Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Secretly Saved Videos Users Deleted

nymag.com

Post reply on HN
Print view View original

311–320 of 405 posts

Re: Facebook Secretly Saved Videos Users Deleted

#311

Post by pwg »

chmaynard wrote: post #10
guessmyname wrote: post #8

This reminds me of the long conversations that I used to have with family members and friends several years ago. With their continuous requests to create my own Facebook profile so I can keep in contact with them and with their activities as well as to share my whereabouts. I always used the same argument to reject these suggestions — "I don't want Facebook to have too much data about me, more than the data that you…

> Facebook and other services do not actually delete data, they just mark it as "deleted" and purge it only if they need the space. You may be correct, but that doesn't explain why Facebook decided to include so-called deleted files in a download of user data. Clearly these deleted files are still a part of Facebook user profiles and accessible to company data mining software. Facebook has exposed their own duplicity…

> but that doesn't explain why Facebook decided to include so-called deleted files in a download of user data.

This happened because the person tasked with writing the code to build the archive forgot to include the filter for "deleted" records somewhere in the code.

I.e., they forgot the "where is_deleted = false" part below on one or more DB query requests like this:

select * from table where is_deleted = false;

This is the biggest problem with the "soft delete flag in database" method of deletion. Every single query writer, everywhere, forever, must always remember to include the "is_deleted" filter in their queries. And when they don't, what was deleted reappears as if it had never been deleted at all.

Re: Facebook Secretly Saved Videos Users Deleted

#312

Post by [deleted] »

e12e wrote: post #172
contravariant wrote: post #163

Earlier quoted context omitted.

Unless I'm misreading, that criteria rules out data about individuals that are not identified and can't be identified. When looking at a single datum by itself, this seems to rule out anything except PII i.e. data that identifies or can be used to identify an individual.

Facial recognition means all pictures with a face are personal data?

[deleted]

Re: Facebook Secretly Saved Videos Users Deleted

#313

Post by kumarvvr »

hrktb wrote: post #266
kumarvvr wrote: post #256

Earlier quoted context omitted.

"best practices" is for developers. For the average Joe and Janet out there, "deleting" something is synonymous to "remove from the internet for eternity"

Except when it’s not, and they want back the data they’ve deleted by mistake. In those cases it will take a lot of support to explain that what is gone is gone. I think customers don’t have a unified vision of what deleting means, they just want what’s optimal for the situation.

Then let FB show what is happening. Let them change the text on the "Delete" button to "Remove from timeline" or something similar.

How hard is it to clearly state what FB is doing in the background?

Re: Facebook Secretly Saved Videos Users Deleted

#314

Post by contravariant »

e12e wrote: post #172
contravariant wrote: post #163

Earlier quoted context omitted.

Unless I'm misreading, that criteria rules out data about individuals that are not identified and can't be identified. When looking at a single datum by itself, this seems to rule out anything except PII i.e. data that identifies or can be used to identify an individual.

Facial recognition means all pictures with a face are personal data?

No clue. All I did was rule out anything that can't be used to identify someone.

Whether information that can only be used to identify someone but doesn't tell you anything useful about them is still personal data is unclear to me.

Re: Facebook Secretly Saved Videos Users Deleted

#315

Post by bitexploder »

ehsankia wrote: post #231
bitexploder wrote: post #223

Earlier quoted context omitted.

Disclaimer: I deleted my Facebook account a couple years ago and never looked back. That said, Facebook is who is just getting collectively stabbed with the pitchfork right now. Engineering best practices are one thing. My right to privacy is another. As an engineer I care about efficiency. As a human I care about privacy. My rights win over any technocratic babble. Sorry if I am being harsh. I am, of course not surp…

I agree that you have the right to privacy, but there's also technical reasons why instant deletion is not always possible. If they can guarantee that the data will be gone after X days, then that's fair to me.

Yeah, that works. A best effort of actual deletion is good enough IMO. Maybe even notification it is actually done being sweeped out of a storage system.

Re: Facebook Secretly Saved Videos Users Deleted

#316

Post by dustingetz »

crdoconnor wrote: post #308
dalore wrote: post #304

Earlier quoted context omitted.

A lot of the big agile companies are using event sourcing. So there isn't even a model to delete. It's all events with the models being created from a snapshot of events. The event stream is usually durable and lives forever. https://martinfowler.com/eaaDev/EventSourcing.html So with this type of system nothing is ever "deleted". It's just an event that something is deleted. This is a common and very scalable system.…

I was thinking the other day that GDPR might make event sourcing problematic.

https://docs.datomic.com/on-prem/excision.html

Re: Facebook Secretly Saved Videos Users Deleted

#317

Post by Someone »

traskjd wrote: post #249
noobermin wrote: post #176

Earlier quoted context omitted.

Allow me to ask the obvious question. Who doesn't do the something like this? Not to alleviate facebook of blame, but who's to say data on almost every other social media service isn't also just flagged for deletion?

We don't soft delete payloads at Raygun ( https://raygun.com ), for the very fact that typically if one of our customers wants to delete something it's because they might have sent something they don't want a third party to have. We have filters and other PII filtering tools etc, but it every now and then something might be sent by mistake. Having said that, you'd be amazed how often folks ask for things to be undele…

It isn’t that hard to combine soft deletes with delayed hard deletes: generate a new encryption key every day for “data deleted today”, and encrypt deleted data with it. After X days, destroy the decryption key.

If you use asymmetric encryption, you can keep the group of people who who can recover “deleted data” small. You could even have an independent party generate your encryption key pair, give you the encryption key, and your customer, on request, the decryption key (I think there is a business model for a non-profit here).

Re: Facebook Secretly Saved Videos Users Deleted

#318

Post by delfb »

scottmf wrote: post #191
kbsletten wrote: post #158

Earlier quoted context omitted.

That's not true. What if you want to support un-delete? That's a reason.

To my knowledge there is and has never been any option to “undelete” your deleted content on Facebook.

Mm, what about deactivated accounts? You can reactivate them, which would involve undeleting data.

Re: Facebook Secretly Saved Videos Users Deleted

#319

Post by gcb0 »

traskjd wrote: post #249
noobermin wrote: post #176

Earlier quoted context omitted.

Allow me to ask the obvious question. Who doesn't do the something like this? Not to alleviate facebook of blame, but who's to say data on almost every other social media service isn't also just flagged for deletion?

We don't soft delete payloads at Raygun ( https://raygun.com ), for the very fact that typically if one of our customers wants to delete something it's because they might have sent something they don't want a third party to have. We have filters and other PII filtering tools etc, but it every now and then something might be sent by mistake. Having said that, you'd be amazed how often folks ask for things to be undele…

and why offer the false sense of security?

if they upload a private key, and delete because they "don't want a third party to have". do you also guarantee it wasn't seen or cached anywhere else? I dont know the details of that product, but I usually treat anything uploaded even once as compromised from that point on.

Re: Facebook Secretly Saved Videos Users Deleted

#320

Post by ahmedalsudani »

nasredin wrote: post #274
fastball wrote: post #227

Earlier quoted context omitted.

If you truly want privacy and security I would recommend Signal over Telegram -- Telegram has had some controversy with respect to their encryption protocol not being audited, as well as some weird stuff with a very large recent ICO that seems entirely unnecessary except as a money grab and Russian subpoenas for their master private keys.

You are getting off one boat and getting on the other one. Destination is the same. Any centralized communication network is by definition insecure (one point of failure). Maybe try Tox. https://tox.chat/ Telegram copperating with Iran https://news.ycombinator.com/item?id=16039859

Signal and Telegram are very different. Signal has always been an open source project that allows you to audit the source and run your own server if you so desire [1].

It’s a project that has always put security first but made some compromises for usability — very different from Telegram which has put expansion and monetization first — and it was started by Moxie Marlinspike whose views and contributions are well-known.

With Signal, it is not a single point of failure. The Android, iOS, desktop apps all do end-to-end encryption. So a compromised server wouldn’t mean your messages are compromised.

The client would need to be compromised, and if the client is compromised, tox.chat is toast as well.

[1] https://github.com/signalapp

Post reply on HN