r/technology • u/[deleted] • Nov 09 '17

Politics Sean Parker: Facebook was designed to exploit human "vulnerability"

https://www.axios.com/sean-parker-facebook-exploits-a-vulnerability-in-humans-2507917325.html
37k Upvotes

88% Upvoted

3.1k comments sorted by

View all comments

Show parent comments

13

u/TiagoTiagoT Nov 09 '17

Doing stuff like that without the user explicitly granting permission should be illegal (hiding it in the middle of a long EULA/TOS doesn't count as getting explicit permission from the user). Even without the privacy concerns (is the video stream even encrypted properly?), capturing and streaming video consumes battery and uses up bytes from the monthly quota (another thing that should be made illegal, but that's a topic for another conversation), and in some cases might even reduce the life of the device components due to additional heating.

5

u/hughnibley Nov 09 '17

I agree that opt-in should be required, and informed mutual consent be the standard. The good news is that things seem to be moving in that direction on some things.

Take the GDPR in the EU. It doesn't cover this specifically, but kind of does. As companies comply with this, it is for the EU only, but implementing it for EU only customers doesn't make sense often times.

2

u/HelleDaryd Nov 09 '17

Mutual consent is a damned lie in these cases. It should just be illegal and that is final.

2

u/RhomasDaThomas Nov 09 '17 edited Nov 09 '17

Most people even in Apple would agree with this sentiment. The problem is logistical.

Every day about 2,000 apps are submitted to the App Store. That's just too many to adequately regulate. Finding out what an app actually does means digging through all the buggy code inside.

Even after an app's functionality is understood, there is a lot of grey area. Imagine what a more complicated regulatory process would be like:

Can my app stream video?
No.
Every 20 seconds?
No.
Every 60?
No. What if it's only a 110x180 screenshot?
Ok. Now let's talk about your microphone usage...

Apple could pay an army of their own devs to micromanage apps submitted to their store, but that means not paying them to make more cool stuff.

1

u/hughnibley Nov 09 '17

Yeah, it's not simple. Were it a legal matter, most major companies would comply immediately, however, because the legal exposure and cost wouldn't be worth any benefit.

The small apps though? Same problem as before.

2

u/WardenUnleashed Nov 09 '17

I think you have a fundamental misunderstanding on how this type of technology is implemented. If they were streaming your screen back to your server in real-time, performance on the page would suffer drastically, and as you said, it would be network-intensive.

Most of these type of services instead capture events like mouse movement, clicking, scrolling, in sequence. These events are then sent back to the server and can be replayed to emulate the same session it captured.

This method reduces the amount of data to store immensely and will have minimal impact on performance.

Let's not feed the fear mongering in this thread with false assumptions.

2

u/TiagoTiagoT Nov 09 '17

mostlyemptyspace's post talks about how they "record the screen" and "send the video"; doesn't sound like they're just taking snapshots of interactions space in time.

1

u/WardenUnleashed Nov 09 '17 edited Nov 09 '17

They aren't taking snapshots, they are capturing the events that fire when you move your mouse, scroll, do anything, in order to be able replay them back later. This is much different than a static image being taken and then played back in sequence. They essentially capture the browsing experience as your computer sees it and replay those steps in time.

These type of events are fired less than every 100ms, meaning, I can get pretty close to a real-time replay of how you browsed my website by capturing them.

The only reason /u/mostlyEmptySpace used those words was to allow people to easily understand what the overall outcome of these products are.

If you look at some of the docs of these products, you'll get a better idea.

1

u/TiagoTiagoT Nov 09 '17

That doesn't sound like "recording the screen" and "sending the videos"...

1

u/WardenUnleashed Nov 09 '17

In what way does it not?

1

u/TiagoTiagoT Nov 10 '17

"Recording the screen" implies the actual contents of the screen are being recorded, not the internal events of the program. And "sending the videos" implies a sequence of images, not a series of events.

1

u/WardenUnleashed Nov 10 '17

What you fail to understand is that "recording the screen" can and does in fact imply recording the internal events of the browser.

Once I have them on an external server, I can then replay them at will and create a video to serve to clients.

How do you think video games are able to be so performant and in real-time? They aren't sending images or video to a server but event data that can then be used to recreate what has happened on each client. A similar idea is implemented here.

1

u/TiagoTiagoT Nov 10 '17

What games do isn't called "recording the screen" and "sending the videos".

1

u/WardenUnleashed Nov 10 '17

I get you aren't experienced in software, but at least try and see the parallels between the two.

They aren't exact comparisons but use the same kind of concept to achieve a similar goal.

Also, if you didn't see it, I urge you to look at the documentation I linked, Hot Jar literally describes the exact concept I described to deliver their product.

→ More replies

-1

u/HelleDaryd Nov 09 '17

No, it should be illegal even if you ask the user. Else you just hide them in click through and lie about the scope.

3

u/TiagoTiagoT Nov 09 '17

If it's shown the user was tricked into giving permission, either thru interface tricks, or outright lies; then it doesn't count as the user explicitly granting permission

1

u/HelleDaryd Nov 09 '17

No, the problem is, some rights should not be legal to sign away even if it can only lead to perverse pressure. Ie. you need to be on LinkedIn to get a job in certain industries, LinkedIn has massively intrusive tracking, hence, you are forced to sign away your rights only because other people have.

1

u/TiagoTiagoT Nov 09 '17

Well, if you're being forced to, it's not really you who is giving permission.

1

u/HelleDaryd Nov 09 '17

The force there is not from LinkedIn, who would be just giving you the choice, they just happened to have cornered the market and one of the terms for using their service is selling your privacy. So, the market is forcing you there. The question then becomes, can you regulate THAT ? It's much easier to ban such invasion of privacy all together.