Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook denies 'listening' to conversations

bbc.com

Post reply on HN
Print view View original

201–210 of 415 posts

Re: Facebook denies 'listening' to conversations

#201

Post by throwaway613834 »

nilved wrote: post #198
throwaway613834 wrote: post #64

Earlier quoted context omitted.

> Regardless, it’s easy enough to dump HTTPS traffic (pinned or otherwise) if you have root access to the client, which in the case of Android is not difficult to get. Hm, well okay, would you mind explaining the easy procedure that lets you capture Facebook traffic then? I have tried lots of different methods (Fiddler, Xposed modules, etc.) with root access and have failed. It's no problem in theory, but practice is…

If you have root access to one end of encryption, you necessarily can inspect and save it. The way I would do this is by issuing a certificate for facebook.com that I mark as trusted on the device. This will let you do a man in the middle "attack." But you can probably do this directly on the device: just look for where the encryption is taking place, and intercept it.

> The way I would do this is by issuing a certificate for facebook.com that I mark as trusted on the device.

Half the entire point is "mark it as trusted" doesn't work when the application has already pinned the certificate it's expecting. Have you actually done this yourself at all?

> But you can probably do this directly on the device: just look for where the encryption is taking place, and intercept it.

"Just" intercept it? You mean "just" spend several weeks if not months trying to disassemble/decompile their code, figure out how to inject your own, somehow locate the relevant in-memory data structures for encryption, & reliably patch them at runtime? all while preventing the application from crashing? That's "easy" to you? Have you done any of these things you're suggesting yourself? How often have you done them? and how long have they taken you that you found them "easy"?

Re: Facebook denies 'listening' to conversations

#202

Post by halflings »

underwater wrote: post #199
tfinniga wrote: post #141

Earlier quoted context omitted.

Right, like the example from Target. It is possible that facebook has access to a stream of Target purchases or credit card purchase information. I'd be 0% surprised if there was a data sharing agreement with credit rating companies. Even if they just knew the price of the purchase, combined with the job (burn risk) and location data (traveled from work to nearest store with pharmacy during the day), it's possible th…

I'm sure Facebook would like to do what you're saying, but I think that they're a long way from having those capabilities. They have billions of users, billions of ads, and trillions of pieces of metadata. Sifting through that to produce a guess like "User 1234 burned themselves and would be interested in product 5678" would be an amazing and scary piece of AI. Not to mention that Facebook are limited by the ads they…

Patterns like these can definitely be inferred by machine learning, with well principled models.

P(product_class=bandage | job=factory_worker, pharmacy_visit_last_month=1) >> P(product_class=bandage)

Re: Facebook denies 'listening' to conversations

#203

Post by ggreer »

denzil_correa wrote: post #178
madeofpalk wrote: post #164

Earlier quoted context omitted.

Facebook doesnt request microphone access on iOS. https://imgur.com/a/ifaiT Edit: Actually, FB will ask for microphone permission if try to record a video. Based on every other app that records video also prompts for permission to record using the microphone, I'm lead to believe the microphone permission is required on iOS if you want to record video. FB Messenger does not prompt for Microphone until you record a vid…

> https://imgur.com/a/ifaiT I can see "Messenger" and "Instagram" with access to microphone.

Those apps have voice and video features, so it makes sense that they'd request microphone access. (And iOS lets you disable those specific features if you want.)

iOS also shows an indicator if an app is using the microphone. This is true even for built-in Apple apps like Voice Memos. There's no way to surreptitiously record.

Re: Facebook denies 'listening' to conversations

#204

Post by halflings »

sp527 wrote: post #28
halflings wrote: post #25

Earlier quoted context omitted.

IMHO this is irrelevant to what is being discussed here. > enables devices powered by Snapdragon 800 processors to be “woken up” by a custom voice command (beginning with a custom phrase set by the device OEM like “Hey Snapdragon”, for example) Because they are always on and have to use minimal power, these chips are used to recognise a very specific term (probably why these companies don't let you customise how you…

Why would audio have to be transcribed locally on battery power? You could do that server-side and/or keep the data stored locally as audio until the device is charging and on WiFi.

Record audio data continuously on disk? I'm not sure if this is even worth debating, it is a fact that this is not happening (these chips are on most new Android phones, and they do not save audio).

Re: Facebook denies 'listening' to conversations

#205

Post by twostorytower »

I don't see definitive proof one way or the other, but I've never given Facebook microphone access on my iPhone. And many others users claiming they've received targeted ads haven't either. But something interesting that is being pointed out on Reddit is that they can use your gyroscope to detect vibration and convert it to soundwaves when your phone is on a flat surface. The PM at Facebook denies listening to the microphone, but what about the gyroscope data? Technically, what he is saying could be a true statement, but still invading privacy just as much.

Re: Facebook denies 'listening' to conversations

#206

Post by halflings »

quickben wrote: post #56
halflings wrote: post #25

Earlier quoted context omitted.

IMHO this is irrelevant to what is being discussed here. > enables devices powered by Snapdragon 800 processors to be “woken up” by a custom voice command (beginning with a custom phrase set by the device OEM like “Hey Snapdragon”, for example) Because they are always on and have to use minimal power, these chips are used to recognise a very specific term (probably why these companies don't let you customise how you…

What minimal power? Phones are being charged at home all the time. Android apps can prevent sleep. Dsp to parse voice is there. There are sdks for all this.

These chips are built to use an unnoticeable amount of power. One of the biggest factors for a mobile is battery life, hence my comment.

Re: Facebook denies 'listening' to conversations

#207

Post by sp527 »

halflings wrote: post #204
sp527 wrote: post #28

Earlier quoted context omitted.

Why would audio have to be transcribed locally on battery power? You could do that server-side and/or keep the data stored locally as audio until the device is charging and on WiFi.

Record audio data continuously on disk? I'm not sure if this is even worth debating, it is a fact that this is not happening (these chips are on most new Android phones, and they do not save audio).

Wait are you trying to say there’s no way to record audio on a smartphone app? And also, why are you calling it “disk”? Smartphones use flash memory for storage.

Re: Facebook denies 'listening' to conversations

#208

Post by nilved »

throwaway613834 wrote: post #201
nilved wrote: post #198

Earlier quoted context omitted.

If you have root access to one end of encryption, you necessarily can inspect and save it. The way I would do this is by issuing a certificate for facebook.com that I mark as trusted on the device. This will let you do a man in the middle "attack." But you can probably do this directly on the device: just look for where the encryption is taking place, and intercept it.

> The way I would do this is by issuing a certificate for facebook.com that I mark as trusted on the device. Half the entire point is "mark it as trusted" doesn't work when the application has already pinned the certificate it's expecting. Have you actually done this yourself at all? > But you can probably do this directly on the device: just look for where the encryption is taking place, and intercept it. "Just" int…

I've done all of these things since it's my job. I haven't tried Facebook, because I don't have any confidence in the surveillance hypothesis, but my first guess being inapplicable doesn't change the fact that root access would allow people to prove this is happening, and that hasn't happened.

Furthermore, this could be proven with some fair reliability using correlation only. Is more encrypted data sent when you're speaking? Is more encrypted data sent when the microphone permission is enabled? Does the app access the microphone while sleeping? Nobody has presented anything _close_ to evidence.

Re: Facebook denies 'listening' to conversations

#209

Post by madeofpalk »

user982 wrote: post #200
tedunangst wrote: post #165

Earlier quoted context omitted.

Apparently people think there's a secret backdoor that lets an iPhone app record audio without turning the status bar red. You could deny mic permission and people would still think it's the secret backdoor.

There was a backdoor that let the Uber iPhone app record the screen invisibly from the background that went unnoticed for years.

Well no, Apple (in an unprecedented move), granted the Uber app the com.apple.private.allow-explicit-graphics-priority entitlement.

    "Apple gave us this permission because early versions of Apple Watch
    were unable to adequately handle the level of map rendering in the Uber
    app," an Uber representative, Melanie Ensign, told Business Insider.
    "Subsequent updates to Apple Watch and our app removed this dependency,
    and we're working with Apple to remove the API completely."
Uber was doing other sneaky stuff to read the devices serial number (or other unique identifiers) and evade Apple's countermeasures, but that's seperate from this.

Re: Facebook denies 'listening' to conversations

#210

Post by maltalex »

rickhanlonii wrote: post #103

They're listening, but not to your voice or with a microphone. Facebook is listening to your data--to all of our data, all at once. They have locations, searches, clicks, messaging, photos, hashtags, and any other form of browsing patterns for everyone in your country, everyone in your neighboorhood, everyone in the same room as you. They have enough data with such advanced analysis that on occasion they can get real…

> a sufficiently advanced amount of data and analysis will be indistinguishable from surveillance.

What’s surveillance if not “sufficently advanced amount of data”? They’re indistinguishable becaus they are the same.

Facebook isn’t “collecting data”. It really is following you.

Post reply on HN