Facebook Is Giving Advertisers Access To Your Shadow Contact Information

https://gizmodo.com/facebook-is-giving-advertisers-access-to-your-shadow-co-1828476051

by dhotson • 8 years ago

1359 454 8 years ago

tomlock• 8 years ago

I'm surprised people didn't know this... this has been happening for at least 4 years through custom audiences. An advertiser can upload a list of mobile numbers or email addresses to target people.

lmedinas• 8 years ago

Actually this should be an act of "good faith" where you are adding a layer of security to your account and not about making even more harm to your account.

senectus1• 8 years ago

https://www.gizmodo.com.au/2018/09/facebook-is-giving-advert...

hnzix• 8 years ago

The reason I never give fb my mobile is if you use a pseudonym account, it will suggest your profile as a friend to anyone who has your mobile in their phone contact list (eg ex-partners, stalkers, employers, drug dealers). Found that one out the hard way.

I know Zuck wants me to preemptively upload my nudes, but still.

black_puppydog• 8 years ago

Lucky you already have your account. These days you can sign up for one without a phone number, but then you flat-out can't sign in without giving one.

lysp• 8 years ago

You can even do a search by mobile number, by typing a mobile number into the search without pressing enter.

Depending on the owner's security settings, Facebook will often suggest the profile of the person in the type-aheaded search results.

muglug• 8 years ago

I believe they removed this feature a couple of months ago.

rickdg• 8 years ago

FB's terms of service do not allow pseudonym accounts.

paulie_a• 8 years ago

Do people honestly give a shit about terms of service?

ageitgey• 8 years ago

This is basically how FBI Director Comey's secret Instagram account (and thus Twitter account) was unmasked. But it was even worse - you are suggested to 3rd party people who just follow the people who know you: https://gizmodo.com/this-is-almost-certainly-james-comey-s-t...

ninit3• 8 years ago

Yep, something similar I discovered recently that if you sign up to Instagram with somebody's email that they use on Facebook then within a day or two you'll start to see all of their friends from Facebook whom are also on Instagram in your recommended follows. All of this happens without email verification..

denzil_correa3• 8 years ago

The reason I never give fb my mobile

Here's the issue with it. You might not give it but your friends would. Therefore, this strategy is pretty useless as network effects kick in.

tumetab13• 8 years ago

TIP which I discovered by accident: create a bogus account with your phone number.

Facebook will remove the phone number from your account when you do that. You can also use that to check who are your friend who gave FB your phone number.

unquietcode• 8 years ago

Facebook gonna Facebook. It's long past time to consider regulation of an ethically bankrupt corporation.

Symbiote• 8 years ago

"four months ago" they stopped requiring it for 2FA, that's the time GDPR came in.

I wonder if Facebook acts differently for European users?

everdev3• 8 years ago

Why have costly government regulation when users can just quit?

Plenty of other online and offline ways to connect with the people in your life.

lumberjack• 8 years ago

Users cannot "just quit". Facebook probably has a profile for my grandma who never touched a PC in her whole life.

epicide4• 8 years ago

Why have costly government regulation when people can just not breathe polluted air?

There are some things users/people did not sign up for and cannot (reasonably) opt out of that still harm them. This is what regulations are for.

bryanrasmussen2• 8 years ago

you generally don't regulate companies, but whole industries. Then you punish companies for breaking the industry regulations.

Yetanfou• 8 years ago

No regulation needed, just avoid using their 'services' and block anything facebook at the point of access. They might keep 'shadow profiles' and use facial recognition to find you on images posted by others but if you keep them out of your network they can have a ball trying to target their advertising at that closed door.

Not that I allow any advertising here, mind you - everything is blocked at the router (ipset [1] comes in handy here), at the client and in the browser. This works at home as well as abroad since I route all my data through a VPN (OpenVPN) terminating at my router.

[1] http://ipset.netfilter.org

pimmen3• 8 years ago

Then it definitely sounds like regulation is required, the vast majority of Facebook's users don't know how to do all that. The public should not have to protect themselves from unethical companies, the companies should have to stop with their unethical behavior lest the government shuts them down.

Drawn to its logical extreme, you don't need regulation to be protected from racketeering if you run a restaurant either, you can just hire private security and arm yourself.

a_imho2• 8 years ago

It would be really surprising if that was a facebook only thing. For starters Google pesters me at least as much to add my phone number to secure my account.

tialaramex2• 8 years ago

I think it will stop pestering you for a phone number if you give it some neutral second factor like a Security Key ?

(Security Keys are actually way more anonymous than I'd even thought possible until I understood how they work, if you know Susie uses the same key for DropBox and GitHub, and you suspect Susie also uses this key for the account NumberOneSecretTrumpFan on GitHub, and then you steal all the account credentials from GitHub somehow, this doesn't end up being enough to verify that Susie has the same key as NumberOneSecretTrumpFan, nor is it enough to sign into Susie's DropBox account, and unless GitHub's data includes the backup passphrases or whatever it's not even enough to sign into GitHub as Susie, NumberOneSecretTrumpFan, or any other Security Key user...)

jarfil2• 8 years ago

Phone numbers were not a secure 2FA anyway, and I've been using the TOTP alternative since it's been available... but I don't really see a problem with them using whatever to show "more relevant ads", if you don't want ads just use an ad blocker.

cecja• 8 years ago

Can you link me the Ad Blocker for text messages?

hjek2• 8 years ago

If you're running android, it has a word-based spam-filter[0]. But it does look like phone number blocking is a more common solution.

[0] https://www.quora.com/Which-is-the-best-app-in-Android-for-b...

xg15• 8 years ago

What if the more relevant ads are robocalls like in this case?

lozaning• 8 years ago

Who is still answering phone calls on their cell from numbers not in their contact book? If you call me and you're not in my phone my phones just dumps you direct to voicemail.

Not excuse this behavior in the least, but robo calls in general are a solved problem for me.

underwater• 8 years ago

Likewise, passwords fail to protect against a whole class of attacks. I don’t know why Facebook still uses them.

jarfil2• 8 years ago

Phone numbers fail against remote third party undetectable attacks with O(1) complexity. You'd have to use a password like "1234" to fail like that.

anonytrary2• 8 years ago

"Give me as much service as you can while keeping me as far off the grid as possible" is a skill that is sorely lacking in this market. I don't have this problem with weed dealers, but I have this problem with information dealers. Internet companies could seriously learn a thing or two from the black market on how you treat your customers.

tanto• 8 years ago

Does your weed dealer provide the service for free? If you want to be treated as a $$$ paying customer start paying. Problem with social networks and $$$ is that network effects will not come into effect as not everyone will be willing to pay.

There are actually ethical information dealers but they require you to pay them as you are paying your weed dealer.

tokyodude• 8 years ago

I'm probably wrong but I feel like there's a market for an ethical advertiser that does no tracking and placed ads by content only. is that impossible? it was reality until the 90s

Isn0gud• 8 years ago

I mean, if you give a $$$ option instead of giving up data than you removed the intended targets of most ads out of your advertising pool.

hazz992• 8 years ago

I'm sure it's possible to advertise without tracking. We did it for years.

fouric2• 8 years ago

Most internet service companies, including Facebook and Google, don't give you the option of paying for privacy even if you wanted to.

stallmanite• 8 years ago

So if I pay GM for a car they won't data-mine me? Just yesterday on HN we learned that this is not the case. Why do you think companies wont take your money and then proceed to sell your data anyway?

dbt00• 8 years ago

I mean, I've paid both Comcast and Verizon a lot of money for internet access, and they both have done awful, privacy-shattering things while I've paid them. (Subverting DNS, X-UIDH header, etc).

Once there's money on the table, companies are going to take it and assume the number of customers who walk away aren't enough to offset the profits.

mjevans2• 8 years ago

That battle has already been lost; between a complete lack of at least semi-anonymous banking (I.E. GNU's Teller, well see notes), ad behamoths, "credit" companies (Experian, etc), and all sorts of proprietary social platforms having a majority of the market roped in: there's a shadow profile in one sense or another for everyone short of the crazy cabin in the wilderness types.

A focus on consumer rights, protections, and building difficult to defraud and difficult to exploit consumers systems is where effort needs to be spent.

* GNU Taler - A digital cash / micro-transaction system that hopes to be audit-able for tax and other legal reasons while still being anonymous for consumers.

Please read about privacy, verifiable in the right ways, and the "operational in 2018" claim

https://taler.net/en/index.html

https://en.wikipedia.org/wiki/Micropayment#GNU_Taler

anilakar• 8 years ago

This is exactly the kind of abuse that GDPR is designed to curtail.

rikkus2• 8 years ago

Yes using information for a purpose other than it was collected for. Hopefully this means in Europe we won’t see this spam.

afandian2• 8 years ago

Hopefully? Hopefully this means we will see facebook employees faceing criminal charges!

TheGrumpyBrit• 8 years ago

Don't count on it. From the Gizmodo article:

I’ve been trying to get Facebook to disclose shadow contact information to users for almost a year now. But it has even refused to disclose these shadow details to users in Europe, where privacy law is stronger and explicitly requires companies to tell users what data it has on them. A UK resident named Rob Blackie has been asking Facebook to hand over his shadow contact information for months, but Facebook told him it’s part of “confidential” algorithms, and “we are not in a position to provide you the precise details of our algorithms.”

amelius• 8 years ago

Small question: how do you prove it, adequately for a court of law?

I imagine that to prove it, you'd have to make several accounts, with several phone numbers, and somehow demonstrate to a judge that the information leaks through. Not an easy task.

tumetab13• 8 years ago

It's "easy".

1. Ask for the judges phone number 2. Register new account with judges phone number (clean browser, no friends added or pages liked) 3. See friend recommendations from the judge in this new FB profile.

icebraining3• 8 years ago

The GDPR is not applied by courts, but by regulators, who are tasked with investigating just that sort of thing. Courts may come later, if the company disputes, I think.

dredmorbius4• 8 years ago

Canaries.

http://canarytokens.org/generate

dwighttk3• 8 years ago

does GDPR talk about hashes of emails, or just emails? (or mobile numbers or whatever)

ummonk• 8 years ago

As a security engineer, I cannot overstate just how horrible this is. Phone numbers might not be an ideal 2nd factor for authentication, but to punish users for setting up 2FA by using the provided phone number for ad targetting is incredibly unethical.

qrbLPHiKpiux3• 8 years ago

I never heard of this company when I did a monitor.firefox.com search of my work address.

Exactis Breach date:June 1, 2018 Compromised accounts:131,577,763

tumetab13• 8 years ago

https://haveibeenpwned.com/PwnedWebsites

Compromised data: Credit status information, Dates of birth, Education levels, Email addresses, Ethnicities, Family structure, Financial investments, Genders, Home ownership statuses, Income levels, IP addresses, Marital statuses, Names, Net worths, Occupations, Personal interests, Phone numbers, Physical addresses, Religions, Spoken languages

cmroanirgo3• 8 years ago

I agree with your sentiment.

But, as someone who understands that not all people and companies use the same moral set as myself, this is why I've never set up 2fa using a phone.

Why should I give some company my phone number? Increasingly it's become a single point of metadata to uniquely describe myself (just as my email addresses have).

otachack• 8 years ago

You don't have to but it's the most user-friendly, although flawed, method of enabling 2FA. They could have easily used a software token but that requires non-tech savvy users to download a 3rd party authentication app, as well as understand the basic usage. Why do that when users can simply get a text sent on a method they most likely have?

jsjohnst6• 8 years ago

just as my email addresses have

That doesn’t need to be the case though with just a little bit of effort and minimal cost. Use your own domain for email and set your account to be a catchall. Then use facebook.com@yourdomain.tld and your email address is no longer a cross site unique identifier.

TangoTrotFox2• 8 years ago

It's also something that people should have expected. I don't understand how people have not noticed that all of the major sites that generate revenue through user profiling and advertising have been pushing hard for users to either be obligated to register using their phone, or to setup a two factor authentication using their phone when it's not necessary for registration.

The reason I say it's something people should have expected is because if people were more critical of the things asked of them, then things like this would never get off the ground. Instead, because people do not seem inclined to naturally believe that corporations might have ulterior motives, such practice has become common place and on some sites even mandatory.

rchaud• 8 years ago

Instead, because people do not seem inclined to naturally believe that corporations might have ulterior motives

People worship at the altar of success, and there aren't many relatively new companies as profitable as FB. That's not to say that these companies don't spend significant coin in pushing their inane message of "we're connecting the world" wherever they can. And mass media for the most part go along with it, mostly focusing on the stock price, rarely bothering to examine how FB makes its money and what tradeoffs that comes with.

gammateam• 8 years ago

It is unethical and negligent to force people to use SMS 2fa without any other alternative

It is OBVIOUSLY for ad targeting, I think I mentioned it not even two weeks ago: https://news.ycombinator.com/item?id=18020177

samstave2• 8 years ago

Somewhere in the bowels of FB is the product manager who feels like a smug genius for coming up with this 'feature'.

kevin_b_er2• 8 years ago

Ethics do not matter vs profit, so long as the elected representatives can be properly paid off and the public lied to that regulation is always bad.

propman• 8 years ago

There has to be a reason Facebook reminds me 50 times (yes 50 times) a year to put my phone number in for security reasons. That’s extremely unethical tbh and then I can’t recall if this is true because I’ve stopped using Facebook but I’m 80% sure they then filled out my phone number and just wanted me to confirm it.

matz1• 8 years ago

I'm using adblock, how does this affect me ?

dymk• 8 years ago

How is a difference in how ads are targeted a punishment?

mojuba2• 8 years ago

Another personal observation. I have an Instagram account that I thought was fully incognito. I never connected it to any other social account, I used a separate email for authentication etc. Just days after the Instagram founders left Facebook I started receiving friend suggestion on my IG that were very very relevant. Those were people I knew in real life and mostly connected via Facebook but not only. I shouldn't be surprized as being connected to the Internet by itself is an end to your privacy but still, this was probably the spookiest invasion into my privacy so far. Bye-bye Instagram.

krn2• 8 years ago

Haven't you used the same web browser for both, Facebook and Instagram? They might just be sharing cookies.

mariusmg• 8 years ago

Well, Instagram and FB being 2 separate domains , they shouldn't (in theory at least) be able to access each others cookies in browser. The tracking is most likley still server side based.

Based on what the OP is writing, the unique identifier foe the user can even be the IP address...

ezoe2• 8 years ago

Are you sure you didn't access it from the same IP address? There are so many fingerprints you are willingly sending to the public.

mojuba2• 8 years ago

I did of course, how could I not access both from the same IP. The bottom line is: a property owner is a property owner even if it comes to separate domain names.

amirmc• 8 years ago

‘Willingly’? I think unwittingly is more likely.

helloindia• 8 years ago

This happened to me after Facebook acquired Instagram. I had my mobile no in Instagram profile. Instagram cross-referenced my mobile with my Whatsapp contact list(I haven't given Instagram access to my iPhone contacts). I suddenly got suggestions to follow my colleagues on Insta. Colleagues with whom I interact only on Whatsapp. Since then my trust level in Instagram,Facebook & Whatsapp has gone into negative.

mooman219• 8 years ago

Definitely location tracking of some sort. IP, location data from the browser (if allowed), and scraping photo metadata can all lead to them associating people.

qrbLPHiKpiux3• 8 years ago

This is a perfect example of the need for physical comparmentation. Separate devices never connected through the same internet service. As far as devices go, to think you have separated “anything” on only one device, you’re living in fantasyland.

fghtr• 8 years ago

Qubes OS disagrees with you here.

pixl97• 8 years ago

If the app can look at your wireless, even that is not enough. It can just make a map of the SSID/BSSID around you.

jzl2• 8 years ago

IP address commonality is probably a major part of this, so using separate devices only helps if they are on different carriers and you never use wifi AND you don't allow location services or practically any other permissions.

With a single device, it's fairly reliable to use a vpn or multiple vpn providers and only log in to each account when connected to a given vpn.

oedmarap• 8 years ago

When I was in another country on a business trip I bought a temporary local SIM, originally valid for two weeks but I've kept it active as I travel there often.

I used that foreign number to create my Instagram account and I've gotten the benefit of only being shown suggested accounts from locals from that country (zero people I know). Same goes for ads as well. Currently I keep it on roaming and actually use it to verify other online services that may stubbornly require SMS.

Might be worth a try for those of you looking to pseudo-opt-out of phone number tracking & recommendations on social media services that do this, if you can get your hands on one.

bilbo0s• 8 years ago

Just as a warning to anyone who might try this, it won't work. (At least not without a massive amount of opsec effort expended on your side.)

I'll give you an example of why it might not work. Since your phone has roaming, you happen to have it with you at work, or at a party, or at the library, or anywhere really. If even a single acquaintance of yours is "nearby", the information is leaked. If acquaintances seem to always be "nearby", children, wives, husbands, siblings, your info is DEFINITELY leaked.

If anyone is going to try to use this strategy for anything which might result in the loss of your livelihood, (eg - porn), please realize there are many, many, many more precautions you will have to take than are listed in oedfmarap's comment. If you just do what you see in that comment, you could find yourself without a job somewhere down the line.

finnjohnsen2• 8 years ago

I've seen this, and concluded that friend suggestions must use GPS to see who I am near on a regular basis.

aurbano• 8 years ago

This is absolutely true, when I moved to London a few years ago, I rented a room in a house with 3 other housemates I had never met.

Within 1-2 days, Facebook recommended one of them as a friend - bear in mind I hadn't added any of them to Fb, so all it could have used was our location...

rubatuga• 8 years ago

I’ve seen this happen with YouTube, specifically this video: https://youtu.be/bKgf5PaBzyg

I had watched it many many years ago, and I suddenly remembered about it while at my friends apartment, (which is in the same building). Now I searched it up on my friends computer which was logged into his gmail account. We watched it and laughed. However, an hour later, I was on my iPhone at home when it appeared in my related videos.

http://i.imgur.com/u31ZuWM.jpg

I refreshed and it was gone...

kerng• 8 years ago

Again? Weren't they called out on this about half a year ago already? Did they continue doing this? How irresponsible and total lack of any ethical standard. Its horrible but mostly just sad that users are just a commodity to make profit. So let's trick them to sign up for 2FA to pretend they have more security and then we can send them nice little ads. What a bad company this has become.

usrusr3• 8 years ago

The other really stupid thing, besides generally hurting the adoption of 2FA forever, is that they probably did it for hardly more than scraps, compared to their conventional add targeting capabilities.

Maybe I am completely wrong about this, but I'm pretty convinced that almost all of the ad spending for that feature would have reached Facebook's coffers anyways had it not been available.

neotek• 8 years ago

At Facebook's scale even the scraps can be worth millions.

And the sad truth is that the vast majority of people will not be deterred by, be aware of, or even understand the fact that Facebook is abusing their phone number in this way, so as far as Facebook is concerned it's a small bump in the long road to increased profitability.

usrusr3• 8 years ago

At Facebook's scale even the scraps can be worth millions.

Sure, but the same is true about negative headlines, the effect is just more difficult to quantify.

Maybe it's a general world view problem within Facebook, but usually these things are the result of one overly ambitious person or group optimizing the singular bonus metric of their own little fiefdom at the cost of corporation-wide commons. Big organizations need to be extremely vigilant in their defense against internal foes who won't blink an eye costing the company billions for a gain of millions add long as the latter will be attributed to them while the former won't.

philipodonnell2• 8 years ago

"Millions" is still scraps to a company with the scale of Facebook

blake_himself• 8 years ago

An ever increasing craving for an ever diminishing pleasure is the formula. It is more certain; and it's better style. To get the man's soul and give him nothing in return -that is what really gladdens our Father's(0) heart. - C.S. Lewis, senior demon to a junior, 'Screwtape Letters'. (0) Satan

buboard• 8 years ago

Same can be said about personally-targeted advertising in general. Really, how more effective is it?

usrusr3• 8 years ago

For exotic niche products, incredibly. On Facebook, you can advertise to golfers who don't subscribe to a golf magazine. This is new and valuable (to everybody except the publishers of golf magazines, who suddenly have to face competition in golf-specific ad-spending). But if you are selling washing detergents, even the tiniest premium for targeted over untargeted would be a waste.

tajen• 8 years ago

I didn’t give facebook my phone, my email has timed out (and facebook knows it, it deactivated my email) and I forgot my password, more or less intentionally. So the only thing tying me to Facebook is my browser cookie. I have to say, I’m surprised I’ve been able to keep this account open for years in this state, it’s almost as if they really wanted me to stay. But it’s possible to keep a facebook account alive with no accurate contact information.

a_imho2• 8 years ago

When people suggested phone 2fa was a data collection scheme they were hushed and called tinfoils.

Freak_NL• 8 years ago

People still do that when you point out that using a phone number as a required identifier (WhatsApp, Signal, etc.) gives every 'free' service a near perfect unique identifier that's the same for all services used by that person. Ideal for cross-service collation.

Who wants a social security number when you've got someone's phone number?

baarkerlounger• 8 years ago

Except that a phone number is as quickly and easily disposable and changeable as an email address or any other identifier?

probably_wrong• 8 years ago

While I share the sentiment, I think I should be fair to HN: according to a quick search I've just performed, I brought up the topic 4 times in comments over 3 years, and those comments have scores of 7, -4, 16, and 3 [1][2][3][4]. So saying that I was "hushed and called tinfoil" would not be fair to HN.

[1] https://news.ycombinator.com/item?id=17515029

[2] https://news.ycombinator.com/item?id=14105696

[3] https://news.ycombinator.com/item?id=12782158

[4] https://news.ycombinator.com/item?id=9804876

Spearchucker• 8 years ago

All my personal details on Facebook are (and have always been) false. My phone number is the number of a hotel in Monte Carlo. When Facebook nagged me to give them my mobile number for 2fa I ignored them. My friends thought I was crazy. I know it's not exactly gracious of me but feeling very self righteous right about now.

FilterSweep2• 8 years ago

Your friends also gave Facebook your actual phone number too....

Facebook app abuses your phones internal Contacts API.

Effectively, you are linked and your main Facebook account is known to be a pseudonym already

Loughla• 8 years ago

So you're stuffing it full of false data, but still connected to people who aren't stuffing it full of false data?

That seems like a lot of effort for no real payoff.

epicide4• 8 years ago

This is basically the only reason I don't "delete" my Facebook account. I have so many family members and friends that I cannot realistically prevent putting pictures and the like about me on Facebook.

At least I can see some of what Facebook has about me instead of none.

happybuy• 8 years ago

This should have been obvious for anyone who is paying attention.

When data collection and advertising companies such as Facebook (and Google) push a feature actually beneficial to users so aggressively – such as 2FA – during the sign-up process; you'd have to be naive to think it's for your benefit.

It's not 2007 any more... tech savvy users should know better than to trust such organisations with any scrap of additional personal information than absolutely necessary.

type04• 8 years ago

Tech savvy or not, really there's no way any current fb user would be concerned with it nowdays and they will continue to rat you out to the fb apparatus. You know how they say "ignorance is a bliss".

anoplus• 8 years ago

Sadly, I believe Facebook will truly respect their users in the face of backlash.

yesenadam• 8 years ago

Lately FB says when I go on there "Add a profile pic so people know who you are". Huh? I've always one.

pndy• 8 years ago

Ha! I'm being constantly nagged whenever I visit fb (to see if those who can't live anymore without it, didn't want something etc.) to update my details - which I removed long ago; among that, they sometimes "suggest" updating new profile pic, which I haven't change since end of 2014 - when I stopped wasting time there

denzil_correa3• 8 years ago

The worst part about these updates is that you have two options - "Yes" and "Not Now". The "No" option doesn't exist in their dictionary.

ddebernardy• 8 years ago

The url should point to the Gizmodo article; not the sensationalizing tweet.

https://gizmodo.com/facebook-is-giving-advertisers-access-to...

The actual story is FB enriching your profile with shadow contact information about you when you or third parties provide it with details it wasn't aware about yet. For instance when a friend of yours has your landline number in their address book and gives FB access to the latter; or when an advertiser provides FB with the same as part of targeting an ad campaign.

B-Con2• 8 years ago

Is this any surprise? Just a few hours ago the Acton article on the front page[0] talked about them doing this in WhatsApp:

Later he learned that elsewhere in Facebook, there were “plans and technologies to blend data.” Specifically, Facebook could use the 128-bit string of numbers assigned to each phone as a kind of bridge between accounts. The other method was phone-number matching, or pinpointing Facebook accounts with phone numbers and matching them to WhatsApp accounts with the same phone number.
Within 18 months, a new WhatsApp terms of service linked the accounts and made Acton look like a liar.

Companies like this, and Facebook in particular, are desperate to connect identities. Phone numbers are an incredibly useful way to do so. Most people only have a couple of them, their re-use rate is slow, they get entered into forms all over the place, and they're usually valid (because they were provided as a primary method of contact).

In this case advertisers have an identity (and phone number), Facebook wants to match on that value. They're going to do it any way they can.

It may not be ethical, but the carrot is right there and it's naive to think you can give them your identifying number and they're going to turn a blind eye to it.

[0] https://news.ycombinator.com/item?id=18074690

close042• 8 years ago

Wasn't one of the conditions to get the deal approved by EU regulators to NOT share any data between services? [0] Did they just restart it because they found reprieve or simply decided to ignore the regulation?

Edit. Also this [1]. Does GDPR suddenly open the door for sharing this data "legitimately"?

[0] https://www.ft.com/content/951d650e-abf5-11e6-9cb3-bb8207902...

[1] https://www.theguardian.com/technology/2018/mar/14/whatsapp-...

mtgx3• 8 years ago

I remember FB doing that with WhatsApp at least 6-9 months before announcing it officially and pushing the new "terms of service."

It's a shame the EU didn't punish them more severely over that, because they were basically already using the feature without mentioning it in their ToS for almost a year, if not longer.

Illniyar• 8 years ago

Oh, that's troubling. Not the fact that they are adding 2FA phone numbers to their collected data, but rather that custom audience is a thing.

I thought they were taking pains to limit the ability to directly target individuals. They limited audience size to at least 1000 people previously when doing regular targeting.

How is it that I've never heard of custom audience until now?

dalbasal• 8 years ago

They limited as targetting to 1,000 people because (a) people were using it in very noticeably creepy ways, highlighting thing FB wanted less attention on and (b) it wasn't making money. Targeting 1 person is not the advertising business.

Custom audiences though, is why FB are profitable. The platform before those tools were intriduced (5-8 yes ago) made a lot less.

macpete• 8 years ago

That‘s what happens when you give a dog a bone

vezycash• 8 years ago

On android, if messenger handles SMS, FB knows how much you have in the bank and your transactions.

saiya-jin• 8 years ago

having any FB-developed app on your phone is a serious mistake in the first place

CalRobert• 8 years ago

It's a mistake many people make just by buying a phone. I had an HTC M8 and liked it except that they made it absolutely impossible to remove FB until I flashed Lineage on to it.

icebraining3• 8 years ago

How so? Do you get your transactions by SMS??

gruez2• 8 years ago

maybe not by default, but if you have transaction notifications delivered through SMS, it's possible

tjoff3• 8 years ago

I guess EU users should be fine? GDPR is a masterpiece.

I actually assume that they violate GDPR, but GDPR gives users a sliver of chance to fight back.

newscracker• 8 years ago

The situation is such that this is what's expected of Facebook. It would be a shocker if Facebook didn't do this. Actually, it's quite surprising that it took so long to do this.

Bottom line, Facebook will devalue you as a human and invade your privacy in any manner possible for as long as it can withstand legal pressures and get away with paltry fines. Obviously, all these measures are to provide users with a better experience. That's Facebook's DNA.

anfilt3• 8 years ago

Honestly, I hate how many 2FA systems want you to use a phone number. There are other ways that are much better.

snarfy• 8 years ago

Everybody punts security issues from identification to the next guy. Eventually the only safeguard left between you and the bad guys is a minimum wage salesman working at the t-mobile counter. It's sad to know that all of your primary email addresses, with links to online shopping accounts with credit cards, bank accounts, etc, can all be accessed by spoofing your phone number.

anfilt3• 8 years ago

I honestly wish sites would use client side certs or auth via a private key.

qwerty456127• 8 years ago

Wait? Did somebody ever doubt this? I always believed collecting phone numbers for their marketing needs is exactly the reason why do any of the social networks ever introduce SMS auth.

type04• 8 years ago

Orwells final warning is chilling and beautiful, in a some kind of perverse metaphorical sense it's strangely relevant to the future of the Brave new world that we are "faced with":

https://www.youtube.com/watch?v=SIoAX5bI6S0

edit: typo

tremon• 8 years ago

George Orwell didn't write Brave New World, though.

type04• 8 years ago

I haven't said that he did, I just meant things probably won't be completely Orwellian.

subbz• 8 years ago

Facebook (probably) using everything possible for ad targeting

boraturant• 8 years ago

As an FB Marketing API developer, this has been available for several years . The way it works, advertisers can send their phone list to FB for ad targeting. However, phone hashes are sent, not clear ones.

Personally, as long as the user has an opt-out and opt-in options, I don’t think ad targeting is necessarily an unethical pattern, the blurring lines of ads and recommendations would be actually a pattern that users might like. Would you rather use Netflix or Spotify without recommendation engine?

oneeyedpigeon• 8 years ago

Speaking as someone who hasn't used facebook in years, I think it's awkward trying to compare it with netflix/spotify. The latter are narrowly-focussed, with a clear target for recommendvertising - i.e. I am viewing a film or listening to music, the case for suggesting another is pretty good, and useful. That's very different from, for example, recommending a product to me when I'm viewing my friends' photos.

FabHK• 8 years ago

Also, one pays for Netflix, and there are no ads. They try to give you, the user/customer, a better experience, so that more users/customers sign up and pay.

Needless to say, Facebook's goals and incentives are very different.

hjek2• 8 years ago

I disagree. Blurring the lines between ads and recommendations is super creepy[0].

Anyway, I still upvoted your comment, because it's interesting to read what someone working at FB has to say on this.

[0] https://readwrite.com/2012/12/11/why-are-dead-people-liking-...

EDIT: Images seem to be missing from the original link, so here is an archived version: https://web.archive.org/web/https://readwrite.com/2012/12/11...

jstanley• 8 years ago

However, phone hashes are sent, not clear ones.

The space of phone numbers is small enough that this is not a significant consideration.

Fri21Sep• 8 years ago

"No worries we hashed IP adresses"

pjc50• 8 years ago

Advertising destroys reccomendations. Suddenly it's not based on any genuine attempt to work out what the user might like but only what benefits the margins of the advertiser. This is why Google's adverts are in a separate box at the top, un-mingled with the search results.

pmlnr• 8 years ago

Would you rather use Netflix or Spotify without recommendation engine?

Hell yes.

Related artists per track, that would be more, than enough.

mattlondon• 8 years ago

Thanks for the info - didn't think of this angle (i.e. advertising sending a list of numbers to target, and facebook tying that to their cookie ID they have on you). There I was wondering how this works in a browser since browsers don't know your phones number (right?).

Would you rather use Netflix or Spotify without recommendation engine?

100% yes.

Personally for me the term "personalisation" is becoming a dirty word and I am becoming uneasy when I hear it mentioned in design docs and product launches etc. I dont want to see what some algorithm thinks I want to see. Instead I would prefer to see the real, unfiltered, unfettered data. I think the whole Fake News outcry started me thinking about it in a more deep way.

Imagine if you went into a fancy restaurant for some special occasion and the waiter took a look at you as you walked in and brought you a "special" menu based on some decision they made silently in their own head about what they think you want. Rightly you'd want to see the full menu and not just what they think you want to see. Sure I'd welcome them pointing out some highlights on the menu, but I'd apprecaite seeing the whole thing before making up my own mind.

As a result now I use DuckDuckGo exclusively and have Firefox set up with Google Container[1] to keep the Google cookies separate from everything else (I dont use facebook at all so their cookies are entirely blocked as 3rd party) as well as the usual uBlock Origin, privacy badger et al. I am even toying with the idea of moving away from my gmail that I've been using since 2004/05.

1 - https://addons.mozilla.org/en-US/firefox/addon/google-contai...

3945494• 8 years ago

Personally for me the term "personalisation" is becoming a dirty word and I am becoming uneasy when I hear it mentioned in design docs and product launches etc. I dont want to see what some algorithm thinks I want to see. Instead I would prefer to see the real, unfiltered, unfettered data. I think the whole Fake News outcry started me thinking about it in a more deep way.

That's also a corruption of the meaning of "personalisation." Personalisation is about me making choices to adapt a product to my preferences, it's not about the product making choices about how to interact with me.

Real personalisation would be having the (sticky) option to shut the algorithm off and "see the real, unfiltered, unfettered data."

fivre• 8 years ago

However, phone hashes are sent, not clear ones.

Somehow, the knowledge that the efforts to tie every trace of my existence together to help marketers target ads to me are done in a cryptographically secure fashion is not entirely comforting.

In general, I have been unimpressed with recommendation engines of any sort. Spotify can't suggest music I'd like worth a damn, and it's working within a relatively specific domain. Whatever fractional gains in ad relevance are currently obtained from this aren't worth the privacy invasions needed to obtain them.

ric2b2• 8 years ago

are done in a cryptographically secure fashion is not entirely comforting.

It's not even cryptographically secure, a phone number is like a 10 digit number that isn't even completely random because of area codes, trivially brute-forceable.

aaaaaaaaaab• 8 years ago

However, phone hashes are sent, not clear ones.

Lol! Phone numbers have less than 40 bits of entropy, it's trivial to break those hashes.

dredmorbius4• 8 years ago

Salt them.

stordoff• 8 years ago

Would you rather use Netflix or Spotify without recommendation engine?

I'd rather it didn't have a recommendation engine. I'm fed up with it trying to get me to watch something else - I'd rather it just stay out of my way.

ric2b2• 8 years ago

However, phone hashes are sent, not clear ones.

A 10-digit number is only 10 billion possibilities, much less if you consider that they aren't completely random and have area codes, etc.

You can probably brute-force a hash of a phone number in seconds to minutes _on a CPU_.

psykus• 8 years ago

You'll notice whenever you get the banner to add a phone number for 2FA, it says "add your phone number for additional security and more"

daemin2• 8 years ago

I also hate how all the social media apps want to grab your address book to "see who else you know on here". They all do it.

uptown• 8 years ago

And even if you don't do it ... chances are a friend of your already has so your contact info is already burned.

JetSpiegel• 8 years ago

At least on recent Android you can deny it. The UI doesn't support it and you need to resort to hacks such as https://whatsappwithoutcontact.com/

EZ-E• 8 years ago

Does this affects Facebook's "Account Kit"? (toolkit that provides login/register by SMS to third party apps)

_Microft• 8 years ago

I had my mobile phone-number appear pre-filled in an add-your-number-to-your-account prompt on Facebook's mobile website while I never provided it in any way to Facebook myself (in the meaning of: neither added it to my account nor mentioned it ever on the website; I never used their apps at all either) . They had farmed it from one of my contacts adressbook obviously. Not surprising that they'd do that but still a disconcerting feeling to actually see it happen.

philipodonnell2• 8 years ago

TBF that might ave been your browser doing the pre-filling.

akerro2• 8 years ago

I'm in a wired situation, I opened my facebook account with a phone number, not email, my username is phone number I had ~5 years ago. I lost the sim card ~4.5 years ago, so since then I still use the same login. Every time I login facebook asks me to update my phone number because it's no longer valid, so they probably know it's been recycled and someone else owns the number. Another thing... a year ago, I got a new sim card with new phone number again (I change my number every 1-2 years), and since that time I can't use this phone number to setup 2FA because... someone else on Facebook has this number in their profile!

batuhanicoz• 8 years ago

It's admittedly off topic but if you don't mind me asking, what are the reasons for you to change your number every 1-2 years? Doesn't that complicate things with past clients, old friends and maybe even with family?

I changed my number 3 years ago but I still keep my old number active because it occasionally gets calls or text from past contacts.

akerro2• 8 years ago

I don't use phones for communication, I much more relay on emails. My friend and family know how to contact me and they know that my phone number might stop working any time. I don't give phone numbers to clients, as I don't want to be disturbed when they want something, instead I respond to emails when I have time.

tempodox• 8 years ago

Is anybody still surprised that everything FB touches ends up being an unethical swamp?

throwaway122378• 8 years ago

One would think they’ve learned and will stop. On the other hand, they’ve been getting away with this type of behaviour so WHY STOP

magicalhippo• 8 years ago

It's also entirely what I expected, hence why I haven't given Facebook my number. Not sure why anyone is surprised by this to be honest.

josho• 8 years ago

If I recall correctly creating a Facebook account today requires a phone number. So, consider yourself lucky that you have the option to protect that bit of yourself.

asaph2• 8 years ago

Facebook probably knows your phone number anyway because your friends have likely shared their phone's contacts with Facebook.

ddeck2• 8 years ago

Or if you use Whatsapp. Their privacy policy makes this pretty clear:

As part of the Facebook family of companies, WhatsApp receives information from, and shares information with, this family of companies. We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings. This includes helping improve infrastructure and delivery systems, understanding how our Services or theirs are used, securing systems, and fighting spam, abuse, or infringement activities. Facebook and the other companies in the Facebook family also may use information from us to improve your experiences within their services such as making product suggestions (for example, of friends or connections, or of interesting content) and showing relevant offers and ads.

Bizarrely, whilst general everywhere else, the policy specifically calls out banner ads to make it clear that they won't use them until they do, at which point they'll stop saying they don't:

No Third-Party Banner Ads. We do not allow third-party banner ads on WhatsApp. We have no intention to introduce them, but if we ever do, we will update this policy.

https://www.whatsapp.com/legal/#privacy-policy-affiliated-co...

FilterSweep2• 8 years ago

The second one person with your phone number as a contact downloads the Facebook malware app, they have given Facebook your phone number.

pard68• 8 years ago

I work in sysops. Our user base is larger 40+ year olds. It has taken us nearly two years to convince our users to use a phone or email for password resets. We are now moving to 2fa and this sort of stuff only hurts the industry.

pilif2• 8 years ago

Didn't we have this discussion already earlier this year and they told us it was an unfortunate bug and that it has been fixed?

Yes. Yes. We did: https://www.theverge.com/2018/2/16/17022162/facebook-two-fac...

darthoctopus• 8 years ago

not relevant

pilif2• 8 years ago

I think it is relevant: back in february they made us believe that them using 2FA phone numbers for marketing purposes was a bug and today we learn that them using 2FA phone numbers for marketing purposes is a feature.

So either they lied in February or they have changed their minds. Either way, I think there is value to bring this very similar discussion back to our minds.

mtgx3• 8 years ago

Google has been pushing SMS 2FA a little more aggressively over the past couple of years, too. And I think Apple made it "easier to use SMS 2FA" in iOS 12 for the same reason.

I also said before that this is exactly why Facebook wanted to "verify people's faces for security purposes", too. It just seemed so obvious to me that Facebook would use security as an excuse to get people to put their own 100% accurate face scans into Facebook. It's also because Facebook used the same excuse with the shadow tracking (it's for your own good!), which is as ridiculous as Google claiming Analytics is for website visitors' own good.

matwood• 8 years ago

And I think Apple made it "easier to use SMS 2FA" in iOS 12 for the same reason.

Wait. You think Apple is selling your phone number to advertisers?

jeromegv• 8 years ago

That person is confusing different things.

Apple is making it easier to use SMS 2FA in iOS 12 (automated copy paste)

However Apple itself doesn’t use SMS for 2FA.

As for Apple they had your phone number since the launch of the iPhone (!). Never needed 2FA to know it.

And no, Apple isn’t selling your phone number.

TangoTrotFox2• 8 years ago

Information and data is the modern day 'gold'. There's much more value to tying an account to something that with negligible doubt identifies them than just selling it to advertisers. It lets you create sophisticated models and track and model users' behavior across services, and even outside the digital domain.

There are also extrinsic benefits outside advertising. Apple, for instance, is also a member of PRISM and one can only imagine how many other surveillance programs across the world that remain classified. Companies are undoubtedly 'compensated' for their involvement in these programs, and the more information they have and can gain - the more valuable their participation would be seen as.

This conflict of interest is why I think we will never see any sort of significant guarantee of privacy at the federal level in the US. The more information companies obtain, the more information the government has access to.

spr1ted• 8 years ago

People of multiple platforms dislike me for discrediting facebook. Simply talking about facts and what they could expect. They think they know it all. Some corps are good some are evil. People tend to forget that an evil person could also be your most trusted and reliable one. I work as a cyber security engineer and the things i have see flying by are crazy. The fact that information is sold without you4 knowledge is real. Its a dark world out there in disguise.

da024• 8 years ago

What are some crazy things you've seen?

krageon3• 8 years ago

You don't need his crazy stories, really. All you need to do is accept that Facebook isn't behaving exceptionally poorly, this is industry standard. Lo and behold - the entire sector is suddenly a cesspool of disrespect and money grabbing at the cost of your data, your privacy, anything they will be able to get away with. And they can get away with a lot, because you are not allowed to talk when you work anywhere. On pain of basically having your life ruined.

sambull• 8 years ago

Not related to private data but I've seen a bank shadow fund a project to get the mortgage review packages of a competitor to run through their models and test them out, also giving this one bank all the data on the mortgage packages and the scores. A really big bank did this to two others BIG lenders (one lender directly related to the federal government). We were instructed to turn a blind eye and the business model was exfiltrating info to a different lending institution while the auspice is we were only building a product as a service. My personal opinion is ALL your data is being sold. Every single bit that can be collected will be sold with no protections, regulations.

fosco2• 8 years ago

What can we do about it? I realize this is probably not answerable in this thread but I find myself asking this question more frequently lately and I still cannot answer it.

would be happy to see this discussion split into an Ask HN: or other, I think this topic should be debated quite a bit more than it is with the goal of attaining real results on fixing these issues.

jzl2• 8 years ago

Simple: delete your Facebook account. Many of us already have. Nothing will send a stronger message than people doing this en masse. Even if they don't get the message or don't care, it's the only way to protect yourself from their never-ending privacy violations.

_jal• 8 years ago

Same thing we are currently doing about it. Keep talking.

FB and similar surveillance shops thrive because people let them. People let them, primarily, because humans instinctually follow a safety-in-numbers model - FB just couldn't be that bad, or someone would have done something about it. That is likely the most clever/evil hack - FB flips this instinct on its head.

So keep telling people the truth about FB. It is a tacky AOL 2.0 panopticon optimized to manipulate you in the name of your friends and family. The company routinely lies about their practices, the CEO gives all appearances of being an untrustworthy weasel, and they're more interested in growth than the damage (up to and including facilitating mob violence!) they're doing.

And: the net is a big place. FB is a big corner of it, but unless you'd also think living inside a Walmart is a great idea, there's a lot out there that you're missing.

It took years, but I've gotten some family members to stop using them.

dangrover• 8 years ago

Inaccurate headline. Being targetable is different than them "giving access" to the information. The actual information is not shared with anyone.

megous• 8 years ago

Though you can probably gat at least an IP address, and if you create a nice looking fake e-shop with something your target may want, ... they may give you the rest.

Phishing ads on FB may be less obvious than sending them a phishing link over e-mail.

pishpash2• 8 years ago

Correlation is information. People are slowly beginning to learn that basic information theoretic fact.

WA• 8 years ago

No surprise. But what can one do? Btw this is definitely not GDPR-compliant, because consent isn’t given for using the phone number this way.

I feel helpless, even though GDPR is in place.

d--b• 8 years ago

"Why did you never join facebook?" they used to ask me.

ravenstine• 8 years ago

I talked with the lead engineers from a company back in 2014, that shall remain nameless, that bought private profile data from Facebook, ran it through a bunch of algorithmic mumbo jumbo, and sold the aggregated data to marketing firms. They acted like this was really cool and awesome, much like the wide-eyed cultists. It was very creepy, and I backed away slowly even though this place was looking for more engineers.

This kind of thing has been going on forever, and I've told people this. 99% of people don't actually care, though.

avivo• 8 years ago

Are you sure the "private profile data" wasn't aggregated before it was sold? Either way, selling private data is not something Facebook is actually known to do much (outside of misunderstandings by confused activists/journalists). If you contact me (info in profile) I'm very curious to understand more.

pimmen3• 8 years ago

Maybe they bought it from someone violating the terms of setting up a Facebook app? I can't stress that this shit's illegal but I also can't stress how the Cambridge Analytica scandal showed that Facebook had almost no way of regulating this.

tambourine_man• 8 years ago

At what point are people going to stop being surprised by news like this?

That’s their business model, it’s what they do. If you use it, treat all data as public. Otherwise, don’t.

css2• 8 years ago

A spokesman also told us that users can opt out of this ad-based repurposing of their security digits by not using phone number based 2FA.

That's one way to encourage people to use 2FA App, I guess.

jandrese2• 8 years ago

Note however that to enable any other type of 2FA you first have to give them your phone number. You can delete your phone number afterward, but it's too late, they have seen everything.

css2• 8 years ago

Interesting, thanks for letting me know. I don't have an account. I understand _why_ they require you to verify a phone number though, for the exact reason this article explains.

Mankrik• 8 years ago

Well it won't matter once you change your number, but nobody should have to consciously think about doing that because the company you gave it to is using it for non-user account security purposes.

dwighttk3• 8 years ago

can you actually "opt out" of that number being used or is the spokesperson just saying "we don't get your number via this method if you never give it to us via this method"

I.e. if you switch from using a 2FA phone number to using the app do they stop using that phone number in your facebook profile? And your shadow profile?

SilasX• 8 years ago

Yeah, but it looks like it still doesn't work if you switch to the app after having given them your phone number for 2FA. The sentence that follows your quote says:

>(Albeit, the company only added the ability to do non-mobile phone based 2FA back in May, so anyone before then was all outta luck.)

bigtyy• 8 years ago

I believe that for us to wait for our governments to have to make regulations around our privacy and data is overly optimistic. Since companies like Google and FB exist on a global market the only way to truly bring about any real changes is to take away the very thing that they're looking for, and that's our use of said services. As someone that works daily with the general public trying to educate them on the safety and use of their technology, I often ask what their feelings are on the subject of companies like FB and Google selling their data to anyone willing to pay for it. The response I get the vast majority of the time is that they aren't doing anything illegal so why would they care? My response to that is "Would you let strangers walk into your house and dig through your personal items?". Every time i get the same response. "Of course not!" Well in my mind this is no different. I've read a lot of suggestions on what we feel government should do to regulate these things but we need face facts here. Society is addicted to many of these services. The simple solution would be to just STOP USING THEIR SERVICES. There are alternatives to both of those services. We now know that the data being collected and sold has the potential of revealing information that could be used maliciously against us, and we complain about what's going on. But then many people turn right around and continue to use the free service. I truly feel that this isn't totally an issue with government regulation as much as it an issue with the vast majority of its users being completely addicted to it. If we want to truly make any kind of impact we need to take personal responsibility for these things. And not only that, but as people that are knowledgeable on these topics we need to educate those non-technical people around us just what it is they're giving up when they click Accept on their EULA's and privacy agreements. As much as I dislike what FB and Google are doing at the end of the day they are counting on the fact that the general public won't spend even 30 seconds reading these agreements. If users care so little about the fact that they're making a legally binding agreement why would FB and Google? Most are so concerned with getting access to whatever service they're attempting to gain access to that they just click the accept button with little or no thought about what it is they're agreeing to. Government can't be expected to do our thinking for us.

chadash• 8 years ago

I'm not sure I understand what's going on here and the article doesn't really explain. What does it mean that they are "using your 2FA phone number"? It doesn't seem like they are texting ads to people. Are they just using the area code to determine where you live?

NiekvdMaas3• 8 years ago

No, they are using the phone number for "custom audience" targeting, where advertisers upload lists of phone numbers of users to target.

idunno246• 8 years ago

Multiple devices and linking them to a single person is an active area of development. Say your phone you’ve never signed into Facebook on safari, so Facebook won’t know what account it is. But you sign into some other service that you give it your phone. Since phone is pretty uniquely identifying, the two companies share info and thus Facebook knows that safari browser is you and can track everything you do to your account.

p49k• 8 years ago

Advertisers can upload lists of phone numbers that represent people they want to see their ads. Facebook matches those up with your 2FA phone number to show you those ads.

adpirz2• 8 years ago

What's facebook's boiling point? My guess is they'll respond, they'll no longer use 2FA #'s for ads, the damage will have been done, and 99% of the population won't know any of it occurred. We'll repeat this cycle when a fresh revelation occurs months from now, as facebook continues to test how much they can leverage for more ad revenue.

But none of it is actually slowing FB down. Its biggest dip in value came from decelerating growth and spending to make FB more user-friendly, so there's a clear disconnect between shareholder incentives and those of the general populace.

On top of that, most people remain unaware that FB owns both WhatsApp and IG, and while the departures of their top brass have made waves in these circles, it's not a concern for most.

I don't see FB's dominance relenting any time soon, though I wish it would.

secfirstmd• 8 years ago

As someone who has occasionally runs experiments with FB adverts for various types of business. I feel it's boiling point will be when people and organisations advertising on the platform really start to look deeply into the value for money they are getting on it. I can't tell you the amount of times I've seen organisations throw money at it in return for dubious clicks from markets they never targeted, bot like users and poor really ROI after advertising with it.

gcb02• 8 years ago

from that egoistically lawless point of view, they will do better on each privacy violation that gets reported as it signal better return for the investment of advertisers.

NiekvdMaas3• 8 years ago

Are you hinting that FB advertisers are throwing 50 billion (expected 2018 revenue) at ads that are poorly performing? Obviously that is not correct, the result of all this detailed targeting is campaigns that are performing very well for experienced marketeers.

close042• 8 years ago

So... not anytime soon? As long as FB has real and active users advertisers will advertise and throw money at them.

loceng3• 8 years ago

I mean, Facebook tricked advertisers initially into spending 100s of millions into the platform (if not billions?) with their bait and switch of telling advertisers they'd "own" the users that liked their pages - and people still trust them even with that starting pointing to keep advertising? It's strange to me.

mbesto• 8 years ago

People have been doing this for years on Google's platform and the behaviors still haven't changed (I have a lot of hands-on experience with $100k+ annual ad spend budgets that are atrocious), so I disagree. People set it and forget it (mainly to ad ops agencies who charge 10%), because they don't know any different as long as sales keep coming in.

mjevans2• 8 years ago

This is how I feel about ads in general.

The only type of ad that makes sense to me at all is one that educates someone about a class of problem and that there's at least one product (X) that can be used to solve this problem.

In many cases it would make more sense to focus these efforts on making stores more effective at presenting solutions and grouping related solutions in expected areas to improve the search effectiveness of independent agents that have black box algorithms and are outside of the store's control.

Attempting to modify said black boxes by an inundation of annoyances is ethnically wrong to me. (As implied above, when it ceases being educational it's increasingly likely to cross that line, particularly if the campaign is based on gimmicks or repetition to be effective in vulnerable population segments.)

mmatear• 8 years ago

My problem is how easy it is to "fake" advertising. As in I go to website browse and buy then I get ads after about said product. Is that counted as evidence of a successful add sale?

dillondoyle2• 8 years ago

Buying digital advertising is big part of my job. I find the exact opposite to be true. FB provides high quality, low fraud. Especially compared to anything that's not Google/FB.

When we advertise to raise money (for politicians) that provides a direct provable ROI and I can tell you nothing else has come close. Seems that is true for many corporations as well just look at FBs growing revenue. FB provides the tools to measure either a sale or the value of an app install over time the increased spend is proof of quality/value so clearly many others have also found success. I wonder who/what/how your campaigns didn't provide value?

gonmf• 8 years ago

I think platforms like Facebook depend on being "cool" over some demographic. Then other demographics adopt it, time passes, other demographics grow tired of the same old Facebook look their parents also used, and Facebook starts to die. We've seen this as well with other social networks like hi5, myspace, that once dominated entire continents as the preferred social website. Of course they are smart and competent people so they will try to prevent it, and it seems to have lasted longer and left a bigger mark already, but still; I'm sure a lot of people around the world already share the sentiment of "not doing anything on FB", and just keeping it open for messenger chat.

klez• 8 years ago

I see what you mean, but I'm under the impression that Facebook is not "your father's social network" in that it's not even comparable to what MySpace was, neither in numbers nor in qualities.

What I mean is that we are comparing two different beasts, so I'm not sure "it happened to MySpace" is a good telltale sign of what will eventually happen to Facebook.

malaysanghi• 8 years ago

This is why acquisitions such as IG and WhatsApp are crucial. If they purchase the next cool thing, they never really go out of fashion. FB has gone from throwing sheep at your friends to this. I don't think they are stopping anytime soon

AJ007• 8 years ago

It is an anti-network effect. The early adaptors are cool, the late adaptors are not. In Facebook's case, the early adaptors are now old people posting photos of their children. The users aged to irrelevance.

There definitely was a big difference between MySpace and the other social networks. Facebook ran well and worked. People forget the total shit show MySpace was in the middle of 2008. The site ran terribly, was getting hammered by spammers, and they starting covering it in banner ads. We didn't see a repeat of those problems with Instagram or Snapchat.

There is a coolness factor. It isn't as defined as fashion, or the latest hot nightclub, but it is there. That alone won't be enough to make the "next" Facebook, but I think it is the foot that gets stuck in the door.

Facebook might be able to acquire the next challenger in the US, but they will definitely fail to get it by EU regulators.

signal11• 8 years ago

This is a very good point. In particular kids wouldn’t be caught dead on a network their parents (and other elderly relatives) are on.

I suspect Facebook knows this and will keep acquiring new platforms when they can.

bduerst• 8 years ago

FB is now running it's own branding ads in out of home media [1], which is a signal they've done the cost/benefit analysis internally and are now losing enough user trust to justify this brand spend.

Also, FB MAUs and DAUs are stalled [2], meaning users are becoming less interested in the blue website.

If anything, FB is closer to a 'boiling point' now than ever in the past.

[1] https://www.ispot.tv/ad/wUQP/facebook-a-little-closer

[2] https://www.businessinsider.com/facebook-maus-daus-stalled-u...

adpirz2• 8 years ago

Definitely worth noting, but I think they felt pressured to respond because the election meddling made enough waves with the gen pop to warrant a message, I don’t see it having a lasting impact.

The MAUs and DAUs are more interesting, especially since younger people seem to be avoiding it entirely (although many are flocking to IG, so again, no loss for FB).

chooseaname• 8 years ago

It all comes down to Wall Street. As long as investors are OK with FB's shenanigans, they'll continue to find innovative ways to sell off their users.

wpietri• 8 years ago

Which is a bit of a mug's game, as most investors are explicitly about profits. Externalities be damned.

I would much rather see industries self-regulate. But I have big concerns about industries where people are mainly the product, not the customer. I think it breaks the key feedback loop that makes most self-regulation work: irritable users/customers.

For me America's best backup to irritable customers has always been class action suits. It allows aggrieved customers to band together and force accountability where otherwise individual harm would be too small to justify the costs of a lawsuit. But mandatory arbitration is breaking that too, and anyway doesn't work as well when users aren't customers.

So if we don't have user-fueled self-regulation, and we don't have class action, then I'm not sure what we can do short of government regulation. It's a last resort for me, but nothing else seems to have worked on Facebook.

loceng3• 8 years ago

I wonder too if there is a boiling point with the mechanisms at play. Google was a "do no evil" company, and yet there was maybe a small earthquake within the company regarding the news coming to light they're making a censorship-friendly version of their search.

I take everything Facebook has done that caused any level of public outcry as a guide book to design a better platform, likewise with Google. And I won't dive into the history or foundation of Facebook, however it's not surprising their path would lead to problems - and at indirect cost to society.

mtgx3• 8 years ago

Facebook is already in decline (people have stopped using it, either completely or drastically reduced their usage of it).

The problem is Facebook is allowed to buy rising competitors on its way down, thus prolonging its monopoly in the social media space.

Jaruzel• 8 years ago

It may be in decline, but like a ship slowing down from light speed, it will take years before there's any significant change in the social media landscape. They have a very long time-frame of opportunity to turn their ship around, and it wouldn't surprise me if they do.

A good real world example is Disney. Disney has been almost broke a few times over its lifetime, yet currently it's so huge that people believe it will never fail again.

Facebook have so much money in the bank, that the moment their primary model is no longer viable, they'll just go to market and buy up the next hot thing, and switch their focus there. They are like an unstoppable pandemic virus in this aspect.

In dystopian sci-fi novels and films, there is commonly the concept of 'The Company' who see-all, and control-all. It used to be that we'd predict it would be IBM, or Microsoft who would be 'The Company', more recently we'd say it would be Google. Currently however, it's more likely to be Facebook.

nirelBRACITOS• 8 years ago

FB seems to be the favorite punching bag for HN, probably because it’s full of people who have tried to set up 600 different startups and raised exactly $0 where as Zuckerberg made more money than all the people here combined in 100 years.

H1Supreme• 8 years ago

I told my girlfriend about this just now, and she said "omg, they do?!", and went right back to her phone. Probably to check Facebook or Instagram.

Which is the reaction most people will have, I'm guessing.

jacobush• 8 years ago

Out of respect for you said "omg, they do", I reckon.

bogomipz4• 8 years ago

"...they'll no longer use 2FA #'s for ads..."

What are 2FA numbers in the context of ads?

sbr464• 8 years ago

I'm assuming it's meant that a user connects their phone to secure their account, but FB is also using it for marketing etc.

anonytrary2• 8 years ago

most people remain unaware that FB owns both WhatsApp and IG

I am not surprised. If you let Google autocomplete the search "is facebook o" for you, you'll find these autocomplete results in order:

  1. is facebook owned by google
  2. is facebook on roku
  3. is facebook over
  4. is facebook offline
  5. is facebook overvalued
    ...
  10. is facebook on its way out

Seriously, people? "Is Facebook owned by Google?". AFAIK most people have no idea what goes on with tech companies and they have no idea how much power they have and how they work with your data, or what personal data is even comprised of.

snaky2• 8 years ago

The best one is 'is facebook and twitter owned by the same person'.

sandov2• 8 years ago

True. The other day I was talking to my cousin and the conversation was something like:

— Facebook copied Snapchat's functionality on all their platforms.

— Instagram and Whatsapp copied it too.

— Yeah, that's what I meant by all their platforms.

— They're owned by Facebook?

She uses Instagram and Whatsapp everyday!

pdeuchler• 8 years ago

A reminder that if you work for Facebook you are fully complicit. Especially if you're an engineer, there should be no shortage of jobs available to you at this time. There is no excuse to work for a company that's sole focus is exploitation of its users.

duckMuppet• 8 years ago

This is an asinine, Deference to authority, nanny state garbage take..

No-one is forced to give all their info to fb. Better yet, no one is forced to use fb.. Of your using these services, and you give all your info to them, that's on you, not engineers just earning a check.

jliptzin• 8 years ago

Exactly. When I get recruitment emails from Facebook I like to kindly remind the recruiters that I am not interested in furthering the interests of a company that in my opinion is making the world worse, not better.

Sir_Cmpwn2• 8 years ago

Reminder that the same applies to Google.

pavanred• 8 years ago

The problem with this argument - I care about issue X, company C is known to disregard/exploit users with X and so I assume all employees of company C are complicit while I give a free pass to the users who remain ignorant and simply don't care no matter how many times these issues surface.

And where do you stop? Are all doctors working for big pharma related to opioid crisis complicit? what about people working for firms related to the financial crisis? engineers working for any company that suffered data breaches due to lax data security? what about engineers working for companies that haven't suffered data breaches yet but might have lax security? scientists working to certain biotech firms related to GM? engineers working for car manufacturers that cheated emission norms? engineers working for telecom/internet service providers that cheat users by throttling/net neutrality etc. etc. etc.

dreamcompiler2• 8 years ago

... there's a clear disconnect between shareholder incentives and those of the general populace.

This is always the case when the general populace are not customers but products. It cannot not be the case.

ozim• 8 years ago

I really liked it when people downvoted me when I wrote that Google pushing for 2FA phone numbers is doing it to get your phone number. (they don't use it for ads but lately I don't trust them, also 6mo ago I removed my FB)

In the end I gave Goog even 2 of my numbers because I am scared as hell to lose access to my account. I got my Gmail account when it was in 'innvite only' so it is my main account for long time. Have to move out of it soon.

megaman8• 8 years ago

I think it's much worse when HTC places ads on your phone via bloatware apps that can't be uninstalled. That's absolutely vicious and hardly ever gets any press time. But, oh, facebook makes a minor little slip up and they even FIX the problem and everyone looses their heads over it.

darpa_escapee• 8 years ago

One of the bloatware apps that I can't remove from my phone is Facebook :)

Thanks, Sprint!

saagarjha• 8 years ago

Can't both things be bad?

puppetmaster2• 8 years ago

It should be already well understood that free services aren't free. To me the moral issue of the story is how Facebook isn't upfront about "the cost" of the services they provide.

You want to use facebook to get in touch with friends? We all now know that you will be targeted by ads customized with every piece of information that you reveal (and some bits that you are not even aware you are revealing...)

Assume that an extra layer of security is also costing you some privacy. Interesting dilemma...

sincerely• 8 years ago

Also, it's one thing to willingly give up your own data in exchange for using Facebook etc for free, but often the data they collect could reasonably considered other people's - for instance uploading your contact book to "find friends" tells Facebook what names to associate with phone numbers and helps them build "shadow profiles" (or whatever the term they use is) for users who haven't given them anything.

puppetmaster2• 8 years ago

This is particularly an issue when minors are present in the photo, videos, comments, etc... Dad/Mom/Uncle/Grandma shares a photo of a young family member, and without a doubt a new individual has been added to Facebook's records.

Will our kids resent our posts?

ben_w2• 8 years ago

It is not well understood that they are a service.

To many people it is more like a place, and places are free. Sure, technically you can buy a place and own it and charge for access, and technically somebody owns almost all places you might care to go to, but mostly we think of them as free.

The fact that it costs nothing, monetarily, to access… that very thing often makes something seem like it has no cost.

gdrift• 8 years ago

I don't understand why people think these services cost nothing monetarily.

All ads are not free, all advertised products already include the cost of advertising in their price.

So everybody are paying for those "free" services whether they use them or not.

gowld• 8 years ago

It's worse than that. You can't even buy privacy-respecting Facebook service if you wanted to, even at the ARPU/LTV that Facebook would be happy to get, and network effects mean that you suffer when your friends and family choose to use Facebook but you opt out.

wmeredith• 8 years ago

It’s a cycle. Facebook has been doing nasty shit and apologizing for it since 2003. I’m starting to think they aren’t actually sorry.

https://www.wired.com/story/why-zuckerberg-15-year-apology-t...

MaxBarraclough• 8 years ago

Right, because Move fast and break stuff is their mantra. I'm surprised that articles doesn't even mention it.

Perhaps Move fast and hurt people would be more honest. I think it's rather catchy.

beaconstudios• 8 years ago

I think that's already taken by Uber's self-driving car division.

splicer• 8 years ago

Move fast and break stuff, like a bull in a china shop.

simonh3• 8 years ago

Move fast and break moral and ethical standards.

samstave2• 8 years ago

Actually their motto is "Make money, because fuck you, that's why"

njarboe5• 8 years ago

It is probably still the mantra for people who work there, as corporate culture is slow to change, but Zuck changed it in 2014 to "Move Fast With Stable Infra"[1].

[1]https://mashable.com/2014/04/30/facebooks-new-mantra-move-fa...

bitL• 8 years ago

Be Bold is no longer the mantra? Aren't they pretty bold all the time? ;-)

Brockenstein2• 8 years ago

Pretty much no one is actually sorry. They're just sorry the underestimated the negative response.

simonh3• 8 years ago

They are abjectly, truly remorseful and sorry that they got caught.

loceng3• 8 years ago

Once or if it impacts them enough personally then they'll be sorry, however that's the problem with rewarding people relatively blindly.

da024• 8 years ago

There is also this from his college days. Nothing much has changed:

  Zuck: Yeah so if you ever need info about anyone at Harvard
  Zuck: Just ask
  Zuck: I have over 4,000 emails, pictures, addresses, SNS
  [Redacted Friend's Name]: What? How'd you manage that one?
  Zuck: People just submitted it.
  Zuck: I don't know why.
  Zuck: They "trust me"
  Zuck: Dumb f*cks

https://en.wikiquote.org/wiki/Mark_Zuckerberg

hnbroseph2• 8 years ago

this is truly a revelation.

kevmo• 8 years ago

I am becoming anxious to see some action out of the DOJ Anti-Trust division against Google, Facebook, and Amazon, etc. These tech behemoths effectively own most of the consumer internet and they use their muscle to either acquire or force out the majority of other players. More regulation is not going to cut it (or else it would have already).

In America (and most places), law normally lags quite a bit behind the events of the day. Standard Oil destroyed markets unchecked for several decades in the 1800s. No individual or company could withstand their market power. Then the government divided it into dozens of vertically integrated companies, which allowed for a wave of new market entrants, better deals for consumers, and higher standards of living for more people.

We are obviously at that breaking point now with the tech behemoths and their sprawling, impregnable market power. It is time for antitrust action against Facebook and the gang.

trendia• 8 years ago

I think we need proper privacy measures, since the misuse of data is not necessarily an "antitrust issue". For instance, would breaking up Facebook really mean that the newly formed constituents respected privacy? And would antitrust enforcement against Google or Facebook reduce privacy exploitation by smaller entities?

I'd argue that it would not -- 1,000 small Facebooks could still violate privacy. Creating privacy legislation is the only real way to achieve proper privacy guarantees.

danShumway3• 8 years ago

You can personally decide not to use Facebook, which is good. But you can't convince everybody to do that. So if you or your family members do use Facebook, at least install an ad blocker for all of them.

Not for privacy, but to deny them revenue. I block Google ads on every single site I visit, period. I don't care if the advertising is non-obtrusive. If it's being run through Google, part of that revenue is going to fuel Google's tracking. I support creators directly instead. And if creators refuse to give me a way to support them, that's not an excuse to expect me to contribute to Google's bottom line.

Huge props to the people who are working on blocking trackers and protecting privacy. I'm very glad they exist, and I don't think their efforts are worthless. But, it is currently a losing battle to fight these companies on the privacy front, because the tracking model is so profitable that they will always be pushing more resources into it than we are. Collectively, the people fighting for privacy don't have enough resources to win.

But there's an easy, completely legal solution to that problem; the one thing companies haven't figured out how to get around is ad blocking. And a good ad blocker will block even native ads. For a company like Facebook, all of this boils down to getting you to click on ads. If enough people target that chokepoint, then the advertisers will start pulling out of the system, and there'll be less financial incentive for these companies to undermine people's security and privacy.

And we have evidence that this works. Even Google, which is the powerhouse for getting their ads to actually show up, is starting to devote more resources into trying to figure out how to stop mainstream people from installing adblockers. That's where all the autoplay stuff came from, that's where the acceptable ads initiative came from. They desperately want your roommate to say, "I'm not going to mess around with these weird Chrome extensions or whatever, that's too complicated. Chrome blocks this stuff itself, anyway."

Install adblock on every browser you get access to, tell ordinary people who aren't on HN to use it, and let the advertising industry kill itself. Make it very obvious to companies that buying ads on Facebook is a complete waste of time because even non-technical users just won't see them.

gcb02• 8 years ago

you gave an idea for a weekend project. posting here in case I change my mind and slack on something else.

instead of deleting facebook (or not having it), create a shell profile, just enough for you family to pointlessly add. then subscribe the account with a service (aka The Idea) that simply post a once a month post on how to install ad blockers and such.

bla2• 8 years ago

You can personally decide not to use Facebook, which is good. But you can't convince everybody to do that. Pretty scary.

Which means Facebook has a shadow profile of you even if you don't use it at all: http://theconversation.com/shadow-profiles-facebook-knows-ab...

danShumway3• 8 years ago

Yep. And I don't know a way to get around shadow profiles.

We should try to find one. I fully support the privacy fixes people are proposing. I think that's really important. But it's pretty obvious that Facebook is winning right now.

However, the only thing that Facebook cares about is getting you to click on an ad. So even if you can't stop Facebook from getting a shadow profile on you, at least you can make that profile worthless by blocking ads literally everywhere that Facebook can think to display them to you, for you and your family/friends.

And you can be public about it to ensure that when Facebook goes to companies and says, "we have all this data for your next campaign", somebody in the sales-pitch meeting raises their hand and says, "yeah, but nobody looks at your ads."

adam12• 8 years ago

This should not be a surprise to anyone. Facebook is all about making money with your info.

ricokatayama• 8 years ago

cambridge, whatsapp founders, instagram founders, 2FA exploit and so on. What's next for Mark? And actually what would be the trigger for people to flee away?

justtopost3• 8 years ago

Slow boiling the frog. Those who can notice at this point already left.

oxymoran• 8 years ago

I was purging my life of all things Google(Facebook went first), so I was changing my email addresses under all my various accounts. An odd thing happened when I was changing my info for my Microsoft account: they texted my as a security precaution. The only problem is that I NEVER gave Microsoft my phone number. I do not have 2FA set up. In my contact details, there is a blank for my phone number. WTF Microsoft.

joering2• 8 years ago

What kind of cooperation level did YOU expect from a $240MM check?

http://www.nbcnews.com/id/21458486/ns/business-us_business/t...

marssaxman• 8 years ago

I always imagined they would probably end up doing this, and that's why I've never accepted 2FA anywhere a site has tried to push it on me. They can't spam me if they don't know my number...

JoshTriplett• 8 years ago

Good 2FA does not involve phone numbers.

I use 2FA on sites that support TOTP.

makecheck2• 8 years ago

I only use Facebook like every month now but it always asks about my phone number. It also asks me to enable a log-in short-cut every time.

This last time, they crossed a line: they pre-filled the field (I do NOT have this set up in the browser), meaning they already figured out my number (probably by scrubbing some friend’s phone) and just want it confirmed. To hell with that. I would not be surprised if every spam call in existence can be traced to Facebook.

tombert• 8 years ago

It upsets me that the "normal" way to keep in touch with people now seems to be to use some kind of big-brother-esque system.

I try and evangelize Signal over WhatsApp and most of my friends won't budge. I deleted my Facebook four years ago, and as a result I have lost contact with a lot of friends.

Brockenstein2• 8 years ago

Before this sort of technology keeping in contact with friends wasn't trivial. Both parties had to want to keep it up. And if they didn't, or you didn't, you just lost contact with a lot of people as a normal matter of course. Everyone moved on with their lives, you met new people, and so on.

That there is this artificial world where people can arbitrarily keep in contact doesn't make that sort of non-interaction of occasionally commenting on or liking posts normal or better. It certainly is easy though to search for someone you knew ages ago, add a friend, have the five minute conversation of what's been going on the last five, ten, twenty years and then never really talk again.

In this regard facebook isn't the problem, and your preferred platform isn't a solution. The problem is people.

justtopost3• 8 years ago

As someone who still makes phone calls and writes letters, it seems like a step backward. Most people have nothing to even discuss once they 'get together' as they have shouted everything remotely interesting about themselves and their lives into the void already.

I have letters I treasure and will keep to my death. Emails? Not so much. The impression, the personal touch is missing. We as humans notice that sort of thing even when we pretend its all the same.

paul7986• 8 years ago

So, Google is not doing this too?

How many of us use 2FA on our Google accounts?

ergothus2• 8 years ago

recently interviewed at Facebook (didn't pass the in-person) and one thing I was looking for was a job that WASN'T based on ads. I didn't want to come across negative so I was circumspect in my asking ("Tell me about the positions at Facebook that I as an outsider don't know about - I know ads, messaging, and events"). I wasn't really excited by the answers I got - ads seemed worked into everything they brought up, but the answers weren't super-nefarious either. This was the Seattle office, which apparently has a strong ads-basis. Because they hire people and then (allegedly) let them pick from available team openings (after a "bootcamp" to do onboarding), I simultaneously felt like I'd have a chance to avoid the worst but also couldn't be sure of what I was committing to. I didn't pass the interview and the few weeks since have tried very hard to make me not regret that by raising issues like this one, despite my natural tendency to give FB the benefit of the doubt and to recognize the difficulty of moderating speech sanely.

I've never had such uncertainty about what a job would involve before - the "you find your match" sounded good initially, but in retrospect I'm wondering if I dodged a bullet - so hard to know.

mav3rick• 8 years ago

There's Oculus and Building 8. Also, backend infra stuff.

sweezyjeezy• 8 years ago

I find it interesting that you would absolve yourself for working for Facebook just because you wouldn't be working directly on ads. Facebook is an ad company with services attached (a fairly reprehensible one in my opinion). If you work for them, you are helping them achieve their goals, which ultimately is about serving people ads, it doesn't matter what particular role you are doing there.

ergothus2• 8 years ago

"absolve" is not the correct term (I think) - I don't find ads particularly offensive, I just don't ENJOY them, and I was looking for a job I'd enjoy and enjoy telling people about. I'm perfectly fine with ads existing, though I'm supportive of being able to buy my way out of them. (You can raise issues about ads being inherently deceptive and manipulative, and I wouldn't say you're wrong, but I've not taken a position against them...yet)

That facebook is doing bad things because ads are their only real source of income is a problem because of the bad things, not the ads. At the time the primary concern was "what should facebook be doing about de facto empowering hate speech and (actual) fake news?" and that's a tricky problem that I don't think has a resolved answer, and I sympathize with those that empower communication and only later realize people have more desire to trash things than apply rational caution. Since then much more has come out about some FB practices (and Google), and the question of whether ads-as-your-primary-revenue-source is too much incentive to be "evil" is being implicitly raised, but is likewise not yet resolved.

That said, I do think there are lines to draw and lines not worth drawing. There's very few jobs that don't end up supporting bad things. I don't think it's right to pretend that if you aren't doing it directly that you AREN'T supporting such things...but I also think it's sometimes unrealistic to make your situation worse to deny an indirect support. Deciding where that line lives is an individual decision, and one I have to regularly re-evaluate. To expand my point in the previous post, the news coming out about FB practices definitely made me feel like I'd have been uncomfortable even if I wasn't working directly in ads.

Bhilai2• 8 years ago

The only justification I could come up is that Facebook has grown so big that "one hand does not know what the other hand is doing." The security and privacy folks at Facebook agreed to this kind of abuse is somewhat hard to believe and the most likely explanation is that these features never got fully reviewed and vetted. Either way its a big failure.

yumraj• 8 years ago

We know that social networks are here to stay, and even if people disagree the writing is on the wall for Facebook to have Myspace moment, as soon as an alternate is available.

What will it take for some prominent VCs/Investors to just come together and create a fund to fund FB replacement? If done right, they will make a killing (from a returns perspective).

Aunche• 8 years ago

Don't get me wrong, this is absolutely a scummy thing to do since it's deceptive. That said, I don't understand why everyone thinks this is such a big deal. They already have your phone number from 2FA anyways, and they already show advertisements. What difference does it make that they let advertisers target people based on their number?

bogomipz4• 8 years ago

And yet in April Mark Zuckerberg told the US Congress that he wasn't "familiar" with shadow profiles[1]:

Lujan: Facebook has detailed profiles on people who have never signed up for Facebook, yes or no?

Zuckerberg: Congressman, in general we collect data on people who have not signed up for Facebook for security purposes to prevent the kind of scraping you were just referring to [reverse searches based on public info like phone numbers].

Lujan: So these are called shadow profiles, is that what they’ve been referred to by some?

Zuckerberg: Congressman, I’m not, I’m not familiar with that.

[1] https://techcrunch.com/2018/04/11/facebook-shadow-profiles-h...

igravious• 8 years ago

Quelle surprise.

I bet plausible deniability is that they call them by a different name internally.

Information brokers are so sketchy – it makes me so sad that the coolest tech companies are also some of the sketchiest.

Do you remember back when the internet and web were all so full of promise? Instead we got tech behemoths that would put Standard Oil and AT&T in their day to shame.

bogomipz4• 8 years ago

I wouldn't count FB to be among the "coolest" tech companies. Maybe 10 years ago they had some cachet but today it's just Mega Corp.

abalone• 8 years ago

They found that when a user gives Facebook a phone number for two-factor authentication or in order to receive alerts about new log-ins to a user’s account, that phone number became targetable by an advertiser within a couple of weeks.

I have always been suspicious of the aggressive "give us your phone number to secure your account" campaigns that so many sites/apps are running. And I think this is a HUGE disservice to users.

At first I was like, cool, companies are being responsible and encouraging good security practices, good on them. But there was something a touch too.. aggressive and "marketing-y" about it. It raised my spidey sense. Maybe the form and frequency and placement of them just was too familiar to previous campaigns to grab your email for "opt in" spam.

All of these companies should be shamed to high hell. Getting people to adopt 2FA is so important and here they are shamelessly exploiting it to market to you for undisclosed purposes.. well, buried in the privacy policy, but you know how that goes. The prompt is 100% about securing your account and nothing mentioned there about using it for targeting.

Seriously F these companies for breaking user trust.

ALSO: Did Zuckerberg lie to Congress?[1]

[1] https://techcrunch.com/2018/04/11/facebook-shadow-profiles-h...

njarboe5• 8 years ago

The article states that you can give Facebook a list of phone numbers or email addresses and it will put your ad in front of only those people. Does anyone know how small a list you can target? List of one? List of one plus N number of dead email addresses? Therefore a list of one, but more expensive?

TheKarateKid• 8 years ago

This is probably the reason Jan Koum left Facebook. He knew the betrayal of privacy promised of Whatsapp was completed by Facebook by doing exactly this.

This doesn’t surprise me at all. Facebook has been bothering me for YEARS to enter my mobile number for “account recovery” purposes. My email is fine for that.

Now Facebook is recommending pages and friends to me who I only am connected with on Instagram. Not to mention Facebook notifications are now integrated into IG. I wouldn’t be surprised if these were the final nails that made Kevin Systrom leave.

sandov2• 8 years ago

The researchers also found that if User A, whom we’ll call Anna, shares her contacts with Facebook, including a previously unknown phone number for User B, whom we’ll call Ben.

Why didn't the author use Alice and Bob?

joesb• 8 years ago

Umm, based on the content of the article, no, Facebook did NOT advertiser access to your shadow contact information.

Advertisers can specifically say that they want to advertise to a phone number THAT THEY ALREADY HAVE, (READ: THE ADVERTISER ALREADY KNOW WHO YOU ARE). And Facebook will display that ads to the Facebook account that use that phone number in their shadow contact info.

At no point does advertiser have access to which Facebook account that is.

tomhoward• 8 years ago

From the guidelines:

Please don't use uppercase for emphasis. If you want to emphasize a word or phrase, put asterisks around it and it will get italicized.

https://news.ycombinator.com/newsguidelines.html

FrostyBear3• 8 years ago

The big picture here seems to be alluding people. Let's not get bogged down with Symantec's and logistics. It boils down to self preservation, people need to understand who/ what that " self" is.

pure-awesome2• 8 years ago

Eluding, not alluding, and semantics, not Symantec's.

(I'm sorry, not trying to be needlessly pedantic - I had to re-read to understand your meaning.)

pure-awesome2• 8 years ago

What do you mean by "people need to understand who/what the 'self' is"? Can you elaborate?

FrostyBear3• 8 years ago

I did mean indirect referencing and Linguistics.

FrostyBear3• 8 years ago

Please try to stay focused on the forest, not the tree's. With each generation my hope grows stronger.

Number82• 8 years ago

Well Frosty, I for one am glad to see the scrambling and gasping for oxygen. As for hope in each generation, I believe #3 is getting stronger each day. We are living in a truly glorious time.

Number82• 8 years ago

Well Frosty, I for one am glad to see the struggle and gasping for oxygen. As for hope in each generation, I honestly believe #3 is growing stronger each day. We are alive in a great moment in time.

makecheck2• 8 years ago

This is the kind of thing that is stupidly hard to fight now. Even if you block Facebook’s 80,000 domains at your router, your friend’s address book dump gives lots of goodies to Facebook and 3rd parties and you can’t touch it. Every new thing they try becomes illegal in 2 years “but not yet” so they do it until they can’t.

Sometimes it seems like the “Default deny” security concept needs to apply to Internet companies. Instead of having years to screw with data and the Internet until told “no”, how about every idea they have is illegal until it can be proven through thorough review that it might be valuable?

Facebook Is Giving Advertisers Access To Your Shadow Contact Information

Related Stories