Comment by adas17 | Hacker News Reader

Comment by adas17 | Hacker News Reader

Can someone explain to me a mechanism for having JSON data describing a user and all their information downloaded and then displayed on the screen of either an Android or iOS phone without the app or OS involved then having the ability to send that data to a server later on?

The sentence “only available on the device” makes no sense to me as an engineer. What?

Did Facebook code review every app and OS they gave this access to? Even then, would they be able to garauntee that an update couldn’t be made to the app or some library it relied on to prevent it from harvesting the data?

If that data was encrypted, how did it get displayed on a screen without being unencrypted first and this made vulnerable to scraping?

I was an iOS and Android applications developer and I can’t think of any way to do it (at least on iOS) short of (a) keeping it completely encrypted the entire time (b) only allowing an application signed by Facebook and belonging to Facebook and controlled by Facebook completely (in iOS, at least) to get this data since iOS apps are well sandboxed from one another or (c) relying vaguely on a legal agreement that the other party not be naughty with the data contractually which means jack shit to the Chinese.

On Android - Jesus, forget about it.

Exactly. All the issues these reporters are up in arms about would still be a problem if Facebook gave these companies access to their regular API instead of a specialized one.

In the end, a user is responsible for whom they give their username and password to. That includes typing it into an app. I hope we can redirect the publicity around this issue to scrutinizing the security of software, operating systems, and hardware. And promoting open source!

I understood that facebook shares a persons data if a friend of theirs has given permission to an app. Thus a person can be vigilant about their own account, and still have their data compromised.

>a user is responsible for whom they give their username and password to.

In 2009, when I signed up for facebook, I was signing up for facebook.

Not sharing with political groups and enterprises.

No one reads ToS and at that point, it should be nullified. Everyone loses their FB accounts because YOU didnt read the ToS. Facebook loses their business because they lied about people reading and accepting their ToS.

Its important to be reasonable, FB definitely went full corruption and blaming the billions of customers is laughable.

You're blaming facebook because people don't read ToS?

And then you try to tell people to be reasonable? That's like the pot calling the kettle black, isn't it?

In many countries, like Germany, surprising provisions in consumer terms of service are unenforceable for exactly this reason (and other reasons).

In my opinion, it's American over-adherence to legal formalism to the benefit of powerful companies and the detriment of consumers that is unreasonable, not the German approach. And I say this as an American myself.

USA has very similar laws and legal tradition about what makes a contract valid.

The German (civil law) and US (common law) legal traditions are pretty disparate, including their approaches to contract law - but in this case the difference is due to consumer protection rules in Germany and Europe, not anything longstanding about either tradition.

I know very little about US law and even less about German law, but I think GP was referring to contracts of adhesion, which are less enforceable in the US too, afaik; even if the laws are far stronger in Germany and have different historical origins, maybe there's at least some spiritual similarity between the protections?

While it's true that contracts of adhesion are less enforceable in the US than other contracts, they're still very enforceable.

In particular, if there's some evidence that a consumer clicked a check box saying "I accept the terms of service" on a web form before submitting it, where a link to the full terms of service was offered and the check box was not checked by default, US courts will uphold far less friendly terms than German courts will.

Hey do you read the ToS?

Before you get too excited about legal jargon, no one reads the ToS. There was some study saying it would take years of your life to read it, let alone try to understand it.

ToS that are unreadable should be thrown out in court.

Everyone, including facebook knows that these are not read.

I pretty much agree with your points, but I don't see the relationship to this topic. It seems possible that you have misunderstood what these news stories are about (or equally possible that I have). This story is about Facebook giving "privileged API access" to certain companies. That means that when users give their login credentials to those companies, they can access certain data about the users in certain ways. However, as I said above, if the user gives those companies login credentials, the user is already putting a frighteningly large amount of trust in that third party. There needs to be much more awareness of this.

Reply on news.ycombinator.com