Why does it ask for your e-mail password to begin with? It is sad that there are 1.5M people out there (and probably more) that actually gave them their password. Scary.
Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
91–100 of 310 posts
Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
#92Earlier quoted context omitted.
its such a coincidence that these accidents keep happening in ways that enable further data gathering...surely there isn't a larger problem with Facebook's attitude towards their users' private data or anything
Well, to be fair we probably don't hear about the accidents that end up causing the opposite situation. Those are just normal bugs.
"Facebook bug causes all user's sensitive data to not be uploaded in some case" sounds like an Onion headline.
Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
#93Earlier quoted context omitted.
From the article it sounds like there was a prompt for permission that got removed: > Facebook told Gizmodo via email that in May 2016 it made a revision to the registration process, which originally asked the affected users for permission to upload contact lists. That change removed the opt-in prompt, though the company did not realize the underlying functionality was still operating in some cases. It doesn't take a…
Also from the article > A Facebook spokesperson also told Gizmodo that a screenshot of the original opt-in prompt was not available. I'm not a conspiracy theorist but if you're trying to claim you cannot capture a screenshot from any release meant to be shipped out, either you're crap at release management or are full of shit. Which one is it? Also, even if we were to suspend logic and belive this was a bug, what's F…
> I'm not a conspiracy theorist but if you're trying to claim you cannot capture a screenshot from any release meant to be shipped out, either you're crap at release management or are full of shit. Which one is it?
That doesn't strike me as especially unlikely, especially for a specific branch of the app codebase that would likely only operate with a huge number of other co-dependent codebases for backend systems that no longer exist.
With six months to recover code and build a non-live environment with all the dependencies could it be done? Sure. But that's not really within the scope of a journalist request.
Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
#94Saying "unintentionally" here is like saying you unintentionally stole someone's TV when they gave you their key to walk their dog. It takes extra work to upload those contacts, which means several managers and developers decided to do it and then spent time implementing it. For the FB employees reading this: what is your tipping point? Would you say no to that assignment?
A common practice is to keep developers unaware of the real objective of their work (like Uber, in another comment on HN, https://news.ycombinator.com/item?id=13786384):
- developer A is tasked to create the prompt to ask for username and password of the email account
- developer B is tasked to call some API to upload contacts from email account
- developer C is tasked to bind two functionalities.
Now replace developers with teams and you see how simple is for the average developer to underestimate the scope and the ethical bounds of a given task.
Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
#95I'm pretty sure LinkedIn does or used to do the same.
yes LinkedIn was certainly using dark UI patterns to upload the contact list and send invites to everyone on it.
Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
#96Earlier quoted context omitted.
Facebook is a multi-billion dollar company. This is gross negligence if they didn't spend time to QA this.
Doing QA at large tech companies is never that simple. You have lots of teams that share code. Imagine a scenario where Team A uses code written by Team B which uses code written by Team C. Team C makes a change to their code that breaks Team B's code but only for the way Team A uses it .
For the people in the back, "Facebook is a multi-billion dollar company." They have 30,000 employees. They could spend the money to do better QA. But it's cheaper to let your end-users do it for free.
Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
#97Why are companies even asking users to provide passwords for unrelated services? For example, when I added an external account on Etrade, they gave me the option of same day verification of that account if I provided them my online banking account credentials.
This practice opens up a significant potential for abuse and should be illegal.
Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
#98Saying "unintentionally" here is like saying you unintentionally stole someone's TV when they gave you their key to walk their dog. It takes extra work to upload those contacts, which means several managers and developers decided to do it and then spent time implementing it. For the FB employees reading this: what is your tipping point? Would you say no to that assignment?
> It takes extra work to upload those contacts, which means several managers and developers decided to do it and then spent time implementing it.
Not really. Facebook is a bunch of autonomous services (registration, access, tracking, activities, etc.) accessing shared databases (chat logs, activities, media uploads, etc.) with some kind of automatic implicit and explicit ACL in place. The suggestion/contact service got access to data provided through the email-not-working-with-oauth-so-let-us-use-automatic-token-delivery-and-confirmation-by-accessing-user-emails because it was told a new source of contacts were available for those users. So, not a straight path.
Accident/Blunder > Evil.
Now. GDPR ? GDPR. And because of GDPR those things aren't supposed to happen in Europe.
Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
#99We will look back on these times and realize how morally and ethically corrupt Facebook was and is, especially under this "Leadership". This is why Facebook should be broken up. Its not just dangerous to Democracy, its an actual menace.
Re: Facebook 'unintentionally uploaded' 1.5M people's email contacts without consent
#100Earlier quoted context omitted.
Apparently Facebook is claiming that the functionality came from a separate "import contacts" feature that used to exist. But I agree; the idea that the import logic could have slipped into the login process accidentally is ludicrous. Or at least it indicates an outrageous lack of care on Facebook's part.
If the feature was using the fact that the user supplied the email password, parsing the emails for contacts or logging in with the password and getting the contact list, how on earth could that have been a part of an earlier import contact feature? Did they already ask users for their email password for that? If not this is a feature that needed special code, impossible to be an accident.
> how on earth could that have been a part of an earlier import contact feature? Did they already ask users for their email password for that
Yes they did. I remember people complaining about it many years ago. Here’s a page from 2012 describing it I found using google advanced search: https://smallbusiness.chron.com/import-email-facebook-44162....
> When you create a Facebook page for your business, you can import your email list of contacts directly into Facebook. From there, you can suggest your Facebook page directly to your customers. Facebook can interact with a range of email providers and only needs your email accounts's username and password to import your contacts.
Here’s another from 2011 https://www.techwalla.com/articles/how-to-import-contacts-to...
> Type your email address and password for the Web-based email or instant-messaging service that you want to import into the dialog boxes and click "Find Friends."