Facebook says one hundred API users may have improperly accessed user data

https://www.nbcnews.com/tech/security/facebook-says-100-software-developers-may-have-improperly-accessed-user-n1076881

209 58 7 years ago

ben_jones• 7 years ago

“Although we’ve seen no evidence of abuse, we will ask them to delete any member data they may have retained and we will conduct audits to confirm that it has been deleted,” the company said in the blog post.

I wonder how these "audits" are done? Force the individuals into a legal agreement through threat of a larger action?

dboreham• 7 years ago

The audits are a figment of a lawyer's imagination.

Edit: when I wrote this I assumed "developers" meant employees of Facebook who work as developers. Actually they're referring not to "developers" but 3rd parties to whom they issued access tokens. My comment is still valid..

jdoliner• 7 years ago

They make them pinky promise. (Can't break a pinky promise.)

r7212• 7 years ago

Could this be related to upcoming release of internal documents?

Big new leak of internal Facebook docs to be published Thursday. There’s been extraordinary attempts by Facebook to suppress this including seeking disclosure of emails sent to journalists & MPs

https://twitter.com/carolecadwalla/status/119140241162292838...

At noon on Wednesday, Dublin time, I + others will publish full copies of 6,971 pages of Facebook confidential and legal documents, leaked in February.

https://twitter.com/dcampbell_iptv/status/119139795858925977...

claudeganon• 7 years ago

Hadn’t heard about this. Certainly casts their recent cozying up to the Republican establishment in a new light (i.e. avoiding further enforcement actions).

r7212• 7 years ago

Duncan Campbell (@dcampbell_iptv) started posting links to documents: https://twitter.com/dcampbell_iptv

UPD Reuters story: https://www.reuters.com/article/us-facebook-antitrust/facebo...

Computer Weekly story: https://www.computerweekly.com/news/252473540/Lawmakers-stud...

Joof• 7 years ago

I may have heard of such a thing happening at another company. Certain personalities just can't seem to help themselves.

matheusmoreira• 7 years ago

Intelligence agency employees engage in LOVEINT.

jsnell2• 7 years ago

The Facebook blog post would probably be a better source, since it explains the nature of the data: https://developers.facebook.com/blog/post/2019/11/05/changes...

I.e. apps added to a group by an admin could get some metadata about members of the group.

(That blog post would also have been harder to mis-interpret than the NBC article. Half the early comments seem to think that this was about Facebook engineers improperly accessing data.)

dang3• 7 years ago

If we do that, people will say that we're trying to protect FB by replacing a news article with a corporate press release. Is there a better third-party article?

knzhou9• 7 years ago

Obviously there isn't!

I don't know what goes into running this site, but personally, if I know I'm guaranteed to get a totally one-sided take, I'd rather have the one from the people who actually know how to code.

jonny_eh• 7 years ago

In the context of a Facebook user, what is the difference between data and metadata?

jsnell2• 7 years ago

I guess it depends on whether you view this as a continuum or have an absolute "anything the user touched is user data" take. Compare it to a couple of security issues they had last year:

First, the one where the attackers would have had full access to the accounts. Photos, posts, private messages, likes, contacts, etc: https://newsroom.fb.com/news/2018/09/security-update/

Or the one where some apps could read photos that they were not given access to, or in some cases that the user hadn't shared at all: https://developers.facebook.com/blog/post/2018/12/14/notifyi...

dbbk• 7 years ago

I'm confused as to how this is 'improper', if Facebook made this data available why are the developers at fault?

r1nkgrl• 7 years ago

This is referring to 100 external software developers that use Facebook's APIs, not Facebook engineers as I initially assumed reading the title.

Source: https://developers.facebook.com/blog/post/2019/11/05/changes...

desdiv• 7 years ago

To clarify further, the exact phrasing used was "roughly 100 partners", as in roughly 100 external legal entities. Each legal entity could have any number of software developers.

dang3• 7 years ago

Ok, we've put partners in the title above.

octocode• 7 years ago

Must've been the Gates of Galloo devs

designium• 7 years ago

For some reason, I don't think this is surprising.

Within the tech industry, specially Hacker News readers, we know that Facebook does a lot of "growth hacks", "gorilla marketing", "Microsoft way of doing things - Bill's era (remember Netscape vs. IE?)". So, even if FB Internal docs are released, the real surprising fact will be that end users are not going to simply stop using FB, IG, WhatsApp and we get mystified about "WHY"?! Or just "accept" that's always the case.

At the end, the users are either not interested to follow what FB does nor they have access to the truth. With those Billion of users, most of them are outside the sphere of influence of American media. Each country shows its most interesting news, a combination of top current world and local news. The current ones would be "Climate Change", "Hong Kong Protests", "Trade war US and China", "Something in the Middle East", "Something about US Stocks", and maybe: something about FB.

If we imagine ourselves as news writers, it is not easy to convey the nuances, calculated moves, and strategic choices that FB is doing to control its market to the general population. Thus, there are many barriers to really use this information to change FB behavior. Perhaps I'm pessimistic about it.

So at the end, it will only be surprising if the users understand and FB get huge pushback from its user base.

jdkee3• 7 years ago

We watched this documentary in the fake news class I taught this past summer.

https://www.netflix.com/title/80117542

While some of the assertions in the film are unsubstantiated, the resulting classroom discussion on the role of social media and privacy were immensely constructive.

forgingahead• 7 years ago

Did your class cover any aspect of how the mainstream media, like cable and broadcast TV news channels and the top printed newspapers in the country, also practice heavy bias in their reporting, and how the members of your class could become aware whenever those biases arose?

jdkee3• 7 years ago

Yes, we did. We cover the difference between journalism and its ethics for the social good and the media, which is produced for consumption.

chillacy2• 7 years ago

I was a bit underwhelmed, while some of the voter suppression stuff was pretty abhorrent, I thought building personality profiles and launching targeted ads was pretty mundane at the end of the day.

The next level of discussion that interests me is why social media manipulation is so powerful in the first place.

If people's beliefs are so heavily influenced by who we communicate with, what are the chances that we aren't under those same forces, and is there even an objective point of view in any of this?

knzhou9• 7 years ago

I thought building personality profiles and launching targeted ads was pretty mundane at the end of the day. The next level of discussion that interests me is why social media manipulation is so powerful in the first place.

Well, if you push in that direction then the whole narrative falls apart. There is absolutely no evidence that social media based personality profiles are actually effective -- why would knowing somebody likes Taylor Swift be better for targeting political ads than knowing where they live and their party affiliation, like in traditional ad targeting?

It's just absurd, and nobody ever counters this narrative because nobody has an incentive to. Journalists want people to believe this to get them afraid of Facebook. Facebook wants people to believe it because that makes their ads worth paying for. Doubly so for Cambridge Analytica and the like.

knzhou9• 7 years ago

I once took a "media and society" class where I was told that critical thinking meant to take all my facts from the New York Times alone, that the NYT was infallible, and that I shouldn't even try to evaluate facts from "unauthorized sources" because they were all definitely lies anyway.

On reflection, I think this kind of class is bad for society. Are you sure you aren't running that kind of class?

jdkee3• 7 years ago

Yes. We cover numerous types sources, from traditional newsprint journalism, to online reporting by some crank with a blog. The idea is to develop and apply critical thinking skills while reading/hearing various news/editorials/advertising sources.

theelous3• 7 years ago

What a surprise.

sdan• 7 years ago

Regardless of how many developers have "improperly accessed user data", you can do a lot of stuff as a regular person such as tracking how long all your friends sleep:

https://github.com/sqren/fb-sleep-stats

After I found one of my friends doing this, I quit FB (this reason among others).

knzhou9• 7 years ago

You could find much much more personal information about your friends before social media, the old fashioned way -- stalking. Both stalking and this kind of data scraping have the same response: get better friends.

pengstrom• 7 years ago

Sitting in the comforts of your own home is very different from having to go outside to reach the victims.

randomb_19793• 7 years ago

I have never seen a comment which is so ignorant of Facebook's past behavior.

Are you aware that Facebook at one point unilaterally decided to allow people to see and comment on photos of friends of friends (i.e. 2nd degree connections)?

Just in case you are not clear on what actually happened: this "feature" didn't initially exist, so you behaved in a certain way one day. And the next day, they added this feature and you had no way to opt out of it.

Am I now supposed to also monitor and choose the friends of my friends? And then also study Facebook's API to know what level of access is provided to first degree connections? And then second degree connections? And are you suggesting everyone who uses Facebook is supposed to learn about all this stuff?

tobr• 7 years ago

Remember that Facebook PR has a habit of releasing a tiny number when they break bad news. The actual number has been as much as 100 times larger[1], but they get the smaller number into articles and the news cycle moves on. For some strange reason their initial wrong estimates are always in favor of Facebook.

Based on that, this “one hundred” may well turn out to be “ten thousand”.

1: https://www.vox.com/2019/4/18/18485528/facebook-instagram-pa...

tobtoh• 7 years ago

If past admissions are any indication, expect a 'revised' admission in a few weeks where they 'discover' that the actual number is one thousand partners who have improperly accessed data.

tannhaeuser• 7 years ago

How can it be that Facebook with all their engineering prowess can't even tell who accessed what, let alone put adequate permission controls on their APIs? Didn't they invent GraphQL and whatnot and aren't they bound to GDPR in EU requiring them to list specifically and individually the external partner companies they're sharing data with, and the kind of data shared?

netsharc3• 7 years ago

Probably laziness. A few years ago (before GDPR) third party "apps" on FB could access many things, and FB just said "don't worry, the devs can't do anything bad because they had to click a button that said they'll follow our rules, or be banned!".

So many of my friends used stupid quiz apps, certainly leaking my data to those 3rd parties too.

speedplane• 7 years ago

> How can it be that Facebook with all their engineering prowess can't even tell who accessed what, let alone put adequate permission controls on their APIs?
Probably laziness

Facebook is a lot of things, but they're not lazy. As far as can be seen, their decisions are largely intentional. If they didn't do something, it's because they didn't want to or it would hurt their bottom line, not cause they're lazy.

newsbinator• 7 years ago

100 is a number that raises my curiosity. Not 97 partners or 104 partners. Exactly 100.

talonx• 7 years ago

FB's post actually says "roughly 100 partners", not exactly 100.

waheediqbal• 7 years ago

So many controversies with facebook lately. It seems like there is something wrong with facebook.

Facebook says one hundred API users may have improperly accessed user data

Related Stories