Dark Stalking on Facebook

http://pjf.id.au/blog/?position=590

by zkz • 17 years ago

57 23 17 years ago

pjf.id.au

marram• 17 years ago

Why does knowing friends' past events cross a moral boundary?!

calvin• 17 years ago

They may not want you to know. They may have had a reason for not telling you about the event (i.e. they're going to a party thrown by your ex-girlfriend). There's a number of social reasons people don't generally let people know everything they do.

tptacek4• 17 years ago

If they don't want things published, they shouldn't be publishing them on Facebook. Nobody should be using Facebook as their personal calendar.

Also, if a detail of how Facebook handles event queries is enough to "keep you up at night", how the hell do you handle nuclear proliferation in the CIS states?

iamwil• 17 years ago

Your friend may go to S&M conferences. Your friend may be a swinger. etc.

tptacek4• 17 years ago

If your friend goes to an S&M conference and posts that on Facebook under his own name, your friend is a public S&M conference attendee. If your friend swings, and posts that on Facebook under her own name, your friend is a public swinger. We are losing the forest for the trees here: Facebook is a publishing medium.

endlessvoid94• 17 years ago

Not just past events, but past events you/they have DECLINED.

codyrobbins• 17 years ago

Yeah — events they didn’t go to. So?

tesseract• 17 years ago

If you don't want people to see that you have declined an FB event, you should 'remove yourself from it' (I forget the exact terminology) rather than declining it.

Perhaps the fact that these are distinct actions is a problem with the FB event RSVP interface.

pfenwick2• 17 years ago

Because, as others have pointed out, those events may not be things they wished to share.

Let's pretend you like activity X, and you'd like to keep that private. It could do with your sexual tastes. You may be a member of the Jarjar Binks fan-club. It doesn't matter, as long as it's something you'd prefer not everyone to know.

Let's say you also have a trusted friend who also likes X, and they invite you to an event. Except that event is marked as a public event (as determined by the event creator, not by you). You may decline the event, or not even respond to the invitation, and this may have even been years ago. However you're still in the event_member table, and that can still be retrieved by applications.

The end result is it's possible for friends to reveal your personal and private interests by inviting you to public events. Unless you take care to weed these out, those interests can then be found and inferred in the future.

The good news is that if you remove the event from your calendar entirely, then you're also removed from the event_member table, but I still have to test that fully.

As a general rule, sharing events information with your friends' applications is probably a bad idea, but luckily this can be turned off. I don't believe there's a way to prevent them being shared with applications you've voluntarily installed.

throw_away• 17 years ago

The moral boundary is that most users would assume that this information would not be public because they themselves cannot see other peoples' information through the web ui.

I don't write much info to facebook because I haven't taken the time to understand their security and application model. I can't figure out what the knobs do, or who can see what. now I've got to weigh the utility of seeing all my past events (which is actually pretty cool) against the creepiness that friends can see the same info.

These would be juicy queries:

* which events for which I was not invited to, but that many other friends of mine were?

* when a friend declines events that I attend, which event did they accept/attend instead (bonus points for events that I throw)?

As mentioned elsewhere, this might result in some hurt feelings. Also, it would be creepy to the muggles to know that such magic back-doors exist.

aneesh• 17 years ago

> "I didn't expect it to share info when people had declined those events."

Just to clarify, does this mean events you replied "No" to, or events where you clicked "Remove from My Events"? If an API call surfaces the the latter, that would indeed be worrying.

tptacek4• 17 years ago

It would be an annoying bug. It would not be a breach of the public trust. For every time quantum that passed between you publishing the event and you removing it, any of your friends could have scraped your attendance.

pfenwick2• 17 years ago

It includes when you click No, Maybe, Yes, or fail to respond.

If you click "Remove from My Events", it appears that you're removed entirely from the event_member table.

ryanwaggoner• 17 years ago

I didn't sleep well that night.

Finding my friends' old events crossed a moral boundary I honestly didn't expect to encounter.

What makes this all rather chilling...

Over-dramatic much? None of this is secret, or underhanded, or arguably even a violation of privacy. If you don't want your friends to see stuff, don't post it on Facebook. And if you don't want a particular person to see it, including some guy messing around with the API, don't be friends with that person.

It sounds like this guy is trying to make a mountain out of a molehill for the sake of attention, to be honest.

thorax• 17 years ago

Well, I actually think the guy probably saw a lot of events he wasn't invited to, and/or some other things that made him realize that it was a violation of trust to see those things. I don't think the average hacker would get all choked-up about the principle of the matter quite so easily unless there was something meaty uncovered in his own life or circle of friends.

kwamenum86• 17 years ago

Once you put in in the public sector of the Internet it is always there. If people always operate under this assumption they will be fine (yes I realize in certain cases information may not be cached before it is removed.)

You shouldn't enter any information on a social networking site that you don't want everyone to see, no matter what the privacy settings tell you. Personally I am wary of sending sensitive information of any kind to a remote machine (of course I do it anyway ahem Gmail, ahem Amazon, ahem etc.) But to expect that you will be able to enter information on a social network and only have a subset of that site's users have access to it is much too high an expectation. No offense to Facebook but it is a difficult enough task to implement an efficient technical solution to this problem. But that is before you take into account the difficulty of explaining complex (or even simple) privacy controls to your users.

This is a really great demonstration of the privacy illusion but the illusion should not even exist. We should all lower our expectation of privacy on Facebook. Again, no offense to Facebook, but they can't meet the unreasonable standard set by some.

[Addendum]

* Facebook is not a private site. The term "privacy controls" is really misleading and should really be called something else that helps people understand how short they can fall of giving you true privacy.

* It is called a social network but our virtual societies have different rules than the real world. One notable issue is the Whiteboard Problem (yes I gave it a stupid name): The Facebook stream is like a whiteboard that you have given your friends access to but you can write comments on your whiteboard and they can write on yours. So whoever can see their whiteboard, whether they know you, can see what you wrote and learn of your existence.

* Another issue, the rules of information are completely different. Referencing the hypothetical swingers in other comments on this submission if I am a) invited to my "swinger conference", b) I accept the invitation, and c) we take lots of pictures only the diffusion of that information has strict constraints in the physical world. Once it is on Facebook a) non-swingers will likely have access to my swinger invite, b) non-swingers can see my response, maybe even in their stream and c) they may find my photos (last time I checked private Facebook photos are relatively easy to access.)

Once again, treat Facebook like a public whiteboard that represents you. For the most part only people you know wil see it but keep it blemish free just in case. So no "swinger conferences" on FB.

billswift• 17 years ago

They'd never use the term, it would be a PR disaster, but maybe "blatency controls" would be more truthful, as in "How blatent do you want to be?".

Dark Stalking on Facebook

Related Stories