What is a #darkpattern and why is @ftc looking into it? This thread illustrates an example of abusive unfairness that I’m sure you’ll find familiar. This disgraceful conduct is routinely celebrated by the growth hacker and digital marketing community as best practices.
#darkpatterns emerge in digital products when dashboards and split tests dominate the decisions at companies. Without incentives, privileges, and/or moral compass to question and challenge abusive design from within, #darkpatterns often expose the dark side of a business model.
Seems reasonable to me that consumers deserve the protections of unambiguous and equal control of starting and stopping a recurring fee. But no, an entire marketing discipline is predicated on designing an abusive asymmetry to impose an unobservable upfront exit cost to services.
They call this retention, fighting churn, net growth, “just sound business quite frankly” whatever jargon helps to obscure how invasively collected data is pushing deceptive practices up to the line of acceptability as far a possible and then some more.
The market doesn’t know what it would be like if recurring costs had to be presented as an unambiguous and equal gesture (easy to start as it is to stop). The market doesn’t know how many customers aren’t starting recurring fees because we just assume stopping will inflict pain.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
If you’re a @criteo user (you probably are!) residing anywhere in the world you are entitled to exercise your personal data rights under the GDPR. criteo.com/privacy/your-r…
For the curious nerds, everyone gets data rights because Criteo is based in France. I had rights to my Cambridge Analytica data because it was processed in UK. But you have to reside in the EU to get extra territorial data rights for data that is not processed there.
Nick Clegg is very very worried about the splinternet (data localization) but he does a fine job of arguing it’s nearly arrived. Meanwhile, he’s not urging US and India to simply and urgently adopt GDPR adequacy in light of Schrems II. He’s slow rolling instead. Gotta ask why.
Feel like GPDR could have used an upper limit of open investigations before algorithmic disgorgement automatically kicks in. Lost count of the open probes into Facebook Ireland a while ago. A failsafe for this colossus scenario.
Why the Facebook contact uploader vulnerability and subsequent hackbreachleak matters. Phone numbers are the ideal attack surface to force multiply other vulnerabilities. Facebook exposed non-public information and needs to answer for it.
As I learned from today’s Spaces call:
—FB’s contact sync was vulnerable to a malicious attacker who could enumerate phone numbers to harvest FB IDs. This revealed non-public information
—attacker then scraped accounts by FB ID
—API limits woefully inadequate/trivial to cheat
—botnets would enable easy circumvention of throttling of lookups per user per session
—Facebook silently changing user prefs made it confounding to know how your phone number was used; default settings put risks on users
—expect probe of who knew what when as FB deflects & spins
Wow. @ashk4n reveals that his 2FA phone number which was different from the phone number he associated to his account was leaked in the contact sync vulnerability. Private information was most certainly breached. Facebook must be pushed on its subterfuge, when it knew what when.
Wow. @intdc explains how Facebook silently changing its confusing privacy settings set the stage for this catastrophic leak by making it too difficult to realize the difference between the visibility of your phone number vs. lookup by phone number. Cambridge Analytica déjà vu.
You can now check @haveibeenpwned to see if your Facebook account data is among the half-billion leaked and circulating. You know that breach that Facebook insists has no responsibility for because it’s an “old” breach. haveibeenpwned.com
FWIW I deactivated my Facebook in 2018 so it was protected from the breach. The only safe account is an inert or deleted account.
CAVEAT: @haveibeenpwned only checks if your email is in leaked data. Most of the Facebook records are uniquely identifiable by phone number, not emails. So unless someone else builds a phone query tool or Facebook notifies folks… ¯\_(ツ)_/¯