News for hackers. Stuff that matters.
Re:Facebook: The Normalization of What Should Never Have Bee... by KaoruAoiShiho on Saturday January 26, 2019 @04:00PM (#19008462)
Yeah but fb didn't install spyware on my phone. I intentionally give data to fb so that they can share it for me...
Re:Facebook: The Normalization of What Should Never Have Bee... by ohazi on Saturday January 26, 2019 @04:20PM (#19008567)
No, you intentionally give fb a photo or a piece of text to share. They hoover up everything else.

For example, they will record your physical location when you send a message or share a post, as well as randomly several times per day. They will also record which photos, posts, and ads you linger on as you aimlessly browse.

This is information that most people are not sharing intentionally, and it's not optional. Fb uses this information to build a profile on you that's separate from anything you share intentionally.

It's being referred to as spyware because most users aren't aware that Facebook does this, and wouldn't have agreed to it had they been offered a choice.

Re:Facebook: The Normalization of What Should Never Have Bee... by raspasov on Saturday January 26, 2019 @07:53PM (#19009644)
If I say "no" on iOS when the FB app asks for location how are they exactly recoding my location?

P.S. No idea about Android.

Re:Facebook: The Normalization of What Should Never Have Bee... by ACow_Adonis on Saturday January 26, 2019 @09:15PM (#19009999)
Theoretically (i don't work at facebook) there's a number of ways you could go about it.

- Geocode down to the lowest applicable level of IP address

- grab it from the photo metadata

- Piggyback off of similarities to other people obtaining similar photos or activity

- grab it from other database sources that do have your location

- correlate it to your interactions with other hardware/infrastructure with known locations

- transitively deduce it from your friends and acquaintances who share their location and tag themselves and reply to your stories/photos

Theoretically you could try to train some neural nets on images themselves. Geoguessr.com is a fun game website where you can try to do so as a human, and you can usually get pretty damn close. Images themselves leak a tonne of information on time/place: clothing styles, fonts and languages on signs, shadows, light colour, fauna/flora, asphault + stone types, arichtecture and design quirks. In many ways the neural net might even have some advantages over humans, because not many humans memorise the thousands of minutae: eastern USSR uses this particular kind of road barrier and reflector type and this kind of font on its road signs.

But aside from a research activity, i imagine facebook already has the data it needs most of the time...

Re:Facebook: The Normalization of What Should Never Have Bee... by mixmastamyk on Friday February 01, 2019 @06:01PM (#19059622)
I once posted a shot including a friends daughter. FB tagged her mother before I shared the post. We were all creeped out.
Re:Facebook: The Normalization of What Should Never Have Bee... by dleslie on Saturday January 26, 2019 @09:12PM (#19009992)
Geo IP is a reasonable last resort; it'll usually show at least what city you're in.

The images you upload may have location data on them.

If you're using a wireless hotspot then your location is correlated to anyone who also used it while sharing GPS data.

And so on.

Re:Facebook: The Normalization of What Should Never Have Bee... by raspasov on Saturday January 26, 2019 @10:15PM (#19010168)
"If you're using a wireless hotspot then your location is correlated to anyone who also used it while sharing GPS data."

That's a clever one I hadn't thought about. I guess for a service like Facebook/Instagram/Google it can work decently well given the scale/adoption.

Re:Facebook: The Normalization of What Should Never Have Bee... by chrischen on Sunday January 27, 2019 @12:49AM (#19010517)
That's in fact how your GPS works most of the time. They triangulate it based on a scan of SSIDs assuming access points are usually fixed. Both Apple and Google use this method.
Re:Facebook: The Normalization of What Should Never Have Bee... by alanlamm on Saturday January 26, 2019 @09:35PM (#19010061)
fun fact - I changed my hometown to Timbuktu on facebook. yet when I click on Why Am i seeing This Ad, I am told it is because the advertiser wants to reach people who live in (not are in or have been in) my actual home town. huh.
Re:Facebook: The Normalization of What Should Never Have Bee... by eightysixfour on Saturday January 26, 2019 @08:58PM (#19009936)
Honest question, I don’t know the iOS APIs very well, can they (if you have given the app permission before) check geotags on your photos without you explicitly uploading that photo?
Re:Facebook: The Normalization of What Should Never Have Bee... by raspasov on Saturday January 26, 2019 @10:13PM (#19010160)
I believe if you give access to "Photos" on the device, they can. Otherwise by giving GPS/Location permission - no. They are two separate things.
Re:Facebook: The Normalization of What Should Never Have Bee... by godelski on Saturday January 26, 2019 @08:29PM (#19009832)
Not to mention that you share the photos you don't post.
Re:Facebook: The Normalization of What Should Never Have Bee... by bobdole12345 on Sunday January 27, 2019 @01:27AM (#19010594)
You can disable FBs access to location services.

And photos.

And contacts.

It was offered as a choice, because when you install the app, it asks for permissions to access those things.

Re:Facebook: The Normalization of What Should Never Have Bee... by chii on Sunday January 27, 2019 @05:25AM (#19011189)
But the choice looked (worded?) like it was required for the feature you're using.
Re:Facebook: The Normalization of What Should Never Have Bee... by masonic on Sunday January 27, 2019 @04:03AM (#19010982)
When you grant those once (eg upon installation), they never have to ask you (or notify you) again... even for updates.
Re:Facebook: The Normalization of What Should Never Have Bee... by Mirioron on Saturday January 26, 2019 @10:06PM (#19010136)
You're still giving all of that information out. Or your device is, but that's still under your control and thus you're the one giving it out.

>It's being referred to as spyware because most users aren't aware that Facebook does this, and wouldn't have agreed to it had they been offered a choice.

Then they need to control their data better. Facebook is an easy target because they do all of this in the open. There are probably untold number of bots online that vacuum up this information and you'll never ever know about it and legislation will never stop it because it's running on some server in China or something.

Re:Facebook: The Normalization of What Should Never Have Bee... by ardy42 on Sunday January 27, 2019 @12:15AM (#19010443)
> You're still giving all of that information out. Or your device is, but that's still under your control and thus you're the one giving it out.

This is utter BS. I'm technically savvy and pretty privacy conscious, but the Facebook app still manged to hoover up my address book without me being aware. Facebook will be less than honest and mislead you to get you to accidentally give them more data than you likely intend, and that's not a voluntary disclosure.

PSA: If you still have a Facebook account, go to https://www.facebook.com/mobile/facebook/contacts/ to delete the your address book info that they've hoovered up. They keep this page well-hidden. When I found it, it wasn't linked from the settings, only from an obscure help page.

Re:Facebook: The Normalization of What Should Never Have Bee... by Mirioron on Sunday January 27, 2019 @12:51AM (#19010520)
>This is utter BS. I'm technically savvy and pretty privacy conscious, but the Facebook app still manged to hoover up my address book without me being aware. Facebook will be less than honest and mislead you to get you to accidentally give them more data than you likely intend, and that's not a voluntary disclosure.

You installed an app that can basically do anything onto your device and you're surprised that it did something? You basically fell for the modern version of the Ask Toolbar. Stop installing things you don't trust. Better yet, don't use Facebook in the first place. But your unwilling to give that up. You want them to provide their service to you, but you don't want to pay the price for it.

Re:Facebook: The Normalization of What Should Never Have Bee... by ardy42 on Sunday January 27, 2019 @02:00AM (#19010669)
> You installed an app that can basically do anything onto your device and you're surprised that it did something?

I'd also be surprised if someone who I let get near me then turned around and punched me and stole my wallet. I guess in your book it's my bad for letting them get so close. In real human society, there are norms of behavior one expects others to follow, even though they have the physical ability to violate those norms at any time.

> Stop installing things you don't trust.

So, basically I should burn my computer because I haven't audited all the code that runs on it? Facebook is a Fortune 500 company, they should behave in a trustworthy manner.

> You want them to provide their service to you, but you don't want to pay the price for it.

If they want my phone's address book to be the price, they need to be up-front about it, which they were not and likely still are not.

And I'm pretty sure your next line of attack is to criticize me for not carefully reading every line of their terms of service and not keeping up with all the un-advertised updates they make to it. After all, if you don't spend your life keeping up with legalese, you deserve whatever you get, right?

Re:Facebook: The Normalization of What Should Never Have Bee... by CaptainZapp on Monday January 28, 2019 @08:07AM (#19017121)
Facebook is a Fortune 500 company, they should behave in a trustworthy manner.

That train left the station a long time ago.

Facebook will never behave in a trustworthy manner, since it's completely against their business model.

My family scoffed, when I told them that there is no friggin' way that I will ever use WhatsApp. Recent development just proves how right I was.

While I had a FB account until I "deleted" it ca. 2013 I will never again come near any Facebook property, no matter what! This company and it's management is the epitome of scum.

Re:Facebook: The Normalization of What Should Never Have Bee... by mixmastamyk on Friday February 01, 2019 @06:09PM (#19059679)
What’s the story with what’s app? Had that installed 4 years ago in Brazil since everyone uses it.
Re:Facebook: The Normalization of What Should Never Have Bee... by ardy42 on Monday January 28, 2019 @09:21AM (#19017567)
> Facebook will never behave in a trustworthy manner, since it's completely against their business model.

Yeah, I agree Facebook's fundamentally broken and I think it's going to take some kind of GDPR-type regulation to fix things (and hopefully "creatively destroy" it).

The idea that I was arguing for is that their untrustworthiness means Facebook is in error, and it's not the user's error for trusting them at some point and having that trust abused. It's only the former that will justify the kind of regulatory response to bring them to heel, and the latter is mainly a reaction to prevent that reckoning.

Re:Facebook: The Normalization of What Should Never Have Bee... by CaptainZapp on Monday January 28, 2019 @10:46AM (#19018312)
Facebook is in error, and it's not the user's error for trusting them at some point and having that trust abused

We have absolutely no argument about this point.

Cutesy passive aggressivenes also doesn't really help their case. It was that, which really turned me off. I couldn't have imagined at that time how dirty that company really is.

Re:Facebook: The Normalization of What Should Never Have Bee... by ikfmpwdsoz on Saturday January 26, 2019 @11:02PM (#19010285)
Most people are entirely unaware of how much data Facebook is collecting about them. Raising awareness about that is a noble goal, but it's not mutually exclusive with stopping Facebook from exploiting their naivety.
Re:Facebook: The Normalization of What Should Never Have Bee... by Mirioron on Sunday January 27, 2019 @12:47AM (#19010513)
But it's a temporary measure that only works against Facebook and maybe other companies that do it above the board. In other words, you're kicking the companies that are honest about it in the teeth. Meanwhile the really shady companies will continue doing it, because they are outside of the jurisdiction. This is like trying to provide security through obscurity. Yes, it works on a large scale, but it's not really security.
Re:Facebook: The Normalization of What Should Never Have Bee... by CaptainZapp on Monday January 28, 2019 @08:12AM (#19017145)
In other words, you're kicking the companies that are honest about it in the teeth.

Where exactly was Facebook's ever honest about what data they hover up?

Want just but two examples from dozens?

That cutesy rabbit and the super shady patterns used for permission to suck up all your communication on Android would be exhibit #1

I would add the fact that they abused the phone number provided for two factor authentication to spam you with adverts. A clear abuse of its intentions and a kick in the teeth of security in general.

There are dozen more examples. If in doubt search for "The apologies of Mark Zuckerberg" on DuckDuckGo.

Re:Facebook: The Normalization of What Should Never Have Bee... by kerng on Saturday January 26, 2019 @07:31PM (#19009548)
Nope, they at one point just stole your address book, without consent. Later they added consent, but the UI is still sketchy and tries to trick people.
Re:Facebook: The Normalization of What Should Never Have Bee... by stevenicr on Sunday January 27, 2019 @01:47AM (#19010637)
Sometimes this is true, however many phones come with fbook preinstalled and some make it very difficult to remove it.

Another recent story showed how fbook is embedded with many other apps, at least api calls and such. so even if you don't install the fbook or messenger and never visit the site on that deivice, sometimes installing other apps that make api calls and send tons of data to fbook on thier (your behalf) -

so it's not so cut and dry.

I'd also argue that most people do not know how fbook gets and uses data on your device that you are not explicitly adding - they also don't know how this can affect other people in their vicinity or included in pics or contacts for example.

fb's spying is more pervasive than most know, and it's added by other apps without notice as well sometimes.

Is it spying if they record your info when you browse webmd or some other site that has beacons there? It may not be installed on your phone in that case, bit it's certainly spying imho. So is Big g analytics and others in many of those cases for that matter.

I don't think there any users who can truly control / stop this kind of thing (maybe .001% ?). There is virtually no education on these things. Short of a host file blackhole for known urls / ips - the normalization of this level of data collection and spying is amazing.

Re:Facebook: The Normalization of What Should Never Have Bee... by DSingularity on Saturday January 26, 2019 @06:58PM (#19009395)
Aside from the great comment below there is another reason why this is unfair. A new technology emerged. Society so thoroughly embraced it we may as well call it a utility. Now, they monetize it in ways which - had they done before they established market dominance - would likely have made society flee Facebook instead of embrace it.

Society was conned. Suckered in and now — once our society has become almost dependent on FB - we are being exploited!

Re:Facebook: The Normalization of What Should Never Have Bee... by Mirioron on Saturday January 26, 2019 @10:10PM (#19010149)
Was society really conned with Facebook? I can understand if you are talking about MySpace, but it was very obvious what Facebook's monetization model was going to be ever since they opened up globally. This is why I never signed up and was confused when so many people freely joined and gave up all of that information.

The other part is that if Facebook doesn't monetize things in a rather shady manner then we probably wouldn't have Facebook at this point or it would be operating at a loss like many of the other social media sites, eg reddit.

Re:Facebook: The Normalization of What Should Never Have Bee... by icelancer on Sunday January 27, 2019 @01:01AM (#19010543)
> Was society really conned with Facebook?

No. It's just gotten to the point in society where individual decisions are becoming eroded to nearly meaningless and it is now only safe to assume that the average person is a complete idiot and not in control of their own faculties.

Re:Facebook: The Normalization of What Should Never Have Bee... by zepto on Sunday January 27, 2019 @03:36PM (#19013642)
It doesn’t matter how much individual responsibility you take, you can still be betrayed. That’s what Facebook has done.
Re:Facebook: The Normalization of What Should Never Have Bee... by beezischillin on Saturday January 26, 2019 @04:10PM (#19008522)
Their VPN app kinda did function shoddily least

https://www.cnbc.com/2018/08/22/apple-removes-facebook-onavo...

Re:Facebook: The Normalization of What Should Never Have Bee... by mcintyre1994 on Sunday January 27, 2019 @08:10AM (#19011552)
To be fair they did (still do on Android?) have a VPN that functioned as spyware, which seems like something people don't intentionally install a VPN for.
Re:Facebook: The Normalization of What Should Never Have Bee... by masonic on Sunday January 27, 2019 @04:00AM (#19010971)
You sure do, if you installed their app:

Your full calendar

All your accounts and all of their contacts

Your precise location at all times you have Location services on

Storage, including accessing your files without notification

Etc.