Hacker News new | past | comments | ask | show | jobs | submit login
Followup to "I bought more than 1 million Facebook data entries for $5" (talkweb.eu)
277 points by tlrobinson on Oct 25, 2012 | hide | past | favorite | 95 comments



You really don't want to mess with the Facebook police. They'll delete your life.

I wish I had something more substantive to say here, but the problem is that we give Facebook an extraordinarily huge power in our personal lives. It's not just some random web service.


but the problem is that we ...

The problem is for those people who decide to give FB huge powering their personal lives. I'm not among those, so there's no "we" for me here.

_My_ problem is to try not sounding like a cranky old man when I often encourage people to move away from Facebook.


20 years old. No Facebook account.

I 'deleted my life', and y'know what? Nothing changed. I still have the same friends I talked to before Facebook, still meet up for drinks on their birthdays, still arrange nights out, and still share what's going on in my life.

The best thing about no Facebook? I know what information is out there, and nothing personal that Advertising Inc. can buy.


You have a much easier story.

I'm 47. Because of the network effect, using Facebook I've connected with people I knew and cared about that I haven't seen in 30 years. Dozens of them. I barely remembered person A and B, found them and became friends. Then they knew person C and D. E and F were close behind. Pretty soon I have 200 friends from places scattered all over the world.

Life sneaks up on you, and people stop having the same phone, email, or street address. You wake up one day wondering what happened to Bob, then slowly realize that you'll never see him again. It's a weird feeling.

Yes, if I were 20 and still had a cell phone with all my friends from 4 years ago, it'd be no big deal. But if I lost my FB data now? I'd never find these guys again.

Personal sidebar ahead: by the way, my wife and I are having a competition to see who can get the most friends. As long as you're not selling anything, and I promise not to sell you anything, send me an invite! Right now she has 600 friends and I have something like 250.

http://www.facebook.com/danielbmarkham


But if I lost my FB data now? I'd never find these guys again.

You haven't bothered to copy off important contact data to some personal file? That's crazy.

You wake up one day wondering what happened to Bob, then slowly realize that you'll never see him again. It's a weird feeling.

True. OTOH, when that has happened to me, I realize there's a reason for it.

At 54 I find that a) life is not only short, it's shorter than you think, and b) there's a whole lot going on right now that dwelling on acquaintances lost to the past is probably a waste of time.

[B]y the way, my wife and I are having a competition to see who can get the most friends.

Seems we're very different people, so my anecdotal reflection likely as alien to you as yours is to me.


The purpose of my post was to point out to HN users, some of which may be old cranky guys with too much time on their hands, the way the average Facebook user looks at things.

If you'd like to make it about me, happy to do that. My email is in my profile.


If you'd like to make it about me [...]

That wasn't my intention, but your post was about you and how you use FB. Just as my response was about me and how I (don't) use FB.

I'm curious to know, though, how anyone can know if they are an average FB user. I know a few people who use FB and they all seem to use it differently. I wonder if each of them think they're an average FB user too.


Either this is an attempt at irony, or you are what is wrong with Facebook.


I fail to see how using facebook to reconnect with disconnected friends is what is wrong with facebook. As a tool that is exactly what it is for.


Did you not read the part about padding his friend list with strangers at the end there?


What's wrong with wanting to interact with strangers? We've built entire startups around that - Meetup, GrubWithUs, Couchsurfing, etc, all come to mind.

God didn't come down and carve the Approved And Valid Contexts of Facebook Friending on a piece of rock.


It is very interesting (and scary) how many things that we kludged together on the net that the new generation are finding as "must haves"


Personal sidebar ahead: by the way, my wife and I are having a competition to see who can get the most friends. As long as you're not selling anything, and I promise not to sell you anything, send me an invite! Right now she has 600 friends and I have something like 250.


>>Life sneaks up on you, and people stop having the same phone, email, or street address. You wake up one day wondering what happened to Bob, then slowly realize that you'll never see him again. It's a weird feeling.

Unless you're older, you have no idea how true this is. So many people I knew in college and this happened so frequently once I got out college. I suddenly realized people at that age are so nomadic. They move frequently, change addresses and numbers and unless you're best friends with them, you'll never know what happened to them.

Scary and yes, very weird to have known someone one day and then a few days later, they're a ghost to you.


if I were 20 and still had a cell phone with all my friends from 4 years ago

I think that's the key here. Smart phones which you use like a database.

If you had that when you were 20, you might have hundreds of contacts in your smart phone today. People rarely change both emails and phone numbers at the same time.


$20 says your wife wins. :-)



25, no facebook account for over 3 years. Life's better without!


27, no facebook account...ever. For some reason I have never been able to make the time to use a social network.


Amen!to that brother (or sister :)


21 and find that it would be hugely inconvenient to delete my Facebook account.

But this isn't for the social aspect, I don't post status updates or photos or share personal information (not even my Birthday), however Facebook Groups are just so widely used that it's hard to stay in the loop for certain things without them.


I'm 25. One of my friends uses Google+ instead of FB. It's really weird because the only way I can really get in contact with him is via the irc channel we all hang out on.

I never get to see any of the photos he shares.


If you actually care about the photos that your friend is sharing on Google+, what's actually preventing you from seeing them? You don't even have to visit the G+ site, just set up email notifications if he/she shares anything with you.

Let's look at an alternative scenario: What if your friend posted the photos online to Flickr, Shutterfly, Picasa etc. and sent you a link via email? Would you still complain?

My point is not to evangelize Google+ here, I am using it only because you referred to it. My point is that the power that FB has over your online social life is entirely up to you, and you can choose to increase/decrease it at will.


What if my friend posts on FB?


This makes me remember a thought I was having a while ago. I'm not a fan of regulation on the internet, but there's some regulations i'd really like to see for the purpose of creating a more competitive atmosphere. They're probably too extreme today, but in the future I can see them being necessary as our lives increasingly become more digital.

One of them is that all data I create, which is stored, I should have access to, programmatically preferably. If I sign up for a site like Facebook, and create data such as friend connections I should have direct access to that data. Without access, there's an anti-competitive atmosphere. It is near impossible for me to create a new social network today on a similar scale to Facebook, because people's data is locked up. Even Google+ with google's resources, and popularity couldn't get people to detach from Facebook. I watched as people enthusiastically went to Google+, but then left as they found everything they wanted to do with it was locked up elsewhere. It is true that Facebook has this data available on their API, however it also has the ability to choose who can use it. That's the problem. I feel this data should be available for the express purpose of allowing competition to flourish.

of course there's other examples. Linked in has almost exclusive access to my resume + business contacts. Gmail has my life's history. Literally. I probably talk to my girlfriend on gchat more than when we're home. By the time we get home, there's nothing new :D Almost every big decision we've made has been while chatting at work. I can go back, and look at the record of our conversation I had when we came up with the name for my dog. Or when we decided to move to a different state, or when I told her my mom was hit by a car. No one company should be able to wipe out my life's memories. No one company should have exclusive access to this data. It is MY DATA (i realize the law doesn't recognize this as true yet, but it will).

Every day as we move to digital lives, the services we use go from being fun things we do, to critical infrastructure. Those gchat logs are really important to me. Those facebook status conversations are important to me. I didn't choose facebook based on their features. It kind of just happened. But now its a part of my life (a lot of our lives). I want control over it.


I really don't understand what everyone is moaning about. You all entrusted companies like Facebook (and remember, companies are there to make money for their shareholders) with a massive portion of your social lives and now you're complaining about the fact that those same companies could shut your social life down in an instant. Well guess what, they do indeed own all "your" data. The moment you agreed to their TOS and started uploading pieces of your private lives online, you confirmed that you were ok with them owning it.

I've personally never felt comfortable with having my social life online and that's why I've opted out of using Facebook, Google+ or any other social networking services for that matter. My social life doesn't suffer because of that at all, in fact, my bond with the people who are close to me has become even stronger due to a lack of social noise in my life. I see my best buddies a few times a week anyway and when I really need to talk to someone else, I can just email them or give them a call. The whole Facebook/Google+/[throw in random SNS here] thing is a joke.


I also have never used any social services such as Facebook/Google+/Twitter because I consider my privacy important and it's tempting to just sit back and say "I told you so" smugly. That isn't really going to accomplish much though. People really should be pushing for stronger privacy laws and companies that choose to base their business around collecting personal data should be held responsible for protecting it.


According to that same TOS, users outside the US and Canada are giving their data to Facebook Europe in Ireland. So they have to follow Irish law, which they don't.

Europe's Data Directive applies to all users outside of the US and Canada. The data directive gives me the right to ask them all data they have on me, and the right to have them remove it.

As a European they have given me that right by setting up a company in Ireland.


In the European Union the Data Protection Directive (implemented by member states in national law) goes into that direction (https://en.wikipedia.org/wiki/Data_Protection_Directive).

It does not guarantee any kind of automated access (and in fact, only at least once per year do you have free access), but in theory lets you retrieve all data associated to your person from any company (and allows you to correct wrong information, respectively require deletion of data that is no longer needed).

If you try to apply it to Facebook, they'll however just redirect you to their data download tool (which only gives you access to a a limited subset of the data). It lacks some enforcement, unfortunately.


Sounds like this may interest you - https://www.facebook.com/help/131112897028467/

Facebook wraps up every status update, picture, etc in a .zip file that you can download.


I've actually setup a system where I download this zip file once every 3 months.

My main point is that the barrier to entry for making a new social network/reader etc is not one of innovation. Search for instance is hard to compete with because the bar has been set so high. Facebook is impossible to compete with because of its walls. I don't feel this page brings those walls down.


A service that did this regularly (like once a week) and then made the data available via API for syncing with other services would be useful.


Facebook specifically prohibits this. If I'm not mistaken only the account holder can download the data, you need to enter your password and bypass captcha. Also the download link is sent to your email.


And you can get more data by making a request under data protection laws.


My understanding was that this is only applicable if you are domiciled in the applicable area. Is this not correct? Has anybody tried this?


I tried it (I'm within the EU), but only got lots of boilerplate and got pointed towards their data download which is very limited in scope.

As far as I understand, the first few people to try it got more complete responses, but the data was still incomplete.

So, while technically it is your right, good luck getting anything more than you can already download.


I'd be great if the US implemented some sensible privacy laws.

I'm in the UK, and Europe has a nice set of data protection laws. Enforcing those laws is sub-optimal.


The prevailing argument against regulation is usually cost. "It would be expensive to implement this! MILLIONS OF DOLLARS!" and to the uninformed outsider this has a ring of truth to it. However any cost figure would be largely overstated as facebook and other big providers are already complying with European data laws. As such the fundamental architecture and implementation have already been done for a non-trivial segment of the internet population. All it would really take is rolling out that infrastructure to the US. Not to say it would be a completely painless process, but they already established a lot of knowhow.


It's bound to happen, if not soon, at least once we start electing legislators who have grown up using these services.


The actual data is of lesser significance than the network effect in my opinion. You already can pull your data out, at least to some degree, but a ban resulting in the loss of social amplification that services like fb provide is probably what would impact even moderate users the most.

To paraphrase Joel Spolsky from his Startup School session, "grandma's gonna be calling".


There's a few practical problems with creating that kind of legislation though.

How do you decide who has to comply with it? Every time I build a website that collects any data from users at all, do I have to also create an API for accessing that data?

Bigger companies such as FB and Google would most likely just move stuff offshore to get around this anyway.


Google already provides for this to some extent:

http://www.dataliberation.org/


Actually, Google DOES have data export features.

They can be found here: https://www.google.com/settings/exportdata


It doesn't necessarily need to be a full API. How about a database dump, or even a .csv? Just some way to get the data out of one system and into another.


That's still a bunch of extra work for a small program, considering you have to worry about security and data protection. Making sure that you don't leak anybody elses data.


I'd actually pay for the Facebook team to delete my online life!

REALLY

This needs to be a service...

The problem is that its just like credit reporting: the data can be obfuscated from you - but not from everyone else who wants the data that is a part of "the system".

Facebook is perm - thus I have never had an account and never will.

Users can benefit from having a photo repos and a wall etc... but users suffer from corp and gov data mining of said data. fark that


If they actually will "delete your life" instead of keeping and mining it I wonder if messing with the "Facebook police" might not become an acceptable roundabout way of effectively wiping the online record clean for people who'd care to.


Similar to the "nuclear option" - post as much racist / homophobic / misogynistic hate speech and fetish porn as possible while adding as many strangers as you can.

A friend mentioned this as an option back at the beginning of the "you can't delete - only disable your account" change a few years ago when Facebook made you go through a click maze and a waiting period before terminating your account.

Idiotic, but illustrative of how frustrating Facebook's polices can be.


I think that FB influence is largely overrated. As a matter of fact FB provides more convinient way to interact with friends.

If one day FB disappear we can move to another social network. It is very likely that we have our closest friends' emails so we don't loose any actual connections. As far as not-that-close friends are concerned, many of us will be delighted that we don't have to keep them at social network any longer (I am speaking here about people who managed to gather together 500 friend and they don't really know 70% of them, but are just to polite to delete them).

I guess if Dropbox would disappear or Google/Gmail would disappear or Flicker that would be really harmful for many people, but Facebook... Marketing people would be upset for some time, but average FB user will move to G+ or Diaspora or something similar in no time.

In fact, we can see how good e-mail is, despite spam and phishing problems. The point is that nobody owns e-mail, it is open standard. In the IM space we have Jabber, which moves e-mail openess to IM world.

In social area we need similar thing, the closest one is Diaspora, but we need something better. If it will be available then any larger portal would have it's own version, similarly as most portals offer e-mail accounts.


Delete our lives?! Oh noes.

Honestly, if you give one company that much power, then you're the foolish one. Same thing with a Kindle account, iCloud, SkyDrive, Twitter.. If you have valuable information in the cloud, back it up!

I personally tried to "delete my life" a while back and the only reason I still have an (unused) Facebook profile is because it got reactivated at some point.


I think we make Facebook to me more than they really are - After using them for 5+ years, and accumulating the regular collection of 500+ friends and 40 or so family members, I finally got a little weirded out over how detailed the timeline was regarding my life. So, one day, I deleted my facebook account.

I'm happy to report not a single thing changed in my life. No fewer parties, snowboarding events, burning man engagements, or family connections. Everyone who was my friend (Defined as "People who will come and help me move or visit me in hospital") remained my friend and keep in pretty much the same amount of contact.


It's possible not to use it. Maybe someday it will be like not having a phone, or email, but in my experience, it's still not like that.

Warning: According to Facebook you are not allowed to read this post, so beware.

WTF


It's a blessing in disguise being banned from Facebook would free up a lot of time.


You really don't want to mess with the Facebook police. They'll delete your life.

Isn't that the risk of putting your personal data up on Facebook? If you fear them so much, why would you trust them with your online identity?


I certainly don't; I haven't given them anything. Google on the other hand...


For all the folks out there that are completely, and emphatically, 100% --ambivalent-- about Facebook and hardly use it, I say: Meh!

Sincerely, A non-anti, non-pro barely-occasional, FB user :)


You can post your cat and dinner pics on G+.

It's not the end of the world if they ban you.

Aside from people using it to sell things/their business, most people will not lose much of anything. In fact, they will probably gain, since they won't be spending XXX minutes on FB each month.


I recently had cause to log in to facebook (first time in 6 months) because my account had been compromised and was used to place a bunch of ads ("find hot guys in your area") which they had apparently approved (and ran to ~$100 in a few hours).

I was impressed with the account recovery process ("you entered an old password -- do you want to recover your account?"), but I felt like they were completely optimized for recovery versus preventing the intrusion in the first place (ala Google's two-factor auth).

Anyway, in this case they obviously took the wrong approach with the blogger and I hope it blows up in their faces. (Microsoft and everyone else used to not be nice to security researchers, Facebook will no doubt learn that cooperation is a better strategy too).


FYI Facebook has two-factor auth as well: https://www.facebook.com/note.php?note_id=10150172618258920.


I wonder how frequently used the accounts which are used for fraud are?

But I guess it's tricky -- maybe I'm signing in from a remote ___location after many months of inactivity to post some vacation photos, and can't receive texts on my phone because it doesn't work in whatever country I'm in...


And the fact that you have to give up more privacy to increase security. I'd rather Facebook not know my phone number (though it's stupid to think they don't already have it due to any one of my friends syncing their contact information).

It's the little things like this that put me off to Facebook. It feels like every attempt to make the site "better" is just another attempt to get more information from a user.


I'm not very keen on those two-factor approaches like this that use text messages to your phone. The text message often does not arrive. And in some places you have to pay to receive text messages so it can cost money to log in.

It would be preferable if they could just use the Google Authenticator app like a few other sites do.


There is a 2-factor code generator built into the Facebook app for iOS and Android specifically to help with SMS deliverability problems. Have a look at https://www.facebook.com/help/270942386330392/


I live in Montevideo, South America, and I've never had a problem with a Google SMS not arriving.

I had my account compromised once, it's not something I want to repeat.


I would say without facebook your life becomes much more productive regardless of security issues. I rather prefer to be in touch with certain few people through other media rather than having a bunch of schoolmates which only stalk my profile. There would be no difference in having them because after all I would not have any contact with them even on facebook.


I spot-checked some of the profiles in the original post screenshot. Four out of five were realtors. So it could be the profiles in the screenshot were ranked by profession, or that this is a lead for where the leak came from. Or coincidence.


What surprised me is that Paypal is facilitating the payment for gigbucks, the marketplace where this is (still) offered.


Well, it's not like they're trying to take donations for cancer patients or anything.


> I tried to ask what they would do next but they said it would be an internal legal investigation.

"By who?"

"Top. Men."


I don't know why Facebook reacted like that. But as I understand, those information are not from Facebook itself. They are from an unknown third party app. Also, anyone who has a knowledge in Facebook API can mine those information by creating a Facebook app. I'm sure those app like "God wants you to know" have more than 1 million Facebook information.

By reacting like that, I think Facebook can be considered as guilty as charged.


You don't even need to write a facebook app. I have put together scripts in R and Matlab with those capabilities. Its absurdly simple to do using Facebook API and a JSON parser.


Using facebook API you are at the mercy of other's person consent to give you access to their email address and other data. You cannot just put some number to access a profile and get the email address or until you have some preferred access to data from FB itself.

Please let us know if you were working using some other better approach.


So Facebook is not only the x largest state, but also acts on the same level of paranoia as government agencies do?


Is not that a good thing that fb is taking this issue seriously and going after the people who sell this information?

On the other hand, they are trying to solve this issue secretly, no disclosure. And we dont yet know if they are taking any privacy measures to prevent this kind of data leak.


It becomes much harder to track down a leak when the leakers know they're being chased.


Is selling such information even illegal? Is it against Facebook's terms?

By using an app you are giving them access to a whole bunch of your personal information. I always assumed that many were scraping data from my profile. This is why I have never use Facebook for authentication.

When I read the original post I figured Facebook would want the data so they could narrow down who the probable culprit is. I would have thought finding a common app among a million users probably wouldn't be too difficult.

That said the nature of this conversation is ridiculous.


Scraping data via app permissions is prohibited by TOS but not policed.


this is so normal. ark torrented all the fb accounts for their yc demo day


Oharo, I'm curious why your only comments on HN are two slanders against Ark, on exactly the same day you first registered on HN?


Ark only shows publicly available data from the people's profile at fb. If its not public then you cannot get it from ark.


you can find the exact profiles mentioned on demo day on piratebay.


? It's true that there is a low quality dump of FB data from years ago, but it's totally useless in terms of our faceted search and we never use these kinds of sources.


And what does that prove? Are public profiles banned from piratebay?


I'm the founder of Ark that that's totally false.


Well this sounds like a good example of social engineering. Someone was really interested on his data an he just send it to them for free :/ I mean "Policy - Police", "It's secret", "we're recording you" are classic social engineering techniques used to put the target in a uncomfortable situation. I used them a few times, too.


This is pretty insane. Did you ever agree to the confidentiality of the conversation you were having?


I know someone who generated thousands of links to facebook profiles, including non-linked ones. They crawled for images with facebook meta data, pulled the facebook IDs, and used those to generate the profile links.


I'm not able to verify this right now, but facebook stores user identification information using EXIF in JPEGs? If so, I wonder whether image hosts delete this info before hosting your file.


Actually, the user ID is in the photo URL. Well, at least it was some time ago.


"According to Facebook you are not allowed to read this post, so beware."



I wish I could hit a "Like" button on this.


There's a like button on that page. I was logged in to facebook. Now facebook knows I read that page!!!


It looks like FB is really unhappy about people stealing their profits, selling user's information.


Haha: I’m guessing the app that leaked this info is called “facebook”




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: