I'm becoming scared of Facebook
reddit.com
reddit.com
Here's a more likely scenario that is scary in its own right: I have a private conversation with John Doe. John Google's it and ends up on a page with the Facebook tracking pixel. Google knows John and I know each other, knows John and I were in the same place and knows John googled something not long after or while we were in the same place. Facebook doesn't know we talked about it but it can make a guess. Worst case is they show me an ad without much context like dozens of other ads I ignore every single day.
That kind of profiling is what we should be talking about because it doesn't take much to figure out who's talking to who about what when you have information about their every move and page load.
I realize that this was posted on the technology subreddit, but that subreddit reaches an extremely wide audience, most of which certainly doesn't know all the ins-and-outs of the tracking/advertising business.
The precision is what makes it seem weird, and without an understanding of how a company would target ads to you, the idea that you're being literally listened to by the app, seems possible.
> Attributing them to spying is a ticket to a level of paranoia that some people have a very hard time finding their way back from.
I'll state again that I don't believe FB is actually listening in on phone conversations, but to the majority of their users, they may as well be doing just that. It is all just spying, only using different sources.
Today, the advertisements aren't about milk, but are about obscure products that eerily match private conversations.
Facebook makes a business of watching you.
If it's legal for FB to use the mic while you're not perfectly aware, they will do it. That said, I don't believe they are doing that, but they are using basically every aggressive means available to capture information about you, which they own, and will do as they please with.
After Snowden revealed what was not only possible, but what was going on, would this really surprise anyone? That was over three years ago, do you think technology hasn't matured? Do you think they wouldn't do it for ethical reasons when there is profit to be made?
Hell, Samsung said they do it with their smart TV's. But their PR department says they respect your privacy, of course. Wink wink.
https://www.cnet.com/news/samsungs-warning-our-smart-tvs-rec...
Also, I suspect it's not so trivial to actually do this - there's a big difference between how people intentionally speak to a phone (e.g. making calls, FaceTime) and just ambient audio from a phone in a pocket or on a table.
>there's no way they'd be able to keep it secret, NDA or not, and there'd be a massive shitstorm about it.
If a developer goes public with that information, their career is pretty much over. They get sued for millions of dollars and their life is pretty much over.
The developers working on it could be led to believe they were working on something else completely. It only takes 1 person to pull the libraries together, and that would have to be someone you trusted.
Coca-Cola protects their formula by having several vats of stuff, so to make Coke, you mix 1 part vat A, 2 parts vat B, and 1 part vat C and you're done (just a hypothetical). Some people knew what was in vat A, but not vat B, etc. The same thing can be applied to programmers.
>there's a big difference between how people intentionally speak to a phone (e.g. making calls, FaceTime) and just ambient audio from a phone in a pocket or on a table.
Siri can do it easily. You have to be in close proximity for it to respond. Say "Hey Siri" from across the room and nothing happens. Just check volume levels and that's it. Anything quieter than a few decibels and you ignore.
Have you actually worked in software engineering? There's no way this approach would be practical, especially not in a public company, with as many platforms and sophisticated tech like FB. This is a ridiculous conspiracy fantasy.
Also, having worked in ad-tech, in order to sell this to clients you have to have product explain it to sales, you need marketing to create powerpoint presentations explaining where the data comes from, with stats showing why it's better, possibly your data science team needs to do bespoke reporting, etc... it would take at least dozens of people from multiple teams to implement something like this.
Yes, 20 years. When dealing with a large application, it's broken into smaller chunks and each chunk has a team. It's called "divide and conquer" and has been a strategy as long as I can remember. You have an AI team and a UI/UX team, a data persistence team, a voice to text team, security / encryption team, multiple teams dealing with various middle tiers / micro services; all providing libraries and services. You have teams that don't even work for you that provide FOSS code.
>This is a ridiculous conspiracy fantasy.
It is but it's fun.
>in order to sell this to clients
That's the point, you don't sell it to clients, at least not directly, you just add weight based on captured conversations to existing "weighted preference" of the client. Do you explicitly explain every technical detail, line by line, algorithm by algorithm of how you acquire advertising data to your clients today? Of course not, they don't care, they just want to sell their wares.
I mean Apple has secret teams by the truck load, and most things are leaked by third party manufacturers. I don't see how you can't imagine how feasible this is to do.
There's just no way you can sneak new functionality into an app without the engineering and product owners of the app knowing. You can't add new data feeds without the data teams knowing how much, how long, who can access etc... And someone has to make that data somehow useful to the actual advertisers, which requires that that they know what it is...
And yes, ad-tech clients do want to know exactly where the data comes from, whether it's reliable (somewhat and sometimes, in my experience), and whether they're allowed to use it (pharma).
Apple's stuff doesn't usually leak until it hits the manufacturers, which are third party. Apple itself is very good at keeping secrets within it's own company. One of the main reasons Snowden had access to that data is the NSA oursourced tens of thousands of tech people. If it's just one or two people, it's much, much less likely to be leaked.
>without the engineering and product owners of the app knowing.
You can sneak it into an app with just 1 engineer knowing. There are still 2-3 people who know the complete formula for Coke. You can get a SVP come directly to the developer and circumvent the product owners, or you could make a skunkworks team of just 1-2 people. Hell, FB manages to keep it's private keys private because only a select group of people can access it, let alone know where they are stored.
>ad-tech clients do want to know exactly where the data comes from
Funny, when I take out ads on FB, it doesn't tell me the algorithms used to determine who likes what, it just gives me the option on what demographics to focus on.
I would venture to say not only is it technologically feasible and organizationally feasible, but they could do it without getting caught unless people start noticing ads popping up for things they never search on, and only talk about person to person. I think that can even be hidden by adding weight only to other weighted preferences captured through other means.
Why?
From a marketing/advertising point-of-view, it would be incredibly valuable data.
With fairly old technology it would be easy to tell what shows you're watching on TV/radio, what ads you've seen, etc.
With more recent technology it may be feasible to figure out interesting attributes from conversations (e.g., you're about to have a baby, discussing buying a car, considering product X, etc.)
To be clear, I have no reason to believe Facebook is doing it. I just don't understand why it would be crazy to think they are.
I would wager that if they were caught doing this Facebook would have a new CEO and possibly a mostly new executive team in a matter of weeks or even days. I think it would trigger the introduction of some kind of third party auditing program to ensure it would never happen again. There would be ads running everywhere trying to make amends with the user base.
Even if I knew nothing about technology I would assume it was something I didn't understand before I assumed it was the company doing something so utterly stupid.
If the ends are a problem, the means are irrelevant.
But why? There is a specific feature inside the Facebook app that does exactly this: listens to ambient sound around you to hear the TV ads, radio ads, etc that it can identify to know more about you.
Since Facebook has built a feature into the app that makes it so that the microphone listens to your life, I can easily understand why people think it's spying on you by listening to your microphone. Because it does.
Citation needed.
It doesn't do ambient recording. Its basically shazaam.
> If you don’t turn it on, we won’t use your microphone to try and match TV or music when you write a status update. If you do choose to turn it on and later decide it’s not for you, you can easily turn it off at any time.
> Fact: Nope, no matter how interesting your conversation, this feature does not store sound or recordings. Facebook isn’t listening to or storing your conversations.
> Here’s how it works: if you choose to turn the feature on, when you write a status update, the app converts any sound into an audio fingerprint on your phone. This fingerprint is sent to our servers to try and match it against our database of audio and TV fingerprints. By design, we do not store fingerprints from your device for any amount of time. And in any event, the fingerprints can’t be reversed into the original audio because they don’t contain enough information.
The app does fingerprint the audio and send it to their server to match a movie or audio. But they say they don't save it.
[1]: http://newsroom.fb.com/news/2014/05/a-new-optional-way-to-sh...
Notice below they say that the fingerprint cannot be reversed into the original audio because it doesn't contain enough information.
Text cannot be converted to the ORIGINAL audio but it can be converted to audio.
This may be just me being paranoid, but I do know that legalese is designed exactly to say something without saying everything.
Anyway.
After all, low-impact recognition of specific phrases is the core of a variety of things - "OK Google," "Hey Siri," "Hey Cortana"
Is there any evidence that Facebook surreptitiously listens to conversations? I could see mining the ambient content of any Facebook video/VOIP sessions, but beyond that I can't see it being true.
Facebook location services can be genuinely creepy though. Earlier this year I enabled location services on the app (while keeping location history disabled), and it would suggest anyone in my phone's proximity using Facebook. It even suggested the attendants at my local gas station, and nurses at my doctor's office. Neighbors too, but only the ones in the same building (~75ft). I suspect this was due to my friends list numbering in the single digits at the time, since I'd otherwise neglected Facebook since its inception.
Then, I took a brief vacation and added a bunch of new people. The creepy location telepathy suddenly vanished. Ever since, all it's been suggesting is acquaintances of said people, despite the fact I live thousands of miles away with location services enabled 24/7. So, I guess Facebook can be as dumb as it is smart sometimes.
The notion of a private investigator (or psychotic stalker) buying a cheap smartphone, installing FB on it with a clean account, enabling location services, muting it, attaching an external battery and dumping it in a bush somewhere unfortunately seems feasible. It strikes me as a good experiment for a security researcher to conduct.
It wouldn't surprise me if they had some decent fudging to match most conversations to TV quotes. I'll be taking off my tinfoil hat now.
Interesting, according to this [1] article, Facebook claimed that running silent audio on a phone was a bug. That's one heck of an interesting bug.
[1] https://techcrunch.com/2015/10/22/facebook-says-it-fixed-a-b...
Twitter had something similar for a while; if you were listening to music, then if you scrolled through your timeline and came across an autoplay video (which would play silently at first), your music would stop. They were preemptively grabbing exclusive audio mode in anticipation of needing it for the video, and then playing silence through it until you tapped on the video itself.
I recently had to get glasses due to degraded eyesight. I never posted anything about it on social media because quite frankly i was embarrassed by it. Never did any searches etc. Just went to my optometrist, did the test and got my glasses.
Whenever friends see me working, or out and about (where i usually have my phone with me), they usually comment "oh, you have glasses now!" Or something equivalent. I usually respond with a light hearted "oh yeah, i am going blind these days" or something along those lines.
Well dang - my Facebook feed is full of ads for optometrists and lasik surgery etc. these days!
Let me reiterate, i have never mentioned my affliction on any social media channels, nor done a search for anything related to my failing vision. The coincidence is spooky.
With as many different users doing as many different actions as Facebook can see, it wouldnt take much to piece it together.
Just basic things like "there's no such thing as privacy when you're on the internet", and "Facebook owns all your private chats and exploits them to coerce you to click ads and use more Facebook".
Roll on 2016 and people are pouring every personal detail into the web, what the fuck happened?
When you depend on fake names, it only takes a sentence (or possibly less) to permanently shatter the lie and associate all those actions you thought were private with your real identity.
This is less applicable with things like Facebook tracking ads and Google searches, but in that case, a good approach is separating browsers/devices.
Some toys listen, too. Toys-R-U pulled "My Friend Cayla" from sale due to complaints from a watchdog organization.[1] "Most devices aren’t recording continuously, and won’t start recording unless activated. You know, a lot of the stuff in the future might get a little more fuzzy.”
[1] http://www.cbsnews.com/news/smart-devices-amazon-echo-google...
* Anything you say in your home is the property of Google/Amazon *
You have sex with your wife? The sounds you make are their property.
Say something politically incorrect? Amazon/FB might not use it against you, but they might have the data stored and others can.
I really can't believe allow this stuff in their homes.
FB/G etc. are too big to do directly nefarious things like 'use the mic on your smartphone' without your permission, it would blow up on them ... but to do it with your permission? It's crazy.
TL;DR: The Echo uploads audio for cloud-based recognition when it detects voices, but it's not clear if or how long Amazon keeps that. The Echo also has its internal audio buffer which is used for that detection, and in this case the police were looking for any audio that might have been retained in that buffer in the time period before the device was disconnected during the investigation.
It was more people than I'd assume would look me up or be able to spell my name, so quite weird. I didn't assume a mic situation, I assumed the app can read SSIDs or something similar. I don't allow FB to use location services, so either they buy my location from Waze and link it back to my FB ID somehow or the SSID thing. I could see it being technically feasible to sample audio on multiple devices to see who's in the same location, something like Shazam and less for actual content analysis.
Nonetheless it is scary. Imagine you were gay in 95% of the countries in the world. Or Muslim in the US. Or Palestinian in Israel. Or Uyghur in China. Just being in the same vicinity as others in your community establishes a network ready to catalog and analyze.
It's more than FB though.
You probably knew some people at the party though, and some of them had location services on. It's really not hard to guess that you were at a party.
It's true we all knew our host but it was one of those worlds collide parties where he had invited friends, neighbors, old friends from high school, some work friends, etc.
"The illusion in which a word, a name, or other thing that has recently come to one's attention suddenly seems to appear with improbable frequency shortly afterwards" [1]
[1] https://en.wikipedia.org/wiki/List_of_cognitive_biases#Frequ...
"The illusion in which a word, a name, or other thing that has recently come to one's attention suddenly seems to appear with improbable frequency shortly afterwards" [1]
[1] https://en.m.wikipedia.org/wiki/List_of_cognitive_biases#Fre...
It's an easily testable hypothesis which is blatantly false. If Facebook had an always-on phone recording, people's data limits would be swiftly used up. There are tons of alternative explanations.
Not if they were converted to text with the phone before they were sent.
I obviously don't know if it's happening or not (deleted my account years ago) but it isn't hard.
There's also the fact that Facebook has gone on the record specifically disavowing this conspiracy. If it were true, they wouldn't so unequivocally deny it. [0] There's far more harm for them deceiving customers than there is in them admitting to a creepy feature.
Additionally, everyone who has promulgated this conspiracy has been fairly suspect. None of them make any effort to analyze the alternative reasons.
But, like I said, I have $1,000 for whoever can prove this is happening. It really shouldn't be hard. If this conspiracy works the way people claim it does, you should be able to mutter about any random product to your phone and have Facebook start showing you ads for it.
[0] http://www.theverge.com/2016/6/3/11854860/facebook-smartphon...
That's a strange conclusion to come to. I think it was Shakespeare addressed that very thing in Hamlet.
>There's far more harm for them deceiving customers than there is in them admitting to a creepy feature.
If they've already deceived, then they certainly wouldn't admit it. If they stopped doing it, they could deny it was currently happening and not be lying.
>I have $1,000 for whoever can prove this is happening.
That number pretty much ensures anyone who has the ability to find out wouldn't bother.
Personally, I think they might have toyed with it but abandoned it. The trick isn't collecting the data without getting caught, that's simple (as earlier described). The trick is taking action on the data and not getting noticed.
If you use the conversation data as a weight to only be added to non-conversation data, you could do it completely unnoticed. In other words, gather conversation data but only apply it to data collected in other, less controversial means. So +1 for posting about Colgate, +1 for talking about it only if there is already +1 from the posting.
Why? I posit that a good portion of the customer fallout from this functionality has already happened since so many people believe the conspiracy.
By lying about it, they add a whole layer of difficulty. They'd also open themselves up to lawsuits: companies can't just record your audio and then lie about recording it.
> That number pretty much ensures anyone who has the ability to find out wouldn't bother.
Why? It shouldn't take any sophisticated technical analysis at all.
Ideally we'd have actual network activity proving it, but I'd settle for someone talking to their phone about a product which I choose for them (ie. not something they'd already have on their consciousness) and having ads show up for it. If this feature works how people claim it does, you should be able to get ads on demand for anything you talk about.
The quote is "The lady doth protest too much, methinks." I'm not sure if you are familiar with it but it means that when people vehemently protest something it usually means they did it.
I actually read the link you supplied and I don't think they are currently doing it based on what they said, but they might have done it in the past and stopped once people started noticing. They could be sending it to a third party, which would make their denial true. They might not be doing it at all. Who knows?
>companies can't just record your audio and then lie about recording it.
Depends on what people agreed to in the terms and also what wording they used to deny it. I mean they denied they gave NSA direct access to their servers, but NSA had direct access to their servers.
>Why? It shouldn't take any sophisticated technical analysis at all.
It can be easily obfuscated using compression, encryption and when they sent the data. I touched on this in another post on this thread.
They could gather the data and only apply it as a weight to an already collected data point that isn't related to the microphone. I posted this elsewhere also.
Aren't conspiracy theories fun?
I'm quite familiar with the quote. Except that in practice, covering up a negative action is often exactly what lands people into hot water (see Watergate, Clinton, etc.).
Facebook strenuously denies this conspiracy. [0] There are in fact laws governing consent for recording.
Of course, it's impossible to prove that Facebook has never listened in on people's conversations, but it's a very suspect claim to say they are today.
> I mean they denied they gave NSA direct access to their servers, but NSA had direct access to their servers.
They were legally obligated to deny that, so the exact opposite of the situation today (you're legally obligated to disclose if you're recording someone).
> They could gather the data and only apply it as a weight to an already collected data point that isn't related to the microphone.
Perhaps, but that's an entirely different claim than what the conspiracy theorists are claiming.
[0] http://newsroom.fb.com/news/h/facebook-does-not-use-your-pho...
You are mixing up testifying under oath versus a PR release. Companies lie to you all day long in PR releases. If FB were to go under oath and state that, it would be more believable, but not completely, see James Clapper.
I'm just pointing out how it's technically and orginizationally feasible to do this undetected. The only thing stopping FB from doing this is ethics and possibly backlash.
That said, it'll never make the messages smaller
I then encrypted the entire message you replied to and it was only 623 bytes. The original was 449 bytes.
Also, you can further obfuscate it by playing with the compression levels and algorithms.
The point being, the difference of 255 bytes is hardly enough to draw attention and hardly enough to hit data caps or affect battery life.
They do record audio when a certain feature is on, and they say that they send it back to their server. They say that it is never saved anywhere.
I don't claim that they are using it in their advertising but I like to take it with a grain of salt when a company says it does not save my data.
(a) opt-in
(b) only active when you're posting a status, not in the background
Whether they save the data or not is immaterial (I also assume they probably do). This feature has nothing to do with sending random background audio to Facebook in the first place.
[0] http://newsroom.fb.com/news/2014/05/a-new-optional-way-to-sh...
Not at all. They could be smart about it.
If the user agreement does not allow them to be listening, they they probably are not.
If it does ... well ... they possibly are. But there's too much bad PR risk if they are so it's unlikely.
Facebook is a horrifying company. It's the largest and most personal and invasive tracking engine on the net, more so even than Google. They know everything about you. Facebook is tracking and making available to advertisers everything from your employer to your political affiliations to your ethnicity to your charitable donations to your credit [1]. Facebook is (illegally) now combining your WhatsApp information with your Facebook profile [2]. Facebook once collected the unsubmitted status updates you typed and decided against submitting [3]. They track when you are asleep [4]. You already know that Facebook has trained a neural network to identify your face. Facebook engages in censorship on a regular and systematic basis, against journalists and political activists, and regular users too. Even when they aren't censoring explicitly they're building a filter bubble around you that is polarizing our population to extremes.
What happens when they get hacked, badly? Even big companies get hacked and have their databases dumped. Are you really comfortable with everything they know about you being made public? What happens if government actors get access to this data? What makes you think they don't already have it? I saw a stiff give a talk at HOPE who mentioned that they have an FBI agent staffed full-time at Facebook HQ.
You should be scared of Facebook. https://www.facebook.com/help/224562897555674
[1] https://www.washingtonpost.com/news/the-intersect/wp/2016/08...
[2] https://www.theguardian.com/technology/2016/aug/25/whatsapp-...
[3] http://arstechnica.com/business/2013/12/facebook-collects-co...
[4] http://arstechnica.com/business/2013/12/facebook-collects-co...
How about I deleted my Facebook account years ago because employers started looking up people's accounts, forcing people to friend them as a condition for employment.
How about I deleted my Facebook account years ago because it's incredible foolish to have your real name and any personal details on the internet for public consumption.
How about I deleted my Facebook account years ago because there isn't any meaningful conversation on there anyway and most people are just posing for the camera.
How about I deleted my Facebook account years ago because some crazy friend of a friend passes masses of ridiculous propaganda all day long.
How about I deleted my Facebook account years ago because it allows people to tag my name in photos they took that I don't want publicly available.
How about I deleted my Facebook account years ago because I don't particularly want to be a product.
How about I deleted my Facebook account years ago because I don't particularly care for Zuckerberg.
I could go on and on.
Unless, if you don't log in after X months/centuries it's completely removed, but I don't see why FB would do that. Apparently, according to what I've read here, even people without FB accounts have FB accounts (shadow profiles).
https://www.facebook.com/help/214376678584711
this is vastly differently then deleting the account:
https://www.facebook.com/help/224562897555674
The delete can take up to 90 days to remove all traces, but it is gone and will not allow logins when the process starts.
Is it possible to know if this is happening on an android phone? I'd love to eliminate the possibility it is happening...
Fun additional: a family member using facebook, when I had one, was getting ads of Amazon products I had recently watched