I don’t really get it. Isn’t the opposite of this (restricting third party developers) exactly what people are furious at Twitter over, for killing Tweetbot etc.?
Two More Cases of Third-Party Facebook App Data Exposure
41–48 of 48 posts
Re: Two More Cases of Third-Party Facebook App Data Exposure
#42Since there are many anecdotal reports of Facebook failing to delete the profile history data even after closing your account, is there a better way people should be scrubbing their data? Some kind of tool, perhaps, that edits all of your posts and replaces them with scrambled / gibberish text?
They could easily be keeping a history of everything, so while this would affect the final version of the item, it wouldn't delete the history. The data would still be there for them to mine, and to be stolen.
Re: Two More Cases of Third-Party Facebook App Data Exposure
#43This other article that got posted today might explain why this happened in more detail: https://medium.com/@six4three/deceit-by-design-zucks-dirty-s... Seems to suggest that FB platform apis were designed to not share any privacy metadata with devs. Maybe not the same as how apps like At The Pool stored that data, but might explain the firehose of data that FB gave devs and now they will point the finger and say it…
Developers would have to intentionally write extra code to respect privacy metadata, so it seems unlikely that would have made a difference.
Criminals seem unlikely to follow laws, so why bother having them? Of course devs would need to intentionally follow the privacy wishes of users but without metadata, even responsible developers who want to, can't.
I guess my question for you, considering it looks like you worked with devs at FB, is this article regarding FB platform design accurate? That's the most shocking thing to me that this article conveys, that even if you wanted to ensure data privacy as a dev, you couldn't unless you built a custom tool. I'd be pretty surprised if most (or any) would.
Curious on your thoughts.
Re: Two More Cases of Third-Party Facebook App Data Exposure
#44Unfortunately, Facebook had a fundamental misunderstanding of how privacy has to work, and their users will be paying for their error for years. If it's earth-shatteringly bad for your users if their private data is leaked by a third-party, you cannot exfiltrate that data to a thrid-party. Full stop. No amount of policy un-leaks data, and "You cannot continue to operate as a Facebook service" is an empty threat the m…
How would this work in the case of data portability? If Facebook were to be forced to provide an API that allowed users to export all of their data to a competing social network would Facebook be responsible for ensuring that the competitor was using the data responsibly?
Yep, now if you have N friends your data might be in the hands of N companies. You'd need a GDPR-like privacy framework with audits and even then the risk of mistakes is enormous.
(Note that when people talk about data portability they're really talking about federation since social networking can't work otherwise. Non-social data is a little easier.)
Re: Two More Cases of Third-Party Facebook App Data Exposure
#45Earlier quoted context omitted.
Facebook used to be much better at locking down third-party exfiltration. But back in the early 2010s, the zeitgeist was against it; there were countless articles in the genre of "I'm a random third party developer, and Facebook is trying to stop me from exfiltrating massive dumps of my user's data! How anticompetitive!" So they decided to start being more open.
Can you provide one or two of those articles?
Here's an article discussing it: https://gigaom.com/2011/07/06/who-owns-your-social-graph-you...
Look at how angry the commenters there are that facebook would even consider restricting the access that third-parties have to such data.
Re: Two More Cases of Third-Party Facebook App Data Exposure
#46Unfortunately, Facebook had a fundamental misunderstanding of how privacy has to work, and their users will be paying for their error for years. If it's earth-shatteringly bad for your users if their private data is leaked by a third-party, you cannot exfiltrate that data to a thrid-party. Full stop. No amount of policy un-leaks data, and "You cannot continue to operate as a Facebook service" is an empty threat the m…
Have partners ship you the computations they wish to do, vet them, and then ship them results compliant with your users' expectations. In this case, the user clicked okay on a dialog that said something like "Share my friend list with this application." It would be sane at that point to expect that the application has access to your friend list. The application typically doesn't want to do a "computation", per se, th…
[deleted]
Re: Two More Cases of Third-Party Facebook App Data Exposure
#47Earlier quoted context omitted.
Not to discount the possibility that the article could be incorrect about this, but it makes the claim quite unambiguously: "it contains plaintext (i.e. unprotected) Facebook passwords for 22,000 users"
They have updated the article to say > it contains plaintext (i.e. unprotected) passwords for 22,000 users and > The passwords are presumably for the “At the Pool” app rather than for the user’s Facebook account, but would put users at risk who have reused the same password across accounts.
Thanks for clearing that up, didn't say that when I read it, indeed, it originally said "Facebook passwords".
Re: Two More Cases of Third-Party Facebook App Data Exposure
#48Earlier quoted context omitted.
Eh, I don’t really care if it is a failure on the point of Facebook engineers or a failure on the point of Facebook data policy that allowed other engineers to post data about me in an insuecure manner. Seems like splitting hairs here.
In this case I think it is a failure on the part of a third-party application developer, rather than any failure on Facebook's part.
I still think this is fundamentally Facebook’s problem.
For example, I don’t care if it’s a failure of the payments ecosystem or my bank if using a new payment technonlogy opens me up to fraud that then drains my bank account- I just won’t use that new technology anymore. Similarly I don’t care who’s fault it is if using Facebook leaks information about me I didn’t realize and didn’t want to become used in the ways it has been. I will just not use Facebook anymore.