Facebook Reveals New Security Settings Amid Privacy Concerns

https://www.bloomberg.com/news/articles/2018-03-28/facebook-announces-new-security-settings-amid-privacy-concerns

by lambda_lover • 8 years ago

58 62 8 years ago

Who is ever going to trust that these settings actually do anything except for the button animation after the previous two weeks of privacy disaster for Facebook?

Probably most of the country, actually. =\

Mark my words, their stock price goes right back to $180 over the next two weeks.

djohnston2• 8 years ago

people who don't wear tinfoil hats

jimejim• 8 years ago

That's kind of a silly comment when we have proof that Facebook's poor design lead to abuse.

pessimizer• 8 years ago

or read the newspaper

dleslie• 8 years ago

Facebook users are still the product, and information about them is still what brings Facebook revenue.

Let's say a user makes these settings as strict as feasible, but only some or none of their contacts do the same; in that, the default and common case, the information about the concerned user may still exist in some form.

kennu3• 8 years ago

What's really needed is a way to delete old data in batches, like "delete everything I've posted over 1 year ago".

Currently you have to delete thousands of individual items (like played Spotify songs) one-by-one, using a tediously slow and inconvenient UI that individually confirms each delete.

atonse• 8 years ago

I actually started researching this. How come someone hasn't built an app that uses the Graph API to delete these things for you?

Even a delete script on Github. I just haven't found anything. Or do the APIs just not exist?

The best I found were Greasemonkey scripts, and I'm just not going to do that.

kennu3• 8 years ago

I believe Facebook's Graph API intentionally does not support DELETE actions. I've had best success with a Chrome plugin called Social Book Post Manager, but it's not particularly fast or reliable either. At least it's able to delete something.

cobrabyte• 8 years ago

Check out the 'Social Book Post Manager' Chrome extension. It automates the deletion of posts.

https://chrome.google.com/webstore/detail/social-book-post-m...

kennu3• 8 years ago

It's better than nothing (I've been using it for a while), but it has trouble handling confirmation dialogs unless you keep the browser window in the foreground. Also it seems to miss quite a lot of posts.

It would really be so much better if Facebook was forced to implement batch delete in their API and/or in their UI.

kerng• 8 years ago

This. A real simple deletion feature where stuff is truly gone would be awesome.

I would much prefer a feature where the user can define what gets deleted when via a policy setting in the profile, and when posting you could also modify the default (delete in 12 hours, next year, after x people read it, whatever...)

conductr• 8 years ago

I kind of don't get this. But this is why I've never really been into SM. Just cause they make a shiny deletion UI and your stuff appears to be truly gone... as in, never reappear visibly ... this makes you trust them that is actually truly gone?

makecheck• 8 years ago

The “tedious to delete, by design” approach crosses all companies (create account = 1 click, delete account = call this number between the hours of 1:15 and 1:16 on Tuesdays and wait half an hour to speak to a representative, enduring their sales pitches first).

There should be a simple law: the mechanism for deletion of any user data must be no more complex than its creation.

It would also be nice to have deletion terms always specified at point of creation, e.g. “bookmark this link to remove what you’re about to create”.

parliament323• 8 years ago

the mechanism for deletion of any user data must be no more complex than its creation

I don't think that'd work too well... indeed, it's already in place. You can create a single post with one click, you can delete a single post with one click. I guess we're looking for "batch deletion".

hw2• 8 years ago

There should also be an easier way to let apps that you've connected to with Facebook before know to delete any information they gathered from you from Facebook.

Deleting data in Facebook itself isn't enough when there are apps out there that could have siphoned your personal data and details. Going through each app one by one and contacting them to delete your data is just painful and usually falls on deaf ears.

ibdf• 8 years ago

Some apps don't even provide a way to delete data or even delete your account. Some people that I have contacted about deleting my account on their app even told me that they never built such functionality. Facebook is on the news because it's a big target, but it happens everywhere.

g_p2• 8 years ago

There should be a simple law: the mechanism for deletion of any user data must be no more complex than its creation.

That's one of the nice points of GDPR, albeit around withdrawal of consent. It must be "as easy to withdraw as to give consent".

That prevents the "call or fax us to cancel consent, but give it via a single tick-box on sign-up that you can never change". Deletion is a right under GDPR; although there's no specification it must be as simple as to create (as at very least you likely want some kind of simple confirmation before losing something).

avoidit• 8 years ago

It looks like just the dark UX patterns of Facebook can be used to write an entire book today. Not that the other companies are any better in this regard.

johnflan• 8 years ago

To delete an item from your timeline from recollection there are three clicks involved - once of which I am pretty damn certain is blocked based on a timer in the back end. The Http request takes like three seconds to complete every time.

uabstraction• 8 years ago

"Unsafe at any feed"

rabboRubble• 8 years ago

There is a solution for that, in a Chrome extension called Social Book Post Manager.

jonahhorowitz• 8 years ago

The real question is: will they let me delete all the call logs, address books, and SMS data they've scraped off my android phones over the years? If they do, will it actually be deleted? How long will it take to be removed from all backups?

rmc• 8 years ago

GDPR comes in in May. That's the interesting development

azinman2• 8 years ago

What’s gdpr

rock_hard• 8 years ago

The answer is: Yes, as soon as you opt out of sharing this information FB will delete it

ggregoire• 8 years ago

Nothing is deleted, it's only a boolean in a table.

FilterSweep• 8 years ago

"IsDeleted"'s existence is the biggest lie tech companies tell media government and consumers alike.

mtgx• 8 years ago

Again, it wasn't "amid privacy concerns". It was because they were trying to be compliant with EU's upcoming GDPR regulation:

https://www.reuters.com/article/us-facebook-sandberg-privacy...

glbrew• 8 years ago

The real problem is data collected about you from other people. For example all of my lesser friends install the android facebook app which gives them tons of information about me from my interactions with them. I need a way to tell facebook to delete and not collect data about me from other people's devices.

macspoofing2• 8 years ago

Here's a good security/privacy option: Provide a fully featured HTML5 app (specifically one that allows you to access the inbox). Then there is no reason to install the native app or messenger.

intrasight• 8 years ago

I only use my browser to use FB. But I don't message with Messenger - I use phone's native text message feature.

macspoofing2• 8 years ago

I'd still like to access the Facebook Inbox when I'm on my phone and using the Facebook web page. Right now it forces you to the messenger native app.

aylmao4• 8 years ago

http://mbasic.facebook.com

Doesn't seem to work on iOS (at least on iOS 11, it redirects to the normal mobile site that asks you to install Messenger) but it works on Android.

grinsekatze2• 8 years ago

Even if they offered a delete button any time before GDPR comes into effect I would not trust and use it. I also don't like the idea of using one of those chrome extensions mentioned here. To me, currently this is synonymous to hiding everything they have on me from myself.

But doing this after May 25 would mean I definitely want it gone for good and if they don't fully delete what I manually remove, I expect them to get themselves into trouble.

g_p2• 8 years ago

But doing this after May 25 would mean I definitely want it gone for good and if they don't fully delete what I manually remove, I expect them to get themselves into trouble.

You're technically right here, but it seems at present that most companies won't be complying with this for quite some time (perhaps an opportunity for some litigations?)

Backups appear to be the "black hole" in GDPR, as nobody spent the 2 years actually planning and preparing. Therefore, most people I've spoken to are planning to simply add a "gdpr_deleted" flag to each row in the database, and set it to true when it happens. They don't return those rows in queries. The inter-dependent nature of many databases (you shared a post with 10 users, you delete your account now, FB wants to retain the view records), coupled with nobody taking GDPR seriously until the last minute, means we'll likely see "soft deletes" for quite some time.

It would be interesting though to make a GDPR request to companies for data held specifically on backups, and held in databases records that would normally not be shown (i.e. these hidden records), as that could get them in trouble if you could prove they lied!

greenleafjacob• 8 years ago

Backups appear to be the "black hole" in GDPR

To delete backed up data, first encrypt the data with a key. To delete the data, delete the encryption key, leaving your "backed up data" meaningless bits.

lukewrites• 8 years ago

They absolutely did not "reveal new security settings" – they revamped the security settings menu & page. From the article:

Facebook announced on Wednesday that it’s redesigning the settings menu on mobile devices, consolidating privacy options in one place, rather than sending users to some 20 different screens

There is no indication in the article that they are allowing users more control over their data, and fb remain free to do what they will with your data once you sign up for their service.

This does nothing to resolve the problem that people are up in arms about:

Under the revamp, users still won’t be able to delete data that they had given third-party apps on the platform previously, even if it was used for reasons other than what was agreed to. That data, generated over years of games and personality quizzes that had access to private information, is largely still stored outside of Facebook’s grasp by the private individuals and companies that built those applications.

TheSpiceIsLife• 8 years ago

users still won’t be able to delete data that they had given third-party apps ... is largely still stored outside of Facebook’s grasp by the private individuals and companies that built those applications.

I don't believe it's possible to resolve that problem.

lambda_lover• 8 years ago

It's pathetic to see a slight decrease in dark UX referred to as "new security settings". Oh, so they moved some stuff around in the settings menu? Call me back when they actually give you a link to delete your profile (seriously, there is none in the settings. There's only "deactivate" and "delete your profile after you die" -- even though both of those appear in a "delete" section.

"New Security Settings" implies that I'm given options I didn't have before. That does not seem to be the case here.

galieos_ghost• 8 years ago

What's amazing to me is how the media can stir the public into a fever pitch with such ease. I've told people about FB and Google data collection for years and nobody cared, at least not until the talking heads told them to care.

What FB does is innocuous compared to the CIA vault7 leaks, and yet the media shoved that down the memory hole. The real question is why is this being pushed now when literally of this has been public info for years?

parliament323• 8 years ago

It's just part of the media machine. FB is currently the "bad guy" so any media agency who can push the narrative is rewarded with more user attention. This has a huge snowball effect and will result in FB getting hammered into the ground until a more interesting antagonist comes around.

Another interesting "bad guy" right now is Russia -- justified or not, notice how media outlets are trying their hardest to find any Russian links whatsoever to every bit of political news, even things completely unrelated. For instance, try searching for "cambridge analytica russia" and look at the number of results.

aylmao4• 8 years ago

I've told people about FB and Google data collection for years and nobody cared, at least not until the talking heads told them to care.
What FB does is innocuous compared to the CIA vault7 leaks, and yet the media shoved that down the memory hole.

But it's Facebook controlling your mind! They know what you like and can manipulate you with that! \s

The real question is why is this being pushed now when literally of this has been public info for years?

I have a theory it's the recent shift in Newsfeed reducing news and increasing friend's posts. It was reported earlier that there were tensions between Zukerberg and Murdoch over ad revenue [1]. Wouldn't surprise me if other media magnates feel the same way.

[1] https://www.cnbc.com/2018/02/12/facebook-rupert-murdoch-thre...

feelin_googley• 8 years ago

"The Facebook Privacy Setting That Doesn't Do Anything at All

'I really can't make sense of it.'

Gergely Biczok, CrySys Lab"

https://www.wired.com/story/facebook-privacy-setting-doesnt-...

benevol• 8 years ago

F#ck the hypocrites at Facebook. That's all.

quadrangle• 8 years ago

What I want is to download my history including the external links I posted. But they seem to not include that stuff. I'm sure they tracked which links I posted, but they don't consider that part of the private data I'd own in any way, so it's not there in the download. Which I means I can't find that article I stupidly posted to FB and forgot to bookmark otherwise…

bogomipz• 8 years ago

"“Last week showed how much more work we need to do to enforce our policies and help people understand how Facebook works and the choices they have over their data,” Facebook Chief Privacy Officer Erin Egan and Deputy General Counsel Ashlie Beringer wrote.

Facebook Chief Privacy Officer. Now there's a job title.

Seriously what does a Chief Privacy Officer at FB do? What are the responsibilities of a Privacy Officer at a company whose entire existence is predicated on their users having no privacy? Here's 15 years worth of their boss's views on privacy:

https://www.cnbc.com/2018/03/21/facebook-ceo-mark-zuckerberg...

nopacience• 8 years ago

Something curious about facebook is, they let anyone access user profile/pages (or whatever it is called), so visitor can see the user profile picture and might be able to see other stuff. Facebook "protects" the privacy of the "visitor" because the user cannot see what visitors have visited their profiles.

So, users have no privacy, but visitors have their privacy protected.

Facebook should list "who" visited user profiles. I dont know why they dont do this already. And even more, they could somehow list what photos the visitor chose to see, how long visitor stayed on user profile, which 'full resolution pictures' visitor had downloaded. If they only saw thumbnails then no need to list, but if visitor made the effort to download all full resolution user pictures then the owner of those pictures should be able to see who has downloaded them.

So this way, the user would be able to see how frequently visitor X, Y, Z has stayed on their profiles, and how many/which full res pictures they have downloaded/seen.

If the user profile is not a person, but a store, then the store would be able to benefit from this data and send some message saying "We noticed you have been visiting us lately, and you seem to have a lot of intrest in product X. Do you want to know the price or make an offer?"

Or, if the user is a person and has seen weird behaviour from weird users, then user would be able to take precautions.

So in the end, the user profiles are public and have no privacy. But the visitors/consumer of other people profiles can snoop on other lifes and have their privacy protected because the page they visited is never able to know they have been visited by visitor X Ntimes.

aylmao4• 8 years ago

This is a pretty interesting proposition. I'm personally not a fan of the store idea --I'd rather be able to visit business pages anonymously and not get messages from them-- but I actually think seeing who has seen your profile could be a good idea, especially in the realm of the picture download/viewing.

eezurr• 8 years ago

I dont see FB implementing that because the more information people have about how their profiles are viewed (and used), the more it's going to polarize their user base.

I think people will fall under two categories.

Group 1: They want attention, followers, etc. Facebook becomes more like Instagram (which is redundant)

Group 2: They want privacy and a place to connect with peers, but that "profile use" knowledge will prevent them from sharing their lives on Facebook further more.

Also, I think people have the right to view publicly posted information and photos without being monitored by the poster. Information overload, irrational responses, reactionary culture, and all that.

Facebook Reveals New Security Settings Amid Privacy Concerns

Related Stories