Hacker News Reader

Comment by shajznnckfke | Hacker News Reader

If people are going to be mad at Facebook for allowing Cambridge Analytica to get access to user data by tricking users into providing access to their data on Facebook by installing apps, they really ought to support Facebook in the effort to block these entities who are pulling the same scheme with chrome extensions.

View on HN

> tricking users into providing access to their data on Facebook by installing apps

> same scheme with chrome extensions

These are very different things. One took place via Facebook's own platform while the other did not.

If their own platform officially allowed for third parties to collect user data, it is reasonable to complain about that being the case.

If their own platform explicitly forbid collecting user data in such a manner but they stood by and let it happen anyway, it seems reasonable to object to that.

I don't see how it's any of their business what a legitimate user does with their own data after it's been sent to them (ie the page loads). I suppose they could add a provision to their ToS disallowing such use; if a violation were discovered they could ban the user in question. But a third party almost certainly never agreed to such a ToS. It's not the existence of the program that violates the contract but rather a specific instance of its usage.

I agree. However, I suspect facebook is gonna try and claim some sort of tortious interference between the TOS the user agreed too.

I think the dichotomy you’re pointing will affect Facebook’s legal tactics, but has no bearing on the privacy risk they need to defend against. In both cases, Facebook has an API that served data for some authorized client for a specific purpose (users browsing Facebook, users taking a quiz), but really there’s some entity pulling the strings and misusing the client to amass user data (collecting data associated with users who took the quiz, collecting data associated with users browsing on Facebook).

Not only that, but recognize that any location where people share information about themselves is susceptible to attacks like this. Even personal blogs. If you make it so that your friends can see things about you, and your friends are wont to install extensions, then you are vulnerable to this kind of attack. Decentralized open source solutions will not help with this problem. Quite the opposite: who will fund the lawsuit?

Facebook had to dedicate some resources to even go looking for extensions like this. They only have 5000-10000 installs. IMO it demonstrates a change in the company’s attitude toward protecting user data from the old days of letting people download the entire social graph of the US.

And there is a real trade-off here. 10 years ago everyone would be hating them for cracking down on the open web if they did this, and calling it anti-competitive to silo user data.

Isn't that what they are doing. I'm not a big fan of facebook policing others while they horde data themselves.

They view themselves as an agent of their users. The users willingly give them data, with the intention of sharing it with a select audience. As the user's agent, one should generally abide by their wishes, and especially prevent the data from being shared further abroad than the user intended.

I’d argue most Facebook users do not know the difference between what FB does with their personal info and what this other organization does.

For those that installed the extension, one is Facebook, one gives free gift cards. Both are “okay.”

So I don’t see this as protecting users so much as ensuring no one else monetizes their data.

It's not about the user who installs the extension. It's about the user's friends.

Unless Facebook stopped creating shadow profiles of non-users (have they? I'm not a user and don't keep up with it) I don't think they have a leg to stand on.

> Facebook had to dedicate some resources to even go looking for extensions like this.

Its called "data abuse bounty program"

You find an app like this, rat them out to facebooks legal team, you get a small bounty and FB sues them for fame and profit.

Interesting if you can get a bug bounty for reporting this. I think if an enterprising bounty hunter heard about that, a bunch of anonymously authored extensions might start mysteriously appearing. It might pay better than building web apps for people on upwork.

I'm not sure what level of KYC the Chrome web store does, but said enterprising bounty hunter might find that it's not that hard to detect a pattern of "Guy reports a lot of suspiciously similar unpopular extensions. Let's get a warrant to find out who he is from his bank and see if Google knows anything about it."

This comment really put into perspective what kind of malware these extensions are to me.

When I think about decentralized open source solutions, the major example that comes to mind is email, with how Gmail can communicate with Hotmail can communicate with AOL Mail.

And this made me realize that these chrome extension are not too different from an extension that saves and archives your email history. Pure malware.

But what if I want to periodically scrape my facebook data to migrate to a different platform?

You can directly request it from the platform. No need to use a crappy extension.

Yes, but that only gives me my own data. I might want to export events to a different platform, including which of my friends go to these events.

Also, I might want to read my friends' posts on a different client.

That very quickly veers into territory that violates facebook's terms of service.

The “access your own data + your friends' data” API is exactly what Cambridge Analytica used to scrape everybody’s friends’ data

Yeah it's interesting to me that people are disregarding the parallels. Is Facebook responsible for keeping your (and your friends) data out of 3rd party hands or not? Maybe if the makers of these extensions were affiliated with GOP PACs...

EDIT: Also to be clear, I do think it is Facebooks job/responsibility/obligation

> Is Facebook responsible for keeping your (and your friends) data out of 3rd party hands or not?

They are responsible for the activity that they directly facilitate on their own platform. They have legal authority over the interactions they directly engage in (ie with users). They have no say (legally or otherwise) over what goes on outside the bounds of their own platform and thus no responsibility for it.

Regulators, not individual actors, are the ones with authority over the broader ecosystem. GDPR and CCPA are examples of such.

What's next, should Google be permitted to publish a ToS forbidding access to their services with non-Chrome browsers and then legally pursue other browser makers for facilitating the violation of their ToS?

Not if you follow the money? CA was an FB customer, weren't they?

My understanding is that CA got the data by building a free quiz app on Facebook’s platform (I don’t think FB was getting paid for that, correct me if I’m wrong). The difference is that the quiz app used Facebook’s developer-facing APIs to access the data, whereas these Chrome extensions are hijacking the user agent to access the data via Facebook’s browser-facing APIs. I don’t think it makes a difference as to whether Facebook ought to try to stop the data collection to prevent the another CA-type scandal, and to protect itself from the resulting uproar. The fact that the extension developers haven’t made any agreement with FB means that FB needs different legal tools to try to shut it down, and perhaps they won’t succeed.

A quick search indicates they have free plans up to a certain number of active users and then you need to call them. So apparently they keep their pricing secret.

Reply on news.ycombinator.com