Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook denies it collects call and SMS data from phones without permission

techcrunch.com

Post reply on HN
Print view View original

11–20 of 370 posts

Re: Facebook denies it collects call and SMS data from phones without permission

#11

Post by jonathankoren »

wakeywakeywakey wrote: post #4
nukeop wrote: post #3

"Without permission" is the crucial part. Of course, you have to give the app the permission to do it when you install it, otherwise it will refuse to run. That is why the Android permissions model is fundamentally broken.

Could you explain how permissions could be better achieved? Also, could you provide examples of platforms with good permission/security model?

Better questions are:

- What is the minimum amount of data sharing required?

- What happens when permission is denied? Does the app close?

- Do people even understand what is being shared?

- Are these click through "consent" screens really giving informed consent? Are they deceptive and biased to get users to give permission without really understanding what is going on? ("Text anyone in your phone" doesn't sound like "Continuously upload SMS and call history." Nor does a giant blue button versus no button, look like there's even an option to say no.)

- Why is this data even allowed to be shared?" (I understand that SMS and call data has neverbeen shareable on iOS.)

Re: Facebook denies it collects call and SMS data from phones without permission

#12

Post by endless1234 »

bthornbury wrote: post #7
wakeywakeywakey wrote: post #4

Earlier quoted context omitted.

Could you explain how permissions could be better achieved? Also, could you provide examples of platforms with good permission/security model?

iOS is pretty good. The onus for dealing with rejected permissions (in many cases) is put onto the app developer. For example, if you make a photo editing app, you need to request access to the user's photo gallery at runtime of the app. If they refuse, it's fully expected that your app will continue to work with reduced functionality. IIRC you will have trouble getting approved for the app store if your app breaks a…

But requesting permissions as they're needed is how it works on Android too, since M (late 2015).

Re: Facebook denies it collects call and SMS data from phones without permission

#13

Post by sdoering »

Gaelan wrote: post #5

The Facebook blog post includes this screenshot [0]. That's definitely an opt-in, although I could imagine a non-technical person clicking through it without reading the grey text. Better than nothing. [0]: https://fbnewsroomus.files.wordpress.com/2018/03/opt-in_scre...

This is exactly why I do not have any call/sms info in my FB data downloads. I read such stuff and deny the app these things.

Btw. something I am required by law here in Germany. I would need written permission of every contact in my phonebook for this upload, before uploading. Same goes for WhatApp.

Re: Facebook denies it collects call and SMS data from phones without permission

#14

Post by soziawa »

drawkbox wrote: post #9

Much of this blame goes on Android and some on iOS/Apple. The phone/call permissions, especially for Android, were needed for any app that wants to suspend when a call comes in and for analytics/social libs. I always hated that about Android especially because even harmless games made it look like you were taking contacts and monitoring calls. Of course this would be abused and it is all over the place. Unfortunately…

> Much of this blame goes on Android and some on iOS/Apple.

Which part of the blame goes on Apple?

Re: Facebook denies it collects call and SMS data from phones without permission

#15

Post by pvg »

wakeywakeywakey wrote: post #4
nukeop wrote: post #3

"Without permission" is the crucial part. Of course, you have to give the app the permission to do it when you install it, otherwise it will refuse to run. That is why the Android permissions model is fundamentally broken.

Could you explain how permissions could be better achieved? Also, could you provide examples of platforms with good permission/security model?

It seems like it should be an obvious given that just installing an FB app on your phone shouldn't hand FB a record of all your phone calls and text messages. Which is what appears to have happened on Android and nowhere else. The sensible question really is 'wtf is wrong with Android' not 'who and how is somehow managing to do this better'.

Nobody asks about cars that don't come with a face stabbing device nor writes long comparative reviews about the best car to get if you prefer not to get stabbed in the face.

Re: Facebook denies it collects call and SMS data from phones without permission

#16

Post by orb_yt »

drawkbox wrote: post #9

Much of this blame goes on Android and some on iOS/Apple. The phone/call permissions, especially for Android, were needed for any app that wants to suspend when a call comes in and for analytics/social libs. I always hated that about Android especially because even harmless games made it look like you were taking contacts and monitoring calls. Of course this would be abused and it is all over the place. Unfortunately…

> The phone/call permissions, especially for Android, were needed for any app that wants to suspend when a call comes in.

No they weren't

Re: Facebook denies it collects call and SMS data from phones without permission

#17

Post by lovelearning »

wakeywakeywakey wrote: post #4
nukeop wrote: post #3

"Without permission" is the crucial part. Of course, you have to give the app the permission to do it when you install it, otherwise it will refuse to run. That is why the Android permissions model is fundamentally broken.

Could you explain how permissions could be better achieved? Also, could you provide examples of platforms with good permission/security model?

CopperheadOS[1] has a good permission model (compared to stock Android). Notice that they had implemented a better permission model over Android's even in older Android versions which didn't have runtime granular permissions. It proves what the ad company Google itself could have implemented in stock Android had they not been an ad company.

CyanogenMod's Privacy Guard[2] - basically a proxy that sits between the apps and the ContentProviders, and provides user-configurable "fake data" - was another good approach. Not sure if its successor LineageOS has this feature working - a search shows user complaints that it doesn't work as expected - but I hope it has retained the feature.

I feel a distro that combines both approaches would have been best. Both approaches also prove that there was no technical impediment to implementing them in stock Android.

[1]: https://copperhead.co/android/docs/usage_guide#permission-mo...

[2]: https://www.androidcentral.com/cyanogen-os-privacy-guard-kee...

Re: Facebook denies it collects call and SMS data from phones without permission

#18

Post by eh78ssxv2f »

lovelearning wrote: post #17
wakeywakeywakey wrote: post #4

Earlier quoted context omitted.

Could you explain how permissions could be better achieved? Also, could you provide examples of platforms with good permission/security model?

CopperheadOS[1] has a good permission model (compared to stock Android). Notice that they had implemented a better permission model over Android's even in older Android versions which didn't have runtime granular permissions. It proves what the ad company Google itself could have implemented in stock Android had they not been an ad company. CyanogenMod's Privacy Guard[2] - basically a proxy that sits between the apps…

> It proves what the ad company Google itself could have done had they not been an ad company.

I think you make fair points, but I think this does not prove anything. CopperheadOS has a different user base than Android. A permission model that CopperheadOS users understand (e.g., CopperheadOS users are likely to be more technical) may not work for Android user base.

Re: Facebook denies it collects call and SMS data from phones without permission

#19

Post by deely »

lucb1e wrote: post #8

I'm sure they had their "permission" on page 27 of the terms of service. This isn't news... My opinion is still that those terms of services are silly. If I ever do start my own business, one of the things on the checklist is to have a minimal, if any, terms of service, because nobody wants to waste time reading them, and 99% of what is in ToSes is in the law anyway. Except, of course, data collection beyond function…

And, what happen if some big comp asks you to 'polish' a bit ToS, to make it more 'lawyer style', because otherwise they didn't spent additional $ 10m on you business?

Re: Facebook denies it collects call and SMS data from phones without permission

#20

Post by contrast »

wakeywakeywakey wrote: post #4
nukeop wrote: post #3

"Without permission" is the crucial part. Of course, you have to give the app the permission to do it when you install it, otherwise it will refuse to run. That is why the Android permissions model is fundamentally broken.

Could you explain how permissions could be better achieved? Also, could you provide examples of platforms with good permission/security model?

Read the article and explain how they could have been worse!

For anyone with a basic appreciation of "honesty" or "ethical behaviour", it is fairly obvious that simple improvements would include:

Don't deceive the user about why the app is requesting permission. Don't deceive the user about what you will do with the permissions. Provide the user with an app that does what you say it does, for the purposes you say it is for.

Examples of platforms with a good model: in this context, it is well documented that Apple has been superior to Android.

Post reply on HN