50M Facebook profiles harvested for Cambridge Analytica in major data breach • Hacker News Board

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#171

Post by nl » Sun, Mar 18, 2018, 12:19 AM UTC

heckanoobs wrote: post #153

I used to make fb apps, any app gets full access to fb's user graph as long as they request the relevant permissions. Users don't comprehend what permissions they are giving to apps they run. A quiz site getting full access is not surprising. Once an app has any amount of access the only thing stopping them from harvesting their own clone of your data is an agreement in the ToS that you won't store PII for more than…

They stopped most data access via apps in the 2014 clean up they did.

But yes, you are right that I’m sure lots of apps kept that data and sold it.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#172

Post by scotu » Sun, Mar 18, 2018, 12:28 AM UTC

OrganicMSG wrote: post #144

threeseed wrote: post #132

Earlier quoted context omitted.

Please provide evidence then. I have never seen Facebook allowing large scale harvesting of their data. And it would qualify as data breaches in places like EU which do not tolerate this sort of thing.

Well, they may not officially permit it in public, however they clearly allow it, otherwise we wouldn't be here.

do you understand how this data ended up in CA's hands? Regular facebook app asked persmission to get data to it's users, one by one. It then retained the data and shared without facebook or their users permission (and against FB terms). Then facebook realized this data was shared, required CA to delete all of it. CA agreed. CA didn't delete. That's how we are here

I'm no facebook fan by the way, but there's no reason for facebook to sell their most important asset when they can allow you to pay to use it, without ever seeing it

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#173

Post by matchagaucho » Sun, Mar 18, 2018, 12:30 AM UTC

This is hardly news... Facebook ads cannot target specific users, they only target audience segments.

It's actually far easier to create ads targeted at segments with likely political beliefs, and Marketers have access to aggregate numbers of niche segments today.

There's no need to scrape people's profiles or get down to the individual level.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#174

Post by dawhizkid » Sun, Mar 18, 2018, 12:41 AM UTC

phonypho wrote: post #146

dawhizkid wrote: post #38

Think about all those apps where you connect your bank account via your online banking creds that have full access to everything you buy.

Do people do that?

have you used robinhood?

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#175

Post by myth_buster » Sun, Mar 18, 2018, 1:30 AM UTC

myth_buster wrote: post #37

50M doesn't strike much in FB scale, that's until... At the time, more than 50 million profiles represented around a third of active North American Facebook users, and nearly a quarter of potential US voters.

Sorry for the crappy formatting, can't edit now, so here's pprint version:

  At the time, more than 50 million profiles represented around 
  a third of active North American Facebook users, and nearly 
  a quarter of potential US voters.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#176

Post by gfodor » Sun, Mar 18, 2018, 2:00 AM UTC

I remember when the Obama campaign hired data scientists and used targeted social networking tools to pursuade voters who were on the fence and it was heralded as brilliant and the future of politics.

I worked for a company crawling Facebook data by creating viral apps the year the original API came out. By now I am sure this is done by many companies.

Why is any of this news? My understanding is that companies harvesting social networking data via viral apps and then reselling it to perform targeted voter advertising is literally a 10 year old concept. Were any laws broken here? Were there any techniques used here that were novel or done by one political party and not the other? Why are we talking about this one firm and not the many others that surely exist that are trying to do the same thing for

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#177

Post by chatmasta » Sun, Mar 18, 2018, 2:06 AM UTC

yeldarb wrote: post #50

fjsolwmv wrote: post #11

> Facebook denies that the harvesting of tens of millions of profiles by GSR and Cambridge Analytica was a data breach. It said in a statement that Kogan “gained access to this information in a legitimate way and through the proper channels” but “did not subsequently abide by our rules” because he passed the information on to third parties. This is exactly how Facebook was designed. You get a stupid quiz or photo fra…

As of ~4 years ago when graph api 2.0 was released that’s not true. The /friends endpoint only returns friends of the user who have also already installed your application.

As of April 2016 wasn't it limited to 50 "close friends"? IIRC it was also possible to abuse iOS webview and the FB library by modifying some private methods and injecting some JS to get the info of more than 50 friends. I don't remember the details, but I saw it in the wild in a high growth top 10 iOS app (reverse engineered to see how they were getting so many users so quickly).

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#178

Post by trhway » Sun, Mar 18, 2018, 2:07 AM UTC

For example, "Weev" got 3 years for downloading ATT user data. I wonder whether Bannon&Co would get anything ... So far it doesn't look like FB makes any push for CFAA case here. I wonder what would FB do if instead of Bannon it were a nobody like the above mentioned "weev".

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#179

Post by swebs » Sun, Mar 18, 2018, 2:15 AM UTC

phonypho wrote: post #146

dawhizkid wrote: post #38

Think about all those apps where you connect your bank account via your online banking creds that have full access to everything you buy.

Do people do that?

Yes, I know Mint does it and most credit unions offer FinanceWorks. Intuit gets the data from both.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#180

Post by stevenwoo » Sun, Mar 18, 2018, 2:22 AM UTC

patja wrote: post #28

I was curious how the figure leaped from the 270k cited in the Facebook press release to this 50M figure. It sounds like they never had full access to the Facebook profiles beyond the 270k who installed the app, but just harvested the friend lists of those 270k. This doesn't give the app developer full access to the friends' profile data, but I guess once you have the network of friend connections you can use other p…

From the interview, the architect of the system says Facebook detected the download of data (50 million users' data might crush smaller companies.) and asked what was going on and he just told them it was for academic purposes so Facebook let it pass. Also when Facebook told them to delete it later, CA said they did but didn't.