Zuckerberg on Cambridge Analytica situation

Re:Zuckerberg on Cambridge Analytica situation by aylmao on Wednesday March 21, 2018 @05:05PM (#16642407)

Hm, the catch here is something like this could happen:

  +--------------+        +----------+        +--------------+
  |              |        |          |        |              |
  | other server |        |  Server  |        | other server |
  |              |        |          |        |              |
  +-------+------+        +----+-----+        +-------+------+
          ^                    |                      ^
          |                    |                      |
          |               http request                |
          |               containing user             | 
          |               data for UI                 |
    http request made          |               rouge http request
    with a legit purpose       |               sending the user data
    say fetching assets        v               to some other server
          |            +-------+-------+              |
          |            |               |              |
          +------------+  mobile app   +--------------+
                       |               |
                       +---------------+

And there is really no way of knowing which requests are for legit app purposes and which would be leaking data. Now, you could require that the mobile app make no requests to any service but Facebook, which brings two questions:

1. can facebook do this? Apple could; they approve apps and get the binary/manifest before the app is released. But how could Facebook enforce this?

2. would developers be ok with this? Relying 100% on facebook?

It is an option, I'm not saying it's infeasible. An interesting idea for sure, thanks for sharing!

[ Parent | on HN ]

Re:Zuckerberg on Cambridge Analytica situation by adrianmonk on Wednesday March 21, 2018 @05:18PM (#16642512)

I guess you could let the mobile app access third-party servers but require all traffic to go through a proxy where Facebook can examine it. (Either by letting Facebook handle all the encryption or giving Facebook a copy of the key.)

All of this tends to trade one problem for another, though: the user no longer has to worry that the third-party app has access to their Facebook data. But now the user has to worry that Facebook has access to their third-party app data.

[ Parent | on HN ]

Re:Zuckerberg on Cambridge Analytica situation by dmannorreys on Wednesday March 21, 2018 @05:18PM (#16642507)

What tool did you use to make that schema?

[ Parent | on HN ]

Re:Zuckerberg on Cambridge Analytica situation by tzahola on Wednesday March 21, 2018 @06:24PM (#16642990)

http://asciiflow.com

[ Parent | on HN ]

Re:Zuckerberg on Cambridge Analytica situation by aylmao on Wednesday March 21, 2018 @07:10PM (#16643321)

yup, that's the one.

[ Parent | on HN ]

Re:Zuckerberg on Cambridge Analytica situation by hendzen on Wednesday March 21, 2018 @05:14PM (#16642478)

1) agreed - for mobile apps to maintain some semblance of data sandboxing, this would require FB to work with Apple. I'm imagining some kind of new iOS "Secure API" where the return values from certain API calls are marked "tainted" and then Apple uses static binary analysis to reject apps that write the tainted data to non-whitelisted socket calls.

2) Developers simply wouldn't have a a choice in the matter - FB is so big that they can force the market in a certain direction if they want to.

[ Parent | on HN ]

Re:Zuckerberg on Cambridge Analytica situation by tzahola on Wednesday March 21, 2018 @06:22PM (#16642980)

Bits can’t be colored... http://ansuz.sooke.bc.ca/entry/23

[ Parent | on HN ]