In light of the Cambridge Analytica scandal, I finally deleted my Facebook account. Here are my thoughts on the matter.

[catweazel]

Thanks for the new word (gormless). I'll have to remember it the next time I play Scrabble with my family.

Where do I send the invoice?

[Penn]

Knee-jerks can be damaging to both your chin and your arguments.

My point is...

Moem made the very same point, only without prolixity.

No. She said one was more important. I say the other is more important. If you are going to snip and disregard all that counters your point use that.

If for no other reason than what I said that may have been drowned with the rest if you didn't see the importance.

As I said, the particular meta-data she pointed to by way of what she quoted can be acquired to varying extents by other means and always has been, at least in my lifetime, acquired for campaigns. What made this different from the past is additional unique elements that didn't exist before social media (and sites like you-tube, whatever category those are called these days).

[catweazel]

My point is...

Moem made the very same point, only without prolixity.

No. She said one was more important.

<sigh>

The point turns on the meaning of data as opposed to metadata. Since you didn't define the meaning of either, there is no point to be made or accepted. Moem is correct. A picture of a dog (data) without metadata is just a picture of a dog. In greatly simplified terms, a picture of a dog subtitled "My dog" and with Penn's metadata is a picture of Penn's dog, thus something more is known about the latter than the former.

[Mattyboy]

Something I was reading in Linux Format..

Code: Select all

"Authorities are quick to point out that “it’s only
metadata” that’s collected during bulk
surveillance operations, whether that’s through
IMSI-catchers, passive taps on cables or tit-for-
tat sharing arrangements with other agencies
to circumvent pesky laws on spying on your
own subjects. Metadata typically consists of
the “who” and the “when” rather than the
“what”. So things like phone numbers, IP
addresses, hostnames and timestamps, rather
than emails/voicecalls or complete URLs.
Thanks to advances in processing huge
datasets, combined with so much of our lives
being carried out online, this metadata can still
paint a worryingly accurate picture of what an
individual is up to. Simply logging all phonecalls
and text messages made in a given area over a
few days will produce a social graph showing
everyone’s circles. If someone knows you were
in regular contact with a doctor, and also
visiting a website about fibromyalgia, then they
may deduce you’re a sufferer. Quoting NSA
General Counsel Stewart Baker, “Metadata
absolutely tells you everything about
someone’s life.”
In the wake of Snowden, it emerged that
people up to three “hops” away from persons
of interests had their data scooped up
(1 http://bit.ly/LXF235wearewatching).
An oft-quoted figure is that two random
individuals are only separated by six degrees,
but in reality this is probably much less now,
especially if you count the many superficial
connections that social media (especially
Twitter) engenders

I wouldn't be to harsh on Facebook, come on anybody that uses that site should know nothing is 'private'.

This is political, to some degree it's playing into the hands of those that wish to control a population. 'They' hate facebook. Regardless of 'real news' 'fake news'... people saying its real or fake because it doesn't hit their agenda. They don't like people having a platform..We have the NSA, the UK has the 'snoopers charter' ....

Code: Select all

"However, the Regulatory Powers Act is, well, frankly awful.
Among other things, the Act requires CSPs (communications
service providers) to retain communications metadata (who
an individual has texted/messaged/written to and which
websites they viewed, but not the content of calls/texts nor
the individual pages on said website) for 12 months. This data
can than be examined, subject to some “double-locks” and
systems of “checks and balances” by intelligence agencies,
the police and the Home Office. That’s not surprising, but
what is, is several other agencies that feature on the list – the
Department for Work and Pensions, the Food Standards
Agency and the Gambling Commission, among some 50
others. Further, in the original wording, requests needed only
be approved by a “designated senior officer” rather than
requiring a formal warrant."

...Mrs May ( British PM ) "We currently have no contracts with Cambridge Analytica" Currently, meaning we have in the past, meaning they're wiping their drives of anything that may 'incriminate' the government as I speak these words.... probably... ( convenient legal 'loop holes' prevented any documents or drives being ceased for four days after the news hit )

Yeah, facebook shouldn't have done what it did ( but don't tell me they're all not at it ) this is a perfect political move to scapegoat facebook, finger point, so they can run their own brand of propaganda based on what they know about citizens and discredit free speech.

Nothing quite like turning a crises into an advantage.

[Pat D]

Perhaps we should look at the whole concept of pre-configured, pre-programmed social networks. Surely letting some unknown person(s) put it "all together" is just asking for trouble?
Do we want more from our computers/internet/phones than they are capable of giving us in a reasonably secure form?
Are we in too much of a hurry? I remember using punch-cards.
And finally, do we want/need social networks? Or are they just a cultural novelty?
Open-ended questions, people.
Don't shhot the messegnger...

[catweazel]

... meaning they're wiping their drives of anything that may 'incriminate' the government as I speak these words.... probably... ( convenient legal 'loop holes' prevented any documents or drives being ceased for four days after the news hit )

Absolute nonsense. The UK Public Records Act prohibits the wilful destruction of records.

Pardon me while I put on my tinfoil hat.

[Pat D]

Tinfoil hats have been proven to actually increase your susceptibility to various forms of radiation. Especially military ones. snork snork

[catweazel]

Tinfoil hats have been proven to actually increase your susceptibility to various forms of radiation. Especially military ones. snork snork

[Moem]

I wouldn't be to harsh on Facebook, come on anybody that uses that site should know nothing is 'private'.

I'm not on Facebook but they probably have some sort of a profile of me anyway.

And again, it's not the content of what people willingly post that says the most about them; it's mostly what's gathered from tracking them that helps built that profile.

Yeah, facebook shouldn't have done what it did ( but don't tell me they're all not at it )

Who all are you thinking of?

[catweazel]

Yeah, facebook shouldn't have done what it did ( but don't tell me they're all not at it )

Who all are you thinking of?

Them!

I don't believe my tinfoil hat is working...

[mike acker]

the interesting thing about Security Today is the legal business is getting into the act,....

Facebook received four lawsuits in one week following Cambridge Analytica data privacy scandal

Equifax now hit with a rare 50-state class-action lawsuit

who's responsible?

historically computers and their related software have been considered tools: the user is responsible for whatever is done -- using the tools. If I pull out my chain saw and cut down a tree and that tree falls on your Porsche -- I'm responsible for that.

but computers and software have transitioned now to the point where they are more like cars than they are like saws: they depend on components that are complex beyond the user's ability to comprehend.

the question of product liability will need to be re-thought. liability needs to be assigned based on responsibility: While driving it's my job to stop at red lights and to have my vehicle serviced as required. It's the mfr responsibility to provide parts that work properly. Brakes that stop the vehicle and "air bags" that don't blow your head off.

same thing in software: if I write code it's my job to certify same. As we know I'll need to compile it. It is thus my job to check the mfr signatures on the compiler and library before I use same to compile my project.

as far as this all happening in the commercial world --

I'll stick with FOSS.

[Pepi]

the interesting thing about Security Today is the legal business is getting into the act,....

Facebook received four lawsuits in one week following Cambridge Analytica data privacy scandal

Equifax now hit with a rare 50-state class-action lawsuit

who's responsible?

historically computers and their related software have been considered tools: the user is responsible for whatever is done -- using the tools. If I pull out my chain saw and cut down a tree and that tree falls on your Porsche -- I'm responsible for that.

but computers and software have transitioned now to the point where they are more like cars than they are like saws: they depend on components that are complex beyond the user's ability to comprehend.

the question of product liability will need to be re-thought. liability needs to be assigned based on responsibility: While driving it's my job to stop at red lights and to have my vehicle serviced as required. It's the mfr responsibility to provide parts that work properly. Brakes that stop the vehicle and "air bags" that don't blow your head off.

same thing in software: if I write code it's my job to certify same. As we know I'll need to compile it. It is thus my job to check the mfr signatures on the compiler and library before I use same to compile my project.

as far as this all happening in the commercial world --

I'll stick with FOSS.

Three weeks after the Equifax breach both my Discover and Visa card was hacked online. Not sure how Equifax would be responsible for credit card fraud but it did happen to me ???

[Penn]

Moem made the very same point, only without prolixity.

No. She said one was more important.

<sigh>

The point turns on the meaning of data as opposed to metadata. Since you didn't define the meaning of either, there is no point to be made or accepted. Moem is correct. A picture of a dog (data) without metadata is just a picture of a dog. In greatly simplified terms, a picture of a dog subtitled "My dog" and with Penn's metadata is a picture of Penn's dog, thus something more is known about the latter than the former.

Very valid point. Another mistake I made was leaving too much to logical leaps and now looking at it in a more clear mind I see that was more of a leap than I intended.

The simplest yet common definition I've heard for metadata is data about data. The first time I heard the word was before Snowden from one of the two very high up campaign workers that I learned a bit about campaign tactics from.

In this case, data is information about the individual person. Take data from a lot of individuals and combine it and now you have data about data which is the metadata. In the past, moem is right. Data about the individual wasn't as important to advertising or election campaigns as metadata but times have changed.

In the youtube scenario I gave first I said no cookies and not signed in. Youtube collects data on me as an individual when I watch a video. That limited data shows nothing to make it possible to market directly to me but when combined with other data to form metadata about typical usage among many people in my local area (provided by IP address) or state, nation and world they now now tendencies. In advertising or campaigning that is used to throw out a wide net which is more expensive and less effective than targeting individuals.

Allow cookies and they get more information about me as an individual and combining with the metadata that used to be more important they increase their chances of catching my interest but they still don't have enough to target me as an individual so they continue to treat me as part of a group (demographic).

Once they can conclusively link my data to an individual person combined with an increase in the amount and type of data that can be collected they can both show a selection of videos tailored to me as well as sell to advertisers who know they have a higher chance of making an impact because now they can use data to target and individual instead of metadata to treat me as part of a group.

The same campaign staff member that first informed me of the difference of data and metadata all those years ago also pointed out that in his political party they were looking for ways to make data and targeting individuals instead of metadata to try to get unknown percentages of groups because they felt the majority of people, though part of a group, didn't fit cookie cutter mentalities.

At that time they rarely targeted individuals (data) but it did occur. Now, with online social networking they can learn more about individuals. If what I believe is going on is in fact a new norm, data is now more important than metadata but the metadata still has its value.

One candidate spent more money on their campaign which used all the old metadata and wide net tactics and lost. The other used raw data in a more direct way so they were able to spend less money and win. Sure, there were other factors but...

[Pierre]

They used to be a referral to Big Brother, which also meant Big Gov't,,
but, today that is more likely to mean some Some Big Private Corporation ..

thus, it would still be interesting to "know" what They know about some individual who:
- doesn't use any Social Media
and
- uses a Ad Blocker on their machine(s)
ie: some individual who values their privacy - somewhat.
there is a few of use around, like those individual(s).

[Moem]

Reminder: this thread cannot be about who won the US elections, and why. I know this subject is intermingled with US politics, but let's avoid that angle so we can keep the topic open.

[mike acker]

--snip

Three weeks after the Equifax breach both my Discover and Visa card was hacked online. Not sure how Equifax would be responsible for credit card fraud but it did happen to me ???

this is a very important question that will absolutely have to be taken under consideration

if you try to establish liability for leaking PII regarding your cards it could be tough to pin it on any particular source: your data might have been leaked from anyplace you used your card...

in cases like this there is a common problem: a failure to authenticate transactions. This applies to forms 1040 also as well as to the new fake mortgage scam.

the best solution is to have people authenticate transactions by signing with PGP. but PGP isn't easy to understand; many folks will need some sort of packaged technology solution before they can authenticate their transactions, using PGP. While this is certainly possible I think the industry is leaning more toward some sort of 2FA solution.

the new chip& pin cards are a step in the right direction: the two factors are (a) something you have ( the card) and (b) something you know ( the PIN ).

I don't think "smart" phones should be considered as a component of any financial system: I don't think they can be secured: they are too complex.

At the End of the Day here it is the business that processes transactions without proper authentication that is responsible for the fraud. More than likely "proper authentication" will have to be determined by ( e.g. ) the FTC and then established as a commercial rule.

this is one of my favorite subjects; let's see what folks think on this !

[catweazel]

They used to be a referral to Big Brother, which also meant Big Gov't,,
but, today that is more likely to mean some Some Big Private Corporation ..

Or men in black.

[mike acker]

as far as "Big Brother" goes, check this one out:

Sticking to your diet? This tooth-mounted food sensor could transmit the truth
The device can transmit data on sugar, salt, and alcohol.

what we need is to for an Official Committee in Opposition to the Internet of Things.

( hmmmmmmm. we already have it: EPIC )

[Pepi]

Glad I have a clear conscience

[Bolle1961]

There is a great alternative for faciesbook, movim.eu
Based on XMPP, OpenSource, distributed, federated.
If you want you can run your own pod/ server.
Clients for Linux and Android (GooglePlay and F-droid), web client