>Facebook must exercise greater oversight over third-party apps, including by terminating app developers that fail to certify that they are in compliance with Facebook’s platform policies or fail to justify their need for specific user data; >Facebook is prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising; >Facebook must provide clear and con…
>Facebook must encrypt user passwords and regularly scan to detect whether any passwords are stored in plaintext; and
Why are they storing passwords at all? It's not necessary for authentication. They should only be storing a hash, or better yet a public key derived from the password on the client.
A lot of the terms of the settlement deal with organizational changes, but when you look at the very specific privacy restrictions that Facebook agreed to, it's really, really problematic stuff: * Facebook is prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising; * Facebook must provide clear and conspicuous notice of its use of facial recognit…
So basically a defanged, company-specific halfway-there poor man’s GDPR. Still a win though.
I still find Facebook has one of the most toxic cultures of any company out there. All they've ever done during their history is betray user trust, but it's ok as long as they keep 'apologizing' and then doing nothing to fix it
A lot of the terms of the settlement deal with organizational changes, but when you look at the very specific privacy restrictions that Facebook agreed to, it's really, really problematic stuff: * Facebook is prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising; * Facebook must provide clear and conspicuous notice of its use of facial recognit…
> prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising
Facebook is not alone in misuse or wrongful use of phone number given for 2FA. LinkedIn explicitly requires phone number to be added on the profile to enable 2FA and makes the phone number visible by default to all the contacts, if you don't want your phone number visible; you'll have to loose 2FA as LinkedIn doesn't support authenticator or other alternate 2FA means(FB does).
I came to know this as after I enabled 2FA on LinkedIn, I started receiving messages from random people on WhatsApp whom I later found to be my LinkedIn contacts.
I'd be curious to see where this fine goes. From what I seen most FTC fines go to "the U.S. Treasury for general use". Not even Congress gets a chance to mismanage it.
Then again, if they take it out of circulation, maybe it is a net gain for everyone?
I don't think I agree with Facebook getting a bigger fine than Equifax. I put my own information on FB. Equifax compiled information on me without my explicit consent. Both sets of data got into hands they shouldn't. I realize that misses FB willfully doing what they did and Equifax not intending to be hacked, but for me my consent is equal or more important than what the holders of the data did after they had it. Le…
> Who did worse, the friend sharing the data I gave to them, or the stranger who got it without permission? I honestly don't know which answer here is supposed to be the obviously correct one.
I think the idea is supposed to be that you have some agency when you share your data with a friend. You can choose whether you want to entrust your data to this friend or not, and the onus is on you to properly vet them for transparency and trustworthiness. Conversely, if a stranger leaks your data, that isn't on you at all (beyond you allowing the stranger access to your data, but that's stretching the metaphor a bit). I don't find this argument particularly compelling though, because the typical Facebook user definitely didn't know what they were getting into when they signed up years ago. I find it hard to fault people for improperly vetting entities that are beyond their area of expertise, and I don't think this mistake on the user's part makes Facebook's practices any less egregious.
I still find Facebook has one of the most toxic cultures of any company out there. All they've ever done during their history is betray user trust, but it's ok as long as they keep 'apologizing' and then doing nothing to fix it
Did you work there? I worked there for 2 years (it was a mistake), and found that the culture wasn't toxic, just obtuse. They never questioned what they did, or thought about the implications. They focused on "move fast," without really thinking through implications of things.
Does it bother anyone else that Facebook is being fined $5 billion while Equifax, a company with a history of anti-consumer activity and privacy violations going back decades, the company that congress was forced to enact the Fair Credit Reporting Act to contain, and who gave away all the personal information for over a hundred million people through its own negligence, was fined a mere $650 million? Do you get the idea that this is less about consumers and more about Zuck blowing off Congress?