WhatsApp told to stop sharing user data with Facebook by French authorities • Hacker News Board

Re: WhatsApp told to stop sharing user data with Facebook by French authorities

#231

Post by chrisper » Tue, Dec 19, 2017, 8:03 PM UTC

briandear wrote: post #152

kuschku wrote: post #3

» The CNIL said it had repeatedly asked WhatsApp to provide a sample of French users’ data transferred to Facebook but the company had explained it could not do so as it is located in the United States and “it considers that it is only subject to the legislation of this country.” « That's a very interesting quote from Facebook, and explains why the GDPR has a special section explaining that it also applies to foreign…

> taking our data Hang on. You're GIVING it the data. People want "free" services, so I'm genuinely curious what people actually expect is going to happen when they use WhatsApp. Is it just something provided benevolently? How does WhatsApp make money? Are people really so ignorant to think that they can get a free lunch? There's an implied quid pro quo -- you use a free service in exchange for providing data used to…

Maybe you don't remember, but WhatsApp used to cost money. I even bought it back then. So how can I opt out of this data sharing then?

Re: WhatsApp told to stop sharing user data with Facebook by French authorities

#232

Post by robrenaud » Tue, Dec 19, 2017, 8:04 PM UTC

DannyBee wrote: post #146

theptip wrote: post #125

Earlier quoted context omitted.

As the article says, under GDPR (coming in mid-2018) they will be able to fine 4% of global revenue, or 20m EUR, whichever is larger [1]. I'm not certain that this particular case is covered by the GDPR, but if it is, then that will compel action. If Facebook declines to pay these fines, then presumably their execs would be arrested if they ever travelled anywhere in the EU. While FB can claim that it “is only subjec…

Or you'll see FB/others decide the EU isn't worth it over time. It's interesting how many people here believe that there is no other possibility other than "we get what we want to happen". Your faith is, IMHO, misplaced. There are many cases in history where other companies decided it wasn't worth the cost of doing business in certain countries. Or they just successfully coopted the governments!

I am skeptical. FB desperately wants to get into China, which seems way worse than the EU.

Re: WhatsApp told to stop sharing user data with Facebook by French authorities

#233

Post by mikeokner » Tue, Dec 19, 2017, 8:04 PM UTC

seszett wrote: post #51

mikeokner wrote: post #15

Earlier quoted context omitted.

Is there legal precedent for "sharing" when the only entity you're providing the data to is your owner? Presumably if I bought WhatsApp, I would legally be allowed to query some database for someone's phone number if I so chose because I now own the database.

> I now own the database. You might own the database, but you will never own the personal data that is stored in it. And in France (and in the near future the whole EU with GDPR) this personal data has a specific set of allowed uses (explicit or implicit when the user provided the data) attached to it, that you cannot change without asking the owner of the data (the user). So you own the database, but you cannot use…

Seems like in that case it should be Facebook being reprimanded if they do something with the data that violates the original terms of use. "Sharing" is a bit misleading because as soon as Facebook acquired WhatsApp, they became the legal owners of the user database and data insofar as anyone can "own" user data. WhatsApp is Facebook.

Re: WhatsApp told to stop sharing user data with Facebook by French authorities

#234

Post by kilburn » Tue, Dec 19, 2017, 8:07 PM UTC

a_imho wrote: post #154

gradys wrote: post #134

Earlier quoted context omitted.

I'm torn on this. On the one hand, I agree, the EU legislates privacy to a degree that no other political entity does as far as I'm aware, but on the other hand, they often do so with poorly designed policies. As an example, I'd point to the cookie notices that appear on almost every major website, which must have absorbed, globally, many careers worth of man-hours to implement while offering virtually no real-world…

I don't even understand how a cookie notice is equivalent to consent [1]. Anyone who consumed the content in this message agrees to pay this user 1 BTC [1] https://en.wikipedia.org/wiki/HTTP_cookie#EU_cookie_directiv...

In websites using this technique, consent is not assumed until you keep browsing the website. Hence, the notice cannot be in past tense like yours :P

Re: WhatsApp told to stop sharing user data with Facebook by French authorities

#235

Post by vkou » Tue, Dec 19, 2017, 8:10 PM UTC

briandear wrote: post #136

vkou wrote: post #103

Earlier quoted context omitted.

> Presumably if I bought WhatsApp, I would legally be allowed to query some database for someone's phone number if I so chose because I now own the database. It's not your data. It's your users' data. So no, you may own the database, but you do not own the data.

I don't understand how users own their own data. That doesn't make any sense. Where does that idea come from?

The same way that my bank does not own the contents of my savings account... Even if it is allowed to use that money (in highly limited and regulated ways) to, say, issue loans.

You don't own your users' data. Your users do. You may be allowed to use it in highly limited and regulated ways.

Re: WhatsApp told to stop sharing user data with Facebook by French authorities

#236

Post by da_chicken » Tue, Dec 19, 2017, 8:10 PM UTC

gradys wrote: post #134

RestlessMind wrote: post #99

EU is one of my best hopes when it comes to privacy and really wish they start going after tech behemoths. I have given up on US authorities doing anything to reign them in. And policies in other significant countries (eg. China) would be even worse for user privacy.

I'm torn on this. On the one hand, I agree, the EU legislates privacy to a degree that no other political entity does as far as I'm aware, but on the other hand, they often do so with poorly designed policies. As an example, I'd point to the cookie notices that appear on almost every major website, which must have absorbed, globally, many careers worth of man-hours to implement while offering virtually no real-world…

> they often do so with poorly designed policies

This is often what happens when legislatures take a first swing and regulating something. That rule about "build one to throw away" is just as relevant with law as it is code.

Re: WhatsApp told to stop sharing user data with Facebook by French authorities

#237

Post by DannyBee » Tue, Dec 19, 2017, 8:11 PM UTC

zajd wrote: post #222

DannyBee wrote: post #179

Earlier quoted context omitted.

"EDIT: I see you are fairly highly placed in Google. I'm quite surprised if you genuinely think what you wrote, given the raw numbers you must surely know, but given your legal training, I am not at all surprised that you would posture as if you were unaware of this." Character assassination, awesome! Please leave the company i work for this out of this, always. I never speak for my company on hacker news unless i sa…

This is probably the best way to prove his point for the record.

I'm okay if they, or anyone, thinks i "lost" or if makes them feel like their view is correct. That's always one of the possible consequences of doing what i did.

Plenty of folks on HN know i'm happy to participate, even in contentious topics.

I can get that kind of 'discussion' on Reddit. (IE Where the response would be someone pointing out that claiming someone else is posturing is itself posturing, etc).

Meanwhile, i'll stick to HN discussions with people who assume good faith and actually want to talk about the topic. When that stops being a possibility, i'll delete my account and go do something else with the time.

Re: WhatsApp told to stop sharing user data with Facebook by French authorities

#238

Post by ori_b » Tue, Dec 19, 2017, 8:12 PM UTC

geofft wrote: post #164

mikeokner wrote: post #33

Earlier quoted context omitted.

Sure, that makes sense to me. But this seems more like "the company said it wouldn't allow anyone else to query the database" before I bought it. Now that I'm owner, do I still count as "anyone else?" I'd argue not. Edit: that's from a US perspective. Sounds like France (& the EU) put additional restrictions on how personal data may be used even after it's voluntarily provided.

> Sure, that makes sense to me. But this seems more like "the company said it wouldn't allow anyone else to query the database" before I bought it. Now that I'm owner, do I still count as "anyone else?" I'd argue not. I don't think the change of ownership matters. If I say that I won't allow anyone else to query the database, that statement isn't about restricting others from wandering into my offices and pulling up…

> I commit to not querying the data with the purpose of sending it to others.

Nobody's arguing with that. The problem is that there was no commitment to avoid querying the data with the purpose of sending it to yourself.

And when Facebook bought WhatsApp, they ceased to be "someone else".

Re: WhatsApp told to stop sharing user data with Facebook by French authorities

#239

Post by JepZ » Tue, Dec 19, 2017, 8:19 PM UTC

cosarara97 wrote: post #212

cJ0th wrote: post #175

Earlier quoted context omitted.

> Yes, it is a little more complicated to setup, but in the end it works as good as the others And this is quite literally true. It really only is a little more complicated. This is not a handwaving statement. You don't need any technical know-how to get Conversations running. It's only the fingerprint thing you have to explain to people who are not tech-savvy. But if you hit the right tone they'll have no problem wi…

There is the issue of the account. Whatsapp and Telegram are free (signal too?) and require 0 setup. With Conversations, you either have to pay for a conversations.im account, or open your browser and register on another server. I certainly can't imagine my grandmother doing that.

Well, there are a few more issue. None is a real show stopper but each would be worth to be solved in the sense of usability:

- Explaining decentralization aka. 'Its like E-Mail: you need an address'

- Choosing a good provider (reliable to stay for some time, server features)

- Registering an account (many providers require a registration via browser)

- Obtaining Conversations:

-> Play store: and pay for it - 'yes, its worth it and you support the development'

-> Fdroid: free, but more complicated

- Adding contacts (as Conversations doesn't scan your address book you have to do it manually)

- Enabling OMEMO (not enabled by default)

- Adjusting settings as some default settings are kinda weird (e.g. disabling green background of encrypted messages, show online status, enabling confirmation of receipt)

So to solve those issues I have a few Ideas:

Provider selection: The App could score all available providers (important features, years of service), sort by score and let the user select the desired domain extension. Afterwards it could perform an in-band registration (it already does so if the server supports it).

Price: While I find the app totally worth its price, I think it hurts the adaption to some extent. So if I could decide it, I would make it available for free and see to make the money somewhere later in the customer journey, as setting the price up-front kills the network effect.

Contacts: Actually, I do not like it when Google & co. scan my whole address book and send it to their servers and keep it there for future use. But think there could be some compromise like: I can decide to publish my own address as a hash to some central service and use my address book to ask if someone else has registered the address (rate limited). Yes, you would still have to trust the central service to some extent, but that should be an acceptable and completely optional way of contact discovery.

OMEMO: Should be enabled by default.

Default settings: Maybe some day I will create a pull request.

While this list looks kinda intimidating, using Conversations after the installation is pretty much the same as WhatsApp/Signal.

Re: WhatsApp told to stop sharing user data with Facebook by French authorities

#240

Post by tzahola » Tue, Dec 19, 2017, 8:22 PM UTC

a_imho wrote: post #154

gradys wrote: post #134

Earlier quoted context omitted.

I'm torn on this. On the one hand, I agree, the EU legislates privacy to a degree that no other political entity does as far as I'm aware, but on the other hand, they often do so with poorly designed policies. As an example, I'd point to the cookie notices that appear on almost every major website, which must have absorbed, globally, many careers worth of man-hours to implement while offering virtually no real-world…

I don't even understand how a cookie notice is equivalent to consent [1]. Anyone who consumed the content in this message agrees to pay this user 1 BTC [1] https://en.wikipedia.org/wiki/HTTP_cookie#EU_cookie_directiv...

Shit, you got me! Post your BTC address please... :(