Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook denies it collects call and SMS data from phones without permission

techcrunch.com

Post reply on HN
Print view View original

31–40 of 370 posts

Re: Facebook denies it collects call and SMS data from phones without permission

#31

Post by underwater »

lucb1e wrote: post #8

I'm sure they had their "permission" on page 27 of the terms of service. This isn't news... My opinion is still that those terms of services are silly. If I ever do start my own business, one of the things on the checklist is to have a minimal, if any, terms of service, because nobody wants to waste time reading them, and 99% of what is in ToSes is in the law anyway. Except, of course, data collection beyond function…

If you read the TechCrunch article you wouldn't have to guess where it was shown. There is a screenshot of the prompt that shows that the prompt and explanation "Continuously upload info about your contacts like phone numbers and nicknames, and your call and text history." Your solution of hiding this information in a minimal terms of service is strictly worse.

My take away is that you can tell users exactly what you're doing and they'll still be outraged. So don't do creepy stuff.

Re: Facebook denies it collects call and SMS data from phones without permission

#32

Post by endymi0n »

soziawa wrote: post #14
drawkbox wrote: post #9

Much of this blame goes on Android and some on iOS/Apple. The phone/call permissions, especially for Android, were needed for any app that wants to suspend when a call comes in and for analytics/social libs. I always hated that about Android especially because even harmless games made it look like you were taking contacts and monitoring calls. Of course this would be abused and it is all over the place. Unfortunately…

> Much of this blame goes on Android and some on iOS/Apple. Which part of the blame goes on Apple?

Apple had zero permission management on the contact book, it was wide open. Especially FB and LinkedIn exploited that heavily and partly do to this day.

Re: Facebook denies it collects call and SMS data from phones without permission

#33

Post by on_and_off »

I remember working on integrating facebook with an app I was working on several years ago. It was in the pre-M days, so Android was still using the old install time permission system.

As soon as facebook would be installed without even running the app, it would access the contact database and do network operations (very probably uploads .. ).

For this reasons, well among many others, I never installed the facebook app on one of my personal devices at the time.

In their credit, when M arrived, they have updated their app pretty quickly to the new permission model.

Still, I try to be as conservative as possible with critical permissions.

The only one I regret is whatsapp now that facebook owns them.

Re: Facebook denies it collects call and SMS data from phones without permission

#34

Post by drawkbox »

orb_yt wrote: post #16
drawkbox wrote: post #9

Much of this blame goes on Android and some on iOS/Apple. The phone/call permissions, especially for Android, were needed for any app that wants to suspend when a call comes in and for analytics/social libs. I always hated that about Android especially because even harmless games made it look like you were taking contacts and monitoring calls. Of course this would be abused and it is all over the place. Unfortunately…

> The phone/call permissions, especially for Android, were needed for any app that wants to suspend when a call comes in. No they weren't

You need/needed READ_PHONE_STATE if you wanted to suspend your app data/saving and allow calls to be accepted you did.

For instance you are playing a game and a call comes in, you needed them to allow that and to possibly not crash your game and save your data as well as for some analytics/social network integration.

Also if you allowed os level music to be played over game audio, you need that to handle music and app state when a call came in.

It was/is a default on many large app platforms including game engines like Unity and any social network app integration such as Google Play Game Services and Unity analytics [1][2]. When you have READ_PHONE_STATE you could get the number and more.

For games it wasn't such a big thing but for apps like Facebook that are always running and kept alive playing a silent sound [3], it could get every call that ever came in on record and apparently did. With these holes, apps could scrape everything and they did [4].

[1] https://forum.unity.com/threads/unity-5-1-adds-android-permi...

[2] https://stackoverflow.com/questions/39668549/why-has-the-rea...

[3] https://www.reddit.com/r/iphone/comments/3opxhm/facebook_app...

[4] https://arstechnica.com/information-technology/2018/03/faceb...

Re: Facebook denies it collects call and SMS data from phones without permission

#35

Post by hux_ »

mrarjen wrote: post #29

I always enjoy these lawyer correct texts by facebook and how we all know it's been going on for a long time now. If only the general public would suddenly all figure this out! It's 50/50 now if everyone will forget this next month, or if the new trend continues to remove facebook.

Yup. Everything has been reduced to generating memes/outrage and reacting to them.

Only exit from the trap is turn off the internet.

Re: Facebook denies it collects call and SMS data from phones without permission

#36

Post by pdkl95 »

lucb1e wrote: post #8

I'm sure they had their "permission" on page 27 of the terms of service. This isn't news... My opinion is still that those terms of services are silly. If I ever do start my own business, one of the things on the checklist is to have a minimal, if any, terms of service, because nobody wants to waste time reading them, and 99% of what is in ToSes is in the law anyway. Except, of course, data collection beyond function…

> nobody wants to waste time reading them

How about a law that requires the party presenting legal paperwork to show that the recipient could have read the document. Use an algorithmic method to estimate the reading time, take off ~33% to account for variance in reading ability, and declare that the minimum time that must be spent with the document.

If you cannot show that e.g. someone clicked "I Agree" at lest 5 minutes (or whatever) after they received the ToS text, then the court will assume prima facie that the have not read the ToS and are not responsible for anything in it. The friction this would add to the checkout/signup process grows with the document size, creating an incentive to write short and simple ToS.

Re: Facebook denies it collects call and SMS data from phones without permission

#37

Post by malka »

Gaelan wrote: post #5

The Facebook blog post includes this screenshot [0]. That's definitely an opt-in, although I could imagine a non-technical person clicking through it without reading the grey text. Better than nothing. [0]: https://fbnewsroomus.files.wordpress.com/2018/03/opt-in_scre...

dark pattern like this one needs to be hammered down by law. We should consider the most prominent button as "default" and such a form as an "opt-out".

Re: Facebook denies it collects call and SMS data from phones without permission

#38

Post by verinus »

pdkl95 wrote: post #36
lucb1e wrote: post #8

I'm sure they had their "permission" on page 27 of the terms of service. This isn't news... My opinion is still that those terms of services are silly. If I ever do start my own business, one of the things on the checklist is to have a minimal, if any, terms of service, because nobody wants to waste time reading them, and 99% of what is in ToSes is in the law anyway. Except, of course, data collection beyond function…

> nobody wants to waste time reading them How about a law that requires the party presenting legal paperwork to show that the recipient could have read the document. Use an algorithmic method to estimate the reading time, take off ~33% to account for variance in reading ability, and declare that the minimum time that must be spent with the document. If you cannot show that e.g. someone clicked "I Agree" at lest 5 min…

No thank you.

How about present your TOS in a form that is understandable by the average user in a span of 2 minutes? Without being a lawyer...(and I doubt you have 2 minutes at all)

Re: Facebook denies it collects call and SMS data from phones without permission

#39

Post by drawnwren »

pdkl95 wrote: post #36
lucb1e wrote: post #8

I'm sure they had their "permission" on page 27 of the terms of service. This isn't news... My opinion is still that those terms of services are silly. If I ever do start my own business, one of the things on the checklist is to have a minimal, if any, terms of service, because nobody wants to waste time reading them, and 99% of what is in ToSes is in the law anyway. Except, of course, data collection beyond function…

> nobody wants to waste time reading them How about a law that requires the party presenting legal paperwork to show that the recipient could have read the document. Use an algorithmic method to estimate the reading time, take off ~33% to account for variance in reading ability, and declare that the minimum time that must be spent with the document. If you cannot show that e.g. someone clicked "I Agree" at lest 5 min…

Various ToSes already attempt this. Either by forcing you to scroll to the end, timing you, or by putting verification next to each paragraph. Still, no one reads them. The problem is putting a legal contract before a leisure app. I'd rather see legislation that requires the reading level and length of the ToS to match the reading level and attention span of the average user.

Re: Facebook denies it collects call and SMS data from phones without permission

#40

Post by plasma »

Facebook Messenger is keeps reminding me to let it access my contacts “to find my friend”; after telling it no it stops reminding for a while then it comes back again.

This attitude is just an example of the constant weasel to get access to the data.

Post reply on HN