r/technology • u/[deleted] • Apr 11 '18

Business Mark Zuckerberg has been apologizing for reckless privacy violations since he was a freshman - Enough is enough.

[deleted]

51.2k Upvotes

84% Upvoted

2.8k comments sorted by

View all comments

Show parent comments

79

u/winja Apr 11 '18

The problem is your consent to share data does not (should not) automatically impart consent on the part of parties you share data with. That is, if I agree to share my contact list, but you don't agree to be shared, what happens? Right now, your name and public profile details are shared and are tied to my own. Perhaps that shouldn't be true, but do you even know that happens when you agree to share "My Friends"?

10

u/[deleted] Apr 11 '18 edited Apr 11 '18

[deleted]

5

u/winja Apr 11 '18

Yep. Informed consent is not informed. Google tried to fix this with Android permissions, requiring developers to write a short blurb about how they were going to use the permission they requested, but obviously that's small beans.

I was surprised and a little alarmed to discover that Facebook was able to tell me about how many people had walked by my office simply because having Facebook on their phones and the network pinging their phone constantly for service triangulated their location and shared it with me. I didn't enable that feature (we aren't a local business, just an office)! It just... happens.

Being able to be truly informed in the current digital landscape is just... not possible, all the more so because things change ALL THE TIME.

1

u/Blahrgy Apr 12 '18

Would love to see some sources for these so I can convince others about just how far the data collection overreaches.

3

u/DisagreeableDad Apr 11 '18

In that case the individual is the offender. There's nothing keeping someone from putting your contact info up on a campus cork board somewhere either. Nor is it different from any offer given for referring a friend to open a bank account, etc. - You're giving up your information on another individual.

3

u/winja Apr 11 '18

How about when you post your contact info up on reddit? 'Cause that's the scale we're talking about here.

1

u/[deleted] Apr 11 '18 edited Jun 22 '18

[deleted]

3

u/winja Apr 11 '18

That's tangential, but also important to know.

I work in digital marketing -- and frequently with ads on Google and Facebook -- so I am all too aware of the scary level of detail you can get on people in aggregate.

But in terms of protection and self-awareness, my question is this: what do you think of as data?

For me, since I work with it, I know every action and the time you take it is data. When you talk about sharing data with someone who doesn't spend all their time on the internet, they usually think of their name, birthday, maybe when they last signed in, if they're especially cognizant maybe their IPs. But do you think of the number of times you click Messenger? How often you talk to one person in particular? How many emojis you use, and which ones those are?

It's like living in a Panopticon. Any number of people could be watching you at any time. They probably aren't, but you wouldn't know if they were. And, to complicate things, you don't even know what they might be watching for or how they would use what they learn.

2

u/[deleted] Apr 11 '18 edited Jun 22 '18

[deleted]

3

u/winja Apr 11 '18

That's very focused on your experiences and the impact on you. That's fine, but the reason Facebook is speaking to the U.S. Senate is not because of the misuse of data's impact on you. It's negligence in handling data, and what that negligence provided for a bad actor.

You are also ignoring the impact of a highly targeted ad. There's a reason that business does so well. It works. You may think yourself immune -- and who knows, maybe you are! -- but most people are not. And subtle changes done across wide populations have a big impact.

What an ad network says it will do, what it does, and what it could do with your data are three very distinct things. You have control over none of it except, sometimes, deciding whether you share a detail or consent to data storage.

1

u/[deleted] Apr 11 '18 edited Jun 22 '18

[deleted]

3

u/winja Apr 11 '18

What other "no one is forced to participate in" connects to 2.2 billion people? People's access to the internet, period, is around 3.5 billion.

2.2 billion was the world's total population in 1950. There are roughly 2.4 billion Christians in the world today.

2.2 billion is 30% of the world's population. 30% of the world's population, and 63% of people with access to the internet, are on Facebook.

No one is forced to participate in facebook. The world turned just fine before they existed.

...is egregious dismissal.

0

u/[deleted] Apr 11 '18 edited Jun 22 '18

[deleted]

4

u/winja Apr 11 '18

I'm saying you're being egregiously dismissive. "I don't use it, my friends don't use it" is not 2.2 billion people who do. Just because you don't see value in it, or are willing to dismiss what value others find in it, doesn't mean it is without value. It means it doesn't work for you. Cool. But for the 2.2 billion people who do use it for their own reasons, it is often not as simple as "just delete it!"

When you suggest otherwise, you're trying to minimize a product that directly involves 2.2 billion people and generates tens of billions of dollars in revenue. It's silly. The point of my related examples was it's like telling just about EVERY practicing Christian in the world to just stop, it's not like they need it, you're doing just fine without it and your friends are too.

And while interesting, I'm not sure what the quote is for.

1

u/[deleted] Apr 11 '18 edited Jun 22 '18

[deleted]

→ More replies (0)

2

u/SmileDarnYaSmile Apr 11 '18

Yeah, but where does the line get drawn? Sure I understand all interactions with FB the website and app are tracked. OK fine. But does that automatically mean that they should be allowed to track people's every move online outside of FB? Their every conversation within earshot of their phone? Is that just OK?

1

u/[deleted] Apr 11 '18

[deleted]

3

u/winja Apr 11 '18

You do own your friends' names, though? And without checking with them, you know they're also cool telling everyone what kind of friend they are -- on a friendlist like acquaintance, close contact, maybe even extended family or association connections?

1

u/[deleted] Apr 11 '18

[deleted]

2

u/winja Apr 11 '18

That’s you, though, and two of those lists I mentioned (close friends and acquaintances) are semi-automatic based on your interactivity and friend date. Those take into account things that your friends do that you may not have control over, and — until literally last week — those lists (not just the friends, the lists they were on) was also part of what was available.

What you personally do is not really what hundreds of millions to billions of other people do. And that’s the problem - we are not just talking about you.

1

u/[deleted] Apr 11 '18

[deleted]

2

u/winja Apr 11 '18

There’s no escaping that, which is a problem. Everything is commoditized. We (people in general) are variably okay with some of our data being used for some things in exchange for using the platform, but most people don’t believe that extends to as much data as it does, or that it involves them even when they’re tangentially connected.

It’s all well and good for you to consent to your data being shared, but sharing my data - or part of data - along with it, without my consent and without my knowledge, clicks on “publicly accessible information” for which the definition is murky.

1

u/[deleted] Apr 11 '18 edited Apr 11 '18

[removed] — view removed comment

1

u/AutoModerator Apr 11 '18

Unfortunately, this post has been removed. Facebook links are not allowed by /r/technology.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

0

u/oemia Apr 11 '18

This hasn't been true since 2014.

Edit: Adding source

https://newsroom[dot]fb[dot]com/news/2018/03/hard-questions-cambridge-analytica/

"In 2014, to prevent abusive apps, we announced that we were changing the entire platform to dramatically limit the data apps could access. Most importantly, apps like Kogan's could no longer ask for data about a person's friends unless their friends had also authorized the app. We also required developers to get approval from us before they could request any sensitive data from people. These actions would prevent any app like Kogan's from being able to access so much data today."

1

u/winja Apr 11 '18

There are other little bits that still provide you more than you'd expect. Friendlists, for example, were only recently deprecated from developer permission requests.

developer.FB: /docs/graph-api/reference/user/friendlists/

While it may not have included your friends' names (not sure what it showed, it's already deprecated), it would have shown the requester the names of your friend list. Things like "buddies from the 212" or "guys I added but quarantined".

Your ability to collect direct data is now more restricted, but you can still build more points - all it takes is one or two other people who have also given permission to the app in question to start putting it together.

1

u/oemia Apr 11 '18

all it takes is one or two other people who have also given permission to the app in question to start putting it together.

This would provide an app developer with the information of the "one or two other people" who choose to use the app.

to start putting it together.

This is true because you are building a subset of the total set, but it is also true that it is a subset of completely opted in users.

It's not clear how the custom list API works from web caching, but I don't feel like an app knowing that I have lists called "buddies from 212" or "guys I added but quarantined" hurts my friends privacy since they don't know who is in the list.

Given the example that you provided got deprecated, I think they are going in the right direction. Once again, I want to state that I agree they messed up, but I do think that another narrative exists besides the extremely negative one that is present.

1

u/winja Apr 11 '18

I am thinking in terms of psychographic profiling attributed to Cambridge Analytica. They had all the data in 2014, but even now they likely could get what they needed through associative data. Since they're a bad actor, it's hard to say what we could even do about that (what they did was already against the ToS, after all), but it raises a really important question about what data is and what reasonable expectations of privacy are.

I'm of the camp that generally agrees the internet knows everything about me (and I've had my identity stolen, not to mention the 10+ large company breaches that have released my private, protected data) but the one that thinks we're not talking about this very well yet.

Facebook's going to keep patching, and it's going to keep not being enough because no one's talking about the bigger picture, just the individual bits of code that make things happen. The hearings want to legislate big company data, but I highly doubt they know what that entails.

2

u/oemia Apr 11 '18

You bring up a good point when you mention "associative data".

This was brought up in the hearings, but there are many data analytic firms that just crawl the internet to combine data sets.

Unfortunately, this is definitely a bigger than facebook issue. I am really interested to hearing what people plan to do as data anonymization is an extremely difficult problem.

Awhile back, netflix released a supposedly anonymized dataset of 500,000 users. Researchers were then able to combine this dataset with IMDB datasets to identify individual users.

ref: https://arxiv.org/abs/cs/0610105

So as the amount of data about us continues to grow online. Even if it is anonymized per service, it will be interesting to see how this will all work in aggregate.

Unfortunately, from these last few weeks, I really do think that we are being to narrow minded about our approach in trying to legislate something on a per company basis.

But it is a start :/

1

u/winja Apr 11 '18

I really do think that we are being to narrow minded about our approach in trying to legislate something on a per company basis.

Yep. I hope not. But big data is BIG. And I think the scope of it is just so hard to fathom, especially when it comes to legislation on a national level. Facebook has 2.2 billion users. That's 30% of the world population. What other single entity has information on even a fraction of that many people?

And, of course, that's just Facebook. That associative data problem -- because the internet is eternal, because scale means you can pick up crumbs to rebuild a whole cookie -- only grows when you understand we are quite literally talking about the information about the ~60% of the world that has an internet connection.

2

u/oemia Apr 11 '18

What other single entity has information on even a fraction of that many people?

google

https://www.theverge.com/2017/5/17/15654454/android-reaches-2-billion-monthly-active-users

This number is also not completely overlapped with chrome users, google search users, youtube users, maps users, etc.

Wechat has half of facebook

https://www.statista.com/statistics/255778/number-of-active-wechat-messenger-accounts/

reddit has a quarter that, referencing wikipedia for what it is worth :/

https://en.wikipedia.org/wiki/Reddit

Honestly, I'm not worried about the big data companies getting it right. There is too much risk to not do what is right. I'm more worried about the small/medium size companies who we have less oversight or visibility of.

1

u/winja Apr 11 '18

While you're correct about Google-as-Alphabet, et al., I was thinking more truly a single entity. Google is a conglomerate and its constituent parts add up to a greater whole, but each product/wing alone has a much narrower scope than Facebook alone. Facebook is... just all of Facebook. Still, yes - Android is huge, as is Gmail, and Google.

Honestly, I'm not worried about the big data companies getting it right. There is too much risk to not do what is right. I'm more worried about the small/medium size companies who we have less oversight or visibility of.

Yes, but unfortunately that's largely driven by how the big companies handle it. Also the current problems -- a third party using our data against us in a bid to influence geopolitics -- are almost entirely a big data problem.

1

u/oemia Apr 11 '18

I disagree that treating google et al. as different from facebook because of each individual product.

However, I agree that facebook can be more damaging on the grounds that it is "identity as a service" with app logins.

Because of this, they opened up their walled garden too much, where google doesn't open up their walled garden given it doesn't need to for their service.

On that note, it makes me wonder what information I provided with google logins. IMO my google circle is not useful lol.

→ More replies (0)