Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

nytimes.com

Post reply on HN
Print view View original

271–280 of 331 posts

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#271

Post by kerng »

monsieurbanana wrote: post #42
AdmiralAsshat wrote: post #23

Seems like they should add another 0 to the fine after the recent hat trick: 1) Prompting users to give Facebook their email passwords.[0] 2) Using that email access to "inadvertently" upload the information of their email contacts.[1] 3) Storing said passwords and others in plaintext. [2] It's pretty impressive that a company could do something so brazenly malevolent and be confident that they will escape with no mo…

I'm ashamed to say that up until now, when I saw Facebook (or similar) acting evil I thought about the quote, "Never attribute to malice that which is adequately explained by stupidity". Well, fuck that and fuck me, those people are not idiots, they're criminals.

I think that is the perception that needs to change, some actions certainly can't be explained with "move fast and break things".

Some actions move into the criminal areas, like tricking users for passwords and phone number to then use that for other purposes to further their own agenda. That could indeed be seen as criminal I think.

And someone has to be held accountable.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#272

Post by Macross8299 »

cowpig wrote: post #206
shubhamjain wrote: post #101

It seems beside the "the bug bounty is far less than it would have sold for in the dark market" another meme has taken hold of HN. No matter how significant the fine is, there always be people clamoring how trivial it is compared to their revenues. It could have been $10B and you would hear the same thing. The only fine, then, worth slapping is one that bankrupts the entire company. Facebook made ~$7B net income in 2…

Facebook earned about $172 billion since 2013. Do you think facebook would have earned $167 billion while behaving legally? What about ethically? How much do you think Facebook would have earned if it acted responsibly? Once you add punitive damages, I don't understand how you could possibly think $5 billion is anything less than an order of magnitude off.

>Facebook earned about $172 billion since 2013. Do you think facebook would have earned $167 billion while behaving legally?

>5 billion is ... an order of the magnitude off

So you're saying a 30% of their income came as the result of illegal activity? That's a pretty strong statement to make. What proof do you have of that?

Do you want to punish Facebook for doing things that are legal (but arguably not ethical) or do you want to punish them for doing things that are illegal? The former means you're essentially advocating for an ex post facto law and it's easy to understand why some people would see that as not fair.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#273

Post by _jal »

UncleMeat wrote: post #209
jyrkesh wrote: post #193

Earlier quoted context omitted.

There might not have been a large-scale public data dump of passwords, but if 20,000[1] employees had access to logs with plaintext passwords, there is no guarantee I could ever accept that zero of them read or used customer passwords for personal purposes. What's to stop a malicious ex-lover from grabbing a FB password and reading that person's private messages? If FB didn't even know there were passwords in plainte…

Malicious insiders don't need your password to access your data. If you are concerned about malicious insiders then plaintext password logs don't matter.

With FB's dataset and employee count, it would be insane not to be concerned with malicious insiders. Even if you completely discount morality and honesty where Facebook is concerned (and I do), there's substantial liability risk, PR risk, regulatory risk and commercial paranoia, which I suspect was likely their biggest concern, at least until recently.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#275

Post by kerng »

beatgammit wrote: post #164
scotchmi_st wrote: post #112

Earlier quoted context omitted.

Not to contradict your overall sentiment, but people often focus on intention with these issues. I think that's wrong. Like, if someone treads dog poo into my house on their shoes, it doesn't really matter if they did it by mistake, or spent ages walking around town trying to find some dog poo to step in before coming to my house; the effect is that there is now dog poo on my carpet. We need to be more dispassionate…

There definitely is a difference between someone accidentally tracking dog poo into your house vs someone doing it intentionally; in the first case, you all them to clean it up, and in the second case you break the friendship and/or seek criminal prosection. Likewise for big companies. If a company is acting badly, you need to figure out if it was intentional. In both cases you seek damages, but your approach to maki…

Repeated behavior probably has to be taken into account also, like if your friend does it 10 times - you'll want to break up that friendship.

It's hardly an accident at that point anymore, but intentionally or (intentionally) carelessly done. That's where we are with Facebook I think.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#276

Post by [deleted] »

wavefunction wrote: post #261
_cs2017_ wrote: post #172

Earlier quoted context omitted.

I don't think they can make money off plain text passwords? They can only lose money from that, if it's discovered and they are fined and lose some users. They can make money from contact lists, but IIUC the article said they didn't use the contact lists. Also, given that it only affected a couple million users (like 0.1% of their user base), the damage to their reputation would far outweigh any benefits of actually…

how about extracting a user's contacts with their plaintext passwords that would usually be hashed into a database (at least in my professional experience) and thus unusable by facebook?

[deleted]

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#277

Post by hw »

fuzz4lyfe wrote: post #220
UncleMeat wrote: post #210

Earlier quoted context omitted.

There are a finite number of log locations now . How do you intend to operate an integration test across the entirety of Facebook's stack to detect new log locations?

Change requests and a change review board staffed by professionals. Subject: Change Request Body: I would like to log the body of authentication requests in production. Subject Re: Change Request Body: How will you ensure personal data is not stored that shouldn't be? Subject: Re: Re: Change Request Body: I will add configuration Y to logging system X.

Bureaucracy like this is what kills teams and products. There's no guarantee it works, and every change or commit should already have privacy and data protection in mind anyway. You also don't know what you don't know - you could for all your knowledge think that nothing is being logged, when in fact there's a subsystem outside your scope that's actually doing the logging.

You assert that it's trivial, yet you're adding more layers to protect against something like that from happening. It's the naivety that all problems are trivial is what gets people and companies into trouble in the first place

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#278

Post by doctorpangloss »

kerng wrote: post #275
beatgammit wrote: post #164

Earlier quoted context omitted.

There definitely is a difference between someone accidentally tracking dog poo into your house vs someone doing it intentionally; in the first case, you all them to clean it up, and in the second case you break the friendship and/or seek criminal prosection. Likewise for big companies. If a company is acting badly, you need to figure out if it was intentional. In both cases you seek damages, but your approach to maki…

Repeated behavior probably has to be taken into account also, like if your friend does it 10 times - you'll want to break up that friendship. It's hardly an accident at that point anymore, but intentionally or (intentionally) carelessly done. That's where we are with Facebook I think.

Has this really where our discourse has gone? Dog poo? Break up friendships?

This isn’t stupid fucking kid stuff anymore. It’s not debate club. You’re inheriting society, you have to start talking and acting like god damn adults and for once get mad when an utterly soulless corporation screws this society over and gets a god damn fine instead of jail.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#280

Post by drb91 »

beager wrote: post #130
minimaxir wrote: post #2

> Every insider I've spoken to said any FTC fine on Facebook under $10 billion would be seen as a massive win, showing firm won't face serious consequences for privacy violations. Wall St. seems to agree in response to news of $3-$5b settlement [$FB up 4% after hours] https://twitter.com/lhfang/status/1121148735818358784

In other words, market rewards Facebook for being fined only $5 billion by increasing their market cap $20 billion. Unreal.

> by increasing their market cap $20 billion

Is this actually meaningful to any company that isn't IPOing or releasing new shares? I am not pro-facebook by any means but it's not clear this means much aside from how much their investors like them, again of questionable value as the majority of votes are privately held by Zuckerberg.

Post reply on HN