Install it on your phone? Anyone you have in your phone's address book gets to see your picture under "people you may know".

Someone in your family joins Facebook and friends you? Now everyone you are friends with gets prompted about whether or not they know your family member.

Want to delete some pictures you uploaded to Facebook? It's extremely difficult and they must be deleted one by one.

Other than LinkedIn, I'd say FB is the prime innovator of UI dark patterns that exploit users' unwitting behavior for profit.

The youngest generation of internet users gets this which is why they largely do not use Facebook. Soon they will realize that IG and Whatsapp are connected, and will avoid those too.

What's interesting to me is that the recommendations are fundamentally not useful. It's easy to look someone up by searching for their name without the privacy-invading helpful suggestions.

If you search for someone on Facebook, then Facebook will suggest to that person that they friend you. Seems a massive privacy hole to me.

I've been aware of how Facebook attaches people to you for a long time, so I deactivated that one, made a new Facebook several years ago primarily for development purposes, different name, different email address, friended a few people from one particular circle, never installed it on my phone

Occasionally I will get random friend suggestions about people in different chapters of my life

Facebook didn't have my address book, or a big enough graph to make these connections

I hadn't considered that those were the people merely searching for my name or variations of it

If B searches for A and C searches for A, does that imply a relationship between B and C? Especially if they live nearby? Who knows :(

I think it's kind of interesting to 'figure out' how the facebook machine works. How a simple interaction, a location, a conversation or even a purchase on amazon shapes your news feed and the feed of people around you.

They get it because in the jungles of many junior high and high schools, anything that can get you bullied will get you bullied, and young people quickly realized that all the accidental oversharing (by themselves or by their parents, elders, etc.) were easily exploited by bullies.

Thus they came to prefer simpler networks with simpler security/sharing models and features (like automatic photo deletion) that respect user privacy.

Dark Patterns are user interfaces that are designed to trick users.

Facebook requests the permission to go through your stuff and if you read their data use policy, they go so far as to tell you in detail exactly the information they're taking from you, as well as how they use it.

Sure, it's a little bothersome when the information that you've given them goes farther than your personal preference, but it's not a 'dark pattern', it's just a feature that you don't like.

It's a similar sort of dark pattern to the practice of putting the important details of a contract hidden in a massive block of text rendered in a tiny font.

Yes, they are technically being upfront about what is going on, in the same way that two pages of 8pt legal boilerplate informs the signer of the details of a written contract.

If it weren't a dark pattern it would be very easy to turn off the undesirable bits, and users would rarely be surprised by the consequences of the default settings.

Let's not forget that contrary to our poor performance on abstract logic puzzles, humans of all levels of intellect are superbly good at reasoning about potentially embarrassing social situations. Hence FB must work hard to de-emphasize the way FB actually works to make people consent to many of the default permissions. That is in my opinion the definition of a dark pattern.

It is the gray area enabled by these practices that makes FB's content interesting... because accidentally over-shared content is interesting to us about a small percentage of the people we are friends with. It's nearly a law of human nature that we are fascinated by obscure details of a small percentage of people for all sorts of reasons (sexual interest, jealousy/aspiration, schadenfreude, stalking, etc.) and we all have some small group of people who are interested in our obscure likes/posts for the same reasons. Rarely do we overtly interact with such people (in either direction) because it is socially awkward, but FB generates revenue/engagement off of the lurking that we all do and the blindness people have that they too are the target of such lurking by others (which is why the dark pattern works)... it's what makes FB scratch a particular voyeuristic itch for people and why it's been so successful. LinkedIn works the same way but for things like job changes, promotions, etc.

Convincing users to accept a feature they would otherwise opt out of if they had a reasonable choice and/or fully understood the feature seems like a textbook dark pattern to me. Hiding the data collection policy inside a giant EULA or using a carrot feature as a lure is indeed intended to trick the user. The fact that many services have adopted these tactics does not change their being dark patterns; it just means dark patterns have proliferated and become the norm.

The real problem is how the information was utilized by the recommendation engine, which is known to be creepily effective at matching people (people who just met for the first time, for example). FB is investing heavily in AI here so this is the natural outcome - where the results are very effective but has some unintended side effects. The side effects are largely due to the fact this connectivity happens in the background, outside of a place where the user can control privacy settings on particular contacts.

So I'm not sure there is an easy solution here. Mining contacts and social information is Facebook's business. It's what you hand over to use the service and why many people stop using Facebook voluntarily - or carefully limit what information they allow access to. I never allow FB to access my phones contacts, for instance, and their mobile app still works fine.

It takes more than it asks, and the fine print is there to cover its ass, when in reality if users were asked about what information they were willing to share they would be much more uptight. The users's have no real idea what is happening with their data, what they've given up or how its used to make the company money. It may be true that most user's don't care, and some might even prefer the outcome to them in the form of "relevant" ads (if the choice is made over "irrelevant" ads or paying for the service). It certainly is transforming what is in the public sphere about people, and the lessening of privacy can certainly be used as a weapon (and it is, to the extent that it is a big powerful force arrayed against a person independently figuring out what they want to spend their resources on).

OK, what is a dark pattern by your definition?

Dark patterns are a relevant topic on HN because many startups are measured in terms of user engagement and the growth of their user-base.

What is the difference between advertising and information? Growth hacking techniques and clickbait? Nudges and dark patterns?

These things are interesting because the line is blurry, and many patterns (dark or otherwise) that used to work suddenly stop working. This is why banner ads worked for a while and why interruption ads are becoming more and more common, and why adblock is becoming more and more common.

The world is not static, and so there is not ever going to be a consistent definition of what constitutes a dark pattern... it depends on the audience. In the first world, most 70 year olds are now on Facebook, and they are vulnerable to many patterns that the younger generations are not.

Just as scammers send senior citizens envelopes that look like social security checks but are actually ads, Facebook offers something that looks like a way to voluntarily share information but is actually often involuntary.

I think FB should take a hard line against dark patterns and be content to grow based on the massive network effect it can get without them.

Something like "malign algorithm", or "encroaching design" might do.

This is about exploiting the exposure of unique identifiers (phone number mapped to email), and an interloping tattle-tale ratting out their correlation to the same owner.

It's something more akin to a Prisoner's Dilema, except people aren't cognizant that "They Are The Product" so no one thinks of themselves as prisoners ratting out conspirators.

I used to freelance and FB started showing me one of my client as suggestion even though I use a work email for that, how? My client must have installed the FB app on the phone and his email client must have synced my email on the phone and now even FB had my email.

THIS is a huge pain point for me. I would ideally like to delete all my Facebook photos and timeline/wall posts from all of history. However, I cannot find a greasemonkey or tampermonkey script which will actually accomplish this. There are a few that claim to, but none actually worked for me (outdated).

Has anyone figured this out?

Only way to prevent this is to hide/obfuscate/limit information that fb is accessing about you. And that would be a huge feat in an of itself.

I bet the patients of the Doctor found themselves through each having her phone number. Hey they both are "friends" with this person maybe they should be friends as well.

This doesn't require for the middle man to have an account. You are inadvertently acting as a conduit for people to connect to one another.

FB likely has a "ghost" account for you anyway that they use to do this connection. So it is like you are using FB in some alternate universe.

TLDR#2: The recommendation to "prevent" these issues on the individuals side is, "Lisa’s medical community has started recommending that patients concerned about privacy not log into Facebook or other social media accounts at medical offices, or even leave their phones in their cars during appointments. "

This is about as practical as recommending people just figure out how to fly and occasionally levitate into the upper atmosphere to go out of the cell tower's range, move a few kilometers west, and then fly back down to earth to scramble all these tracking algorithms.

It's sad that we are at this stage but it's mostly our fault for being so complacent with companies doing these kinds of things.

If people stopped using their service when they did these kinds of things they would change their behaviour really quickly but most people don't know or care that this is happening.

Just because I'm not on Facebook (I'm not), anyone that's allowed Facebook to see their own contacts, in their phone or email, has shown that they are or are not connected to me in some way. Without me actually ever even having an account with Facebook they can correlate this data from users to see who is likely to know one another by a shared connection to me. Just because my particular node on the relationship tree has more blanks than it would if I was a Facebook user does not mean I don't create a node at all.

My guess for this Facebook issue in particular is that the Doc potentially did absolutely nothing herself, but rather all of her patients had mail and phone contact lists that included her and that common thread along with the same geographic area was enough to trigger a recommended match. In other words, this was equally likely to happen even if the doctor never had a Facebook page of her own.

The people who want privacy allowed Facebook to scrape their contact lists and monitor their locations. They then expected Facebook not to correlate this data with others who contact and visit the same doctor. Why not?

Because that would be a dick move.

But clearly that is not enough to dissuade companies from doing this kind of thing, because they have no morals.

And that is the crux of the problem. They don't give a shit what would be considered "reasonable behaviour" for a human being, because they are just giant correlating machines with access to data they shouldn't have been given access to by people who don't know better.

At the end of the day, we are allowed to have reasonable expectations of others, including companies, so I take issue with any implication that they should have known better. We are allowed to have these reasonable expectations. And we will be constantly disappointed. But we should maintain them, I might even say that it is a duty to do so.

Saying "they should have known better" is giving up the fight prematurely. They shouldn't have to know better. They should be able to expect that their privacy (a right) will not be violated.

It is an ideal, not a reality, but it is something to work towards. One step might be to sue the hell out of Facebook for this.

The people who want meat didn't demand tours of the meatpacking factories. They then expected the meat they bought to not be unsanitary and diseased. Why not?

I've been doing this for years now, and you know what? I don't miss it at all. I use the Facebook website from my computer, and that's A-OK.

It would be really great if the choice not to use Facebook did not often entail serious negative consequences. For one thing, I'd be a lot less annoying on the subject. Unfortunately, that happy state of affairs does not appear to obtain in either case.

You don't know if it was "opting not to use Facebook" that lead to decline in your social life, because you didn't test whether "being on Facebook" would not have lead to decline in your social life.

(I've seen many articles that state exactly the opposite - that people who have less social interactions spent more time on Facebook.)

https://news.ycombinator.com/item?id=12009198

https://news.ycombinator.com/item?id=12362818

(Maybe it's necessary to point out that I'm aware of the possibility that all the apologies I ever received on this subject were lies. I'm aware of the possibility that all the apologies I ever received on this subject were lies. Given that no evidence exists to support that conclusion, parsimony would require it be disregarded even were I otherwise inclined to imagine that all my friends actually hated me and didn't want me around, and were willing and able to deceive me by presenting the impression of sincere regret for having forgotten to include me.)

I'm still working on a better metaphor than that of an abusive relationship; while that one speaks strongly to me, my experience suggests it does not do so to others, which renders it useless for my purposes. Any suggestions you might have to offer on a more effective replacement would be welcome.

"I mean, imagine you're interviewing for a job, and the hiring manager asks you for the password to your Facebook or your email. Yeah, maybe you can say 'sorry I don't give that out' and still get the job - but at that point, do you want to? And what the hell is even going on that that's a question you get asked?"

Yeah, I think maybe you've given me my new metaphor. Certainly I look forward to trying it out. Thank you very kindly!

This has been my strategy for years, since the first time my entire contacts list got snarfed in.

Privacy is an environmental issue, not a transactional one. With the current system, there's really no opt-out short of opting out of social life altogether.

It's sort of infuriating, if I'm honest. He has a lot of insight with regard to, for example, the extent to which Facebook abuses people who use it. But the best he can muster by way of response is "Well, don't do that, then, and if you do, then to hell with you." Which is, to say the least, not helpful.

Edit: And on further reflection, the insight he does have is hardly unique. The more I consider what I've heard and read him to say, the less I find myself able to see what he actually has to add to the kind of nuanced conversation which needs to take place on this subject.

Further edit: So your response, while of value, kind of misses the point I set out to make, in that Stallman's situation falls neatly into the "effective social nonexistence" category. The question I'm asking is larger, and more along the lines of: How the hell did we let our industry become something of which Facebook is the exemplar, and is this really something with which we're okay?

Just because you don't want to switch your lifestyle, or we trade convenience for exposure, doesn't mean that stalman's lifestyle is wrong.

It's just different choice, and we are comparing apples to oranges here.

As it happens, I recently attempted to open a conversation on this subject with the man himself, in a public forum. I was polite, if uncompromising. He was profane, and preferred to have a minion disconnect my microphone rather than address the point I raised. Many people in the hours that followed found it worth their while to seek me out and thank me for making the attempt. Perhaps more thanked him for his response. I hope I may be forgiven for finding that improbable. In any case, he found no reason not to sign my Emacs manual when I approached him not long afterward, so I can at least hope that, however fundamental the differences in our positions on this matter and however unlikely the prospect of fruitful debate, there may remain at least some modicum of mutual respect.

I can certainly understand that it seems kind of incredible to you. It seems extremely incredible to me! I still haven't quite got wholly around it. And, yes, I can "just" call people up, or text or email them, and sometimes even get a response. I still occasionally do so, and still occasionally get together with one or two people at a time for a few drinks and to catch up. The problem comes in where you try to organize something on a larger scale, or where someone else does so. It would be technically inaccurate to say that to do so is impossible without using Facebook. But I've certainly found it ineffective to try to set things up via email, which was not the case a couple of years ago.

I would not be surprised to learn that I'm as old as, or older than, you are. Most of the people in my former social circle are somewhat older than I am. I'm pretty sure this isn't just a "people in their twenties" thing.

(Edited to add that I don't understand why you're getting downvoted, and I wish people wouldn't without explaining why they're doing so. Certainly, if it's out of some misguided assumption that I've chosen to put myself and my experience out there without being prepared to address people who express entirely reasonable incredulity and doubt about my veracity, let me take a moment to note that such action on my behalf, while certainly appreciated, is entirely unnecessary.)

I suppose we can agree that "it depends" on who your friends are. Oh, and I don't sweat downvotes on HN--any quick way to bury unpopular opinions can be hard to resist for some people.

Oh, don't get me wrong! I don't believe it impossible to have a social life without Facebook, and I hope I don't come across otherwise. But I have found it a great deal harder than seems at all reasonable, quite aside from the fact that it's absurd in the first place to have to develop a new social circle because opting out of Facebook sufficed to estrange me from my old one.

[1] (warning: strong language) https://www.youtube.com/watch?v=J1q4Ir2J8P8#t=2291

Most Androids have a slide-from-top quick menu when you can toggle it with one click. Honestly, Google Maps is the only app on my phone that really needs location access.

Don't share location via the web browser

Still poor substitutes but ....

People You May Know still had old high school friends, my old real estate broker (??), and someone I starred on GitHub. I have absolutely no idea how they connected that account to my old one, considering Google Mail is the only other service I've used on that laptop.

1. You log in to your account and get redirected to http://example.com/?user=3834

2) That page has an embedded Like button.

3) When your browser requests the button from Facebook, the referrer is "http://example.com/?user=3834" which is a URL that you visited a lot when your old Facebook login was active, and it was never visited by any Facebook users apart from you.

There are other similar ways they could link you to an old identity if they wanted to, some not necessarily blockable by these plugins, but the above would be simplest.

I did use my real number for the old FB account, but used 555-867-5309 for the new one.

https://github.com/jmdugan/blocklists/blob/master/corporatio...

Otherwise all that's left is you - how you type, click & otherwise use FB.

Edit: and the 1st thing the goddamn site shows me is a pop-up begging for a Like :\

Anyway, no, I don't know if FB can do that at scale.

What I do know is that sites, especially complex ones like FB, like to track user interaction to evaluate UX (hover targets, click targets, time it takes to find call-out etc).

If I were a data science type at FB, and knew FB was collecting that stuff, I think I'd like to find out what other questions I could answer with it.

Or more banal - did you use your laptop as a wifi endpoint and connect your phone & WhatsApp to it?

Wow, that makes a lot of sense.

Welcome to the post-privacy era, I guess.

Someone should start a project with the sole purpose of mining all kinds of personal data about FB employees from Facebook/Google and publish it as a Kaggle dataset for mining. Wonder how they would feel about that?

But I see your point, and certainly would like to see more constructive suggestions than mine.

Because I know very well how easy it is for people to think "oh, well, but that one little thing isn't so bad, when faced with bills to pay, or a raging boss. Many of which really aren't all that bad in isolation. Except it doesn't take all that many "one little things" before you have a total privacy disaster.

Alternatively a union can put pressure companies to never ask for certain things or to meet a standard for any privacy issues. Unions are usually seen with hostility in the tech industry, but they are just another tool; a union can be made for specific purposes, and ignore e.g. wage or anything else.

> only hire them?

I suspect this is the knee-jerk hostility toward unions I was referring to. If a strong union was created that only addressed ethical behavior, how long would Facebook be able to hire from a dwindling pool of non-members? The entire point of a union is that it's a way to put pressure against specific business practices.

Dwindling pool of non-members: Facebook is an especially bad example here, because they have enough money and clout to get around this.

How often do you see doctors being hired that are not members of the AMA: Doctors need to be on location, but this restriction doesn't apply to software. Facebook can always find talent in a country that doesn't have an 'AMA.'

In most organisations "everyone" will know who are "difficult" when it comes to dealing with privacy and other issues. Sometimes that means they are the ones you go to, when you e.g. want to be certain everything is right. But if you have something you think is ok but you think they will raise issues with, they will just go to someone more "flexible" in the organisation instead.

Unless the organisational culture itself strictly punishes this kind of behaviour and rewards protecting privacy even in instances were doing so might hurt revenue, there will be plenty of room for amoral people to find each other and "work around" safeguards

Day 87; Facebook declares bankruptcy. None of the money can be found. The servers have already been stolen by the surviving employees. Administrators arrive at HQ to find only a few broken chairs and a vast pile of shredded paper.

(to explain the joke, there is a downside to hiring amoral people)

If Facebook takes care to only hire smart amoral people they will last much more than 87 days.

If they are currently hiring only amoral people and people who are afraid of expressing their moral outrage, then there is absolutely no difference than if they were just hiring amoral people to start with.

I mean, to be clear, I still think this whole line of discussion around the imaginary (im/a)morality of Facebook employees is pretty far off base. But the question bears asking all the same.

I agree with you, and e.g. in the UK we have the BCS, which does have ethical rules you are expected to know and apply (their membership is just a small proportion of the UK tech industry, though; in part because it is not prestigious enough for e.g. employers to ask for, while requirements for membership makes it a hassle to join for a lot of people), but at the same time it is not sufficient.

Especially give that a lot of things first become truly problematic in aggregate.

E.g. Developer #1 gets asked to ensure you pull in the phone contact list to tie your local contacts to your Facebook friends, to enable extra functionality (lets say a "call" button when you view their profile) that seems entirely benign.

Then developer #2 gets asked to match on phone numbers that have already been pulled in, possibly without even being aware that the phone numbers he is working on are not necessarily just phone numbers of Facebook friends but also unrelated contacts.

You can say that they should have verified, but often it is very easy to assume that it's fine, and not think about consequences. E.g. it doesn't seem so unreasonable to suggest friend-of-a-friend. The problem in the article is that it is not suggesting friend-of-a-friend but contact-of-a-contact, which is an entirely different relationship. But if you're told "here you can find a bunch of phone numbers for each user", build a "friend-of-a-friend" recommendation feature, it is not that strange if people assume it's actually "friend of a friend" - people like to assume the best.

Here's an example from my own past, that I did stop, but only at the last minute, when I realised what was about to happen:

And old boss asks me for a database dump from a "sort-of-still-client" that was leaving us. Nothing odd with that - they kept asking for more up to date copies to make their migration easier, and kept paying us for a year after they'd migrated their site in order to be able to continue to use their old reporting facilities.

So I prepared the database dump. Then I asked him how to deliver it, and he asked me to pass it to X. X was not the client, but someone in a new corporate parent. If my boss had instead asked me to deliver it to him instead of X, I'd have done it without further questions, and he would have passed it to X and the damage would have been done.

What X wanted to do was to mine it for potential customers. The almost-ex-client were not in any way competing with the new corporate parent, so it would not harm them was , but apart from likely violating our contracts with them, it was also a blatant Data Protection Act violation (UK).

My former boss thought this wasn't a problem because we were passing the data internally in the same company and we held the data in our system legally anyway. But the point is the data had been provided by the customers of our client for a specific purpose, and was handed to us for a specific purpose, and that purpose no longer existed. We certainly had not been given permission to use the data for sales. It was hair-raising when I realised what he wanted to do.

He accepted it when I explained why, but it was rather shocking that it took an explanation for him to realise it in the first place.

He was stupid to think his suggested use was remotely ethical, and that's the only reason I caught it: If he'd realised how unethical (and illegal) it was, and he still wanted to do it, he'd have asked me to provide the data to him, which I would have - that'd have been routine. If he'd asked me to put it up for download and provide a username and password, I also would have - assuming reasonably enough he was intending to pass that info to the client. Though after that incident I started being more sceptical about providing him with data without knowing the purpose first, and making sure the client had actually requested it.

Don't get me wrong. I have no love whatsoever for Facebook, and I would very much like to see a world where no Facebook does or even can exist. But there's a difference between recognizing the problems that result from Facebook's existence, and imagining Facebook and its employees to be deliberately inflicting such problems on people and thus deserving of threatening, even violent, action in imagined response.

Developers are not sweatshop workers beholden to the company store. They have a plethora of employment options. If they willingly choose to work for such a company, the case could be made that they have made themselves legitimate targets for having made this choice.

I might also counsel a certain restraint in your rhetoric, such that you fight shy of hyperbole such as likening Facebook to the NSDAP; ideally that would be your lookout and no one else's, but since we're arguing at least nominally on the same side of the issue, your statements reflect somewhat on mine, and I would prefer they not do so negatively.

It's not that. It's that in this very short life we have, it's not only not helpful (in the longer run) to pursue actions which knowingly hurt people for the sake of some perceived greater good (unless absolutely necessary) -- it leads one down a very dark path.

My solution? I'd prefer to educate people about the simple fact that most of these social media sites just don't do very much to improve our lives, are a huge soul-suck and time sink generally, and basically not worth the gargantuan amounts of time and emotional energy we invest in them.

So that eventually FB, WhatsApp and all the others will hopefully just die of starvation without a single shot fired (or employee being threatened or doxxed).

Normally in a market system you want to keep the chain between cause and damage short enough to be comprehensible for the people causing it; otherwise, there's no good way to make them avoid it.

¹ https://en.wikipedia.org/wiki/Moral_hazard

This is a general problem with creating an algorithm to supplement or replace anything previously done by humans. Even if the algorithm is given accurate and unbiased data (which is rare), the choice itself to use an algorithm in the first place and the design of the algorithm also contain bias.

Sometimes this bias is intentional such as "redlining" where housing loans were denied to blacks using various proxies for race. I suspect that in most cases the bias is accidental, which is why it is very important to check the results carefully for any unintended bias. In situations like Facebook, simply asking their users first (opt-in) if they would like to participate in "local friend discovery" would be a great start.

I mean, at this point you're asking Facebook to do something which is directly inimical to its interests, in that people opting out of "local friend discovery" truncates its social graph, or at least reduces the weights it can put on some edges, and thus makes its information less valuable for targeted advertising.

It would be nice to imagine that the people who make such decisions would make that one out of the goodness of their hearts. I do not think this likely. In the absence of a strong financial incentive to do otherwise, I would expect to see things go on pretty much as they have been, i.e., getting gradually worse over time. Threatening Facebook employees with physical harm seems like a severely counterproductive strategy toward applying such an incentive, but I'm not sure what to suggest in its place, because I've tended more in the direction of finding ways to convince people the problem actually exists - itself a regrettable necessity.

I have very little sympathy for a business model based on surveillance and manipulation. Figuring out how to generate revenue is Facebook's problem. Lots of unethical behavior would be valuable in various business models. Facebook can police themselves or they eventually invite (probably less desirable) legislation crafted by pissed off people.

> Threatening Facebook employees with physical harm

For the record, I am in almost all circumstances I am a pacifist. I would never advocate for physical harm. That said, I have nothing against revealing the private information of the people who insist on doing the same as a business model.

> directly inimical to its interests

> I'm not sure what to suggest in its place

That's easy; you change arrange it so they want to do the necessary due diligence of making sure new any new algorithm is both necessary and safe. We accomplish this with liability. Data needs to be toxic. If you collect data and store it for long periods of time or aggregate it with other types of data, then you are responsible for problems that arise from your databases. In the case of this doctor, if any problems happen to her patients from Facebook's disclosures, then Facebook is the liable party.

They can decide the level of safety required. Either transit the data for the users blindly and enjoy immunity like a common carrier, or inspect the data and pay for the problems that derive from that inspection.

> finding ways to convince people the problem actually exists

That's always a good idea, but in the meantime it is not the responsibility of the user to understand information theory before critiquing Facebook's claims. Blaming the victim is never the right answer.

I have none whatsoever. But Facebook, as it is today, is a thing that is. I don't see that imagining the current state of affairs to be other than it is helps anything. I'm also not hugely in favor of looking to government for a solution to this problem, because the United States government, for all its many and various qualities, has an extremely poor track record on legislation related to technology, and I do not see any reason to imagine their response to Facebook would buck the trend. At best, it'll be ineffective in its stated aim. At worst, it will be that and also inimical to a lot of other businesses which don't actually belong in its crosshairs to begin with.

> I have nothing against revealing the private information of the people who insist on doing the same as a business model

This implies an inaccurate conception of Facebook's business model, which has really nothing to do with revealing private information in the way you describe. I don't think Facebook lies when it says that such disclosures are accidental. I don't think that honesty is any excuse here, but you seem to be imputing evil where there's no reason to believe any exists; the problem is not that Facebook schemes at inflicting misery, but that its financial drive to monopolize an ever larger swath of human interaction increasingly creates misery as a side effect. We can acknowledge this, and work to put an end to it, without erroneously painting anyone as a monster.

You claim, too, not to advocate physical harm, and to be in general a pacifist. Those are nice claims to make. I hope you don't find yourself in the position of having to defend them after a release of Facebook employees' personal information results in someone being SWATted, or driven to suicide, or otherwise assaulted, battered, murdered, or likewise mistreated, as a direct result of an action with which you say you see nothing wrong. You might protest at that time that your rhetoric is unrelated, and your responsibility nonexistent. After all, I'm sure you yourself would never actually dox anyone, even if you do say it's fine to do so. Such protestations are not likely to find many sympathetic interlocutors.

> We accomplish this with liability. Data needs to be toxic.

This is an excellent point! It deserves to be found in better company than you have given it here.

> Blaming the victim is never the right answer.

I invite you, quite seriously, to review my HN comments on the subject of Facebook - they are quite plentiful, you'll have no trouble finding them - and identify any case in which I may accurately be said to have blamed the victim. My entire perspective on this matter is what it is because I am a victim! How do you suggest anyone go about making any kind of beneficial change more likely, if no one recognizes the need for it? How do you suggest such recognition come into existence, if not by finding ways to explain to people that there is a problem? Would you rather just sit back and wait until there's enough of a critical mass, of people who've been chewed up and spat out by the gears of Facebook's advertising data generation machine, for a groundswell of public opinion to arise organically? That seems a bit cruel to me.

My reference to victim blaming was targeted at the the ideas in the thread - and often stated by Facebook and others in the surveillance industry - that people should know not to use Facebook when they have not had an opportunity to learn about how modern technology works. Education is a great idea, but that takes time. (I've been spending 20+ years trying to educate people about the internet, encryption, and privacy in the modern age)

> to be in general a pacifist. Those are nice claims to make.

I have the scars and hospital bill to prove it. Fortunately I was lucky and the (tool assisted) beating didn't do a lot of permanent damage.

> an action with which you say you see nothing wrong.

I never said I saw nothing wrong with it, only that Facebook should to accept what they do to others.

I do understand Facebook's business model. I also understand some of the VP-level people involved, because I taught some of them how to program. These are people that are perfect examples of being born into "privilege", who need some real experience in how the rest of the world actually lives. I don't wish them harm, but I won't shed a tear if they get harsh dose of reality.

(I've probably not worded this optimally; I'm trying to restrain my language because these people piss me off)

> I don't think Facebook lies when it says that such disclosures are accidental.

I'm sure they're telling the truth. I'm suggesting that they are being negligent in their use of automation. If they had any experience in the problems that most people face in the real world, they should have know that problems like at this doctor's office would have happened.

> I never said I saw nothing wrong with it

You said you have nothing against it. If there's a substantive difference between the two, I fail to see it. And while I can only consider it honorable, if admittedly also incomprehensible on a personal level, to choose to submit to a beating rather than betray a personal conviction on the subject of pacifism, it still seems at odds with such a conviction to advocate action which is well known often to result in the infliction of serious harm upon those who are its maleficiaries. I suppose it's possible there is a way to reconcile those, but if so, that's something else I currently fail to see.

On the other hand, it's clear that your perspective on at least some of the people we're discussing is vastly better informed than mine, and intellectual honesty would require that I respect that fact even were I otherwise disinclined to do so. The impression I've gathered in general is that most people who work for Facebook genuinely believe they're improving the world by doing so. Would it be accurate to say that that's especially true for the VP-level people you describe? And in general, it would be interesting to hear whatever else you'd like to describe about Facebook's internal culture and the effect it has on people who partake of it.

> I'm suggesting that they are being negligent in their use of automation

Another point on which we agree. I don't know that it merits the kind of punishment you seem willing to countenance. But I gather also that you're angry about this, in a way that I'm not, and that can easily produce a certain clarity of perspective.

No they are not. For example, it is now common knowledge that Mark Z bought off all nearby houses in every direction to get more privacy. [1] Do you and I have similar access to resources?

Suppose your identity is stolen and you find yourself penniless because someone hacked into Facebook which also affected your friend who works at Facebook. Who is more likely to be in great financial distress the next day? Who is more likely to know the full impact of the situation?

Also, if someone in Facebook were to be negatively affected in some way, they probably have friends inside who can help them out. Do you and I have a direct line to a similar friend? In fact, we are likely to be the very last people to know of any such exploitation.

Besides, the closer you are to the algorithm, the more likely that you know how to circumvent it, even exploiting some simple bugs that others are not aware of.

And how about opting out? As a technologist, how hard do you think it would be for an insider to add himself/herself to the opt-out database, and also make sure that there were no hiccups in the process? Contrast that to something as simple as opting out of junk mail - have you been 100% successful?

I just made four observations about how you and I do not possess the same advantages as an insider at Facebook. What are the odds that, something can slip through four different test cases you set up and still turn into a bug in production? Minimal, don't you think?

You make really good points about not countering immoral action with more immoral action. But your notion that FB employees could somehow become unwitting victims of their own technology sounds seriously far-fetched to me.

[1] http://www.businessinsider.in/Mark-Zuckerberg-Just-Spent-Mor...

In fact I think that should be the basis of privacy laws everywhere: You can only use data that the user personally entered into your application or website. Data should only be available across your different "properties" it they are branded as being part of a single platform.

It would be much more in tune with the average persons understanding of something like Facebook.

Once a day when someone logs into FB, they should be presented with a word problem asking if the data they have thus far submitted to Facebook can be used to mine such-and-such fact about them.

If they cannot answer correctly, FB should not do said type of mining. As their understanding of the potential for mining info increases, FB is also allowed to add that type of mining.

This would be a win-win. People would actually understand what is going on, and FB itself has something to fall back on when the day comes when people turn this into an inquest (more a question of when than if in my view).

And I wish all the big tech companies would do something like that.

I don't think that's in the interest of companies like Facebook or Google. If people understood how their data can be used, many would close their accounts immediately. Data mining companies, and their customers are best served by keeping the public in the dark as much as possible. Revealing how much they actually know about us would cause trouble, if nothing else then simply because it's creepy as hell to many of us.

The funny thing is that while I think all this data mining is creepy, I also believe it's useless in most cases. The only thing I've seen work well over time is Amazons recommendation of books.

Also, I would argue it is indirectly in the interest of said companies and their employees if they prefer that their legacy is to avoid being referred to in the same bracket as the Enrons and the Arthur Andersens of the world.

The trouble is, they are also too big to fail now. The thing that petrifies me more than a thriving Facebook is a Facebook on the brink of collapse and which has nothing to lose.

Also the contacts of lots of recruiters.

If Lisa has her phone number associated with her Facebook account and either Lisa or the client has the others phone number in their smart phones contacts and the Facebook app installed that relationship can pop up in people you may know. If there aren't good "people you may know" suggestions the ones you get can end up being "people who may be known to people you know".

The reason I think this is because a therapist friend of mind had this exact problem and deleting her cell phone number from her Facebook profile made it stop.

What Lisa (and anyone else with a professional responsibility to protect client privacy) need to do is to stop associating the phone number they give to clients with Facebook or other social media.

Understanding how Facebook connects different people might help prevent this from happening, but as Facebook's tech becomes more advanced/pervasive Facebook will need to provide an explicit feature to protect user privacy for situations like this. As it stands, the implications of sharing your phone number, location, etc are already far from explicit.

1. Sharing my mobile number via the Facebook app without my explicit consent or knowledge

2. Using my Whatsapp contact list to recommend people I might know

And now, I've recently started getting all sorts of arbitrary notifications even though I've stated several times I don't want to be notified of anything.

The only reason I still have a facebook account is so that I don't have to share stuff like my email address and phone number with people. But at this point it doesn't seem worth it any more.

https://www.facebook.com/help/224562897555674/

Back in March I laid out how they could use a private set intersection protocol to enable any pair of users to privately share their contacts: https://news.ycombinator.com/item?id=11289223 (I'm not posting this to shame them or something: March wasn't that long ago for developing a feature like this, and of course it's open source; I could develop it myself and submit it to them).

I think it's something they care about; they've just not found a solution they're comfortable with yet.

No matter how good a given company or product is at privacy-respecting, what happens to all that data if they are bought out by someone else?

so did you get a reply?

No, I've not. If I wanted to brush up on my Java, I'd take a look at submitting a PR. But Java is the opposite of fun.

This bolsters my resolve to keep that app off my phone. You know, it doesn't bother me too much to have companies like Google analyzing my email to send targeted ads because I assume that information is not going to get out to the public. Facebook is a different case because there's a bidirectional flow of private information. It is a HUGE privacy concern (especially as someone that will be a physician in a few years).

I moved out of state three years ago, most of the people I see & spend most of my time with a completely different than the people I did five years ago.

If we've agreed to become Facebook friends then we've done it outside Facebook. If I use the "People you may know" feature I look like a stalker.

Quite a lot of people were just old enough to get an account today.

Granted, that's Schmidt, rather than Zuckerberg. The attitude seems to be the same, though.

Privacy != doing something wrong.

(I seem to remember the "it" in the quote meant putting information online / publicly available, no the "something" that you don't want anyone to know)

Schmidt has a way of saying reasonable things using the most offensive and misinterpreted language ever.

Imagine the possibilities [0]. What a wonderful world!

[0] If this were to come true, then the word "possibilities" would be replaced by "synergies" :)

Many possibilities here:

1 - whatsapp connection with messages exchanged

2 - contact list loaded by whatsapp

3 - psychiatrist secretary number in whatsapp

4 - friends in common

5 - places in common

Fb will suggest you know person X if a) you looked at person X's profile or b) person X looked at your profile

It makes sense that people using the same access point or connecting to Facebook from the same external IP would likely know each other.

I definitely did not consent to sharing my address book contacts with Facebook, and frankly nor would I want to. Now WhatsApp is offering an "opt-out" option, but I'm not sure how that will help. Isn't it a little too late for that now?

[0]: https://blog.whatsapp.com/10000627/Looking-ahead-for-WhatsAp...

  * "You're both friends of Duffman McPartyDude"
  * "We found Psycho Ex Boss's phone number in your contacts"
  * "Location Services confirms you were both frequenting a dubious drinking establishment at 4am three Saturdays ago"

Facebook is full of shit. Of course they are using locations, why else would I get suggestion to friend the guy that cuts my Mother in Law's yard - he stops by for a check from my wife.

It seems like that is the source of 99% of 'creepy' Facebook recommendations: Facebook doesn't realize that while 'has phone number' is a great indicator of 'knowing somebody' it has poor transitive properties.

I can't believe "fail" has become the standard noun instead of failure. It started as a lolcatism and now is standard.

This is just one of the economic asymmetries where small annoyances to everyone, but not enough to individually do anything about it, aggregate to billions for a few in power.

The only social network we need is a collective legal one.

My doctor also showed up as a suggestion. I figured either the office phone number was linked to his FB page, or FB was scanning my calendar events and linked me to him that way.

I got friend recommendations from FB for other members of the support group.

I think this issue requires action from Facebook. The minimum they should do is allow numbers to be registered to be not used for making connections. Much better would be for them to be more explicit about what information they are collecting (with sufficient guidance that the user understands that medical privacy can be affected) and allow users to not send them that information in the first place. I can't imagine them doing that voluntarily, though.

What's also just as likely is that patients are allowing Facebook to view the contents of their own phonebooks (which they are certainly free to do, unless of course, they're medical professionals with patient information as well...). Facebook sees that these dozen people have the same contact number, and recommends that they all friend each other.

"When Lisa looked at her Facebook profile, she was surprised to see that she had, at some point, given Facebook her cell phone number. It’s a number that her patients could also have in their phones."

You mean: "Fortunately..."

They really do need to dig into the issue, if in fact they don't know. Because something seriously need to be excluded from their recommendation algorithm if the article is true.

If they are in fact sucking in contact details from users phones and using them for matching and recommendations, that would seem to be something that would be serious enough to likely require express consent (in other words: users taking an explicit action, rather than being "opted in" implicitly by agreeing to a TOS or similar) under EU data protection regulations.

Not a lawyer, but I'd be surprised if there isn't one or more data protection violations lurking in there somewhere.

Strange place.

I mean, I guess you could keep those contacts in a note or some other record outside your contacts list, and just tap to call or email or whatever. But that only works as long as the Facebook app doesn't decide it needs access to that kind of record, too. And when you find yourself going that far out of your way to circumvent something that's installed on your phone, maybe it's time to think about whether that thing is more trouble than it's worth.