Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

arstechnica.com

Post reply on HN
Print view View original

161–170 of 226 posts

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#161

Post by izacus »

rezonant wrote: post #102

For important context on my post here, please read tsunamihippo's post first: https://news.ycombinator.com/item?id=39859319 . This story seems very overblown. Are we arguing that Facebook should not ever allow any third party app to ask permission to read the user's Facebook DMs? There are valid use cases for this permission, and every case where an app asks for it is not a "privacy violation". Sure, did Netflix or S…

Remember that this site is full of people outeight supporting monopolies and walled gardens when it comes to companies they like. So yes, they're absolutely defending removal of APIs that allow data sharing with explicit user consent.

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#162

Post by choppaface »

tsunamihippo wrote: post #21

The article skips a lot of context to make it sound significantly worse than reality. Facebook didn't just randomly give Netflix access to everyone's messages. Specific user would need to purposefully log in to the Netflix app with their Facebook account in order to grant Netflix access to the chat functionality (intended to send movie recommendations to Facebook friends inside the Netflix app). https://about.fb.com/…

> Disclaimer: I work at Facebook but not on messaging or anything related to this article

Same as "Hey, Googler here. Let me tell you how I'm right and why you should think this way."

> Facebook didn't just randomly give Netflix access to everyone's messages.

That's not at all what the title alleges, nor what the article says. The article (1) provides evidence that Facebook monetized user private messages in a data-sharing project with Netflix and (2) cites court documents that litigate Facebook having Jedi-Blue-like monopoly-preserving interaction with Netflix.

It doesn't matter what the Facebook TOS says or how the tech works. Human users never provided informed consent that their private comms would be monetized as well as used for anti-competitive un-American purposes (un-American as in the Sherman Act, altho creating a monopoly is perhaps very American indeed). And Facebook has done that time and time again.

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#163

Post by Mindwipe »

treme wrote: post #2

how much effort did meta put into building a legit competition vs netflix/youtube? it's hard to imagine they couldn't put up a decent competition with max user reach and $ just how great of a moat do yt/netflix have? is Disney the only one mounting a decent fight?

Wha?

Hacker News is literally constantly claiming that there are too many competitors to Netflix and there needs to be some kind of compulsory licensing to reduce competition. Like there are hundreds of posts on the front page every week to that effect.

Meta never took Watch very seriously, just because it requires literally billions of dollars of investment and they clearly never wanted to spend that much.

They licensed Buffy the Vampire Slayer for the US, clearly saw it didn't move the needle much and they'd need to spend $5 billion+ to get there, and scrapped the whole idea.

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#164

Post by choppaface »

robocat wrote: post #145
rvba wrote: post #104

Earlier quoted context omitted.

Lots of comments here look like some sort of astroturfing made by a PR agency

"Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data." - https://news.ycombinator.com/newsguidelines.html

The root comment is literally a Facebook employee who is intentionally trying to change the narrative. An employee of a company that has been fined billions for privacy breaches, that was responsible for literal voter suppression https://www.opendemocracy.net/en/dark-money-investigations/t... etc etc

HN "guidelines" say "Please don't post shallow dismissals" -- Don't allow FANG to astroturf these forums.

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#166

Post by amelius »

Euphorbium wrote: post #148
lupire wrote: post #38

Earlier quoted context omitted.

And if a user consented to Netflix-based chat, Facebook overshared all chat data, instead of only the Netflix chat data, because they couldn't be bothered to build a properly isolated API? That's like asking permission to read and write your entire phone, just to provide the ability to write and read back a file.

That is how permissions work on android. I hate it.

That's why I moved to GrapheneOS.

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#167

Post by krisoft »

lupire wrote: post #38
tsunamihippo wrote: post #21

The article skips a lot of context to make it sound significantly worse than reality. Facebook didn't just randomly give Netflix access to everyone's messages. Specific user would need to purposefully log in to the Netflix app with their Facebook account in order to grant Netflix access to the chat functionality (intended to send movie recommendations to Facebook friends inside the Netflix app). https://about.fb.com/…

And if a user consented to Netflix-based chat, Facebook overshared all chat data, instead of only the Netflix chat data, because they couldn't be bothered to build a properly isolated API? That's like asking permission to read and write your entire phone, just to provide the ability to write and read back a file.

I don’t know. If there is a “Facebook Messenger” feature on some Netflix interface then I would be surprised if it only worked with some chats and not others.

(That being said I have no clue why there would be such a thing, and why a user would prefer it? Maybe if Netflix were making set-top boxes)

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#168

Post by abalone »

slowmovintarget wrote: post #117
rezonant wrote: post #106

Earlier quoted context omitted.

This isn't how permissions work in most OAuth APIs. When you request permissions on apps like this, you request an "action" on a "subject". The "action" can be read/write/delete, the subject can be "DMs". How does Facebook determine whether a specific DM is a Netflix DM? In the database it's just a message from one user to another, with a certain text content. By the way I'm not suggesting that it cant work this way,…

This is why OAuth is insufficient for privilege management, especially for multi-tenant systems, or what should be segregated data sets. You want to grant access to dataset abc123, but not dataset abc124 belonging to the same user. This leads to an explosion of scopes, or an explosion of API keys, unless you have a policy engine, or resource-based access control. A company as big as Meta should be able to (is able to…

OAuth 2.0 is perfectly fine for privilege management. The problem is they granted read access when all Netflix needed here was write access.

An analogy would be granting full access to a Gmail inbox in order to merely send an email. It would not require “scope explosion” to isolate the email sending permission. That’s just one OAuth scope. They just didn’t isolate it.

The more interesting question here is how this interacts with supposed end-to-end encryption. Clearly the messages Netflix sends cannot be E2EE (right?). The whole point of E2EE is the service provider doesn’t have your keys. If Facebook is letting 3P send messages on your behalf, they must be unencrypted.

Normally, ideally, in an E2EE system this should set off alarm bells. If you get a message from someone that’s not actually signed/encrypted by them, this should be very clearly alerted. Otherwise it’s a privacy attack vector. You could be downgraded to an unencrypted channel without your awareness.

So, what’s the Facebook messenger user experience here?

Re: Facebook let Netflix see user DMs, quit streaming to keep Netflix happy

#169

Post by michaelt »

abalone wrote: post #168
slowmovintarget wrote: post #117

Earlier quoted context omitted.

This is why OAuth is insufficient for privilege management, especially for multi-tenant systems, or what should be segregated data sets. You want to grant access to dataset abc123, but not dataset abc124 belonging to the same user. This leads to an explosion of scopes, or an explosion of API keys, unless you have a policy engine, or resource-based access control. A company as big as Meta should be able to (is able to…

OAuth 2.0 is perfectly fine for privilege management. The problem is they granted read access when all Netflix needed here was write access. An analogy would be granting full access to a Gmail inbox in order to merely send an email. It would not require “scope explosion” to isolate the email sending permission. That’s just one OAuth scope. They just didn’t isolate it. The more interesting question here is how this in…

> The problem is they granted read access when all Netflix needed here was write access.

At that point, why not just have an URL that opens facebook with a message pre-populated and skip all the oauth?

Post reply on HN