Comment by criley2 | Hacker News Reader

Comment by criley2 | Hacker News Reader

Crazy that everyone in here is defending Facebook.

- How on earth does Facebook justify giving direct API access to information that users have, in every setting possible, marked as private?

- How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data?

It's ridiculous, and it's more ridiculous that users here are conflating "basic API access with a sane permissions system to give you control" with "deep API access with no privacy controls whatsoever that openly defy existing privacy controls".

It's not acceptable, and frankly, this is EXACTLY why government regulation of data online isn't a possibility, it's an inevitability. Because when the penalty for ignoring the user's selection of "DO NOT MAKE MY DATA AVAILABLE OVER THE API" and "DO NOT MAKE MY DATA AVAILABLE TO FRIENDS OF MY FRIENDS" etc is now billions of dollars in damages and potentially criminal charges for executives, magically, these violations will stop occuring.

Until then, everything in this document is either a lie or sufficiently legalese'd that it's worthless, just like the lies that they told to Congress, just like Zuckerberg's lies to E.U. as well.

I cannot wait until it is a crime to share private user data against their will. We live in a wild west and the past 10-15 years are proving just how much sheer damage we have caused in society by not criminalizing disrespect of digital privacy.

“How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data?”

Here how it seems really non-crazy to me as a programmer. Let’s say I make phone with a Linux OS. I want to make an app to let users check Facebook on my weird OS. I ask Facebook, they say no. I then build an app to call their API and let users do stuff.

All my app does is call the API and show it to the user. In order for the app to function it has to use private data. But the data are not retained or analyzed, just used to operate the app.

This is how all 3rd party apps work. The APIs were not for the general public, but only to trusted third parties. The alternative is that only Facebook can build and show apps.

So this is pretty much how APIs have worked forever and why you only install apps and log into apps you trust.

It would be like complaining that Adobe Reader can read private files from your laptop via Windows/Mac APIs. Of course it can, this is good. It’s bad of Adobe were to misuse the data.

Private means that I (the user of my own FB client) can see my private data. That's obvious. What must not happen is that I can also see data that my friends, or their friends, marked as private. This doesn't happen in the official FB client and must not happen with any API.

And it didn’t happen with FB’s API. Your friends could see their private data. You could see yours. The apps were not able to show your private data to friends and vice versa without breaking their contract with FB.

It would be like being concerned because both you friends both use Chrome to access your individual, private bank accounts. Google accesses your private information, with your permission, to display data on your screen. It’s only bad if they misuse that data.

You do realize that facebook will share user's private information with any random web browser that the user enters her credentials in, right? Is that "ridiculous"?

If a friend of one of my friends, who I am not connected with, can acces my private data despite my settings being clearly limited, with API access disabled, "friends of my friends" settings disabled, as was reported is possible, then yes that is ridiculous.

However your reply completely fails to grasp the problem, like so many others. It's not the fact that I type in a user/password and get my data, it's that, I type in my user/password and Facebook authorizes access to as many as 10,000 to 100,000 other accounts data, based on proximity to my account.

> your reply completely fails to grasp the problem, like so many others.

That's because you're just making up a problem that doesn't exist. The replies are all talking about what is actually happening, not your fantasy world. As the article states: " friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends".

I understand why my iPhone needs access to my Facebook friends' info, in order to display it to me.

I don't understand why Apple Inc. needs access and permission to download and store my friends' data on Apple Inc. servers. That is what the NY Times reported, and Facebook has not directly denied it here.

Edit to be clear: I'm just using Apple as an example company.

Unfortunately, the NYT article is vague on how each of the approved device makers were using the data -- they only say "some partners" stored the data. But it doesn't seem like Apple in particular used the API in that capacity. From the article: "An Apple spokesman said the company relied on private access to Facebook data for features that enabled users to post photos to the social network without opening the Facebook app, among other things. Apple said its phones no longer had such access to Facebook as of last September."

Do you know about the Amazon Silk web browser? If you log in to facebook in that browser, Amazon may download and store your friends' data on Amazon's servers. And that's even without any agreement with facebook.

I can think of a handful of Facebook-like experiences that would require an OS/device provider to store data on their servers, especially considering the constraints imposed on some devices (particularly older ones) and some OSes (particularly older ones and iOS).

Let's take a concrete example. Let's say that Apple wants to support contact syncing across devices. It also wants to support contact importing through fb's device integrated api.

Now, let's say that Apple actually implements that in such a way that it's encrypted end-to-end. Even in that case, Apple may have needed permission to store that data on their servers under whatever agreement the companies had and the Times could have written their story.

But I feel like that case isn't that interesting. Let's consider the case where your contacts are stored unencrypted on Apple's servers, but only for 3 hours while actually syncing to a new device (kind of a silly approach to the contact syncing case, but is likely more reasonable for other things). There may be a reasonable argument against that, but I think that most people wouldn't agree with it. Also, that argument would apply much more strongly to Android's contacts permissions (which don't require any sort of contract around how developers use/store that data).

I run websites that get traffic from Amazon Silk browsers. I've never signed a data sharing agreement with Amazon. There's more going on in this story than a simple browsing proxy.

> I run websites that get traffic from Amazon Silk browsers. I've never signed a data sharing agreement with Amazon.

Of course not. Because the fact that a user agent like this has widespread access to the data that the user has access to is expected. The OS itself also has at least that same level of access (as it has control over the behavior of the user agent). We just all seem to assume that we can trust those entities to not misuse the data (in some cases the particular software we run may have privacy policies that cover how they use that data that we necessarily give them access to).

> There's more going on in this story than a simple browsing proxy.

There's nothing in the report that indicates that. In fact, most "simple browsing prox[ies]" have no data sharing agreement limiting how they use the information from your browsing, in the cases in this story they were all limited to "signed agreements that prevented people’s Facebook information from being used for any other purpose than to recreate Facebook-like experiences." and even further "our partnership and engineering teams approved the Facebook experiences these companies built". In addition, it sounds like in most of these instances, no data was even accessed or stored off the device (i.e. they had much less access than a proxy).

> We just all seem to assume that we can trust those entities to not misuse the data

I don't need to trust that entities will not misuse my data; I have legal documents on my websites that set out how entities may use the data that they download from my sites. The terms apply to my users and to any intermediary technology providers.

For the Silk browser, I don't need a data sharing agreement with Amazon because my terms say that service providers like Amazon may not copy and store data from my website for their own purposes. Amazon Silk can access my site only for the purpose of helping the end user visit my site. I expressly exclude data sharing from my relationship with service providers and users.

This is a standard part of website terms and conditions; here's an example from Facebook's terms of service:

> You may not access or collect data from our Products using automated means (without our prior permission) or attempt to access data you do not have permission to access.

And from their platform policy:

> Data Collection and Use: If you are a Tech Provider for an entity, comply with the following:

> a. Only use an entity's data on behalf of the entity (i.e., only to provide services to that entity and not for your own business purposes or another entity's purposes).

Data sharing agreements are only necessary when another entity (i.e. Amazon the company) wants to store and use data separate from, and in addition to, the service they provide to end users.

The existence of a "data sharing agreement" is proof that device manufacturers were collecting and storing user data, not just facilitating user access to Facebook. That's what "data sharing agreement" means. Further proof is that Facebook explicitly said that some companies collected and stored FB user data.

On my iPhone, I enabled a feature that would sync my contacts with my address book. My blackberry did this as well way back in the day.

My iPhone is also syncing with iCloud.

Now my friends “private information” are on Apple’s serves via my iCloud backup.

I find it equally ridiculous that Hotmail can access my private emails that I send to a Hotmail user. Which is to say not at all.

> - How on earth does Facebook justify giving direct API access to information that users have, in every setting possible, marked as private?

The user logs into Facebook on the device. This log-in action the part of the user is effectively permission to share data with the device.

> - How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data?

When the user logs into Facebook on the device, they are giving permission for their data to be transferred via an API to that device.

I do not understand your outrage.

>The user logs into Facebook on the device. This log-in action the part of the user is effectively permission to share data with the device.

As well as the data of 10,000 to 100,000 connected users as both friends and friends of friends have data pulled without any checks by the third party.

"When the user logs into Facebook on the device, they are giving permission for their data to be transferred via an API to that device."

When the user selects to have their data limited to friends only, and not friends of friends, then additionally disables API access to their data explicitly, no, they are not "giving permission for their data to be transferred via API".

They are quite explicitly doing the opposite.

My outrage, stated multiple times and oddly invisible to the users here, is that my user/password doesn't authorize the third party to access 10,000 to 100,000 other users private data, and those users personal settings should override any third party data hose utility.

Reply on news.ycombinator.com