Facebook admits harvesting contacts of the 1.5m email passwords it asked for

1 Like

It was not compulsory to give your password (I know because I refused), so it was not used to fight bots or scammers. Besides, scammers often set up a large contact list, because they want to contact people.

I fail to understand the outrage.

When you sign up, Facebook says they want you to link your contacts. They make no mystery that they offer the capacity to upload whatever various contacts you may have on their servers. When they requested my email password, it was quite clear that uploading the contacts was the objective. It also gives you other choices, like uploading a contact list or syncing with your phone.

Speaking about phones, that is what happens with the vast majority of users: they have all their contacts from all their various accounts on their phone, nicely uploaded to either Google or Apple servers. The first thing all social apps will do is access that list and upload it to their servers: FB, Linkedin, Whatsapp, Tinder, etc… they all do it.

Unless the user takes extra steps to prevent the upload, this is what happens. And most users will not take these extra steps, because they actually want that feature. They want the social app to link them with the people they already know. They do not care about privacy, especially the privacy of others.

I know, because at the beginning of FB and Linkedin popularity, I would get mail from either one, presenting itself as written by one of my friends and informing me he or she just joined that network and that I should join as well. I never answered any of these mails and the consequence, I think, was that the social networks decided that my email was not manned by a human and passed the word around. After a few weeks, all mail I sent to addresses belonging to major mail providers ended up in my friends spam folder. It happened around the same time. It took me months to get this sorted out.

I recently got a new phone and it uses Google contacts instead of whatever my old phone used. When setting it up I was amazed at all the junk it pulled in. Spent most of an evening on contacts.google.com (something I didn’t even know existed separately from gmail and my phone’s contact list, but was lurking there trying to combine them all) categorizing, merging, and deleting contacts. There’s still too many, but at least now I think most of the excess is people that I did work with at some point in the past instead of things like automailers and ecommerce sites I once bought something from and other junk. Phone and email contacts really aren’t the same thing and I don’t know how to disconnect it or why anyone thought it would be a good idea to just automerge it all (badly with duplicates and triplicates).

2 Likes

Haven’t we all built a scraper bot or two whose behavior happens to line up with our employer’s repulsively invasive tendencies by accident at times?

In the Cloud-Scale App Economy™ a million+ target scraper bot is the new ‘hello world’, right?

3 Likes

Contact management is sort of the cursed child of competing ‘ecosystems’, the grim fact that data hiegiene is a tough nut to crack programmatatically; and all the “lies programmers believe about names” cautionary tales.

It certainly doesn’t help that a variety of well-placed vendors have little incentive to help you easily move your contacts out of their warm little walled garden(ideally exclusively communicating using their tools and at least making it harder to import than export); but a ‘contact’ also tends to be a mess of free text fields(which humans are notoriously accurate and consistent in filling out), fields containing data that could indicate a duplicate or could be legitimate(names, most notably, not exactly GUIDs for humans), fields containing data that could belong aggregated into a single contact or could be important to keep distinct(even if it is the same John Smith, do you have one entry with "John.smith@foocorp.com" and one with "jsmithd00d23@aol.com" by accident, because your phone’s old contact system had poor support for work and personal emails in the same contact, or because you wanted to be absolutely sure that you wouldn’t inadvertently send to one address rather than the other?); and by fields whose labels are I’ll standardized or outright lies because people shove round pegs into square holes differently in different organizations(does Mr. Smith’s company code his phone number as ‘IP phone’ because the unit on his desk speaks h.232 over the LAN, even though the PBX is doing pure legacy DIDs over an authentic copper T1? Did they code it as not an IP phone because their SIP trunk goes into a SIP ATA in the wiring closet and comes out looking like POTS at his desk?)

None of this is to excuse the sorry state of some contact ‘merge’ and ‘migration’ programs(I had the pleasure some time back of helping clean up after a user trusted some Samsung/AT&T monstrosity and ended up with a bunch of chimeric contacts with email addresses munged around such that a number of highly sensitive emails were sent to the wrong external vendor…that was glorious…); but reconciling databases is one of those things that inevitably degenerates into at least some grovelling manually unless the inputs are impeccably sane.

2 Likes

This topic was automatically closed after 5 days. New replies are no longer allowed.