Facebook 'Unintentionally Uploaded' Email Contacts From 1.5M Users (cnet.com) 75
Facebook "unintentionally" harvested the email contacts of about 1.5 million of its users during the past three years. From a report: The activity came to light when a security researcher noticed that Facebook was asking users to enter their email passwords to verify their identities when signing up for an account, according to Business Insider, which previously reported on the practice. Those who did enter their passwords then saw a pop-up message that said it was "importing" their contacts -- without first asking permission, BI reported. A Facebook spokesperson confirmed that 1.5 million people's contacts were collected in this manner since May 2016 to help build Facebook's web of social connections and recommend other users to add as friends.
uhh.. sounds very much 'intentional' to me.. (Score:1)
someone's just finally calling them out on this much more widespread practice than the article leads you to believe.
Re:uhh.. sounds very much 'intentional' to me.. (Score:4, Informative)
Re:uhh.. sounds very much 'intentional' to me.. (Score:4, Informative)
someone's just finally calling them out on this much more widespread practice than the article leads you to believe.
The bigger, ignored, story is that facebook got the passwords to millions of users' email accounts.
Re: (Score:1)
I have ZERO faith that they didn't harvest e-mails either to be honest.
Unintentionally? (Score:5, Insightful)
Except, they programmed it to do precisely that, so.. intentionally. Just unintentionally raised the ire of folks in doing so.
Re:Unintentionally? (Score:5, Insightful)
>"Except, they programmed it to do precisely that, so.. intentionally. Just unintentionally raised the ire of folks in doing so."
+1
This is just super slimy. And the problem with this type of practice it that it doesn't just violate the privacy of that user, but every single person that user knows.
Re: (Score:3)
And the problem with this type of practice it that it doesn't just violate the privacy of that user, but every single person that user knows.
I smell another class-action lawsuit!
Re: (Score:2)
Wait, the EULA doesn't include a personal arbitration clause? Fuckabug is slackin' when it comes to hiring lawyers...
Wouldn't apply to non-Fuckedbook users whose data was "unintentionally" taken.
Re: (Score:1)
Re: (Score:2)
Re:Unintentionally? (Score:4, Interesting)
LinkedIn does exactly the same thing. I've never given it permission to harvest my e-mails, yet it somehow seem to suggest me contacts based on addressbook matches alone.
All social platforms are just slimy personal information harversters. Burn them all.
Re: (Score:2)
Re: (Score:2)
The suggestions are based on other people's address books. Unfortunately if they share their address books then LinkedIn gets your real name, phone number, email address, maybe a photo and more.
The part where it told folks it was slurping (Score:3)
up contacts is the mess up. If it hadn't given any indication it was doing it, then nobody would have noticed. So that's the unintentional part...
How About Fining Them $10,000 Per Theft? (Score:5, Insightful)
That seems like a fairly light penalty. Now if we count each user who had their contacts stolen in this manner than would be a $15 billion dollar fine. But I think that each contact stolen should be the definitions of "theft" in this case. So if we the average address book has, say 50 contacts in it, that would be $750 billion. Seems about right for a long running bit of organized crime.
Re: (Score:3)
Re: (Score:3)
If anyone in the EU was affected then the GDPR fine could be up to 4% of global revenue.
Facebook's revenue was $55.8 billion in 2018, so the fine would be $2.2 billion.
If they get the max fine depends on how many EU citizens were affected and how damaging their actions were. I'd push for the full amount, but unfortunately I was not one of the affected so cannot submit a GDPR complaint.
Re: (Score:2)
Re: (Score:2)
That's an excellent point. I was thinking that I had never installed the app so my address book was safe, but other people with my details may have.
I'll submit a GDPR data subject access request over the weekend.
Re: (Score:2)
"But I think that each contact stolen should be the definitions of "theft" in this case."
If you're going that route, why not say each data element stolen could be a theft. That means if you had a work address, home address, cell #, phone #, birthday, and email address, that would equal 6 "thefts".
This is bad, but you have to cut it off at some point. If I steal your bicycle, you can only get me for 1 theft. Not 152 for each part. Or 1x10^150 for each atom.
Unintentionally? (Score:1)
Pretty sure precious little of what that monster does is unintentional.
That's the excuse my 6 year old tries when they're caught doing something they shouldn't be.
address (Score:2)
Re:address (Score:5, Insightful)
>"Doesn't matter for me, the address that FB has for me is my give away address. it is a real address and I do check it every month or so."
Yeah, but if your REAL address were in anyone else's contacts that that were handed over, then you were compromised without even knowing. It is just like jerk-wads who send out an Email "TO" everyone they know, instead of using BCC. Now all those people you don't know have your Email address. And when their lame-ass accounts or OS are compromised, start welcoming yet more spam (after dealing with the dozens of irritating REPLY ALL messages that follow).
I am glad I have never had a FaceBook account, and never will, and proud of it.
Re: (Score:2)
Yeah, but if your REAL address were in anyone else's contacts that that were handed over, then you were compromised without even knowing.
Which is why I always give my *FAKE* email address to all my contacts. Haha! Spam me now, suckersss!!
Re: (Score:2)
Re: (Score:2)
I wonder if all the people in your email address book feel the same way about you giving away their privacy and anonymity along with your own in such a thoughtless manner.
Naturally (Score:2)
If an individual did anything like this they'd be facing a long list of felony charges, but since it's a corporation, the DOJ is yawning.
Re: Naturally (Score:4, Interesting)
One (brutal, draconian, merciless) Law for human persons.
One (light, permissive, forgiving) Law for corporate "persons".
'unintentially' (Score:1)
You trusted (Score:2)
They also uploaded from their mobile apps (Score:5, Informative)
In addition to that, without asking you, they uploaded all of your mobile phone contacts when you installed their mobile app: https://www.huffpost.com/entry... [huffpost.com]
This is why I only access facebook from the web on mobile
Re: (Score:2)
In addition to that, without asking you, they uploaded all of your mobile phone contacts when you installed their mobile app:
I would gently question the wording of this. Facebook didn't "upload" your contacts, they forced your computers and phones to upload them. Without your permission. They stole it.
Phishing (Score:5, Interesting)
So Facebook was basically running that script like a phishing site to obtain users' passwords. Aren't there laws which apply to that? Or did the lawyers tell them to say "unintentionally" to save themselves from any penalties? Fuck lawyers (and broken legislation).
Load up or down? (Score:2)
They intended to *download* the contacts but actually uploaded them instead?
probably got paid by someone to do it (Score:2)
The more we learn about Facebook... (Score:2)
Re: (Score:2)
... the more evil Facebook looks.
And/or idiotically incompetent. I can see a scenario where someone said "hey, we have code that does what we want it to do already, let's just reuse that code", without realizing that code did other things too. As a professional programmer, it's incompetent bordering on negligent to reuse code without serious analysis, and that's an entirely believable explanation for what may have happened here.
Having said that, they're still liable for whatever the consequences of messing up that badly are, even if it
Bet for Forgiveness Business Model (Score:2)
Riiiiiiight (Score:2)
And Monica Lewinsky "unintentionally" repeatedly faceplanted onto Bill Clinton's crotch.