Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

businessinsider.com

Post reply on HN
Print view View original

111–120 of 310 posts

Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

#111

Post by netsharc »

Cthulhu_ wrote: post #72
yakubin wrote: post #59

Why would anyone just give a site their password to their email account? And to Facebook on top of that?

Convenience. That is, Facebook - and others, like Skype - tells new users that the easiest and quickest way to find your friends is to send them your contacts so they can cross-reference the users. And that, including me not paying attention, is how all my e-mail contacts got an email from facebook where I invited them to FB. That wasn't the intent!

Interestingly, WhatsApp (and Telegram, and Signal) don't even ask and just upload all your contacts' phone numbers (this is before Android had the prompt "Allow this app access to your contacts?). It's very convenient, and also very sad.

Also sad is the fact that BlackBerry already had a fine-grained permissions systems pre-iPhone days, but it took iPhone and Android many many versions and years before they built such privacy controls (but yeah "We care about our costumer's privacy" - Apple). And Google didn't even care about privacy back then I remember the Google Maps app for BlackBerry just prompts you "Please give us all the permissions we want or this app will just exit now." on startup, when you've denied it a permission or two.

Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

#112

Post by matt4077 »

smt88 wrote: post #42

Saying "unintentionally" here is like saying you unintentionally stole someone's TV when they gave you their key to walk their dog. It takes extra work to upload those contacts, which means several managers and developers decided to do it and then spent time implementing it. For the FB employees reading this: what is your tipping point? Would you say no to that assignment?

They did have the upload-your-address-book functionality before they instituted this check. I’m very much hoping to see Facebook suffer for this, but I could conceivably see a scenario where they reused code that did more than they wanted.

Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

#113

Post by astura »

viraptor wrote: post #81
Cthulhu_ wrote: post #70

Earlier quoted context omitted.

I don't know if you've followed the news, but multiple governments have investigated, sued and fined Facebook. A quick Google indicates Facebook may end up paying 1.6 billion to the EU. The UK is doing an investigation too, with FB's impact on the Brexit referendum, as well as the whole Cambridge Analytica thing. If you're thinking Facebook is getting away with it, you're wrong. Of course, they're mainly getting fine…

> that isn't harsh enough punishment then I don't know what to do next, Split the business into smaller, independent ones. We've seen this before. There's enough services hiding inside FB that treating them like a monopoly is not a terrible idea.

What, exactly, does Facebook have a monopoly on? It's not social media, chat, photo sharing, events, ads, or news.

Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

#114

Post by codedokode »

hluska wrote: post #89
swebs wrote: post #69

Earlier quoted context omitted.

Have you read the Prism papers? Governments love this mass data collection since it makes their job so much easier.

Well yeah, I’m sure they do, but at what cost? The same data collection that government loves so much has been misused to throw elections and genuinely cast doubt upon the democratic process. Ultimately, creating this big giant drag nets has only empowered companies to demonstrate a complete lack of regard for humanity. If that’s security, I no longer want to be secure.

> The same data collection that government loves so much has been misused to throw elections

If this is done in favor of the current government, then they probably won't mind.

Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

#115

Post by bryanrasmussen »

simonh wrote: post #92
fooqux wrote: post #78

Earlier quoted context omitted.

Well, to be fair we probably don't hear about the accidents that end up causing the opposite situation. Those are just normal bugs.

"Facebook bug causes all user's sensitive data to not be uploaded in some case" sounds like an Onion headline.

That bug would be a critical failure and be caught, the reverse would be a non-critical bug that the PM decides to to put in the backlog because reasons. If in a year we haven't gotten around the fixing it, then it's time to clean out that backlog!

Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

#116

Post by w0m »

codedokode wrote: post #105
iamrobschiavone wrote: post #94

Earlier quoted context omitted.

A common practice is to keep developers unaware of the real objective of their work (like Uber, in another comment on HN, https://news.ycombinator.com/item?id=13786384 ): - developer A is tasked to create the prompt to ask for username and password of the email account - developer B is tasked to call some API to upload contacts from email account - developer C is tasked to bind two functionalities. Now replace develo…

That looks too compilcated. Will you also use several different QA engineers and several product managers for this?

.. isn't that how larger scale projects are done?

Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

#117

Post by numbsafari »

iamrobschiavone wrote: post #94
smt88 wrote: post #42

Saying "unintentionally" here is like saying you unintentionally stole someone's TV when they gave you their key to walk their dog. It takes extra work to upload those contacts, which means several managers and developers decided to do it and then spent time implementing it. For the FB employees reading this: what is your tipping point? Would you say no to that assignment?

A common practice is to keep developers unaware of the real objective of their work (like Uber, in another comment on HN, https://news.ycombinator.com/item?id=13786384 ): - developer A is tasked to create the prompt to ask for username and password of the email account - developer B is tasked to call some API to upload contacts from email account - developer C is tasked to bind two functionalities. Now replace develo…

That implies that you, as a developer, then hear new stories like this one and simply ignore any role you may or may not have had in the situation. It implies that you simply ignore that your manager or engineering leadership are asking you to do things that are unethical without informing you about how your work will be used. It implies that you continue to work for that leadership knowing that they will lie to you, hide their true intentions, and use your labor to execute profoundly unethical practices.

It's not news at this point to anyone working at FB what their leadership is engaged in, and what their work is being used to accomplish.

Perhaps several years ago you could claim some kind of ignorance.

That's no longer the case. You know who you work for. Own it.

Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

#118

Post by matt4077 »

javagram wrote: post #108

This seems like a case similar to the Google WiFi data collection. Code written for one reason was reused in a different project without understanding what it would do. Here’s an example page from 2011 talking about facebook’s old feature to import contacts via providing them your email username and password. This was at a point when many web mail services didn’t offer an OAuth API to do this, so it did make some sen…

I thought of this as well. One difference, at least subjectively, is that Google seems to make far fewer of such mistakes.

Just as with people, it’s sometimes difficult to judge them for a single act. Only by aggregating behavior over time can we learn of their true character.

And Facebook’s rotten.

Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

#119

Post by bryanrasmussen »

devnonymous wrote: post #66
jayawayjayyay wrote: post #52

Earlier quoted context omitted.

From the article it sounds like there was a prompt for permission that got removed: > Facebook told Gizmodo via email that in May 2016 it made a revision to the registration process, which originally asked the affected users for permission to upload contact lists. That change removed the opt-in prompt, though the company did not realize the underlying functionality was still operating in some cases. It doesn't take a…

Also from the article > A Facebook spokesperson also told Gizmodo that a screenshot of the original opt-in prompt was not available. I'm not a conspiracy theorist but if you're trying to claim you cannot capture a screenshot from any release meant to be shipped out, either you're crap at release management or are full of shit. Which one is it? Also, even if we were to suspend logic and belive this was a bug, what's F…

How about a look at your design process regarding this particular part of the application?

Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent

#120

Post by raverbashing »

matt4077 wrote: post #109
carnagii wrote: post #103

18 USC 1030 (a)(4) (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value https://www.law.cornell.edu/uscode/text/18/1030 A criminal investigation into whether or not this was really accidental would be entirely warranted here. If there was intent to access this…

Not a lawyer, but at least in my jurisdiction, fraud requires a monetary loss by the victim. Generally, civil law is better suited for this sort of thing, no matter how good a pitchfork feels in your hand. As but one of the reasons, the required standard of proof is much lower.

> Not a lawyer, but at least in my jurisdiction, fraud requires a monetary loss by the victim.

Note this is not a state law as quoted, but it's the USC

Post reply on HN