Facebook Is Giving Advertisers Access To Your Shadow Contact Information • Hacker News Board

Re: Facebook Is Giving Advertisers Access To Your Shadow Contact Information

#441

Post by dillondoyle » Fri, Sep 28, 2018, 9:09 AM UTC

secfirstmd wrote: post #247

adpirz wrote: post #239

What's facebook's boiling point? My guess is they'll respond, they'll no longer use 2FA #'s for ads, the damage will have been done, and 99% of the population won't know any of it occurred. We'll repeat this cycle when a fresh revelation occurs months from now, as facebook continues to test how much they can leverage for more ad revenue. But none of it is actually slowing FB down. Its biggest dip in value came from d…

As someone who has occasionally runs experiments with FB adverts for various types of business. I feel it's boiling point will be when people and organisations advertising on the platform really start to look deeply into the value for money they are getting on it. I can't tell you the amount of times I've seen organisations throw money at it in return for dubious clicks from markets they never targeted, bot like user…

Buying digital advertising is big part of my job. I find the exact opposite to be true. FB provides high quality, low fraud. Especially compared to anything that's not Google/FB.

When we advertise to raise money (for politicians) that provides a direct provable ROI and I can tell you nothing else has come close. Seems that is true for many corporations as well just look at FBs growing revenue. FB provides the tools to measure either a sale or the value of an app install over time the increased spend is proof of quality/value so clearly many others have also found success. I wonder who/what/how your campaigns didn't provide value?

Re: Facebook Is Giving Advertisers Access To Your Shadow Contact Information

#442

Post by dillondoyle » Fri, Sep 28, 2018, 9:10 AM UTC

y04nn wrote: post #371

NiekvdMaas wrote: post #263

Earlier quoted context omitted.

Are you hinting that FB advertisers are throwing 50 billion (expected 2018 revenue) at ads that are poorly performing? Obviously that is not correct, the result of all this detailed targeting is campaigns that are performing very well for experienced marketeers.

FB is making sure you can't calculate the ROI of a campaign. Marketers are putting money in FB because they think this is where they can the most accurately target people. https://adage.com/article/digital/p-g-decided-facebook-ad-ta... https://www.forbes.com/sites/joannmuller/2012/05/15/gm-says-...

This is demonstrably not true. FB provides better tools than pretty much anyone else to tie sales to advertising (online or off) and to track app instal lifetime advertising revenue generated over time. The human data and walled garden of tracking they have are hugely valuable in proving ROI.

Re: Facebook Is Giving Advertisers Access To Your Shadow Contact Information

#443

Post by dredmorbius » Fri, Sep 28, 2018, 9:22 AM UTC

bob_roboto wrote: post #432

dredmorbius wrote: post #402

Earlier quoted context omitted.

Salt them.

How would that work in this setup?

If Facebook were required to hash and salt phone numbers, then the correct 2FA value might still work (it would match the salt and has), but an arbitrary list of submitted values would be expensive to match to the hashed set.

Facebook would be unable to contact the user via SMS, they would have to issue a token via WWW or app and have the user text that to a specific address from the corresponding phone number to achieve phone-based 2FA. This might even be a third-party service to deny FB any direct access to the phone number.

The verification channel might become a phishing target via spoofed FB pages or apps, though that would be moderately expensive and of limited use. An attacker might request FB login credentials (the actual verification would not), might acquire a phone number (generally, though not always, a non-critical datapoint), and would still be denied account access via 2FA without further compromises, say, social-engineering the phone account (a proven risk, though expensive at scale).

Tildes.net uses a similar mechanism for recovery email addresses.

Re: Facebook Is Giving Advertisers Access To Your Shadow Contact Information

#444

Post by ric2b » Fri, Sep 28, 2018, 9:23 AM UTC

boraturant wrote: post #74

As an FB Marketing API developer, this has been available for several years . The way it works, advertisers can send their phone list to FB for ad targeting. However, phone hashes are sent, not clear ones. Personally, as long as the user has an opt-out and opt-in options, I don’t think ad targeting is necessarily an unethical pattern, the blurring lines of ads and recommendations would be actually a pattern that user…

> However, phone hashes are sent, not clear ones.

A 10-digit number is only 10 billion possibilities, much less if you consider that they aren't completely random and have area codes, etc.

You can probably brute-force a hash of a phone number in seconds to minutes _on a CPU_.

Re: Facebook Is Giving Advertisers Access To Your Shadow Contact Information

#445

Post by ric2b » Fri, Sep 28, 2018, 9:25 AM UTC

fivre wrote: post #117

boraturant wrote: post #74

As an FB Marketing API developer, this has been available for several years . The way it works, advertisers can send their phone list to FB for ad targeting. However, phone hashes are sent, not clear ones. Personally, as long as the user has an opt-out and opt-in options, I don’t think ad targeting is necessarily an unethical pattern, the blurring lines of ads and recommendations would be actually a pattern that user…

> However, phone hashes are sent, not clear ones. Somehow, the knowledge that the efforts to tie every trace of my existence together to help marketers target ads to me are done in a cryptographically secure fashion is not entirely comforting. In general, I have been unimpressed with recommendation engines of any sort. Spotify can't suggest music I'd like worth a damn, and it's working within a relatively specific do…

> are done in a cryptographically secure fashion is not entirely comforting.

It's not even cryptographically secure, a phone number is like a 10 digit number that isn't even completely random because of area codes, trivially brute-forceable.

Re: Facebook Is Giving Advertisers Access To Your Shadow Contact Information

#446

Post by Jaruzel » Fri, Sep 28, 2018, 10:19 AM UTC

mtgx wrote: post #338

adpirz wrote: post #239

What's facebook's boiling point? My guess is they'll respond, they'll no longer use 2FA #'s for ads, the damage will have been done, and 99% of the population won't know any of it occurred. We'll repeat this cycle when a fresh revelation occurs months from now, as facebook continues to test how much they can leverage for more ad revenue. But none of it is actually slowing FB down. Its biggest dip in value came from d…

Facebook is already in decline (people have stopped using it, either completely or drastically reduced their usage of it). The problem is Facebook is allowed to buy rising competitors on its way down, thus prolonging its monopoly in the social media space.

It may be in decline, but like a ship slowing down from light speed, it will take years before there's any significant change in the social media landscape. They have a very long time-frame of opportunity to turn their ship around, and it wouldn't surprise me if they do.

A good real world example is Disney. Disney has been almost broke a few times over its lifetime, yet currently it's so huge that people believe it will never fail again.

Facebook have so much money in the bank, that the moment their primary model is no longer viable, they'll just go to market and buy up the next hot thing, and switch their focus there. They are like an unstoppable pandemic virus in this aspect.

In dystopian sci-fi novels and films, there is commonly the concept of 'The Company' who see-all, and control-all. It used to be that we'd predict it would be IBM, or Microsoft who would be 'The Company', more recently we'd say it would be Google. Currently however, it's more likely to be Facebook.

Re: Facebook Is Giving Advertisers Access To Your Shadow Contact Information

#447

Post by qubax » Fri, Sep 28, 2018, 10:43 AM UTC

AllegedAlec wrote: post #167

qubax wrote: post #153

Earlier quoted context omitted.

So disappointed in the GDPR evangelism on HN. https://www.techdirt.com/articles/20180920/17133740682/gdpr-... GDPR is a tool that is going to be abused to hide and censor. The EU didn't create this regulation for the benefit of the citizens of EU.

The Right to be Forgotten existed before GDPR though.

The previous right to be forgotten was limited to only search engines operating in the EU. Meaning, google didn't have to remove the data itself, just the entry to the link in the index. GDPR is far more onerous in that it applies to all data processors everywhere.

"The ECJ ruling only enforced the right to erasure on search engines operating in Europe. The proliferation of personal data that is available online extends far beyond their indexes. It's often exploited for the benefit of others, and their motivations may be contrary to the wishes of the data subjects. It will now be extended to all data processors."

https://www.techworld.com/data/could-right-be-forgotten-put-...

I don't believe in "right to be forgotten" period. That's quite orwellian. The data must flow.

Re: Facebook Is Giving Advertisers Access To Your Shadow Contact Information

#448

Post by cmroanirgo » Fri, Sep 28, 2018, 10:47 AM UTC

jsjohnst wrote: post #148

cmroanirgo wrote: post #127

Earlier quoted context omitted.

I agree with your sentiment. But, as someone who understands that not all people and companies use the same moral set as myself, this is why I've never set up 2fa using a phone. Why should I give some company my phone number? Increasingly it's become a single point of metadata to uniquely describe myself (just as my email addresses have).

> just as my email addresses have That doesn’t need to be the case though with just a little bit of effort and minimal cost. Use your own domain for email and set your account to be a catchall. Then use facebook.com@yourdomain.tld and your email address is no longer a cross site unique identifier.

I've been typically using name+website@domain.tld to distinguish email origins (and leakage). Ironically, I've already set up otherdomain.tld@privacy.domain.tld to hide registrar information, but hadn't thought of using it for day-to-day signups until now.

I think I'll extend the latter (and reduce the required Spam score) before it gets sent to my inbox.

Re: Facebook Is Giving Advertisers Access To Your Shadow Contact Information

#449

Post by cmroanirgo » Fri, Sep 28, 2018, 10:48 AM UTC

lancesells wrote: post #218

gruez wrote: post #169

Earlier quoted context omitted.

>Then use facebook.com@yourdomain.tld and your email address is no longer a cross site unique identifier. unless sites smarten up and realize facebook@johndoe.com is the same person as pizzaplace@johndoe.com, especially when johndoe.com isn't a "common" email domain like hotmail.com

As someone that has created a facebook account with an unused email without using my name or any information they still recommend my friends, family and interests. Instagram did the same thing with my interests. There's a lot more going on than linking email addresses.

If you used an app (rather than just a website), then all your contacts were uploaded. (Instagram has always been an app, hasn't it?)

Re: Facebook Is Giving Advertisers Access To Your Shadow Contact Information

#450

Post by realreality » Fri, Sep 28, 2018, 11:55 AM UTC

pavanred wrote: post #439

pdeuchler wrote: post #389

Earlier quoted context omitted.

A reminder that if you work for Facebook you are fully complicit. Especially if you're an engineer, there should be no shortage of jobs available to you at this time. There is no excuse to work for a company that's sole focus is exploitation of its users.

The problem with this argument - I care about issue X, company C is known to disregard/exploit users with X and so I assume all employees of company C are complicit while I give a free pass to the users who remain ignorant and simply don't care no matter how many times these issues surface. And where do you stop? Are all doctors working for big pharma related to opioid crisis complicit? what about people working for…

Yes, they’re all complicit, to different degrees. Even the janitors and cooks are complicit when they support unethical enterprises.

If any Facebook engineer suddenly acquired some moral sense, he should spend his time working to sabotage the company from within. Some have walked away; others have walked away and publicly spoken about facebook’s dubious culture.

Now it’s time to see some sabotage.