica was using the data to influence an election, but Google is not shy about it's own social activism, and it's efforts to manipulate users into seeing it's view of the world.

Google's only protective of our data for selfish reasons: If you sell our data outright, the third party doesn't have need of you anymore, but if Google maintains a tight hold on the data, Google can continually sell the ability to make use of it (through Google's advertising services and the like) over, and over, and over.

The harm to me is the same either way.

searchencrypt4• 8 years ago

I'm personally more concerned with the sheer volume of information that Google/Facebook/whoever collects about me. The Cambridge Analytica scandal shouldn't have surprised anyone that is remotely concerned with privacy. If the data is collected and stored, it's creates vulnerabilities to be hacked/leaked.

kylec• 8 years ago

I thought Apple was pretty good about respecting user privacy. If you opt out of sharing analytics with Apple, what information to they still gather and store?

searchencrypt4• 8 years ago

From Apple (https://www.apple.com/legal/privacy/en-ww/):

When you create an Apple ID, apply for commercial credit, purchase a product, download a software update, register for a class at an Apple Retail Store, contact us or participate in an online survey, we may collect a variety of information, including your name, mailing address, phone number, email address, contact preferences, and credit card information.

When you share your content with family and friends using Apple products, send gift certificates and products, or invite others to participate in Apple services or forums, Apple may collect the information you provide about those people such as name, mailing address, email address, and phone number. Apple will use such information to fulfill your requests, provide the relevant product or service, or for anti-fraud purposes.

In certain jurisdictions, we may ask for a government issued ID in limited circumstances including when setting up a wireless account and activating your device, for the purpose of extending commercial credit, managing reservations, or as required by law.

CaptSpify4• 8 years ago

Apple is good about PR promising user privacy. In regard to making good on that promise, however, they have yet to take action.

r00fus• 8 years ago

In which way have Google, Amazon, or Apple had any known breaches like this or even FB back in 2008 having API security "leaks" where everyone could pull down the entire graph?

Facebook is a pioneer in letting others dip into their vast treasure trove with doe-eyed innocence and many apologies.

garrettdc• 8 years ago

It certainly seems like FB and some credit bureaus are much more fast and loose with the data they collect when compared with Google/Amazon/MSFT

SahAssar• 8 years ago

The parent said "gathering and storing". While facebook is a lot more loose about who they give that data to it's still worth taking a long hard look at what data you want these companies to have, and consider how they are using it today and what they might be using it for or who they might expose it to tomorrow.

bsder• 8 years ago

Yes, the other companies are probably just as bad, but one at a time, please. It is very hard to keep the attention of the man on the street, we should not split it across multiple companies.

stewofkc7• 8 years ago

Only focusing on Facebook's scandal shifts attention away from the real issue, which is tracking on the internet in general. Most people aren't aware of the extent to which they are sharing information.

latexr2• 8 years ago

Focusing on Facebook gives the benefit of focus. Techies have been warning people for years about tracking on the internet, but “tracking on the internet” is a vague premisse.

It’s by bringing the actions of popular bad actors to light that we’ll raise awareness to the rest. People need something tangible that they see is affecting them, and Facebook’s scandal is just that.

skybrian2• 8 years ago

The problem is when you lose all technical details and are just left with who you think is good and who is evil.

We should be asking, how do other companies share their data? How much info does someone publishing to each app store get? What do third-party vendors on Amazon get? What do advertisers get?

Also, how much did direct marketers already know before the Internet came along?

John_KZ2• 8 years ago

Focusing on Facebook exclusively (for now) will give the public a real, indisputable, concrete example on why data mining is terrifying. If you start babbling on how "everyone's doing it" then you take away much of the importance and seriousness of the topic. People start going "you didn't know that? Of course they do" and "yeah, what can you do about it, right?" and just shrug the issue away. But with the specifics of Facebook and CA, you know that something can be done, and that not everyone has been doing it the same way and at the same magnitude.

Even if it's just Facebook, it's a step forward. You can't expect to take down all internet giants at once.

weinzierl3• 8 years ago

I have nothing against Amazon and I had been a happy customer, but when I ponder which company has the most valuable information about me, it's Amazon - by far.

When it comes to Facebook (or other social media companies) it's all about self-portrayal and in the end we have control which information we provide. To some degree at least.

Amazon on the other hand has direct unfiltered buying behaviour data. Isn't this advertiser heaven?

stewofkc7• 8 years ago

This information is certainly very important for advertisers. However, if you shop on websites with Google analytics, etc. Google will have the exact same information, combined with the rest of the information it's able to collect.

Xeoncross2• 8 years ago

Amazon doesn't have a million photos of me, hourly location data, and lots of other things freely provided by my "friend" network.

I'm glad there are no friends on Amazon.

weinzierl3• 8 years ago

Amazon doesn't have a million photos of me,

Yes, but what good are they to make you buy stuff or otherwise spend money?

hourly location data,

Location data is a commodity nowadays, if Amazon want's your locations data, it can have it.

and lots of other things freely

Your messages, which are probably much more useful than your photos and your location, but what else?

My point is that Amazon's data is much more valuable, but I'm neither in advertising nor data brokerage so I might as well be wrong.

jessaustin• 8 years ago

I'm glad there are no friends on Amazon.

Company culture determines everything!

bduerst2• 8 years ago

Do you use a credit card? Amazon most likely has your transaction history, even for B&M purchases, if you have your credit card on your account.

bradyd• 8 years ago

Actually, there are friends on Amazon. You can associate friends and family Wish Lists (if they are public) with your account.

Amazon also has a photo hosting service, so they could have photos of you if you use it.

ReverseCold• 8 years ago

Amazon doesn't have a million photos of me

Prime Photos has unlimited storage an uploads every single picture you take by default. As such, a lot of people use it.

hourly location data

The Amazon app requests location data and it probably checks when you use the app.

fumar• 8 years ago

Facebook's pixel is on most ecommerce domains. They are tracking purchase behavior + all your life events.

Erlangolem• 8 years ago

Unless you use one of the free options to block them, like uMatrix. It’s easy, it requires little or no effort. My bigger concern with FB is what they learn about me from people other than myself; I can’t control thst at all.

8note• 8 years ago

Why would Amazon want to give this data away? If somebody else can use the data better than amazon, they'll probably steal the sales from Amazon too, and amazon loses out.

dwyerm• 8 years ago

Amazon has an eerily cultish dedication to customer privacy. The phrase "work vigorously to earn and keep customer trust" is practically line one of their principles[1].

Amazon appears to be under the belief that retaining customer trust is much more valuable than selling customer data for immediate gain.

I suspect it has to do with their unique financial setup that allows them to operate with a long-view, and not have to chase quarterly profit.

[1] https://www.amazon.jobs/principles

amelius3• 8 years ago

Your bank has even more valuable information then.

dictum2• 8 years ago

I can't trawl through all of their terms of service to confirm whether they do it, but AWS alone is a valuable resource for analytics collection.

Kalium• 8 years ago

Visa, Mastercard, AmEx, and maybe your bank.

rhizome2• 8 years ago

Grocery store.

tortasaur• 8 years ago

I don't know about "unfiltered". There are certain items I won't buy on Amazon that I would buy if it weren't tied to my profile.

mikehollinger2• 8 years ago

Databrokers enable this - take a look at something like Acxiom's developer APIs.[1] You'll find that they have some quite interesting stuff, like whether someone's interested in gambling.[2] Facebook partners with these folks (as do many others) to enable them to build this aggregated database.

Interestingly, you can log in and see your own profile there. I did that a few years ago, and introduced subtle errors into it (e.g. I changed my car to a different brand of car, and the "extended warranty services" robocalls around a year later started calling about my nonexistent vehicle).

[1] https://developer.myacxiom.com/code/api/data-bundles/main

[2] https://developer.myacxiom.com/code/api/data-bundles/bundle/...

m0ngr31• 8 years ago

How do you see your own profile?

mikehollinger2• 8 years ago

jonbarker• 8 years ago

Steve Jobs actually envisioned building an ads product where the ads were actually beautiful and enhanced the user experience, in his final years. That was the idea behind iAd. I occasionally get these types of ads from youtube where I'm actually glad they showed it to me. No other ad product has ever met this bar for me including fb so that's why I think they deserve the market's current skepticism, that and allegedly selling political ads at different CPMs to different parties (this is not legal in other types of media).

stewofkc7• 8 years ago

The price gouging is a whole other issue...which is a by-product of the availability of this data.

If Facebook/Google are really gathering our data to enhance advertising, it isn't helping the end user. Although it could, if they shifted their focus from ad revenue to user experience (not gonna happen).

juststeve3• 8 years ago

Spotify reserves the right to sell your details/listening habits when their terms of use changed... (ie genres of music you like, the types of musicians etc)

Is this facebook data being funneled back to the record labels and their parent companies to sell advertising? my research says its likely, this feels similar to the CA situation, just not as political..?

searchencrypt4• 8 years ago

If you use Facebook to login to Spotify then that information is definitely available. The information doesn't even need to be sold to the record labels. If the labels then use Facebook ads, the targeting can be as specific as someone who likes a particular band or song.

The fact that people use Facebook to login to EVERYTHING, means that Facebook has access to their usage data.

dullgiulio• 8 years ago

No, that's not true. If Spotify sells the data without anonymizing it, then it could tracked back to Facebook, but otherwise OAuth only provides them with your email and Facebook ID: listening data doesn't flow anywhere automatically.

A different thing is Facebook gadgets on random websites while you are logged in into Facebook.

lambda_lover• 8 years ago

Wow, I didn't know this about Spotify! Too bad there's no opt-out. I actually like the social aspect of Spotify (seeing what my friends listen to often introduces me to new bands) but it's a shame I can't limit the selling of that data. Hell, I'd even pay for the right to keep my data to myself!

juststeve3• 8 years ago

Yes I do too,

some quick searching says that spotify pays the record companies monthly, around 50-70% of revenue for the music licensing.

however there seems to be a serious distinction between free subscriptions and paid.

Because free users are getting music for free, this seems to be where the Spotify Group may be packaging up and selling data to music companies or elsewhere to pay for hosting, salaries etc.

I guess the opt out is to disconnect your facebook from spotify;

Or, create a new separate spoitify account. But, because your billing/email settings would be the same.. it's would be easy to join/coalesce the account data in the backend.

or just buy cd's

Sir_Cmpwn2• 8 years ago

Companies choosetoencrypt.com sends information to by embedding them in this page:

- Facebook

- LinkedIn

- Twitter

- Google

sheetjs• 8 years ago

Is it technically possible to add an image/link like "Find us on Twitter" without embedding anything that ultimately requests a Twitter-hosted asset?

Sir_Cmpwn2• 8 years ago

Yes, you can. But if your message is that social media networks are "privacy villians" then you shouldn't have a Twitter or a link to it in the first place.

thwarted• 8 years ago

Huh?

<a href="//twitter.com/USERNAME"><img src="twitter-dot-png">Find us on twitter</a>

And host twitter-dot-png yourself.

(edited to remove autolinking)

kakarot• 8 years ago

It is exceedingly rare in practice.

Felk• 8 years ago

Here's a screenshot of umatrix, showing that it tries to load javascript from those domains: https://imgur.com/bvZzZsX

arca_vorago2• 8 years ago

I wish webdevs would stop this bullshit yesterday.

"Bbbut, everyone does it. It's industry sop..."

godelski4• 8 years ago

I always love that argument. Because it reminds me when I was 5 and my mom said "Just because everyone else does it doesn't make it right." If your argument is one that a 5 year old is making, you might need to reconsider.

Sylos• 8 years ago

The depressing part is that there is actually somewhat of a point to that.

I despise Google, Facebook et al and I develop a webpage in my freetime for a club that I'm in. I'll gladly work an extra hour, if it means I can avoid sending data to one of those asshat companies, but it's really not as easy as it sounds.

I for example used a template to base my webpage on and that template creator chose a font, as he should, but then instead of statically embedding the font file, the guy included it by linking to Google Fonts, meaning that all of my users' browsers sent their IP and that they are visiting my webpage (as part of the HTTP Referrer) off to Google.

I found out by looking at my page with NoScript and I suppose, you could find out by looking at the network requests, too, but neither are necessarily something that a hobby webdev is going to look at.

Another time, a module decided to load JQuery off of a Google server. And incidentally, that module was installed by the guy who maintained the webpage before me, so that's another point how "everyone doing it" does actually make it harder on you.

Then we wanted to embed a map. I happened to know of OpenStreetMap, but most webdevs probably don't, because everyone's using Google Maps everywhere.

For videos, I was convinced to embed YouTube-videos, because of networking effects and such, so then I wanted to at least try to make it privacy-friendly and, you know, comply with EU law, so I put up a picture, if you clicked on that picture, it would then load in the actual YouTube player.

I was hoping to find a module that did this automatically. I found one. Exactly one, that is. And it was kind of shitty at that. So, then I had to spend not just one extra hour, but probably rather five, to try to patch that module up into a semi-usable something.

godelski4• 8 years ago

Privacy badger only lists: Twitter, Facebook, and Linkedin as trackers. Though I see that it is using google APIs, but PB doesn't think it is tracking.

Though interestingly the DDG app says "3 trackers blocked" and only shows twitter being blocked.

tzahola• 8 years ago

Hypocrites...

barbs2• 8 years ago

Completely by the by but is the scrolling on this page screwed up for anyone else? Seems to have a weird slow non-native scrolling method for me. I'm running Firefox on Android

stewofkc7• 8 years ago

Works for me. But I'm using an iPhone.

mikeleeorg• 8 years ago

Same here, using Chrome on Mac.

John_KZ2• 8 years ago

Yeah, looks like custom JS scrolling. I hate people that do this.

nielsbot• 8 years ago

It's the worst. Disabling Javascript temporarily can work around this. Or using Reader mode... Assuming the content is worth it to you.

barbs2• 8 years ago

Wow. I have no idea why they would do this, it's so much worse!

Seems to work fine in Chrome on Android though?

kromem• 8 years ago

To me it's an issue of cost vs reward.

While I would love to see greater privacy awareness and consideration from all entities I use, the fact is that there are certain web properties that I find indispensable and without a privacy considered alternative.

Facebook I can live without, likely even happier than with it. I also think that the social contract of "sell me as a product in exchange for enabling my social communication" is not the correct paradigm, and once there's a user friendly alternative similar to secure scuttlebutt (i.e. Mozilla level friendly), that best represents the proper social contract (I'll provide hardware resources to enable my social communication).

gt_• 8 years ago

That sounds nice but it’s a pipe dream.

FridgeSeal• 8 years ago

Not with that attitude.

Seriously, writing off any attempt at discussing or fixing the problem because "it's a pipe dream"/"network effect"/etc will ensure that you do end up going nowhere.

lifthrasiir• 8 years ago

A problem in this argument is that "enabling my social communication" is extremely vague and possibly negative reward compared to cost. In some sense people have been tricked into believing that "enabling my social communication" in the Facebook way is beneficial, while it might not be.

amelius3• 8 years ago

Perhaps the government should protect us more actively. It could hand us fake-ids we can use when dealing with these companies. And it could give us fake home addresses, etc. Like a witness protection program, but for everybody. And it could provide an API for sending (e)mail to real users, using their fake info. And it could set up a VPN service for everybody to mask IP addresses.

itsevrgrn• 8 years ago

gov't won't do it IMHO but could be a good startup idea

stewofkc7• 8 years ago

The internet has been a "wild west" for its entire existence. While this allowed it to grow and improve freely, it also brought about bigger issues. Government intervention could work, but the government getting involved in tech usually sucks.

amelius3• 8 years ago

the government getting involved in tech usually sucks

The internet was built by government organizations (e.g. DARPA, NSF)

thibautg2• 8 years ago

Most media criticizing Facebook run Google Analytics and many other trackers. Fortunately HN is clean, according to Privacy Badger.

stewofkc7• 8 years ago

It all comes down to profits. The media companies need the data. And I would argue that most people aren't sharing information directly with publishers on the internet, it all goes through Facebook and Google (the companies they are criticizing).

ebikelaw5• 8 years ago

This equivalence is false. Facebook’s business is selling access to your private data to third parties. Google’s business is not that. They are not the same.

CaptSpify4• 8 years ago

Google's business is tracking me despite me not wanting to be tracked. It doesn't matter what they do with that data, I don't want them to have it.

There are differences, but they aren't worth worrying about. You are still vulnerable to being abused by Google's data about you as well as Facebook's data.

kokwak• 8 years ago

Recommend this: https://books.google.com/books/about/Surveillance_Valley.htm...

davidjhall• 8 years ago

Malwarebytes flagged this page as malicious; and umatrix lists a lot of javascript from elsewhere.

notacoward2• 8 years ago

Many of us, as software developers, are taught to solve general problems instead of specific instances whenever we can. That's what I see as wrong with 99% of the commentary about this recently. Sure, there might be a bug in Facebook. Maybe it's a serious bug, and it really needs to be fixed. But it's a bug that manifests in many other places too. It's even possible that Facebook is neither the first nor the worst. Facebook doesn't have "assistants" that listen to your every word like Google and Amazon and Apple do. It doesn't have all of your email, or your entire search history, or the very OS on a device you have with you all the time. But I digress.

The real point is that targeting any "fix" too narrowly toward Facebook, or Google, or any one party doesn't fix it for the others. It might even distract from or interfere with development of a more general solution. But that's exactly the path a lot of people seem to be going. By all means, criticize Facebook if you think they've done something wrong, but don't stop there. Make sure you understand the full scope of the problem, and the options for addressing it in a general way, and the benefits or drawbacks of each approach. Progress doesn't come from everyone saying "me too" on a bug report. It comes from people talking about and then implementing ideas to make the bug stop happening anywhere. I've seen precious little of that.

pigscantfly• 8 years ago

This is a great example of the impact of the 'ruse of solvency.' A solution which appears to the public to solve a problem yet actually doesn't is oftentimes worse than no solution at all, since it will erode pressure and advocacy by convincing people that the problem is already solved. This is a tactic frequently employed by lobbyists and legislators to cool down a hot issue.

AndrewKemendo• 8 years ago

I've seen precious little of that.

In fact I don't know of any example that required a plurality of people to act, that wound up being anything but a unit fix and not a global fix for a problem.

More than likely someone will go down in flames, everyone will congratulate themselves on a job well done and then it will be business as usual for everyone else doing the same thing. Hell, I'd be surprised if Facebook even takes the hit for this one.

rdtsc• 8 years ago

It might even distract from or interfere with development of a more general solution. But that's exactly the path a lot of people seem to be going

Or it could set a precedent... It has to start somewhere. Maybe Amazon or Google is next.

Were you thinking in general about some legislation? Say something like GDPR?

Progress doesn't come from everyone saying "me too" on a bug report. It comes from people talking about and then implementing ideas to make the bug stop happening anywhere. I've seen precious little of that.

That happens if there is a common platform everything runs on. Maybe a shared library. You just fix the security bug in it and every application relying on it will benefit (generally speaking). In a way legislation, taxation, treaties, open standards are somewhat like it. When those change it affects everyone. But that is kind of rare, so doing it one instance at a time is still making some progress.

notacoward2• 8 years ago

In a way legislation, taxation, treaties, open standards are somewhat like it. When those change it affects everyone

That's the key: it affects everyone. In constitutional law there's this concept called a bill of attainder, which is a law directed toward a specific person instead of an action. Many constitutions, including that of the US, forbid them. I think any solution to these problems will be as much legislative/regulatory as technical - GDPR is an early model for this - but it has to be about the behavior. Otherwise it's just politicians playing favorites. I've seen some of the replies mention precedent as though it's a good thing, but we hardly need another precedent for the government picking winners and losers.

virgilp2• 8 years ago

Ugh. I hate these sorts of arguments. "ha! you're outraged? Maybe you're not outraged enough! You do something? Do more, you're not doing enough!". If you tell people "if you stop wasting water you don't solve global warming!" it typically won't entice them to do more; most people will hear "I might as well waste the water, my efforts are meaningless anyway".

But I digress.

Yes you do. Starting with all that makes the reader feel that "they're not even the worst offenders, Google/Apple/Amazon is probably worse". Which may be true but you present no proof for that and it's not even something that you needed to argue.

By all means, criticize Facebook if you think they've done something wrong, but don't stop there. Make sure you understand the full scope of the problem

Or stop there if you wish - it's still something. It's certainly better than thinking "I don't have time to understand the full scope, so I'll let others do the criticism".

I've seen precious little of that.

Well, lead the way. Show us how to do it. Help us understand the full scope of the problem and address it in a general way. Don't just chide people for criticising Facebook.

JimmyAustin• 8 years ago

I don't think he is arguing for more or less outrage, he just wants it directed better. I'd argue that picking out one offender and focusing on them is in some ways worse then focusing on the entire issue.

Facebook being slapped with a massive fine/being broken up might not do a lot to stop the general trading and exchange of users data online, but its enough to get the politicians to say "job done" and move onto the next issue. We need to focus on fixing the issues that allowed the FB/CA scandal to occur, instead of just focusing on the symptom.

zombieprocesses• 8 years ago

And Cambridge Analytics isn't the only election campaign "influencers". But for some reason, the focus is only on facebook and cambridge analytics.

partiallypro• 8 years ago

Probably because, and not to get too political but, the perceived slight from those two was helping Trump. Though, I don't think there is much data that supports the notion that data analytics helped Trump more than Hillary. I think the argument that Hillary's ground game was horrendous holds up more under scrutiny.

dna_polymerase• 8 years ago

What? Who would have thought?

https://prism-break.org/en/

ariwilson• 8 years ago

FYI: this article & website are plugs for the owner's "private" search engine:

https://www.searchencrypt.com/

which seems to be heavily ad-laden (e.g. searching for "free" gets you ads, which it doesn't on Google).

Facebook Is Not the Internet's Only Privacy Villain

Related Stories