Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

arstechnica.com

Post reply on HN
Print view View original

101–110 of 226 posts

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#101

Post by k8svet »

aardvarkr wrote: post #76
k8svet wrote: post #40

Earlier quoted context omitted.

So... this sounds like OAuth, with a nice consent scene that says I'm giving Netflix this access to my FB DNs. That's what you mean, right? Otherwise, what the fuck is the difference? . And really, as if this makes anything better, wow. Imagine having the feeling of obligation that you have to stick your neck out over this. Just take your over-sized salary and be happy knowing you work for one of the worst companies…

When you give your mail client credentials to read your email , would you not expect your client to be able to read your mail? On Android, when you give a third party client permission to receive SMS, you don’t expect it to have access to your SMS?

[flagged]

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#102

Post by rezonant »

For important context on my post here, please read tsunamihippo's post first: https://news.ycombinator.com/item?id=39859319.

This story seems very overblown. Are we arguing that Facebook should not ever allow any third party app to ask permission to read the user's Facebook DMs? There are valid use cases for this permission, and every case where an app asks for it is not a "privacy violation". Sure, did Netflix or Spotify actually need the ability to read back DMs instead of just write them so that they could send recommendations? No, they shouldn't have needed that. If Facebook's API required that they have read access just to send a message, then that's crap design. But is it nefarious? No.

As long as the user is appropriately briefed on what they are granting (and it appears that they were), and as long as Facebook addresses over-scoped permissions requested by third party apps in a timely manner, then this should not be an issue.

I for one believe that we need to mandate that FAANG companies have these sorts of permission-driven systems to avoid the vendor lock in we're all too commonly stuck with today.

Because these things are needed for competition to thrive and to avoid the big companies from creating moats that prevent us, the startups out there, trying to dethrone them, its all the more important that these companies invest in better UIs that help a user understand the implications of what they are doing, and better review processes to stop bad actors from exploiting users' ignorance on an ongoing basis.

I despise Meta, but come on. Don't throw the baby (interoperability) out with the bathwater (interoperability can enable exploitation).

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#103

Post by pooper »

captn3m0 wrote: post #91
vlan0 wrote: post #83

Earlier quoted context omitted.

What incentive does FB have to limit that access? Feels like MBAs would just see that as a cost/burden? We know FB does give a fuck about privacy, so that’s never gonna be a reason.

Courts across the world fining them.

The fines have to be more than 100% of global annual revenue if they are going to matter.

The other option is long prison sentences for the board and CEO.

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#104

Post by rvba »

soraminazuki wrote: post #97
cm2012 wrote: post #85

Earlier quoted context omitted.

If this wasn't Facebook it wouldn't even be news.

I hope you’re being sarcastic? Or is that actually your stance on people’s privacy rights?

Lots of comments here look like some sort of astroturfing made by a PR agency

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#105

Post by Wowfunhappy »

lupire wrote: post #38
tsunamihippo wrote: post #21

The article skips a lot of context to make it sound significantly worse than reality. Facebook didn't just randomly give Netflix access to everyone's messages. Specific user would need to purposefully log in to the Netflix app with their Facebook account in order to grant Netflix access to the chat functionality (intended to send movie recommendations to Facebook friends inside the Netflix app). https://about.fb.com/…

And if a user consented to Netflix-based chat, Facebook overshared all chat data, instead of only the Netflix chat data, because they couldn't be bothered to build a properly isolated API? That's like asking permission to read and write your entire phone, just to provide the ability to write and read back a file.

> That's like asking permission to read and write your entire phone, just to provide the ability to write and read back a file.

...it occurs to me that this is in fact how most desktop apps work, and I do prefer it that way.

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#106

Post by rezonant »

lupire wrote: post #38
tsunamihippo wrote: post #21

The article skips a lot of context to make it sound significantly worse than reality. Facebook didn't just randomly give Netflix access to everyone's messages. Specific user would need to purposefully log in to the Netflix app with their Facebook account in order to grant Netflix access to the chat functionality (intended to send movie recommendations to Facebook friends inside the Netflix app). https://about.fb.com/…

And if a user consented to Netflix-based chat, Facebook overshared all chat data, instead of only the Netflix chat data, because they couldn't be bothered to build a properly isolated API? That's like asking permission to read and write your entire phone, just to provide the ability to write and read back a file.

This isn't how permissions work in most OAuth APIs. When you request permissions on apps like this, you request an "action" on a "subject". The "action" can be read/write/delete, the subject can be "DMs". How does Facebook determine whether a specific DM is a Netflix DM? In the database it's just a message from one user to another, with a certain text content.

By the way I'm not suggesting that it cant work this way, just that it doesn't. Facebook could have added a specific scope to allow an app to only read back messages related to itself. But that would have required anticipating the use case before these companies implemented it, or at least having better review policies to try to reduce the permissions apps are asking for.

But if the app wants to allow the user to have a back and forth with the other user, then that implies that Facebook Chat needs to have the ability to have app-specific conversation threads. It doesn't have that, though.

Netflix and Spotify requested read permission for DMs. Did they need it? Most assuredly they did not. But requesting read permissions for DMs in general has valid use cases, even if it should be treated sensitively by Facebook's authentication flow.

If there's any problem here, its that Facebook didn't seem to recognize that the apps (Netflix and Spotify) should not have been requesting read privileges at all, and should have revoked their ability to request that permission in a timely manner.

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#107

Post by ionwake »

tsunamihippo wrote: post #21

The article skips a lot of context to make it sound significantly worse than reality. Facebook didn't just randomly give Netflix access to everyone's messages. Specific user would need to purposefully log in to the Netflix app with their Facebook account in order to grant Netflix access to the chat functionality (intended to send movie recommendations to Facebook friends inside the Netflix app). https://about.fb.com/…

I only read the headline and this reply gave me even greater concern. wtf they shared ALL msg data for logging into Netflix chat?!?

I dunno I’m surprised I’m still surprised these days

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#108

Post by navigate8310 »

k8svet wrote: post #40
tsunamihippo wrote: post #21

The article skips a lot of context to make it sound significantly worse than reality. Facebook didn't just randomly give Netflix access to everyone's messages. Specific user would need to purposefully log in to the Netflix app with their Facebook account in order to grant Netflix access to the chat functionality (intended to send movie recommendations to Facebook friends inside the Netflix app). https://about.fb.com/…

So... this sounds like OAuth, with a nice consent scene that says I'm giving Netflix this access to my FB DNs. That's what you mean, right? Otherwise, what the fuck is the difference? . And really, as if this makes anything better, wow. Imagine having the feeling of obligation that you have to stick your neck out over this. Just take your over-sized salary and be happy knowing you work for one of the worst companies…

Totally agree with the sentiment here. The comment by the employee make it sound like it's the user's fault. Something akin to dark pattern and malicious compliance by giving the user an OAuth consent for their DM.

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#109

Post by rvba »

margorczynski wrote: post #79
_heimdall wrote: post #53

Earlier quoted context omitted.

The problem isn't whether Facebook used private messages for ad targeting (the claim they denied), its whether Facebook used private messages at all. Who cares if it was for ads, giving third party companies access should be a huge problem with or without ads.

This should make it a no-go for any sane person that is aware of that, unfortunately not many are. I always try to convince people I know to ditch Messanger/WA/etc. in favor of Signal, and in many cases I've succeeded.

What is good about signal? It does not allow unique account names (!), but uses telephone numbers - what is just absurdly bad security.

The state can make a duplicate of your sim at any time. Not to mention linking phones to people is relatively easy.

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#110

Post by rvba »

kylecazar wrote: post #31

What is being claimed here? 'granted programmatic access to FB user's inboxes' could mean a lot of things. What privileges? I read the article and still can't tell. I don't believe that Meta allowed Netflix to read messages that a user sent or received, but that seems to be what they're implying.

For me it sounds that they read the messages to measure sentiment (what people are watching / what they like and dislike / what they recommend / generic information about competition from other rv shows, movies and video games), but probably the system was "bugged" (plausible deniablity) so those with access could read everything they wanted - be it messages made by employees from some competitor startup, or perhaps partners and sweethearts. Creepy stuff.
Post reply on HN