The thing that seems really wrong here is that you weren't just granting access to your own information, but all of your friends as well, who had little say in the matter beyond their original grants of permission to Facebook.

It is this way that Cambridge Analytica was able to get 50 million profiles by just paying ~270k Amazon mechanical turkers [1].

It's true that everyone agreed to everything along the way: people allowed Facebook to have the information in question, and people allowed Cambridge Analytica to access that information. But it wasn't the same people agreeing to both. The set of people agreeing to the latter was much smaller than the former.

It may be true that technically neither Facebook nor Cambridge Analytica did anything wrong (at least in collecting this information, this seems to be by far the least shady part of CA's business), but, Facebook's business is built on trust, and this is a huge hit to that trust. Arguing technicalities doesn't help.

1. https://www.nytimes.com/2018/03/19/opinion/facebook-cambridg...

> The thing that seems really wrong here is that you weren't just granting access to your own information, but all of your friends as well, who had little say in the matter beyond their original grants of permission to Facebook.

Except that those users had granted that permission to the people who then granted it to CA. So, transitively (which is the only way to think about permissions), they had granted it to CA.

Not really. You granted permission for your friends to access the information. You did not give your friends permission to grant permission in accessing your information or share it directly.

Now Facebook may make a different statement etc and the rules of service, privacy can allow for this. But it is not a property that is transitive in general. And it is bad publicity. (I hope.)

I can be told a secret, I do not necessarily have the permission to share, for instance, what happened in the bachelor party last Saturday right?

No, this is not how OAuth works - OAuth itself is just a protocol to receive authorization from another server [1]. In this case, a third party relies on Facebook to say "This user has logged into Facebook and their ID is foo". OAuth _does not need_ social information or anything else.

Of course, you can allow the authorization server to publish these details, but this is not an inherent part of OAuth. Also, there's OpenID Connect [2] which builds on OAuth and adds just this information in another token: "The ID token resembles the concept of an identity card, in a standard JWT format." (from [2]). However, you can happily use OAuth without ever publishing the user's details.

[1] https://tools.ietf.org/html/rfc6749 [2] https://openid.net/connect/

Yes, but my point is that the permission grant is explicit.

Yes, it is explicit.

I took your comment to say "You have to allow access to your data if you're using OAuth, because that's how OAuth works", and wanted to argue against that. The OAuth protocol is so complicated because it tries to be safe and secure and so it doesn't force any data disclosure. However, I now see that you probably meant "OAuth forces you to accept these permissions explicitely". In that case, we're hopefully both right :)

We (the general public) grant permission for facebook to use our data, with the expectation that they don't let any bad actors do anything with it that harms us (the general public). This has been their image, this is what they espouse, and it is clearly not what happened.

>anything that we didn't all know was possible this whole time

I believe the reason this story is blowing up so big in the media is because most people never imagined their data being used in this way. When I login to patreon and subscribe to someone, I know exactly what I am paying. When I login to facebook and make a post, I (the average user) have no idea what it is that I am paying and/or how it can be used. I give away some factoid about myself without realizing that my angry post about Trump actually tweaks some political vector that is being calculated on me.

Consent is not enough, informed consent is the bar we have to set and it's basically impossible to say that the average facebook user is properly informed of what data they're giving, how it's being used and how much it is worth in dollar terms. Can you imagine if I could log into Facebook and see the models they've generated based on my content, and the dollar amount they've collected for that information so far. That's informed consent and somehow I doubt Facebook would be quite as profitable if people knew the actual cost they're paying.

I believe that you, a person with a strong interest technology, believe the consequences are (and perhaps always were) obvious.

But I disagree that if we went back in time and quizzed people clicking "yes" that the majority would really understand that recent events were the probable expected outcome of them clicking "yes".

There's a difference between consent and informed consent. And it was strongly in the interests of Facebook (and anybody who made an app using their APIs) to be very vague about the potential consequences.

It doesn't help that anytime Facebook changes their privacy policy or their available privacy settings, they tend to set it to a convenient default that benefits them, and that Plumber Joe is likely to never even know about.

"anything that we didn't all know was possible this whole time"

Actually, there are lots of people who have no clue that such things are possible. Maybe in 20 or 30 years, everyone would become savvy enough to understand the implications of giving away their personal info freely, but we are not yet there. The people who know (younger, tech savvy etc) are in the minority. Today a big chunk of the population simply believes everything they read on FB, that is why trolling works so wonderfully

At some point, you have to make people take responsibility for themselves. I think this is well before that point.

Yeah I agree. There's a price for the convenience of one-button logins, and we're paying it right now.

Well, fwiw, these quizzes weren't even on a separate website where you need to login using OAuth, but they were part of Facebook's "apps" ecosystem. And they were popular, so everyone was doing it, however harmful (and as has been said, even if you're not doing it, if your friend is doing it, the app can also see your information as your friend's connection). Add to that the tragic permission scheme where Facebook does say "This app can see this information..." without offering an option to allow/deny sharing of some things (I think they've changed it so you can give granular permissions).

Granular permissions are also a pain point for me on Android phones. They were possible with apps on BlackBerry phones in the late 200x's, but on Androids before version 5 or 6? No, it's either give the app permission for all of requested functionality, or don't install it...

Considering Facebook is known to profile users who don't even have facebook accounts, it's likely much deeper than that.