Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Searching Facebook drives home the privacy degradation problem

willmoffat.github.com

Post reply on HN
Print view View original

11–20 of 39 posts

Re: Searching Facebook drives home the privacy degradation problem

#11

Post by rictic »

aristoxenus wrote: post #4

Point taken, but what's with the collateral damage? Search for something that's not going to ruin people's lives. FB has a problem. You outing these people on the web isn't helping anything. If you wanted to be classy, you'd leave out the names and/or put rectangles over their eyes. As it is now, you're at least as much an asshole as Zuckerberg.

We briefly added these measures, but after thinking it over we've decided to disable them.

From a technical standpoint they're a fig leaf. This isn't a complex server-side app, it's a minimal UI on top of the JSON results Facebook returns for these searches: http://graph.facebook.com/search?q=control+urges&type=po... . This is frankly the least scary use of this data. For example, it would be trivial to start crawling this data and building your own indices to enable far more invasive searches.

Our goal is to draw attention to this so that people become outraged and Facebook changes their privacy settings. The security community has been having this conversation for a while (more info: http://en.wikipedia.org/wiki/Full_disclosure ) and the only reason not to disclose a security or privacy problem is to give the company involved time and resources to fix the system.

This is not the case here. Facebook made this privacy-affecting change quite deliberately, and I think it's clear that they did so with full knowledge of the implications. If there is not an outcry, this will not be fixed. Right now, from Facebook's perspective, the system is working as intended. The longer it stays this way the worse the privacy breach becomes.

Re: Searching Facebook drives home the privacy degradation problem

#13

Post by rictic »

Chirono wrote: post #7
aristoxenus wrote: post #4

Point taken, but what's with the collateral damage? Search for something that's not going to ruin people's lives. FB has a problem. You outing these people on the web isn't helping anything. If you wanted to be classy, you'd leave out the names and/or put rectangles over their eyes. As it is now, you're at least as much an asshole as Zuckerberg.

That seems rather over the top. I can't really see this ruining anybody's life. It isn't letting me search for specific peoples comments. I don't know any of these people, nor am I likely to meet them. This website reminds me of being outside, with people, and hearing little snippets of conversations from strangers. Nobody goes to a park and then complains the council that strangers where able to hear their conversat…

I think that Facebook has failed in two clear ways.

They do not do a good job of indicating how public an action will be. This is true across the internet, but it's a real problem on Facebook due to the strong ties to your real identity there.

They change the rules far too often. If you had a very strong grasp of Facebook's privacy policy two years ago (or even six months ago) that information would be worse than useless today.

Edit: The brunt of the matter however is this: if a few people are using your system wrong, it's their problem. If a large percentage of your users are getting it wrong, it's your problem.

Re: Searching Facebook drives home the privacy degradation problem

#14

Post by hamstersoup »

rictic wrote: post #11
aristoxenus wrote: post #4

Point taken, but what's with the collateral damage? Search for something that's not going to ruin people's lives. FB has a problem. You outing these people on the web isn't helping anything. If you wanted to be classy, you'd leave out the names and/or put rectangles over their eyes. As it is now, you're at least as much an asshole as Zuckerberg.

We briefly added these measures, but after thinking it over we've decided to disable them. From a technical standpoint they're a fig leaf. This isn't a complex server-side app, it's a minimal UI on top of the JSON results Facebook returns for these searches: http://graph.facebook.com/search?q=control+urges&type=po... . This is frankly the least scary use of this data. For example, it would be trivial to start crawlin…

Here's an example of the fig leaf in action: http://willmoffat.github.com/FacebookSearch/?q=HIV%20test&#3...

We decided the redactions reduce the impact without actually offering any privacy at all. (That's up to Facebook and the users).

Re: Searching Facebook drives home the privacy degradation problem

#15

Post by bloodnok »

dschobel wrote: post #8

http://twitter.com/#search?q=hooky I know it's trendy to hate FB right now but don't underestimate the ignorance factor in all of this.

True, but also consider how those two sites evolved. When I post a tweet, I know that it is essentially the same as me taking out an ad in the paper or shouting it at people in the pub. I'm fairly careful with regards to what I post. When I started using Facebook, it was very much about communicating with the group of people you have approved as friends. Over time it has transformed into something much more public, I believe without the bulk of the userbase realising.

Re: Searching Facebook drives home the privacy degradation problem

#16

Post by skybrian »

snewe wrote: post #10

Unless we assume that these people are completely ignorant of the public nature of their status updates, then this isn't a privacy violation. Is the argument that Facebook defaults to public and makes it confusing to change settings?

So how do you find out whether they're ignorant of that? A good way is to search for things that people probably didn't mean to reveal publicly.

If a large number of people don't know what they're doing, that's a UI design fail. It doesn't matter whether they should have known.

(I suspect Twitter has the same problem. People should know it's completely public, but I suspect many don't.)

Re: Searching Facebook drives home the privacy degradation problem

#17

Post by bloodnok »

skybrian wrote: post #16
snewe wrote: post #10

Unless we assume that these people are completely ignorant of the public nature of their status updates, then this isn't a privacy violation. Is the argument that Facebook defaults to public and makes it confusing to change settings?

So how do you find out whether they're ignorant of that? A good way is to search for things that people probably didn't mean to reveal publicly. If a large number of people don't know what they're doing, that's a UI design fail. It doesn't matter whether they should have known. (I suspect Twitter has the same problem. People should know it's completely public, but I suspect many don't.)

When I talk to people about it, there seems to be a general apathy around the privacy aspects. Most are of the opinion "why would someone other than my friends be interested in me and what I did on Saturday night?". I think the first wake-up call comes when their parents join facebook. Otherwise it's being turned down for a job without knowing why, getting fired for bragging about throwing a sickie, being harassed/stalked etc...

Re: Searching Facebook drives home the privacy degradation problem

#19

Post by tokenadult »

rictic wrote: post #11
aristoxenus wrote: post #4

Point taken, but what's with the collateral damage? Search for something that's not going to ruin people's lives. FB has a problem. You outing these people on the web isn't helping anything. If you wanted to be classy, you'd leave out the names and/or put rectangles over their eyes. As it is now, you're at least as much an asshole as Zuckerberg.

We briefly added these measures, but after thinking it over we've decided to disable them. From a technical standpoint they're a fig leaf. This isn't a complex server-side app, it's a minimal UI on top of the JSON results Facebook returns for these searches: http://graph.facebook.com/search?q=control+urges&type=po... . This is frankly the least scary use of this data. For example, it would be trivial to start crawlin…

Our goal is to draw attention to this so that people become outraged and Facebook changes their privacy settings.

Your link to your project is the most fascinating thread I have seen on HN since the thread about how HN was hacked, one of the all-time top karma submissions. But, amazingly, after playing around with your tool for about half the three hours that have elapsed since you posted it, I'm LESS worried about Facebook than I was before. Pretty much since I joined Facebook I have been posting links (including yours today) to my profile about Facebook privacy. Among my circle of Facebook friends, it is cool to have carefully considered privacy settings, and to be circumspect in what to post online. I have good conversations about interesting links on my profile and on my feed (much like HN), and didn't turn up ANYTHING by searching on my own name, my son's name, keywords strongly associated with my friends' interests, or anything else likely to turn up something we wrote out of turn. Now I'm actually beginning to trust Facebook privacy settings again--at least for smart users--after using your tool and the new Give Me My Data app

http://givememydata.com/

to see what can be seen about me on Facebook.

Great work to make such an interesting tool. And, yes, putting the "rectal surgery" example on your webpage is funny and gets the point across very well.

Re: Searching Facebook drives home the privacy degradation problem

#20

Post by kraynar »

elbenshira wrote: post #18

Interestingly, most of the results of "playing hooky" are females. If I were a psychologist, I'd be thrilled about Facebook's idiotic privacy breeches.

I noticed that too. I don't think it's necessarily a sign that females are more likely to shirk responsibility. Maybe just that guys are less likely to call it "playing hooky".
Post reply on HN