Facebook scraped call, text message data for years from Android phones

https://arstechnica.com/information-technology/2018/03/facebook-scraped-call-text-message-data-for-years-from-android-phones

by node-bayarea • 8 years ago

800 201 8 years ago

arstechnica.com

sverige• 8 years ago

This is completely unsurprising. The question is whether they should be allowed to keep that data.

55555• 8 years ago

Why the hell should they be allowed to keep that data?

jakeogh10• 8 years ago

Because you gave it to them. The alternative goes right to rules that prevent everyone (not just FB) from remembering things, and ultimately more censorship.

Is it just me or has a whole generation lost the concept of personal responsibility? I don't use FB because it's been obvious for a long time this was happening, and it's an awful platform, designed to socially engineer their flock of product people.

Use products that you control. LineageOS + FDriod is a great start.

romanovcode• 8 years ago

Use GDPR soon if you are from EU. 60 days left.

mankash666• 8 years ago

Google is as much to blame here as Facebook is. It shouldn't have allowed apps with "contacts" permission to scrape sms & call logs. I hope both of them are held accountable

ziikutv2• 8 years ago

I agree but I'd generalize this to Android. It is an open source system after all.

Sylos8• 8 years ago

It is an open-source system, which is decided over purely by Google. They don't have to have any fear of being forked, so they don't have to take the open-source community's opinion into account at all.

The Custom ROMs that exist around it do not play into this. They cannot influence how shitty the ecosystem is, as that's entirely in the hand of Google.

stefan_• 8 years ago

If I run a program, I don't expect it to scrape my home folder just because technically my OS granted it permission to do so. And I don't think that is a distinction the law makes, either. Intent and explicit consent matter.

gruez4• 8 years ago

Not a fair comparison because there's no sandbox for desktop apps.

dllthomas• 8 years ago

I wonder if there's a reasonable CFAA case here...

Too• 8 years ago

While i agree with your view here i think app developers have proven over and over again that this is no longer a reasonable expectation we can have as users. We need more and stricter sandboxes for everything.

AlexandrB3• 8 years ago

If I run a program, I don't expect it to scrape my home folder just because technically my OS granted it permission to do so.

Back in the day, apps that did this were called spyware and would be forcibly removed by Antivirus/Anti-malware programs. It's incredible that Facebook gets a pass for equivalent behaviour.

ben_jones• 8 years ago

Was it just too much work for the Android team to add more granular permissions? Did they not have enough time? Enough resources?

shsuudjdjjdjs4• 8 years ago

None of the above. It is a hard UI problem to present the plethora of different features that need access control to the user such that they can meaningfully engage with each one.

For example: which of the following permissions does the Facebook app currently get on Android?

    - access Bluetooth settings
    - access nfc settings
    - view network connections

I bet you don't know off the top of your head, and I'm certain that fewer than one in a hundred users do.

This is not because Android team is lazy. All of this information is already surfaced to those who care to look, right there in the play store app. There's a spectrum of options between removing capabilities, presenting them in more detail, and providing a UI that doesn't make people's eyes glaze over. There is a constant tension among these three poles, and no matter where you are, there will be some use case that isn't served well.

helthanatos• 8 years ago

The Android permission scheme is slowly becoming more granular. I'm not sure what the reason was from the beginning to have such generic permissions. When you saw large lists of permissions on apps before marshmallow, you had to accept them all, now it requests for each on first use but I'm still not a fan of apps that want everything.

Sylos8• 8 years ago

I'm sure, there's cases where they just didn't want to have too many prompts, as that would result in people not reading them either.

But in other cases, this is also just Google that we're talking about. There's for example a presentation [1] where a Google dev introduces this new permission system and afterwards someone from the audience asks, if it's also possible to block internet access with it.

And the Google dev responds in the most innocent of ways that it doesn't need to be possible, because clearly the rest of their permission system works so flawlessly that no critical information one could want to upload to the internet would be available to apps anyways.

I know, never attribute to malice that which is adequately explained by stupidity, but it's not like the guy should be able to be this ignorant in the position that he's in. And Google does have reason to be malicious here. Without internet permission, their ads can't be displayed.

Especially the example in the video of the flashlight app is one where the permission system falls completely flat. In order to toggle the flashlight, you need to ask for full access to the camera, meaning you can take pictures as you like. And since you have internet, you can actually do something malicious with those pictures, too. Clearly, the user did not intend for their flashlight app to take pictures and much less so for it to upload them to the internet.

[1] Relevant question is at 18:07: https://www.youtube.com/watch?v=f17qe9vZ8RM

gruez4• 8 years ago

The permissions are more granular than that. There are specific permissions needed to read SMS and read call logs, but android/google play groups them into top level categories such as "SMS" and "Phone".

tanilama2• 8 years ago

I think permission to read the contact, is different than the permission to store it in your own server.

ocdtrekkie5• 8 years ago

From a technical sense it's not. If an app can read data, and an app has Internet access, it can send that data to it's server, and there's nothing your OS can really do about it if it is letting the app run arbitrary code.

Theodores• 8 years ago

I would like the option to write code that answers my phone or downloads call information or operates a switchboard etc. I don't have a current application but when faxes existed I might have wanted to automate things with an app of my own devising.

I am not a fan of operating systems that deliberately obfuscate things that could technically be done. If I was developing my mobile customer service app then I would like to develop it in such a way that it would not mysteriously fail due to some overly complicated access keys. Or to require a 'rooted' device.

I would not expect my app to be fit for the Google store though. Or any other online app store. Maybe rather than permissions it is the store and what is allowed in the store that is a problem.

kristianov• 8 years ago

Their permission requests are outrageous. That's why I refuse to install any apps from Facebook on my phone, and pollute my Facebook account with false personal data.

Fake news for fake data:)

dexterdog• 8 years ago

If you need to use Facebook on your Android phone you should be using one of the many sandbox wrapper apps that exist.

iKlsR• 8 years ago

Has anyone seen the permissions being asked for recently, games want access to contacts and to make calls. wtf?

derekp72• 8 years ago

Isn't that so they can pause / save the game when you get an incoming phone call? I recall reading that on an app once.

jsemrau2• 8 years ago

It would be fun if there were a service to create false profiles to pollute the data miners of this world.

msoad• 8 years ago

When you allow an app to access your contacts, they grab all of them and upload them to their servers. It's less severe in iOS because they can't access SMS and call logs.

helloindia• 8 years ago

I removed my phone number from Facebook profile months ago. Now and then, Facebook still asks me if "XXXXXX" is my number? Once I unintentionally linked my Facebook account with my insta account. And then I started getting follow suggestions from people in my Facebook friend list. I tried many thing to de-link the accounts. Ultimately, I created a fake Facebook account and linked it to my insta.

Once you give something to Facebook; it's never truly erased.

joering23• 8 years ago

Good story. And I bet you there are lawyers in Europe sharpening their teeth right now waiting for GDPR to kick in to send Facebook discovery letters just a minute after April 1st pass. Need popcorn and comfortable chair, as the stock is down 10%, and we've just started!!

Edit: May 25, of course.

hawaiianbrah• 8 years ago

Doesn’t it go into effect May 25?

jakeogh10• 8 years ago

I'm more than happy to see FB go down the tubes, but legislating away memory is foolish. It's part of the war on general purpose computing.

The way things are framed to make them seem good is very interesting. What if I proposed we make keeping records of past information and actors encountered illegal if they don't want you to remember, while at the same time make it trivial for the same people to waste your time by demanding free consulting?

adventured• 8 years ago

I understand the blow-back against their privacy abuses, it's well deserved (as it was in the past). However, this kind of response is just funny.

The stock is back to where it was in July. Up 100% in less than three years.

$464 billion market cap.

Things are really dire. They'll only earn $20 billion this year, growth will only be 30%+.

They only have ~$43 billion in cash right now with zero debt. That's barely enough to keep the lights on. They should shut down the business right now before they run out of money.

The speeding tickets they might one day get from the EU, could cost them hundreds of millions of dollars. But just imagine, what if it's $3 billion. I mean, it's not like Facebook can reluctantly change several of its policies while maintaining its massive 2+ billion userbase and keep right on printing money at their 50% operating income margins. Yeah, but just imagine if their operating income margins decline to only 40% because it crimps their business model by reducing the value of their ad targeting. And what if it cuts their growth rate in half? Under that scenario they might only earn $30 billion in net income in 2021. It's a rough road ahead.

The other fun part? They'll still net add global users in 2018. None of this is going to matter for the survival of their business, although it might improve user privacy around the globe and that'll be a big win.

sundvor3• 8 years ago

Oooh I've been trying for ages to kill my insta FB link. My FB app permissions is null and zilch, but FB must have secret storage of this.

I'll try that. Then kill the fake account.

thomasahle• 8 years ago

What's the point of removing the link between your Instagram and Facebook accounts? It's all stores on the same servers anyway.

wmwm• 8 years ago

I never connected my FB/Insta accounts and they were created with different email addresses entirely. Was conscious of not letting the two connect. One day my Instagram account started actively recommending my FB friends. Anybody have this experience?

koolba• 8 years ago

What’s the supposed justification for scraping text message data? I mean the contact list could be justified as a means of cross referencing friends. I’m having a hard time coming up with a legitimate use for text message data. Best I’ve got is “who do you contact regularly?” which is still insanely creepy.

augbog• 8 years ago

This is speaking speculatively but Facebook right now is heavily trying to go into Messaging AI (Messenger) and so it needs to train those AI. I'm actually kinda surprised if they foresaw that training data so early but yeah it's really creepy.

rhizome• 8 years ago

It's not hard to foresee wanting "everything" with the goal of sorting it out later, but Messenger is a no-brainer for FB if they want to continue having access to message content.

quadrangle2• 8 years ago

I think it's "This helps us orient both ad- and non-ad- content on Facebook to fit you optimally and keep you on Facebook and also figure out why people keep texting instead of using FB Messenger."

lostlogin3• 8 years ago

That’s not a justification that helps the user much though.

netsharc• 8 years ago

I never manage the address book in my email app, and when some services want your Gmail or Yahoo Mail credentials so it can import contacts, having an empty address book makes that useless. So yeah, the "clever" importers trawled through your mailboxes for the adresses. I'm guessing they thought they needed to do the same for phone contacts - which doesn't make sense because people actually manage that, although I've met one person who doesn't do that - she doesn't seem to need to know who is calling/writing her.

mortehu• 8 years ago

Isn't all of this for friend suggestions? The people you text most often are more likely to be your friends.

Other services ask you to give them your email username and password, so that they can scrape your inbox to discover your contacts. I think LinkedIn used to do this, but they appear to just use SSO with the largest providers now.

adrianmonk2• 8 years ago

Is it known yet whether they just collect metadata or collect message contents?

I can't see any justification for collecting the actual text of my messages.

But if I'm digging for justifications, I can see some benefit to me, the user, of collecting aggregate stats of who I contact regularly. It could be used to decide what content to surface in my feed. Or whose birthday to remind me of. Or which names to suggest when I create an event invite. They are a social platform, after all, so knowing who I socialize with seems relevant to making that work better.

Not that it isn't creepy, but if the question is whether there's an actual benefit to their having the data beyond just targeting ads, it's somewhat plausible.

gruez4• 8 years ago

Funny how this is popping up now (presumably because some guy noticed his call logs were in his facebook data download and tweeted about it), even though the permissions in question (described in no unecrtain terms) were in the app for years, and there was an explicit setting in the app to turn this on/off http://i.imgur.com/NRarWdh.jpg.

tylermenezes• 8 years ago

There was no explicit setting to turn this off until somewhat recently, and is addressed at the start of the article:

This screen in the Messenger application offers to conveniently track all your calls and messages. But Facebook was already doing this surreptitiously on some Android devices until October 2017, exploiting the way an older Android API handled permissions.

gruez4• 8 years ago

Regardless, the permissions were there for years.

   read your text messages (SMS or MMS)
   read call log

Was nobody able to make the inference that facebook might be uploading this stuff to their servers? Remember this was during the whole "facebook is surreptitiously listening to our conversations" fiasco.

derekp72• 8 years ago

The problem is that apps need certain permissions to perform their function. Such as a music app that needs access to the phone module, so it can pause the music when a phone call arrives. This has the effect of users not paying attention the the specific permissions, since in many cases the need for them isn't obvious.

MBCook2• 8 years ago

Why? Why doesn’t the operating system do that for them? Why is it up to individual applications to decide whether or not they want to pause music with a phone call starts?

sratner• 8 years ago

Here's another one: app needs the storage permission to attach a diagnostic log file to a bug report email. An OS that sandboxes applications should absolutely provide a way to do this without additional permissions (a file that was only ever written by the app cannot contain data not available to the app to begin with); as it is, either the user starts ignoring permission prompts because otherwise things don't work, or they deny them and the developer can't get a log file.

jsemrau2• 8 years ago

Shouldn't this be an "opt-in" discussion ?

wlesieutre2• 8 years ago

Android's permissions system for stuff like that is indefensible. Anything with severe privacy implications like "years of text message history" should explicitly opt-in with a permission request popup at runtime like iOS has done for features like camera since launch.

Of all the things to not copy from iOS, of course privacy is the one that they decide to skimp out on. I'm glad they've started to catch up, but they have a ways to go yet.

jon_richards• 8 years ago

I hate that I can't send a photo to a friend without giving facebook access to all of my photos. Where's the "just this one" option?

starik36• 8 years ago

That bugs me too. I've resorted to placing the photo on the clipboard, then paste it. A workaround, but well worth preserving your sanity.

gt640k• 8 years ago

I hope apple can make this happen

ClassyJacket2• 8 years ago

This is a huge problem that has bugged me for a long time, and is a problem on the iPhone too. It needs to be fixed.

nickpsecurity• 8 years ago

That's what PowerBoxes are designed to do in the capability-based, security model. In theory, it can happen if Android had different model.

http://www.plash.beasts.org/powerbox.html

Note: I'm using this link just to explain the concept rather than endorse anything on the site. It was top of Google results.

newnewpdro• 8 years ago

I don't understand why people don't just email photos to their friends without involving middlemen like facebook?

Don't you have your friends in a private contacts list/address book? Isn't it trivial to send a photo attached to an email? What is the problem?

Note: I do not and never have used facebook, genuinely don't understand what the deal is here.

lazycouchpotato2• 8 years ago

Custom ROM's for Android phones had this feature. You get to choose whether to allow once, allow all, deny once or deny all. I haven't used a custom ROM in a long time though so I don't know if they still have it.

wlesieutre2• 8 years ago

At least on iOS I think you can do this from the Photos app itself using the share sheet -> Messenger rather than using Messenger’s send photo button (which requires the app to get photo permissions).

I do agree it would be nice to have “Just once” on pretty much every permission dialog. Apple’s change to mandate an “Only while using the app” on location info after Uber’s location tracking fiasco was a good step in this direction.

ReverseCold• 8 years ago

This is already possible, some apps launch a file picker app (what you're supposed to do).

Instead, apps that want to steal your pictures request access to all of them.

Sylos8• 8 years ago

Applying this to contacts, too, would also make it somewhat less impossible to use WhatsApp and similar messengers legally.

If you don't know why it's illegal: WhatsApp uploads all of your contacts to their server. Granted that their ToS are not themselves ruled illegal at some point, it is on you to get a written permission from all of your contacts that they are okay with you uploading their data to WhatsApp's servers.

So, unless you block access to all of your contacts or actually ask every single one of your contacts for written permission, it's illegal. With selective contact access, you could at least attempt to only grant access to contacts that you actually did get written permission from, or I don't know, of which you know for sure that they are using WhatsApp, too.

And yes, I do love the thought of hitting on someone in a bar and then pulling out this massive form sheet to ask for their written permission, just so you can ask for their number afterwards.

oliwarner• 8 years ago

You can do this if you start from the photo (in another app) and use its share option.

pmlnr• 8 years ago

There is this thing called email.

p49k• 8 years ago

At least on iOS, you can get around this by copying/pasting the photo instead of using the sharing UI.

aj72• 8 years ago

Get it into your photo app. Or in a folder. Send it from there.

shados• 8 years ago

The first time I installed the Facebook app and saw the huge wall of permission requests (back before they had on demand permission requests and they all had to be up front), I noped out of that crap.

Never installed the facebook app on any of my phones (In the odd event I REALLY need to check a cat picture on facebook, I use the browser version). Glad I went that route.

Now though I got a Samsung phone that has the facebook app preinstalled, but I never opened it (and all the other preinstalled apps DONT have the permissions on by default...so I hope it's true of the FB app too)

virgilp• 8 years ago

You can at least disable it (which I always do)

freeone3000• 8 years ago

It does that now.

hungerstrike• 8 years ago

Uggh, I hate the “copied from iOS” meme that is popular amongst Apple zealots. As if iOS was some sort of bastion of originality.

on_and_off4• 8 years ago

That's the strength of Apple's PR.

gpmcadam• 8 years ago

Do handset manufacturers ship Facebook pre-installed? And if so, do they choose the permissions for pre-installed apps, or does the user do this on setup?

the_trapper• 8 years ago

I know that Samsung at least ships with Facebook pre-installed, and I think HTC does as well.

By pre-installed I mean impossible to uninstall without rooting and flashing a different ROM.

johnx123-up• 8 years ago

MIUI has brilliant permission mechanism for older Android version. From Lollipop, it switched to iOS like permission--and so TrueCaller like apps cannot be even opened without giving permissions.

on_and_off4• 8 years ago

How is the iOS permission system different here ?

AFAIK Android's current permission system is very similar to iOS's one with granular permissions granted at runtime for camera, contacts, etc.

noarchy• 8 years ago

The mile-long list of app permissions requested by Facebook's app should have been a red flag for most.

There are alternatives, such as using the mobile web interface, or any of the various apps that wrap the site, such as https://f-droid.org/en/packages/it.rignanese.leo.slimfaceboo...

spookyuser• 8 years ago

The app permissions should have been a red flag, except some users probably never even saw them since Facebook was pre-installed on their phones.

shubidubi• 8 years ago

I really don't get why people use the fb app. It drains your battery and privacy, not to mention the notifications. I use web app only.

TaylorAlexander• 8 years ago

This is one of the things that led me to stop using Facebook last year. In order to use the app you have to give it all manner of permissions. And of course, if Facebook can access your data they’re going to suck in as much as they can. They don’t respect you, they want to use you.

So put me in the “not surprised” category, but I’m really glad there’s more discussion of this.

renaudg• 8 years ago

I'm ex-FB and have it on good authority that this is indeed used to improve the relevance of friend suggestions (i.e. distinguish between your best friends and the plumber in your contacts). I'm also told it's opt-in, and the app dialog (not just the system dialog) does say call logs will be scraped.

But still, IMO it's an incredibly invasive, incredibly dumb thing to be doing in the current context for the small benefit it brings. I hope they wake the f* up to just how bad it makes FB look like to the outside world, and kill this feature with fire.

paulie_a• 8 years ago

I hope it is getting to the point that having Facebook on your resume should be considered a huge red flag

jeswin• 8 years ago

People had been running untrusted apps in the browser and collaborating over the internet for more than two decades now. Mobile OSes threw out all the safety lessons codified into web browsers and built an entirely new permissions model. A decade later, here we are - there are hundreds of companies holding varying levels of access to your entire contacts list, text messages, GPS data, photos and other media. And all of them will hold on to it for eternity.

I for one, am glad web apps are making a comeback. Now I use web apps wherever possible, fully aware that I can't do anything about what's already been shared.

foobaw• 8 years ago

From my insider source, I'm told that permissions will change significantly in the near future.

Just FYI: a lot of other apps also utilize the same permission. Just an aside but Google also has the authority to whitelist certain applications for these permissions - meaning they can enable certain invasive permissions without asking the users.

We shouldn't just vilify Facebook. It was how the privacy framework was designed for Android that's the issue. This will change in the next upcoming versions.

nashashmi• 8 years ago

Yawn! We knew this was happening for years. FB scraped data for one purpose only: To figure out who your close friends were offline. And they wanted all sorts of information that could indicate closeness. From location data that would show how often you meet up together and how long you hang out. To phone call and sms data.

Now a lot of that data is dead data. Like it has no use after a couple of years. But just like Google cookie having an expiration date of 20 years, FB just does not know when that data becomes irrelevant.

FB and zuck have this manifest dream of figuring out connections and then figuring out the strength of those connections. Then they want to figure out social relevance. Then they want to use that info to bind people together on their platform. It is not a bad idea overall, until you add in government and corporate entities.

And by that time you know how evil of a thing you signed up for.

daveheq• 8 years ago

MySpace allowed viruses on their platform; Facebook IS the virus.

johnnyOnTheSpot• 8 years ago

What has changed at facebook to create all this negative feedback?

tmuir2• 8 years ago

The richness of the irony in your question makes me wonder about your level of sarcasm.

On one hand, its pretty reasonable to say that absolutely nothing changed at facebook. We are all witnessing the effects of latency.

On the other hand, the change(s) that has ushered in this uptick in negative opinions in regards to Facebook will likely be the source of vigorous debate for some time.

For one, this is just the latest example of habitual behavior on Facebooks part, selling third parties more access to personal data than the persons referenced are comfortable with. The response every single time has been for Facebook to say roughly "We agree in principle that we slightly messed up, and as our more than adequate self imposed penance, we will solve this problem in secrecy with the completely untested technology that we've been working super hard on ever since we discovered this problem 2 years ago, but only acknowledged publicly as a strategic move when no better alternative existed to preserve our viability as a corporation".

Additionally, the data subjects do not generally understand the power imbued to the purchaser of that data at the point they give away that data. Further, they possibly are giving up the legal right to any privacy stemming from what that data may tell third parties.

In the context of all of these generally nebulous problems, is the growing news story involving Cambridge Analytica's alleged use of Facebook's data, the Presidents use of both of those, and the extent to which it can be argued that voter outreach crosses a line in to deceptive psychological manipulation.

Its what folks in scientific fields refer to as evidence that supports, as opposed to weakens, a falsifiable hypothesis.

burfog• 8 years ago

Users need to be able to mislead the apps.

Right now, an app can force a choice: enable all the permissions, or you don't get to use the app. Users need to be able to feed fake data into the app. For example, maybe Facebook should think I am spending my time with Bill Gates in Bhutan. Users should be able to install dishonesty plugins to generate this data.

Yoric• 8 years ago

I realize that it's too late to cry over spilled milk, but that was one of the reasons for which Firefox OS was developed. We wanted to push a different permission model in which permissions were much more fine-grained and could be audited and revoked easily. Sadly, one of the reactions of the development community (including HN commenters) at the time was along the lines of "Android is just fine".

I understand that recent versions of Android have moved towards adopting a permission model closer to that of Firefox OS, though, and I suspect that the example given by Firefox OS at least showed that it was possible.

P.S.: Yes, Firefox OS had other problems. Let's not try and idealize the past :)

deftturtle2• 8 years ago

BRING BACK FIREFOX OS

on_and_off4• 8 years ago

and revoked easily .

I don't see how revoking permissions solve that problem. Once an app has scraped your info, you can revoke it's permissions all you want, it is not going to delete your data from its server.

aj72• 8 years ago

Is this possible with IOS? Or for people who have never shared their contacts with Facebook?

deftturtle2• 8 years ago

I already suspected this due to getting more posts from my friends based on who I texted, and they were Android users. It's fucking annoying. Also, using the same wifi network leads to getting friend suggestions

fencepost• 8 years ago

I'll throw in another place where permissions aren't nearly granular enough - online file storage (Dropbox, Onedrive, Box.com, etc.). Perhaps I'd like to allow an app to save information for cross-platform use or just because I want it on my own personal cloud storage - 1Password's older versions are a great example of this. I haven't looked at it recently, but I'm not aware of any changes that add that level of granularity to the APIs.

What throws me is that I'd expect security conscious developers to be clamoring for this. If I'm writing an app that should store data for users on the user's own accounts, it's not "I do not want to have access to everything" it's "I do want to NOT have access to everything."

Facebook scraped call, text message data for years from Android phones

Related Stories