Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
It's not just Facebook. Thousands of companies are spying on you (cnn.com)
299 points by mlb_hn on March 27, 2018 | hide | past | favorite | 110 comments


This is a standard media trick (and also common people's rationalization) - oh, it's not just X that's bad for you, see everything else - it's also bad for you too. You might as well stick with what you know. Suddenly, people feel they have no choice and the story is over in a day or two, everything's back to normal.

The difference is these few days blew off the periphery of uncertain users. It won't hurt them now, but in the long run - it may be like tobacco. Annectodal example from here on.

I've tried many times to quit Facebook, these latest ones threw me off board for good. I tried to do it smartly by contacting people I know and want to keep in touch with and then posted on my wall and my profile pic that I am going out of fb for good. I gave (I think reasonable) 72 hours and some people did reach out and most congratulated me. Which means a lot of people want it, they get its bad for them but "everybody is there" is the main argument. I don't try to convince them, I just tell them where they can find me. Tonight I am out for good.


> [...] some people did reach out and most congratulated me. Which means a lot of people want it, they get its bad for them but "everybody is there" is the main argument.

I wouldn't give much weight to those congratulations. When I went vegetarian a lot of people did the same. Most new acquaintances that discover my vegetarianism respond very positively, specially left-leaning people. Although I try not to preach, I'm too often the only one that orders a salad. But they always follow it with "I see that it's wrong, but I could never stop eating burgers/cheese/jamón". I'm not even sure they truly think it's wrong, but feel a need to say it.

It's one of those things that many people associate with positive traits or stories. We've all seen the inspiring posts or youtube videos of the people who refuse to use a car because of pollution, or stop eating meat because of animal suffering, or will never use a device that runs proprietary software...

We seem to like these stories, and sometimes even admire the commitment, while having no intention of doing anything like. We feel good for congratulating them of tweeting our support.

(For example, many here admire Richard Stallman's commitment and honesty, and agree with a lot of what he says, but read him froma Mac. We are never going to switch to an old libreboot-able PC with gNewSense, but we sympathize with his cause.)

Many people love Facebook, and many others hate it but can't be weaned off it. We won't get very far by abandoning Facebook and prompting others to do the same. We'll a alternative, and/or very strong positive and negative reinforcement to do so.

> The difference is these few days blew off the periphery of uncertain users. It won't hurt them now, but in the long run - it may be like tobacco.

Your comparison with tobacco is very apt. People stopped smoking when a) leaving it was applauded, and b) people still smoking were starting to be seen with some contempt. It took a long time to build those up though. We are very far away from that with Facebook, and even if us leaving is the beginning, I don't think we want to wait 10 or 15 years. Tobacco damaged lungs, Facebook damage could be much more insidious.


> When I went vegetarian a lot of people did the same. Most new acquaintances that discover my vegetarianism respond very positively, specially left-leaning people. Although I try not to preach, I'm too often the only one that orders a salad. But they always follow it with "I see that it's wrong, but I could never stop eating burgers/cheese/jamón". I'm not even sure they truly think it's wrong, but feel a need to say it.

That's how it starts, but I've noticed that over time, more and more people have learned more about why one would be a vegetarian (among others because they ask as part of small talk, and I quickly mention a few non-obvious points before moving on), and have experimented with eating vegetarian for a month. And the important part is: when they're around other vegetarians they know, they're proud of giving it a try, which is extra motivation for them to keep it up.

After having formed a habit, many of them keep it up for at least most of the time. And then, of course, they will go on to have the same effect on other people. That's how cultural change happens.

Of course, the problem with Facebook is that the primary method of showing off that you're quitting Facebook would be Facebook itself. I guess the 72h grace period is a good way to deal with that to some extent.


You are probably right about the congratulations part, I try not to think about them too much for the same reasons you pointed out - but I am a human, bias myself and feel good. I did not try to take my friends out with me, I completely understand their reasoning for staying, that's probably why I stayed for about 10 years - it does provide value with everybody being in the same place. But some of my closest friends kept asking me how to reach me beyond the email and phone number I gave them and I said I will be on Signal. Some installed it just for me, I don't expect them to stay too long so I created reminders in my calendar to reach out via whatever means so that I don't lose them (I tend to live abroad from time to time like now).


It's the well known "whataboutitsm" (what-about-ism).

Distract, divert, confuse and conquer!!!

Works-every-time. In every (media controlled) topic!


"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him." - Cardinal_Richelieu

You need to ask yourself "what about..." and make sure your target truly is the worst offender and not just the most publicized offender, or you become the attack dog of the media.


Is this whataboutism? It reads like "its worse than you thought"ism.

If the author is calling for regulation of the category that includes facebook, how is he distracting and diverting attention from facebook?


Google can ID your web browser uniquely. If you've ever logged in to Google just once in your lifetime, they know it's you forever.

They cross it with your location, your movements, your emails, expenses, everything.

There is no single more spooky company than Google.


As demoed on EFF’s Panopticlick site, anyone can. My browser tests as unique and it’s stock Safari on an iPhone.


Does it test as unique on subsequent visits?


With subsequent visits I get “one in 339162.0 browsers have the same fingerprint as yours” and so forth, with the number decreasing each time.

Clearing cookies makes no difference - the hash of WebGL and Canvas fingerprints stay the same.


:( Your browser fingerprint appears to be unique among the 1,357,338 tested so far.


1 in 1,357,338 could easily be 10,000+ devices considering how fast these fingerprints change and how many users are out there.

Geographic location is a much larger issue.


I know this is probably going to sound like magic to some, but you know, one can control, if they so choose to, what one's browser (if one uses a FOSS browser) sends over the network by modifying the code and recompiling it for oneself…


i bet disabling these features make you stick out even more ;D


Who said anything about disabling… some actors spoof information all the time to appear as if they are somewhere/someone else or even a someone (bots) in the first place.

On the topic of disabling, if one disabled javascript by default, one would get the immediate effect of not seeing most of the advertising on the web (outside of submarine articles).

I bet people telling others that they "need" this shit to use the web probably has significant overlap with those who say they "need" Facebook (or any other random app) or else there would be no other way to find events or things to do. Like without facebook groups, one would die! lol


Indeed, obfuscation and sending noise is one obvious countermeasure and that space needs more exploring. Google banned Adnauseam on Chrome just for tinkering with the idea.


while theoretically possible there are enough people monitoring Google's JavaScript to make sure that they will never use fingerprinting on you. Or do they?


I assumed that all large sites use code like this to filter out fraudulent and abusive accounts.


Can someone please revive Random Agent Spoofer?


It's better to switch off JavaScript. Try panopticlick with and without it.


i just tried but sadly it did not finish without allowing js on their site and for both of the thirdparty tests. It might would have finished if i would not have enabled this test though.

However, even if it would show better results then my user agent and accept header is apprently pretty unique anyhow. But why bother.. My ip addresses do not change that often.


yes, noscript is a must, however not enough against fingerprinting


Yes, Google has all this information. No, it hasn't been as careless with it as Facebook. If that counts for nothing in your threat model then your model is useless and you're just spreading FUD.


Google tracking users down to this level is beyond creepy.

Google being careful with user data, may be true now. But what happens one day when Google goes bankrupt? And they have to sell all their information about their users at firesale prices.

Yahoo went bankrupt, and sold off its data about their users.

Imagine the treasure trove of information that can be gleamed from every single American's online activities. Imagine all the "innocent" people that can be blackmailed, and have their lives destroyed.

Imagine a company like no other in human history, that is amassing information on every single American, on every single person in the world, and on a scale that has never been done before. Imagine.. Google.

Google needs to be regulated. The public needs to know what they are doing. And we need restrictions on what can be done with that data. If they go bankrupt one day, then they cannot sell it. It must be destroyed. It is too dangerous to be sold off to the highest bidder.


Ohh this Is why they have no customer support for their products.

We are the product.


The reason for no/lacking customer support is that it requires humans, and humans are expensive.


“Google is less evil than Facebook” is absolutely not something you should assume in your threat model.


While your statement is true, it's best to talk probabilties.

If you calculate the likelihood that companyX is a) hoarding sensitive data about you AND b) isn't competent at securing said data, I'd rate Google as less of a threat because I estimate (b) is much less likely.

The best way to win is not to play. I block cookies, scripts and also don't use FB or much of Google except search & email.


Being “competent at securing your data” is useless when they are incentivized to utilize it.

Usually, when an entity motivated against our best interests is considered “competent”, we calculate that they are more of a threat. This makes fine sense to me. Why would one reason differently about Google? It looks illogical to me.

Google is a company. Google is optimized for profit, not data privacy. Quite the contrary, of course. And that isn’t changing any time soon. Right now, they have a lot of surplus, but that can change, which will effect the nature of their optimization’s. For that reason, we should consider the incentives since they are evidently the core motivation of Google’s behavior.

If I’m not mistaken, you are encouraging others to trust an unrelated entity known to be incentivized against their best interests. Sounds like a tough sell to put it lightly.


> ... much of Google except search & email.

This reads like self-satire.


Google and Apple's data is viewed as trade secret. Facebook, on the other, hand sells access.

Quite a huge difference there.


What parties that are buying data from Facebook do, Google themself can do the same. Manipulate search, Youtube suggested video, using data for their own benefit. May be they did not do anything. But, that does not mean they can't do that in future.

Saying it's fine for Google have so much power just because they are not working like Facebook, is stupid. History repeats, but we never learn our lesson.


Geo-location is the scary metric, peoples habits / when/ where is a trove of data, it can be analyzed much more deeply.


There's so many things that can change your fingerprint that their methods are useless, unless you continue to use their products willingly and don't block their scripts. Without your willful participation, they are quite helpless.


Isn't this already known for years? I might be wrong but feel like the whole thing with Cambridge Analytica was more about accurately influencing public opinion than it was about data being leaked.

This is kind of dumbing down the issue, but: anyone not well-versed in implications of privacy violations would feel way stronger when claiming "Mark Zuckerburg is partly responsible for Donald Trump becaming president" versus "Google, Facebook, Amazon, Apple and Microsoft have data which will make you more susceptible to spending slightly more money [...on something you don't actually need]"


100% agree, Im a little surprised how shocked everyone is in this "exposure" as if you look at any AdTech they talk about this as a standard feature (audience matching etc...)


> 100% agree, Im a little surprised how shocked everyone is in this "exposure"

I'd recommend you try and spend more time with 'regular' people rather than tech bubble then. What you're seeing here is this knowledge breaking further in to the mainstream.


I disagree. What we're seeing here IMO is targeted influencing in it's own right. "Regular people" are way too susceptible to influence - period. In this case it is the joint forces of old media (who are vying to keep their obsolete business idea of peddling influence using paid ads), and governments who are seeing their tax-base dwindle when global tech companies move to tax havens, and certain tech competitors pointing fingers away from themselves: all whom are targeting Facebook to set an example.

Add a sprinkle of righteous outrage at the unethical tactics of Cambridge Analytica and how the Trump Campaign was able to use data that the DNC would rather have exclusive access to.

"Regular people" don't care that their data is hoarded, they only start caring when it is framed nefariously (and disingenuously) by interests like the above.


> "Regular people" don't care that their data is hoarded, they only start caring when it is framed nefariously (and disingenuously) by interests like the above.

If the framing is a good or bad thing is just a matter of opinion. A 'good' way of flipping what you've written is 'we've finally found a way to break through to regular people about these issues on a level they understand and resonate with'.

To call general articles on websites like cnn.com "targetted influencing " is a bit of a stretch.


I think it's the other way round. We are not "breaking through to regular people", the current campaign against Facebook is rather exploiting peoples superficial knowledge and unfounded fears to build a disingenuous case.

Facebook has been too slack, and the good part about this whole thing is that they may finally might get their sh*t together. At least they have the power to bring this under control, as the various decentralized alternatives being touted here on HN won't have.

> To call general articles on websites like cnn.com "targetted influencing " is a bit of a stretch.

Yeah, well. Depends on your definition of targeting, but influencing it is. And as usual, how good or bad you think that influencing might be depends on if you like what you are being led to believe or not.


You've said disingenuous a lot, what exactly is disingenuous about the current reporting?


I'm not OP, but... The fact that it is not consistently connected to other instances of political campaigns previously is a big one. The narrative is that the West is radicalizing to the right because of the evil propaganda, unlike the pure and virtuous honest reporting that brought us "change we can believe in" or "Clinton is 95% sure to win" and so on.

When the good tribe does it, it's "remarkable insight into the political base and clever use of modern technology", when the bad tribe does it, it's "disturbingly sophisticated targeting and an automated violation of consent". Really, go read the write ups about previous democrat campaigns, the narrative was of tech savvy modern progressives leaving the conservative old timers in the dust.

Russel conjugation is the favorite trick or the press today as they hawk their narratives:

"I am trying to get an important message out. You are running a political campaign. They are spreading harmful propaganda."

But 99% of harvested data is gathered with only proxy consent of 1% of the users, and most of either group is unaware of what's happening. Ignoring this ratio in order to haggle about exactly how the 1% was or wasn't tricked is entirely beside the point.

The bigger problem with this whole affair is that people correctly diagnose a breakdown in the mechanisms for forming consensus reality, which makes a lot of information suspect. This should make you question your in-groups' world view as much as the out-group. But instead of going back to primary sources and reevaluating what they know, people only double down on it more, and use it to justify why the out group is even more clueless/insidious than before. But one of the biggest hallmarks of propaganda is that the enemy is both horribly inept and terrifyingly powerful at the same time, swapping between the two seamlessly to serve the current narrative.


This is a very US-Centric view. I suppose that's the root of the disagreement here - a misunderstanding of each other's starting points.

The coverage in my country has been more about castigating Facebook et al and both major parties have copped flack for their voter-intelligence operations.


The fact that your personal information is being sold (with your name, user id, email address, possibly physical address + political opinions) is probably news to most people.

Another thing: Did you know that facebook recorded your phone calls (time and recipient)? Or, it sold your personal info to brands for marketing outside of facebook, say by email?


Whether it has been known or not is not relevant. The right thing is long over due. Engineers build stuff for income. More than a few actions in tech sector appear as theft to me. When I shared my data with google and Facebook, I trusted them same way I trust my cell phone company to not record all my calls. The sector should've been regulated much sooner.


The difference is a military contractor built military grade tools for running an information operation and deployed those tools on the general public. That is new, and not a concept I can recall reading about in popular media coverage of online privacy. Edit: Even at this point, we're not seeing a lot of the news coverage focus in on this element of the story.


It's more like an opium war thing, like how did we let this company get this level of power over regular folks? and how do we respond as a society?


It's always like this. People who get exposed to new scary information always react with 'you are a tinfoil hat person arent you', until it's obvious to everybody that something is true. Takes many years, every time. I'm usually someone who sees these things well before they get public, but there is no point talking about it until the public is ready for it and the thing has again become obvious.


Facebook is pretty bad, but this is a general thing.

https://www.icloud.com/#contacts

http://contacts.google.com

Even many games collect this information. Even really, really popular ones.

https://techcrunch.com/2016/07/11/pokemon-go-wants-to-catch-...

And with graph theory this means that if they got, say 10% (more likely 1% or so) of people to do this, they can reconstruct 99% or more of the total graph easily.

Hence the constant astonishment by privacy advocates that actually watch their own usage. "I don't use a smartphone and yet they figure out the email addresses of people I only ever call" type of comments.

Meanwhile government organizations have become famous in recent years for subpoenaing this information at the drop of a hat ... especially for divorces, but even for commercial conflicts (e.g. non-payment).

Everybody's in on it and this fight has been fought ... and comprehensively lost. The justice system is not going to let this source of information go, and that means companies aren't going to let it go.

You just can't have applications in the cloud and privacy, because the cloud means that aggregating the information from many sources is easy. Not that it isn't theoretically possible, but it just doesn't work in practice.


iCloud and Google contacts are explicitly for syncing contact information. This is what one expects when using these services. Syncing with iCloud is optional. I not familiar with Google Contacts to know the details.

TOS for games and social networks like Facebook may mention they access this information but it's not their sole purpose and users are may be surprised this is happening.

Also, at least in the case of iCloud, contacts data is encrypted in flight and at rest. Apple doesn't have access to the data, and can't be shared with authorities even under subpoena.[0] Again, I don't know the situation with Google Contacts. I agree that the situation with games and social networks is much more problematic and something to be concerned about.

Yeah, there are definitely concerns when storing information on others' servers, but it's also important to weigh them appropriately. That said, depending on your level of paranoia, you might not accept anything anyone says, and that's your choice.

[0]: https://support.apple.com/en-us/HT202303


The problem with the argument from Apple is that they control code that can decrypt the information. That code can do whatever it wants, with or without your approval (they can change the code on the frontend without your approval). This "end-to-end encryption" are a commitment, a promise on their part, nothing more (and I might add, this is a bit of text on a PR page, it is not even a contractual obligation to you, a very important difference that I assure you is not an accidental oversight on the part of Apple's management. Not that a contractual obligation would protect your data from subpoenas).

So this still requires you trust Apple, and any organization that can compel Apple to take action, to not break your security. This, of course, includes any organization that can subpoena Apple, which due to international cooperation includes quite a few organizations.

The ONLY person that can be entrusted with information and be legally protected from subpoenas is you yourself, and your lawyer (and even then technically only when actually representing you, although I don't think that line has ever been crossed), and even that only applies within the US. I agree that Apple does seem to have had some success with this information, has not released such info -so far- in a public request (there are, however, a number of non-public channels for subpoenas).

If I were to ask you to enter your bank information on a website with javascript that encrypts the information, then sends it to the server under my control, end-to-end encrypted (the server does not know - independently of the frontend - the encryption keys. Of course the whole system still does know the information), would you trust that ? Of course not, as I control the frontend and the backend, and therefore I can still decrypt it. I can change the frontend code to send me the unencrypted information (or worse - the encryption key the backend does not know - as that would give me access now and access to any future updates), same trick as with LVM encryption.

Maybe I even need you to visit the site before I'd be able to decrypt it, but I hope you can see that I can still access the information if I control both, and when you decide to entrust information to that you should still decide if you trust me, and anyone who can subpoena information from me. The only difference is a few extra steps for me when I want to access the information.

So far Apple's argument is that it would be unreasonable ("onerous" I believe is the legal term) to demand they actually execute those steps. We don't know if that argument held up in the non-public channels (there does seem to be a compromise made [1])

People think that if you have LVM encryption on a disk it can't be copied without having access to the encryption key. That's wrong, of course I can copy it, I just can't read it unencrypted at that point. If I then install a boatloader that uses a side channel to send the encryption key to me (the 128 bytes of the key, not the actual data on the drive) and from that point on I have access to the information I copied earlier. Note that "protected boot" doesn't actually protect you either. I simply install a bootloader that looks exactly like the official bootloader on screen, you enter your password, it simulates an update or whatever, replaces itself with the official bootloader again, and reboots. Presto, I now have access to all your drives and you're none the wiser, and the only thing I needed was physical access to the information (in other words, only the exact same thing I would need if it wasn't encrypted at all).

[1] https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...


There's a number of straw men here: I understand the difference between being able to copy and decrypt data. You're the one who brought that up. The FBI case is about unlocking a device (which make the keys available), not decrypting data at rest when you don't have access to the keys. You brought up specifically accessing contact data available to specific apps, and those were the points I addressed.

So, only software you compile yourself, and never storing data on servers you don't own? How about hardware, including chips, from third-parties? Trusting encryption algorithms others have certified? How far does your trust extend? Is it reasonable for others to have different levels of trust than you?


Nope. You do not require that you only use software you compile yourself. Software that only uses local storage, for obvious reasons, does not need that.

That's why I'm saying that you only need to be watch out for cloud software. Local contact storage is of course fine.

It's just that neither android nor Apple/ios has that.


I don't know what the options are on Android, but you aren't required to use iCloud on iOS for Contacts (or at all, for that matter, though there are likely feature limitations such as some syncing between devices if you don't have it enabled).


I'm not sure why it is so terribly important for you to defend Apple here, but let's just say that I'm pretty sure I would just avoid using a smartphone all together for anything important.

Contacts has code in it that is explicitly designed to expose this info (to provide features found useful by many Apple customers of course). And we know that the safety guarantees are somewhat noncommittal (and I would argue at least a bit misleading).

And that's enough, if you want to avoid giving out this info, I'd use other tools to communicate.


> "I'm not sure why it is so terribly important for you to defend Apple here"

Only that it appears you're misrepresenting the situation. I would ask the same of you as to why it's important to continue to rail against Apple and Google to make incorrect claims and build straw men when those claims are pointed out. Here, you again shift your position. Initially you talk about cloud storage for contacts, and it's not an option to not use the cloud for storage. When I point out that that's wrong (at least for Apple), you retreat and now only talk about contacts in general. If I'm wrong about anything I've said, please point it out. If I knew more about Google and Android, I'd fill in those details, too, but I don't.

> "let's just say that I'm pretty sure I would just avoid using a smartphone all together for anything important."

If your point is you don't think using a smartphone for anything important, that's fine, and I completely agree that, depending on your threat model, smart phones may not be a good option. But you don't need to make false, misleading, (or perhaps just uninformed) claims about specific features. That just undermines your point. If you're coming at this from an op-sec perspective, that requires a particularly calm and dry-eyed look at the situation, as any misrepresentation likely has severe consequences.


In a privacy-less future, one has to learn how to achieve goals without revealing intentions by hiding them in randomized behaviors and words. One has to practice double-think, triple-think or even recursive-onion-think.


Your comment was all fine up until the very last word, citizen. You used the name of a particular vegetable that's also a name of a particular subversive technology. You're now on a list.


Subversive technology? I 'ardly know 'er!


Of course they are, and up till now they didn't even need to be shy about it. Let's hope things change this time

Start here:

http://www.internetremoval.com/directory/


This is the tradeoff for getting free stuff on the internet. But surely there has to be a balance between watching adverts to pay for free services, and handing over all privacy in return.


The bigger irk for me is when you pay a company for a product, and then they still sell your data anyway.


Exactly, the "you paid nothing so you're the product" trope is patently false.

Spend $1000's a year on sites that are still highly invasive. Using blockers and disabling js often breaks them. Does this business really need to send my data off to a dozen 3rd parties to upsell me on a drillbit set?


It’s not false.

If you didn’t pay, you are the product.

If you did pay, you may or may not be the product. But that’s not covered by the trope.


Perspicuous!

Why do it? Because they can?

Without Javascript it would not be as easy.

With the help of the "modern browser" and its defaults, its like shooting fish in a barrel.

The original HTTP/1.1 RFC has some reasonably low limits on simultaneous connections; todays ad-sponsored browsers ignore them.

Turn off Javascript and the web marketing Rube Goldberg machines begin to fail.

Most web pages try to coax users into turning on Javascript, or even installing a different browser.

At this point, a web developer will jump in and try to convince us the web cannot work without Javascript.

This is false. There was e-commerce on the web before Java1 or Javascript.

1. Java began life as a language intended to be embedded in devices. It was repurposed to be a scripting language for the web. That was a failure.

Javascript is a "success" but in the ways that it is abused, it can be every bit as annoying as a 1990s Java applet.


If I subscribe to a website with real money, I feel free to block all trackers via Ghostery.


> This is the tradeoff for getting free stuff on the internet.

Why?

I’ve been a webdev for 20-something years, and it sure didn’t used to be the tradeoff.


Remember GWB's "ownership society"? That's what you get in an ownership society - massive rent-seeking.

When you have systemic rent-seeking, any sort of gift-economy is priced out.


Except when it isn't. This is not the trade-off for the vast value of Wikipedia or Archive.org.


And this is what makes me wary of apps like Signal as well. Who pays for the servers and why are they free?


You could just look up the answers. https://signal.org/blog/signal-foundation/ describes an aligned philanthropist helping start the 501(c)(3) foundation that supports Signal.

Another resource: https://en.wikipedia.org/wiki/Signal_(software) happens to come from a completely-free-of-3rd-party-ads-yet-free platform…

It's good to be wary, but the idea that nothing is ever free is actually wrong and helps make people think they have to give up something or pay etc. even when they don't need to. We need to get beyond "How can it be free‽ There must be some catch!" and to the reality of just "Is this really free without a catch?"

Because we should be wary but not give into the idea that free is actually too good to be true. Things can actually be free, and people can actually be pro-social in their motivations.


Signal Foundation: https://en.wikipedia.org/wiki/Signal_Foundation

Paid for by Brian Acton's conscience.


I'm pretty sure companies that offer paying services also spy. Basically everyone does.


I opened the article.

My ad blocker blocked 20 scripts, the page somehow managed to still load something from facebook.com--which was the last script to load and froze the page, and then a video started playing automatically.

Doesn't look like CNN can preach anything.


It's continuing to like the most recent Facebook exposure is going to get a lot more public interest than Equifax or other previous exposures over the last decade.

The author suggests that the key difference now is GDPR compliance will ultimately force the public to routinely pay attention to the personal data industry.


The only thing keeping all most people's app download history from getting leaked is fb's (and others') threat of kicking the app download ad partners off their platform. They usually don't do that, and it's always reactive, meaning the damage is already done.


This site itself is full of people who see nothing wrong in the invasive stalking of users by facebook or google inspite of knowing about their practices well before the public. If there was any serious concern you won't need a whistleblower.

While facebook is bad, Google and Android is far worse. Singling out facebook without comment on the unrestrained greed and ethical vacuum in the engineering community that makes this possible seems not only insincere but also feels like a hatchet job by vested interests, happy to replace facebook with their version of the 'users are dumb' and laugh their way to the bank.

The community here is deeply intertwined with invasive practices and implementing and defending them for years now and cannot simply wash their hands away.


From a while ago, this famous onion piece...

https://www.youtube.com/watch?v=juQcZO_WnsI


This reminded me of Scott McNealy from 1999 saying you have no privacy get over it! https://www.wired.com/1999/01/sun-on-privacy-get-over-it/


There's an old adage that I go by–if you're not paying for a product, you are the product.


I guess. But Windows 10 and Amazon Echo are bought and paid for products that seem to be joining the spy-on-you-game.


Windows 10 is basically free considering it comes on $100 tablets now, and you can easily buy OEM win10 home licenses on eBay for $6. And the fact that they upgraded all win7 users to win10 for "free". Microsoft expects to make money from office365 subscriptions, xbox game store purchases, azure, etc.


'etc.' == your data?


Likely, but the inverse may be not true.


I find it so frustrating when people trot out the "if you're no the customer, you're the product" about Android and then claim that it's impossible for Apple to monetize your data just because you also paid through the nose for that shiny iPhone.


I have never seen anyone claim that Apple cannot monetize your data; only that, at present, they do not.


Like The New York Times, where you pay, and they serve you ads, and they collect your data.


If you're paying for a product, you are the product, too. Merchants, banks, credit card companies, utilities, etc, routinely sell your transaction info up the river.


Especially in China, almost all the android apps will steal your personal info, such as all your contracts, all your sms, all your photos, all other apps and etc.


And not only companies, probably your government too


s/spying on/recouping their investment in/


To everyone who is saying "What's the big deal? Wasn't all of this obvious and well known?" - ask 10 people you know who the parent company of WhatsApp and Instagram is (and throw in an irrelevant app in there just to make it less predictable). If your friends list is across a reasonable cross spectrum of age and job titles, I am guessing not more than 2 of them would know the answer. Or, if you want to make it a little more humorous, ask "So what do you think of the recent Facebook scandal?". At least a few of them would say "Oh! I don't use Facebook anymore! I only use WhatsApp"


Because normal users are not techies. They just use whatever they want and not getting into their company information, privacy or other things.

World is about money. You have to realize that that best money come form people who don't give a f$#k. They click on ads, they give their personal data, they buy the most, etc. We can rant as much as we want that Apple does not give us PRO hardware that Microsoft does the same but most of their income is from ordinary people who just use their hardware/software.


had a non-tech friend recently message me this (about brian acton from WhatsApp tweeting against Facebook):

"so dumb. of course the founder of a competing company would criticize them"


> Or, if you want to make it a little more humorous, ask "So what do you think of the recent Facebook scandal?". At least a few of them would say "Oh! I don't use Facebook anymore! I only use WhatsApp"

Or: "what was the scandal?"


Tech-savvy person here, "big deal" isn't what I'm wondering.

How on earth, though, is this "big news"?


Because it started with Trump and Trump makes people click on headlines. They have now realised that Facbeook is bad also makes people click on headlines. That's all.

In any half serious newspaper this isn't big news but more of a reminder of a story they ran when Facebook launched this shit.


[flagged]


Please stop repeating this.


Almost every company is spying on you online. Including CNN and hacker news.

The question is why is everyone picking on FB? In china or russia, Xi or Putin orders the institutions to attack so and so and the media/government hounds an entity.

What happened with FB? Was it just an magical organic process where the media, government, etc all decided to attack FB all at once? That's quite a coincidence. What's even more interesting is how britain, canada and western europe also joined in as well.

I'm not a fan of FB. I've never had a FB account and never will. But what has happened in the past year vis a vis FB is quite astounding.

I don't think there has been a day on HN the past year where we didn't have a hit piece on FB.


FWIW, not every major site on the Internet is out to spy on you.

The Wikimedia Foundation (Wikipedia, et al) bends over backwards to explicitly avoid harvesting and hoarding long-term analytic information that can clearly identify users and their patterns, even internally. Also, the (very minimal) level of co-operation with state actors (etc) is tracked and published at https://transparency.wikimedia.org/ .


Facebook never gave me anything of value in exchange for constantly monitoring and profilingmy behavior online. in fact, as it became ubiquitous,it added a new chore for me: maintaining ever changing privacy options on a defensive profile on their network.

So it takes peoples time, attention, and details on top of behavioral monitoring.

In contrast, Google provides me with a very competent productivity suite, a superb photo-managing software navigation, maps, aggregate traffic data,and a host of tools to actually build a business and educate myself and others.

Plus i get enterprise class security for my account and -arguably- the best web email service.

The day theres a data breach or in this case a breach of trust, im more likely to view google in a better light and give them the benefit of the doubt. Facebook gets my contempt and scorn.


> Facebook never gave me anything of value in exchange for constantly monitoring and profilingmy behavior online.

Then don't use it. I don't use it. It's not that difficult.

> In contrast, Google provides me with a very competent productivity suite, a superb photo-managing software navigation, maps, aggregate traffic data,and a host of tools to actually build a business and educate myself and others.

This reads like cringe material from google's social media team.

> Facebook gets my contempt and scorn.

Well both google and facebook get contempt and scorn from me. But then again I don't work for google or facebook so I can be somewhat objective.


Other websites are different. facebook is performing one big MITM attack between friends and family, and shameless siphoning and selling all information to nefarious bidders.


I'm all for privacy, but I'm also all for facts and reason, and some of this comments are getting incendiary.

> facebook is performing one big MITM

Is it a MITM attack if you choose to use that platform? That's like saying Uber is kidnapping, because you're in someone else's car. The whole point of MITM is you don't know there's a MITM.

> shameless siphoning

Accurate.

> selling all information to nefarious bidders

The data by CA was not sold, it was stolen. Facebook sells targeted ads.


> Is it a MITM attack if you choose to use that platform?

They also build 'shadow profiles' of people who don't, though.


That's sketchy, but not a MITM since there's no communication to or from a shadow profile. Again, I'm all for privacy and it's unceasing that facebook has profiles of people without their knowledge, but just trying to keep the discourse rational cause I've seen a lot of very sentimental and fearful posts, which lead to an irrational collective discourse, which just leads to chaos and unproductive conversations.


There are Facebook trackers on nearly every website and they siphon data from your friends & family which you have no control over. Yes, yes, I can and do block things via browser extensions and whatnot, but it's simply not possible to stop them from sucking up a considerable amount of data.


So if I have never joined Facebook, but fb has logged phone calls to me and associated them with my shadow profile - what is that?


FB has control over both collecting personal data and filtering what news to show. Not to mention scale.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: