50M Facebook profiles harvested for Cambridge Analytica in major data breach • Hacker News Board

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#151

Post by untog » Sat, Mar 17, 2018, 10:11 PM UTC

alangpierce wrote: post #145

underwater wrote: post #127

Earlier quoted context omitted.

There is a big difference between sharing data with companies, and allowing companies to specify as targeting rules. Facebook lets companies bid for ads to show you, based on Facebook’s data about your interests and demographics. If you never engage with the ads there is no information leakage. It’s the difference between telling a random person “I’ll tell my gay friends about your party” and “Did you know that Bob i…

I've heard a lot of people believe otherwise (including a sibling post), so probably best to bring in evidence/sources. Here's Facebook's statement on it: "No, we don't sell any of your information to anyone and we never will." From https://www.facebook.com/help/152637448140583 So if you believe Facebook sells your information, then you also believe that Facebook is directly lying about it on a help page about that s…

No, it's worse, they just gave it away for free.

Until 2014 or so an app could request permission to view almost any data a user stores on Facebook. That's not great, but hey, you could argue it's not Facebook's fault that people don't understand permission prompts (I'd disagree with you, but...). But those same prompts allowed users to give away their friend's data, so absolutely anyone you're friends with could take some stupid personality test and give away your information in the process, and there was no way you'd even know.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#152

Post by aetherspawn » Sat, Mar 17, 2018, 10:19 PM UTC

I hadn’t thought of it like this before, but from a political POV everyone’s vote, whether they are a dole bludger or a quantum physiscist, are worth the same. So really, to win an election .. take that as you will. Identifying these people is a very profitable area.

Interesting side note .. in Australia we assign school funding based on the highest education received or wage class of the parent (classes A, B ... E or such).

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#153

Post by heckanoobs » Sat, Mar 17, 2018, 10:26 PM UTC

I used to make fb apps, any app gets full access to fb's user graph as long as they request the relevant permissions.

Users don't comprehend what permissions they are giving to apps they run. A quiz site getting full access is not surprising.

Once an app has any amount of access the only thing stopping them from harvesting their own clone of your data is an agreement in the ToS that you won't store PII for more than x hours.

These rules are like the bare minimum to stop good actors. If you're a bad actor fb does not do a single thing to protect users from you. As evident in this report fb is also not above blaming the users for the hostile environment fb created and placed them in.

There must be countless copies of harvested fb data out there. My employer at the time once realized we were accidentally storing some PII permanently in a derived field. If good actors can't even keep above the law what do you think the ecosystem looks like in the shadows?

IMO we aren't having the right conversation with fb over how they mistreat our PII and we should loosen the definition of that term when companies like the one in the article can infer our political preferences from the innocuous bits of our lives we tag on facebook.

We should be asking why even an authorized API that can't stop you from copying the data doesn't count as a systemetized data breach.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#154

Post by loxias » Sat, Mar 17, 2018, 10:27 PM UTC

Minor point of confusion -- this article refers multiple times to a "data breach". ("...one of the largest-ever breaches of Facebook data...", "At the time of the data breach...", "...first reported the breach...")

As far as I can tell, there is no data breach, right? It sounds like CA got facebook data through an app they wrote, thisisyourdigitallife, which did some shady things.

Also, "The New York Times is reporting that copies of the data harvested for Cambridge Analytica could still be found online".

The link is: https://www.nytimes.com/2018/03/17/us/politics/cambridge-ana...

Anyone know what they're talking about? I haven't heard of any 50-million-profile data dump, and I really like collecting corpora...

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#155

Post by loxias » Sat, Mar 17, 2018, 10:38 PM UTC

lettergram wrote: post #23

hashkb wrote: post #17

Earlier quoted context omitted.

I agree. But you should take that first step, and then start lobbying your friends to stop posting pictures of you. Personally, I also excuse myself at gatherings when the cameras come out, because I know it's all going straight to FB. The shaming has already started to decrease; now I'm usually not alone in popping out of the room.

I instead, always asked everyone be tagged as someone else. Typically, people are relatively okay with this because no one notices. It totally breaks the CNNs for face detection.

This is a great idea, thanks! I've been asking not to be tagged, but this is better.

I worry that "not tagging" is somehow adding sparse data which can later on be filled in.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#156

Post by Spooky23 » Sat, Mar 17, 2018, 10:40 PM UTC

alangpierce wrote: post #145

underwater wrote: post #127

Earlier quoted context omitted.

There is a big difference between sharing data with companies, and allowing companies to specify as targeting rules. Facebook lets companies bid for ads to show you, based on Facebook’s data about your interests and demographics. If you never engage with the ads there is no information leakage. It’s the difference between telling a random person “I’ll tell my gay friends about your party” and “Did you know that Bob i…

I've heard a lot of people believe otherwise (including a sibling post), so probably best to bring in evidence/sources. Here's Facebook's statement on it: "No, we don't sell any of your information to anyone and we never will." From https://www.facebook.com/help/152637448140583 So if you believe Facebook sells your information, then you also believe that Facebook is directly lying about it on a help page about that s…

You always need to parse statements like this very carefully. Pretty much any other company who isn't providing your information to others says "we do not share your data with unaffiliated entities..."

Facebook said that they don't sell your information. Which is true -- they aren't a data broker. But they implicitly state that your data is shared, subject to the limited controls available. You cannot stop Amazon and Facebook from sharing, for example.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#157

Post by ceejayoz » Sat, Mar 17, 2018, 10:46 PM UTC

thisisit wrote: post #10

ceejayoz wrote: post #7

I wonder how many of the "see what you'll look like when you're 80" and "find out how you'll die" quiz apps are doing this behind the scenes.

If I am reading the paper which started all of this correctly, you don't even need the quiz apps if you have the correct permissions: http://www.pnas.org/content/110/15/5802

The quiz apps are how you get the permissions.

Require the user to "connect with Facebook" to see their result. Give them the result, but quietly siphon off every bit of data you can with the access token.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#158

Post by traek » Sat, Mar 17, 2018, 10:55 PM UTC

heckanoobs wrote: post #153

I used to make fb apps, any app gets full access to fb's user graph as long as they request the relevant permissions. Users don't comprehend what permissions they are giving to apps they run. A quiz site getting full access is not surprising. Once an app has any amount of access the only thing stopping them from harvesting their own clone of your data is an agreement in the ToS that you won't store PII for more than…

> We should be asking why even an authorized API that can't stop you from copying the data doesn't count as a systemetized data breach.

Is your argument that no company should offer any developer APIs at all? It's impossible to stop apps from storing data that they have access to, given malicious intent.

This is like saying that the existence of the Google Calendar API is a "systemetized data breach" because an app could copy data from it once authorized by a user.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#159

Post by JPGalt » Sat, Mar 17, 2018, 11:02 PM UTC

olivermarks wrote: post #44

My problem with this 'outing' of CA is that Facebook explicitly commercially exists to harvest user data for Procter & Gamble, Johnson & Johnson, Fidelity etc etc so they can profile us. A million dollars is chump change in the crazy US election game. This all seems overly selective - it's ok for some people to profile but not for others. I'm not in favor of any of it to be clear but there is a definite political bia…

You won't get far in a blinding leftist arena if you go around spitting truth like this.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#160

Post by JPGalt » Sat, Mar 17, 2018, 11:06 PM UTC

mrtksn wrote: post #67

olivermarks wrote: post #44

My problem with this 'outing' of CA is that Facebook explicitly commercially exists to harvest user data for Procter & Gamble, Johnson & Johnson, Fidelity etc etc so they can profile us. A million dollars is chump change in the crazy US election game. This all seems overly selective - it's ok for some people to profile but not for others. I'm not in favor of any of it to be clear but there is a definite political bia…

>This all seems overly selective - it's ok for some people to profile but not for others What's the issue here? Selective information distribution is rooted in the society, people are O.K. with some information to be known to some people while kept secret from others due to implication differences. I.E. I'm fine to be profiled for selling me chocolates but I'm not O.K. to be profiled to be manipulated to select publi…

You are either intentionally being dishonest or you missed the point. The OP is saying that it is okay for some companies or more pointedly political ideologies to do things like this but if the leftist press or governments do not like the party and or candidate doing it then it is a problem. He should have used the work hypocrite because that is what is at the crux of this "issue"