top | item 20468696

FaceApp Now Owns Access to More Than 150M People's Faces and Names

355 points| ElectronShak | 6 years ago |forbes.com | reply

232 comments

order
[+] stunt|6 years ago|reply
The coverage on FaceApp and the way they talk about it is ridiculous. When it comes for instance to Snapchat's numbers, the coverage is about the success of the company.

How is FaceApp different than all other apps and social networks that are storing all your photos with location and tags to your friends except that FaceApp is a Russian company?

I'm not defending FaceApp. I don't use social networks either for the same reasons. But this double standards in media is ridiculous in my opinion.

[+] mikeash|6 years ago|reply
We keep harping on about privacy, and then shit like this happens.

There are two possible conclusions to draw.

One is that the general public actually doesn’t care about privacy at all. It’s a niche concern.

The other is that the general public cares but is completely and utterly clueless about how to defend themselves, to the point that an app can literally say “give us your name and face and we can do whatever we want with it in perpetuity throughout the universe” and people will happily oblige.

I don’t know which one is correct but neither one is great.

[+] cmiles74|6 years ago|reply
The general public didn't know that the application was saying "give us your name and face and we can do whatever we want with it..." They had no idea that this was even a thing.

I would bet hard earned money that the average person installed this application because a friend told them and they were curious. This bit about what happens to their image and what data does the app save locally verses pushing out to the network, etc. is something that never even crossed their mind. If there was a window with legalese they ignored it as they have been trained to do (by Microsoft, Apple and every other commercial software product they ever purchased). Certainly they didn't go clicking around and looking for it.

[+] idop|6 years ago|reply
The general public doesn't have the knowledge or even imagination to understand that sharing your information with nameless/faceless organizations may have downsides re: privacy. The others have been brainwashed well enough to believe that only criminals need privacy, so they don't care. By now using the "I have nothing to hide" example is cliche but it's literally the response I _always_ get when I bring up privacy concerns. Takes me about 12 seconds to prove to them how wrong they are.
[+] sailingparrot|6 years ago|reply
Option 3: No one read the terms of services, and 99% of the app users are not even aware of that, didn't even give it a passing thought.
[+] envy2|6 years ago|reply
I think we're not giving the general public enough credit. These discussions always seem to come down to "no one cares about privacy" or "they care but they're idiots." I think many people care about privacy and generally understand the issues, but are making conscious trade-offs that make sense for them.

For the vast majority of people—who are boring, non-activist, law-abiding citizens—the value they assign to privacy of things like name/face/products they're interested in is nonzero, but very low. They know their name/face, along with far more sensitive information, is already in a lot of databases that matter more than anything some random app developer can do, and they get some greater value from the marginal privacy impact of that same information ending up in one more place.

There's a good bit of research to support this. For example, there is a study showing you'd have to pay someone on average $1,000+ [1] to give up their Facebook account for year, suggesting that's the value they assign to the service. At the same time, if you ask them how much they'd be willing to pay for an ads-free, more privacy conscious version of Facebook, studies show only a small fraction would pay even $15/month [2]. In other words, people are making a conscious assessment that their privacy is less valuable than the services they can get by giving it up.

We make these kind of trade-offs and decisions every day. It's much the same reason people can be both deeply concerned about child labor in the Global South, but still make the decision to buy the cheaper version of a product rather than the one they know is ethically sourced, even if they could afford the latter. These decisions certainly have societal impacts that are worth contemplating and being concerned about, but it's wrong and infantilizing to simply dismiss people's conscious and rational (for them) choices.

[1] https://journals.plos.org/plosone/article?id=10.1371/journal... [2] https://www.vox.com/2018/4/11/17225328/facebook-ads-free-pai...

[+] Cthulhu_|6 years ago|reply
It's because there's not been a lot of scary things happening yet. Or if they have, it's been on individuals - like someone seeing themselves on a billboard or advert. But because the datasets are so massive, people are reduced to statistics which is a lot less scary.

Of course, if you look at history that can change overnight. Or actually it won't, it's more likely a "boiling frog" kinda thing where nobody's aware of anything bad happening until it's too late.

[+] snarf21|6 years ago|reply
Or option 3. They care about privacy but only when terrible thing X happens.

They post their name and picture to Instagram 12 times a day. Most people have public profiles so there is no new risk. Of course by the time every street corner has facial recognition running "for our safety", it will be too late.

Even as someone who knows the risks, this doesn't scare me as much as DNA testing. Even worse is that if any of my relatives do it, I'm just as screwed. There is also the "let's all install hackable video cameras on our front doors" problem. Clever fear mongering to prevent a random package being stolen that is already insured and will be resent automatically. Instead we paid to create our own surveillance state.

[+] asdff|6 years ago|reply
People probably don't even realize that stuff moves to a server at all. People may think this is all happening and contained within their local app and therefore private and in their control. They probably also assume snapchats go from their phone to the recipient directly and aren't held anywhere in between.

This is I think the most scary possibility. If you think faceapp is processing this in the app with your phone's hardware, learning that they save all pictures sounds like a vast conspiracy and not so believable.

However, if you understand the technology and that most things online are not processed client side, the privacy implications are suddenly obvious because of course the company will keep that data that passes through their hardware. No shareholder will let money be left on the table so all data you put online should be assumed to be kept for later profit.

People have to be better educated on how the software they use every day actually works, at least in broad strokes. This can come in a high school media/technology literacy class or something.

Until that day comes, we have two classes of people: those who understand how the tech they use works and makes a company money, and those who will be forever manipulated by the first group so long as they have a dollar or a right to vote. It's a hard problem to overcome when so many technology companies are entirely dependent on profit from people's continued ignorance and tech illiteracy.

[+] tdb7893|6 years ago|reply
I think as with most things it's a little of both. HN as a whole is concerned about a lot of privacy stuff that just doesn't bother everyone. Also privacy is hard, even if you buy things in cash companies can still track you if they want, they use cookies and fingerprinting techniques that even most people in tech don't really understand. It's not really possible to counteract tracking if large companies and governments make an effort for it.
[+] eeeeeeeeeeeee|6 years ago|reply
I don’t think the general public cares in the same way people on this forum do.

But, I do think they would care if their photos ended up on a billboard or used in marketing material without their explicit permission.

Most understand that the company needs some kind of access to photos for the app to actually do anything, but there is a limit.

[+] JoshuaRLi|6 years ago|reply
> the general public actually doesn’t care about privacy at all

It's not that people don't care; privacy is probably undervalued in the context of making privacy vs. convenience/utility decisions. (Digital) privacy's value isn't really tangible until it's actively used against you.

[+] pbhjpbhj|6 years ago|reply
Bit if A, bit of B.

People don't care that much, but also don't realise the implications that would make them care marginally more in some instances.

Google already have millions of face tags from Picasa, etc.; Facebook has had image tagging for ages; ... governments already have all that data from passports and driving licensee and ID cards ... so why not give it up again. It's a drop in the ocean situation.

Russia having my face data is likely to make much less difference to me than someone in UK having it, which might also make people not care. [But of course they can sell the data on.]

[+] GCA10|6 years ago|reply
In aggregate, people's desire to be noticed is vastly larger than their desire for privacy.

The latest case -- going beyond anything I can parody -- is this first-person NYTimes tell-all about a married couple being overheard in the midst of a sexual morning.

https://www.nytimes.com/2019/07/12/well/family/when-our-daug...

Why bother sounding alarms about Alexa, Google Voice, etc. perhaps listening to our bedroom conversations? There's a slice of the public that will go to a lot of trouble (write article, etc.) to make sure that such moments become public.

[+] gioele|6 years ago|reply
> One is that the general public actually doesn’t care about privacy at all. It’s a niche concern.

There is an established term for this innate human trait: "dancing pigs".

> In computer security, the "dancing pigs" is a term or problem that describes computer users' attitudes to computer security. It states that users will continue to pick an amusing graphic even if they receive a warning from security software that it is potentially dangerous. In other words, users choose their primary desire features without considering the security.

https://en.wikipedia.org/wiki/Dancing_pigs

[+] ryanSrich|6 years ago|reply
It’s somewhere in the middle. The cultural shift is happening though. And once the market is ready, they’ll need tools. Right now it’s simply too complicated to not only understand what an application can do with your data, but then taking actions on that data (right to be forgotten, etc.) in the future. If you’re at all interested in this space feel free to email me. I’m working on something that isn’t quite ready to discuss publicly yet.
[+] JustSomeNobody|6 years ago|reply
The general public doesn't understand. They're not steeped in it like we are. And we're failing to simplify the discussion to the level in which they will understand. Until then, they'll use apps like this.

I think the devs of this app need a slap on the wrist for being party to this nonsense as well.

[+] koolba|6 years ago|reply
It’s both but the second one scares me more than the first as nothing stops one of your friends from giving access to a trove of photos and information about you. It could be as easy as granting access to your camera roll (oh there’s tags! We’ll take those too!) or just holding up your photo to the camera.
[+] lone_haxx0r|6 years ago|reply
I care about privacy, but the state already knows my face, my fingerprint, etc. A private institution is, by definition, less hostile than the state of my country, so it's kind of pointless to try to hide my face.
[+] DisruptiveDave|6 years ago|reply
Another: The general public cares about privacy but not more than they care about the perception of belonging and being a part of any sensation that has to do with social media.
[+] matchagaucho|6 years ago|reply
How soon the public forgets about Equifax data breaches, but goes into a panic when they opt-in for face filters.
[+] nixpulvis|6 years ago|reply
I'd say it's a lot more like an addict that, while smoking a cigarette, says things like "yea I know these things are killing me".

No harm, no foul until the signs are visible, and it's probably too late.

[+] imgabe|6 years ago|reply
Is "what your face looks like" private information? You publicly display your face everywhere you go all the time. It's not really practical to hide it. Likewise your name you pretty much freely give out to anyone who asks. Is that private information?

So Faceapp knows "There's a person with this name who looks like this". Was that supposed to be a secret?

I'm concerned about privacy too, but it seems like some people just want to hide under a rock for their entire lives. I don't know how anyone manages to leave the house if having people see your face and know your name is a serious concern.

[+] lechiffre10|6 years ago|reply
I find it incredibly ironic that it took me about 30 seconds to go to the author's profile, see him plaster all the social media platforms we can reach him on. Went to his Instagram and could tell where he lives, where's staying at when he travels, that he enjoys walks with his mom in Centennial beach in Delta, BC and what he does for hobbies.

All this in under a minute and yet here we are panicking over a Russian Company that can do whatever it wants with your face pictures.

Ok.

[+] llarsson|6 years ago|reply
This is entirely standard legalese language that ALL apps that handle data on your behalf will have in their ToS. It sounds broad and nefarious, and it most certainly CAN be used in such a way, but it is what they need to be granted, lest they get sued by someone for obvious things such as creating derivative works (i.e. the altered face), hosting the images somewhere, being able to make a profit at all off their business, and so on.

Go look up other ToS for similar services, it is almost verbatim the same wording.

My problem is that this is the "least amount" of permissions to realistically make a media centric app, because legally, there's nothing stopping them from abusing the hell out of these rights.

[+] break_the_bank|6 years ago|reply
It's worse when it has access to your picture because a friend thought it'd be funny. In that situation the App gets my picture without my consent.
[+] logfromblammo|6 years ago|reply
Interestingly, "look at all the photos on this device" is a permission that people may be uncomfortable granting to their closest friend. And yet, people will grant it to a complete stranger of a conscience-less corporation with nary a qualm.
[+] erichurkman|6 years ago|reply
What an utterly infuriating article to read: as you scroll down Forbes drops a giant floating video… on top of the text you're trying to read and it follows you as you scroll.
[+] Raphmedia|6 years ago|reply
Every one I know is already using either Facebook Messenger (which has the same face scanning features) and/or Snapchat (which also has this feature).

This is not new.

I've been using FaceApp since its release.

There are a lot of other similar apps that I've used in the past. Especially makeup simulator apps. BeautyPlus, YouCal, InstaBeauty, BeautyCam, Facetune, Photo Plastic, Visage Lab, etc.

[+] bengotow|6 years ago|reply
I think FaceApp in particular strikes a chord in the United States because it's owned by a Russian Company. Name + faces (and therefore age and gender and race) + Location is the kind of data that enabled a lot of granular facebook ad targeting in 2016.
[+] barronlroth|6 years ago|reply
I fully disagree. FaceApp value is that it does its job significantly better than the US competition. Users have the "old" filter on Snapchat and Facebook for years at this point, but FaceApp really has taken it to the next level. Their overnight success is not surprising. I'd tell you to try it for yourself, but I understand the hesitation.
[+] slg|6 years ago|reply
Can someone explain how a company can claim the uploader gave them a license to an image when they do nothing to check if the person uploading the image had ownership in the first place? I have seen plenty of examples of people using the FaceApp on famous people with some image that the uploader clearly doesn't own.

Furthermore, don't people have rights over their likeness that overruled certain rights the copyright holder has over the image? For example, I would own the copyright if I met some celebrity on the street and took their photo. That doesn't mean I can freely use that image in my advertising.

[+] sergiotapia|6 years ago|reply
>To make FaceApp actually work, you have to give it permissions to access your photos - ALL of them. But it also gains access to Siri and Search .... Oh, and it has access to refreshing in the background - so even when you are not using it, it is using you.

This is false, you can just take a pic and never give it access to your gallery. If the authors are lying about something so trivial, what else do journalists lie about? That's why I don't trust them.

[+] djsumdog|6 years ago|reply
Is this true for both iOS and Android? It probably needs access to media to store images, and once you grant it that level of access, it can read media as well.
[+] antirez|6 years ago|reply
LOL people keep posting their entire life on Instagram, and now FaceApp is the danger.
[+] Rannath|6 years ago|reply
Aren't contracts with unlimited time periods non-binding? I was under the impression that any contract that said perpetual anything could be trivially disregarded. Or is that a regional thing?
[+] bhouston|6 years ago|reply
The language from their terms of service (https://faceapp.com/terms) is this:

> You grant FaceApp a perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid, transferable sub-licensable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display your User Content and any name, username or likeness provided in connection with your User Content in all media formats and channels now known or later developed, without compensation to you. When you post or otherwise share User Content on or through our Services, you understand that your User Content and any associated information (such as your [username], location or profile photo) will be visible to the public.

This is standard language that is generally enforceable. It is the license that is perpetual, not the contract.

[+] DINKDINK|6 years ago|reply
>contracts with unlimited time periods non-binding?

I've noticed in countries with Natural Rights frame works for their law that typically contracts that commit /an individual/ to work when it's not "bonded" in some way are interpreted as slavery and nullified.

e.g. If I agree to get paid $100k lump-sum today to work for you for 10 years at no more compensation, and at year 2 I decide to renege on the contract, no Natural-Rights framework court is going to enforce that.

But if I sell my house to you (relinquishing ownership to you for an "unlimited time period") and I try to renege on the sale, it is going to be enforced.

[+] NikolaNovak|6 years ago|reply
I am not a lawyer, but dear gawd, how would that even work? I can imagine a huge number of domains where a time limit would make interaction unfeasible.

- I am buying my house for perpetuity, not leasing it for a limited period

- I'm a photographer, you're a model, I want a model release that's unlimited or it's not worth my time and risk to deal with you (this is usually framed as "rights" or "license", but signed in form of a "contract", similar to what the FaceApp would likely do?)

[+] penagwin|6 years ago|reply
It's almost certainly depends on the juridiction but I am curious on this.

Also if any lawyers read this - If "perpetual" isn't binding, would say "The next 200 years" be binding? It's an explicit time period but effectively still "indefinite" for the lifetime of an individual.

[+] londons_explore|6 years ago|reply
I wonder if a neural network could be trained to recognise people who "look honest" or who "look like they'll repay their loans" (aka, profitable credit scoring data).
[+] alunchbox|6 years ago|reply
Hmm. Would it be possible to run these Apps in a VM like container? allow it access a dummy, empty folder to read from somewhat of a container for all apps? then there would be a manual transfer process between the shared folders after you've saved an image?

So when downloading an App it will ask would you want to run this in an isolated environment? and you can, so if it tries to scan over your photo gallery it will have an empty folder etc..

[+] Balgair|6 years ago|reply
Some commentors point out that though they never put their faces into the app, their family and friends did upload their faces without consent. Literally nothing is stopping anyone from just fishing through public DBs and uploading just about anything into the app.

There are issues of consent, of what is 'personal' data, of who 'owns' that data, of public vs. private, etc.

We've all been on this ride for a while now and it's not getting any more clear. If anything, it's getting more and more murky. Deepfakes are now able to be done on a laptop, essentially. EULAs are basically ghosts, the public cannot understand/see them but is terrorized by them at random. Privacy is meaningless despite it's proven requirement for proper adolescent/human development.

I think we're in a time now where we need a new idea and a new way of doing things and thinking about our world, where a paradigm shift is required.

Our ideas of personal data, of public data, of private data, of consent, and of ownership are no long going to work. The ethics aside, the old ways of doing things are not workable anymore.

What does a flawed, yet workable, solution look like?

[+] garysahota93|6 years ago|reply
Wow, that license agreement it brutal. What sucks is that because they have access to the whole photo library, even if I don't want my face on it, they can still get my face via my friends' (or parents') phones that have taken pictures of me in the past. Because we are all connected, it makes it really hard to not be sucked into this (even if you don't participate)
[+] sysashi|6 years ago|reply
If you're comfortable posting pictures to instagram, twitter and other social means you have nothing to worry about :)

On the other hand, personally I'm freaking out whenever my phone tries to upload photos to "cloud" without even asking or just a small prompt (which can be easily misclicked). So apps like that are out of the question!