Loss of Privacy

Keeping you informed on recent losses to privacy and civil rights worldwide.

Browsing Posts tagged Facebook

Over on reddit, there’s a post to the picture below about how Facebook wants access to text messages, email, and other things on a person’s cell phone.


Although it cannot be verified, someone who claims they work with the Facebook Android app gave this response.

I work at Facebook, more specifically, I’ve spend a considerable chunk of my time working on our Android app and the Android permissions we request. (I also worked on that same problem before I joined Facebook)

The description that includes the words “send emails … without owners’s knowledge” comes from Android itself and applies to the WRITE_CALENDAR permission. This permission is needed by any application that wants to create a calendar feed in the unified Android calendar storage, and create/modify events in it.

In particular, the Facebook app would like to give you the option to import your Facebook events (that you created or you were invited by your friends to) so that you can see them side-by-side with your other calendars like Google Calendar, corporate Exchange accounts and so on. The rationale for this is that it will make the planning of your day easier as you will be able to see all your agendas at the same time.

Unfortunately, the way this specific Android permission works is that it also allows apps that create or modify an event to send event invites and updates to the attendees by email automatically using the your email account on the device. We don’t need to do this, as we have other channels of communication with all the attendees of Facebook events – we have the email they provided to us when creating their Facebook accounts, we can directly update the event in their feed, we can send them a push notification in theri app, we can send them an SMS from our system if they have given us their phone number. However, there is no way for us to explain this to Android and to exclude that specific functionality from the permission.

As for the READ_SMS permission, we require that so we can automatically intercept login approvals SMS messages for people that have turned 2-factor authentication for their accounts, or for phone confirmation messages when you add a phone number to your Facebook account. Unfortunately, the Androids permissions system does not allow us to specify that we would like to be able to read only SMS messages from a specific number (plus that wouldn’t scale well because the list of numbers varies per country, but that’s a separate issue).

It’s also worth noting that we would love to be able to ask only for the permissions we need for the specific features particular users uses. For example if you don’t use Facebook events or you don’t want to see them in your device calendar we would prefer to not request the WRITE_CALENDAR calendar; or if you don’t have login approvals and don’t add a phone number, we don’t ask for READ_SMS. However, Android does not allow permission requests on demand; we have to request all permissions that cover each feature at install time, and the users can only grant or deny all of them and have no control over individual permissions.

We also have an official Help Center page that covers this.

It really is important to know and understand what any app is doing on your cell phone. It’s your decision then as to whether you really want that app on your phone, accessing your information.

FacebookTwitterGoogle+TumblrRedditHacker News

Flattr this!

As I read a story on Slashdot about Facebook removing the ability to download your posts, I came across this bit of information from user bobbied that I hadn’t pondered before, yet needs more attention.

An excellent reason to NOT post personal information on ANY site, your data becomes another’s property. Sites like Facebook collect an astounding amount of information from your activity, more than you likely suspect.

I know of multiple births which where announced on Facebook. Birth announcements only gave the full name and date of the birth but one could deduce a lot more from Facebook. One parent posts the announcement of full name and date. You got the proud parent’s name who has a spouse relationship so you now have both parents’ names. You look at the mother who has her mother shown and volia, mother’s maiden name. Births are recorded in the county records, so you look for what counties are close to their home address. You can usually weed that down to one or two. Now we have Father’s name, Mother’s name, Mother’s maiden name, date of birth and county of birth which is more than enough information to take over somebodies identity. Poor kids…Don’t even know how much trouble their parents may have caused them, even before they get out of the hospital for the first time.

When people are sharing their information on Facebook, they don’t think about the fact that they are sharing with Facebook, they think that they are sharing information with only their friends. They aren’t and they need to be more aware of just how a third party, in this case Facebook, are handling their information.

FacebookTwitterGoogle+TumblrRedditHacker News

Flattr this!

Facebook is building a $1.5 billion data center in Altoona, Iowa. The new facility will be 1.4 million square feet in size.

If you wonder why you should be worried about such things, please take the time to read Privacy as Currency.

FacebookTwitterGoogle+TumblrRedditHacker News

Flattr this!


Comments off


FacebookTwitterGoogle+TumblrRedditHacker News

Flattr this!

Many people do not think twice about “liking” their friends’ posts on Facebook. Consenting adults engage in cybersex regularly. Millions more look at legitimate, legal pornography every day. Still more feel free to criticize many things on the internet, ranging from a dislike of a certain celebrity to politics. If you do any of these things in the Philippines, you now risk being sent to jail for it.

On Sept. 12, President Benigno Aquino III signed into law the Cybercrime Prevention Act, which defines several new acts of crimes committed online, including, among others, “cybersex,” identity theft, hacking, spamming, and pornography.

“If you click ‘like,’ you can be sued, and if you share, you can also be sued,” said Sen. Teofisto Guingona III, one of the lawmakers who voted against the passage of the law.

“Even Mark Zuckerberg can be charged with cyber-libel,” the senator said.

The provision, according to Guingona, is so broad and vague that it’s not even clear who should be liable for a given statement online. And if you’re found guilty, get ready to spend up to 12 years in prison.

“Who is liable? It isn’t clear. The one who made the original post? The ones who share? The ones who tweet? Even you, if you post a simple, ‘hehehe,’ right? Does that mean you agree?” Guingona said.

Many Filipinos are ignoring the new law and going online to protest and criticize the government for its actions. Those opposed to the law say that it threatens free speech online. In response, several hackers have also defaced government websites while others have filed petitions in the supreme court to have the law overturned. There are also those who voted for the law that are now having second thoughts.

At least one senator who voted for the law, Francis Escudero, has acknowledged having glossed over the controversial provision and said it was a mistake.

As with politics in every country, the libel section was added at the last minute. Vicente Sotto III, who added the section because he doesn’t want people questioning his behavior.

“Yes, I did it. I inserted the provision on libel. Because I believe in it and I don’t think there’s any additional harm,” Sotto was quoted as saying in the local news website Interaksyon.com.

Little surprise there, though. Sotto may actually have an axe to grind with the Filipino online community after coming under fire for allegedly plagiarizing an American blogger and the late Sen. Robert Kennedy for his speeches against a controversial family planning and reproductive health bill.

While the government has said that they condemn the hacking of their websites, they welcome any protest done in the proper forum. The problem is they’ve restricted free speech with this law, so where is one to legally protest and who says what forum is proper?


FacebookTwitterGoogle+TumblrRedditHacker News

Flattr this!