Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50M Facebook profiles harvested for Cambridge Analytica in major data breach

theguardian.com

Post reply on HN
Print view View original

21–30 of 271 posts

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#21

Post by mrtksn »

734786710934 wrote: post #2

This wasn't a data breach, it was a misuse of data by a third party.

Don't you think that it can be a breach in the same sense of a breach by phishing? After all, both of the cases are about people giving their "secrets" for one reason but the info being used for something else.

I mean, in the case of traditional phishing the user is tricked to provide the password by impersonating a banking site, getting their funds stolen and in the case in question, the users are tricked to provide personal information by being promised some kind of personality analysis but their data is used for political propaganda that they didn't asked for resulting in life-changing consequences du to politics.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#22

Post by anonymouz »

734786710934 wrote: post #2

This wasn't a data breach, it was a misuse of data by a third party.

Technically perhaps correct, but for the victims it seems rather irrelevant to me.

In a data breach, someone would have used a technical vulnerability or some other (e.g. social engineering) vulnerability of Facebook to get illegitimate access to the data.

In this case Facebook simply gave them access to the data and took their word that they won't misuse it.

Now maybe the latter situation might not be a data breach in the classical sense, but I don't see how it makes it any better for the victims. If anything it seems worse -- Facebook didn't even try to protect their data.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#23

Post by lettergram »

hashkb wrote: post #17
Erlangolem wrote: post #15

Earlier quoted context omitted.

...and have everyone else who knows you stop, and block their widgets and buttons that track you, and block any org that might leak, sell, or just share some of your info with them. I can’t stop a friend or just some rando at a party from uploading a photo of me. I can’t stop friends from using FB and getting me into their system. In 2018, privacy isn’t just about what we choose to do.

I agree. But you should take that first step, and then start lobbying your friends to stop posting pictures of you. Personally, I also excuse myself at gatherings when the cameras come out, because I know it's all going straight to FB. The shaming has already started to decrease; now I'm usually not alone in popping out of the room.

I instead, always asked everyone be tagged as someone else. Typically, people are relatively okay with this because no one notices.

It totally breaks the CNNs for face detection.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#24

Post by cryptoz »

734786710934 wrote: post #2

This wasn't a data breach, it was a misuse of data by a third party.

Every single definition I find classifies this as a data breach.

> A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#25

Post by cryptoz »

hashkb wrote: post #5
cryptoz wrote: post #4

Earlier quoted context omitted.

You are nitpicking a small part of an article (incorrectly) and it distracts from the main point: A foreign power is working with American billionaires to subvert democracy and install a dictator . This is a serious issue and one of the biggest news stories of our time. > This wasn't a data breach Yes it was. > it was a misuse of data by a third party. So a bank robber who gets into the vault just misused the locks?…

You're downvoted because you're technically not correct. The case is more like the bank manager allowing the robber into the vault, with full knowledge that the robber wants to and could easily make off with all the valuables, then asking the robber to please not do that before heading back to work, leaving the thief unattended in the vault. Edit: it's a breach of contract, maybe; but not a "data breach" which I thin…

I was completely technically correct. It's a data breach. Plain and simple.

> A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#26

Post by kmfrk »

ceejayoz wrote: post #7

I wonder how many of the "see what you'll look like when you're 80" and "find out how you'll die" quiz apps are doing this behind the scenes.

I once told a sales rep from my ISP to stop trying to sell me on a phone subscription to which he replied that "I probably signed up for a Facebook competition or something" as if that justified it. (I don't have a Facebook account.)

One of the worst things Facebook did was to just destroy any expectation of privacy.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#27

Post by shiftfocustime »

I think it is much more important to focus on an investigation to make clear to the public how this data was used. That i think will lead into a much more interesting story. No one seems to want to go there and i don't understand why. Maybe because a lot of its clients are political parties/political individuals around the world and they do not want to be ousted for using "public opinion manipulation technology" on a wide scale.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#28

Post by patja »

I was curious how the figure leaped from the 270k cited in the Facebook press release to this 50M figure.

It sounds like they never had full access to the Facebook profiles beyond the 270k who installed the app, but just harvested the friend lists of those 270k. This doesn't give the app developer full access to the friends' profile data, but I guess once you have the network of friend connections you can use other public data sources to fill in or infer the gaps. And of course some of those 50M will have FB profiles that are fully public open books ready for anyone to harvest.

I will say as someone who has developed Facebook apps, the whole ecosystem is pretty much on the honor system for protecting user data. There are some seemingly random and capricious (and often erroneous) abuse detection algorithms, but once an app has access to user data who knows what they do with it and whether it was kept secure -- surely Facebook has no idea unless they perform invasive manual physical audits.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#29

Post by Erlangolem »

lettergram wrote: post #23
hashkb wrote: post #17

Earlier quoted context omitted.

I agree. But you should take that first step, and then start lobbying your friends to stop posting pictures of you. Personally, I also excuse myself at gatherings when the cameras come out, because I know it's all going straight to FB. The shaming has already started to decrease; now I'm usually not alone in popping out of the room.

I instead, always asked everyone be tagged as someone else. Typically, people are relatively okay with this because no one notices. It totally breaks the CNNs for face detection.

Smart, I think I’d have more success trying this than just leaving the situation entirely. This is going to be a lot easier to pull off with non tech oriented friends than a speech about privacy and why I have to leave the room.

Re: 50M Facebook profiles harvested for Cambridge Analytica in major data breach

#30

Post by jdavis703 »

anonymouz wrote: post #22
734786710934 wrote: post #2

This wasn't a data breach, it was a misuse of data by a third party.

Technically perhaps correct, but for the victims it seems rather irrelevant to me. In a data breach, someone would have used a technical vulnerability or some other (e.g. social engineering) vulnerability of Facebook to get illegitimate access to the data. In this case Facebook simply gave them access to the data and took their word that they won't misuse it. Now maybe the latter situation might not be a data breach…

Facebook isn't the victim here, it's voters who may have been specifically targeted at a "physchographic" level and had their opinions unduly influenced. Further, every person who's a member of a democracy that was targeted by Cambridge Anayltica and is now being run by corrupted politicians (or in the case of Brexit by misinformed voters) is a victim.
Post reply on HN