Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Now Shares Phone Number & Address With Third-Party Apps

readwriteweb.com

Post reply on HN
Print view View original

51–60 of 82 posts

Re: Facebook Now Shares Phone Number & Address With Third-Party Apps

#51

Post by joe_the_user »

As I recall, Facebook still won't let the app/script that I run myself save the email addresses of my friends that they choose to share with me (I can manually save each shared email-address of each friend of my hundred friends but the terms of service prohibit any bulk downloading of this information).

So the assumption is that I, as a user, am naturally more willing to share my contact information with anonymous application X than I am with my friends.

Naturally, this is indeed a transparent effort at lock-in.

Re: Facebook Now Shares Phone Number & Address With Third-Party Apps

#52

Post by ericd »

extension wrote: post #16
fuzzmeister wrote: post #13

Earlier quoted context omitted.

1) The fact that there is a second item below "Access my basic information" would seem to make that fact abundantly clear. I'm not sure how much more explicit it can get. 2) While I agree that it would be good to give users a greater level of control, most apps are unfortunately not designed to play nicely with varying levels of permissions. Such a change would require significant advance notice to Platform developer…

While I agree that it would be good to give users a greater level of control, most apps are unfortunately not designed to play nicely with varying levels of permissions. Such a change would require significant advance notice to Platform developers. They can obviously live without contact info since they haven't had access to it until now. This is actually an interesting potential solution to the permission dialog pro…

This is kind of a strange viewpoint for a developer to hold (assuming you are one) - requiring permission by permission authentication would cause an exponential increase in the number of test cases that would need to be run.

Of course existing apps can exist without this permission, it's a question of what new possibilities this opens up for app developers. I know it opens some up for me.

I'm a bit baffled as to why this has been voted up so hard, given its extremely conservative viewpoint.

Re: Facebook Now Shares Phone Number & Address With Third-Party Apps

#53

Post by btipling »

tlack wrote: post #46
btipling wrote: post #38

Earlier quoted context omitted.

They used to provide this option but it actually made the API harder to work with. You could deny or approve one permission at a time and the developer had to handle it (and by handling that really meant always checking for permissions before actions and bugging the user for the permission whenever they tried something that required it). As a developer I prefer the new way, which is also how Android development works…

Are you sure? Unless I am misremembering, much of the Facebook code I see and write verifies permissions after they are accepted to see what you actually got.

Yes I'm sure I used to have to handle this.

Re: Facebook Now Shares Phone Number & Address With Third-Party Apps

#54

Post by jdp23 »

btipling wrote: post #38
jdp23 wrote: post #11

Earlier quoted context omitted.

Facebook has refused to provide that option.

They used to provide this option but it actually made the API harder to work with. You could deny or approve one permission at a time and the developer had to handle it (and by handling that really meant always checking for permissions before actions and bugging the user for the permission whenever they tried something that required it). As a developer I prefer the new way, which is also how Android development works…

Interesting, I didn't know that.

> Giving line-item veto to a user is a terrible idea.

Giving the user choice about whether or not they want to give up their personal information is a great idea. Suppose I don't want the app to have my email and phone number. Without finer-grained control, my only option is to say no to the entire app -- so they lose me as a user.

Re: Facebook Now Shares Phone Number & Address With Third-Party Apps

#55

Post by jarek »

mobileed wrote: post #44

No, Facebook doesn't share this information - you do! Let's be clear here. Those who are dumb enough to put their PII data on Facebook and the alike are sharing their information. My God, can we stop blaming someone else for our stupidity?

Facebook is in a weird middle spot between totally public and totally private. You log in, and you primarily interact with friends, but then a friend can allow an application to programmatically access your data... People have problems parsing the situation. Further, Facebook used to be much more private, and the constant adjustment of goalposts doesn't help.

Re: Facebook Now Shares Phone Number & Address With Third-Party Apps

#56

Post by fuzzmeister »

extension wrote: post #16
fuzzmeister wrote: post #13

Earlier quoted context omitted.

1) The fact that there is a second item below "Access my basic information" would seem to make that fact abundantly clear. I'm not sure how much more explicit it can get. 2) While I agree that it would be good to give users a greater level of control, most apps are unfortunately not designed to play nicely with varying levels of permissions. Such a change would require significant advance notice to Platform developer…

While I agree that it would be good to give users a greater level of control, most apps are unfortunately not designed to play nicely with varying levels of permissions. Such a change would require significant advance notice to Platform developers. They can obviously live without contact info since they haven't had access to it until now. This is actually an interesting potential solution to the permission dialog pro…

I was assuming that such a change would apply to all permissions - not just phone numbers.

Re: Facebook Now Shares Phone Number & Address With Third-Party Apps

#57

Post by jwatzman »

stanleydrew wrote: post #32
jwatzman wrote: post #20

Earlier quoted context omitted.

People who read HN , myself included, want more granular control, sure. I don't think most of Facebook's users would care or understand about the granular control -- I think a simple yes/no like Facebook has right now is probably the best option for most users.

I don't have a Facebook account so I may not be the best person to judge, but it seems like whether "most of Facebook's users would care or understand about the granular control" might not be the best basis for making a decision. In fact, I will go ahead and say that I disagree strongly that Facebook should base privacy control decisions on what most users want. Most users of any service or product won't fully unders…

Unfortunately it doesn't work that way -- users are foolish and will shoot themselves in the foot quite often, all while blaming you. If there were an option to, for example, disallow sharing of X on app Y, users would click it without understanding why. Then, months later, since X isn't shared, feature Z of app Y doesn't work. But the user doesn't understand how this works (messaging in the app might make it better, but not all apps are going to do it right and not all users will understand anyways). Since it's broken, the user will blame Facebook -- Facebook is broken!! Except the silly user did it to themselves.

This has happened. Since most things on the site are an app, Photos is an app. There used to be an option which ultimately disallowed an app to post certain kinds of stories to your stream (I don't recall the details). You could set this option on the Photos app, meaning you would never see any more photo stories in your stream. The option was very buried, so people had to specifically go to Photos and turn on the option... and silly users did this, forgot about it, and then complained that Facebook was broken since they never saw photos stories. Nevermind that it was their own fault. This option has since been removed in one of the Platform permissions revamps recently (IIRC it was simply forced to "off" for all apps, with Photos and similar internal ones special-cased to be forced "on".)

Re: Facebook Now Shares Phone Number & Address With Third-Party Apps

#58

Post by alanh »

jwatzman wrote: post #57
stanleydrew wrote: post #32

Earlier quoted context omitted.

I don't have a Facebook account so I may not be the best person to judge, but it seems like whether "most of Facebook's users would care or understand about the granular control" might not be the best basis for making a decision. In fact, I will go ahead and say that I disagree strongly that Facebook should base privacy control decisions on what most users want. Most users of any service or product won't fully unders…

Unfortunately it doesn't work that way -- users are foolish and will shoot themselves in the foot quite often, all while blaming you. If there were an option to, for example, disallow sharing of X on app Y, users would click it without understanding why. Then, months later, since X isn't shared, feature Z of app Y doesn't work. But the user doesn't understand how this works (messaging in the app might make it better,…

You are arguing against bad design and lazy development, not against allowing users to control their data.

Re: Facebook Now Shares Phone Number & Address With Third-Party Apps

#59

Post by pyre »

ericd wrote: post #52
extension wrote: post #16

Earlier quoted context omitted.

While I agree that it would be good to give users a greater level of control, most apps are unfortunately not designed to play nicely with varying levels of permissions. Such a change would require significant advance notice to Platform developers. They can obviously live without contact info since they haven't had access to it until now. This is actually an interesting potential solution to the permission dialog pro…

This is kind of a strange viewpoint for a developer to hold (assuming you are one) - requiring permission by permission authentication would cause an exponential increase in the number of test cases that would need to be run. Of course existing apps can exist without this permission, it's a question of what new possibilities this opens up for app developers. I know it opens some up for me. I'm a bit baffled as to why…

You're basically arguing that the convenience of software developers trumps the privacy concerns / ease of use issues with the end-users. As a user, if I want to play Farmville, but I don't want Zygna to have access to my address and phone number I'm 'screwed' because it would be too difficult for Zygna to handle multiple levels of permissions? This would be akin to saying that 'forcing' all e-commerce sites to operate over SSL connections is a 'backwards and conservative move' that 'limits innovation' because developers now need to worry about SSL handshakes and purchasing certificates.

The fact is that Farmville doesn't need my phone number or address to allow me to play the game, so why should I (as a user) be presented with an all-or-nothing decision? Your answer seems to be that the reason the user is presented with an all-or-nothing decision is because it would be too difficult for a developer to write some more unit tests. Writing unit tests takes away from time building new features, therefore unit tests stifle innovation (though by this logic bugfixes also stifle innovation).

Implementing a permissions system and allowing your program to not need an 'exponential' amount of unit tests is easy+. Just treat everything like a file. Seriously. Treat every piece of data like a file with an ACL allowing certain groups/users to have read/write/no access to the file. It's that easy. Return a standard error when an app tries to perform an operation on a piece of user-data that it doesn't have permissions for. The apps/frameworks should be able to easily handle this.

You don't see desktop apps with billions of unit tests just to cover file access. You don't see webapps with billions of unit tests to cover database access (databases also have permission systems). Why would it be so hard for Facebook apps to do the same thing? Why would it require an exponential number of unit tests?

As a final note, keeping the barriers to entry low when it comes to (apparently not-so) private user-data is a bad thing. Just look at what the 'ease of use' of PHP's database access did for SQL injection attacks on the web. All developers needed to do was to use bind params, but many of them didn't even know what bind params were. Keeping the barriers low to getting access to users' private data will only result in disaster.

+ For various levels of easy.

Re: Facebook Now Shares Phone Number & Address With Third-Party Apps

#60

Post by rwwmike »

fuzzmeister wrote: post #13
ajg1977 wrote: post #7

Earlier quoted context omitted.

Not really. That implies Facebook are offering a way to push your phone number and data into third party apps. What they are infact doing is now allowing third-parties to request extra, and very very personal, information about you using the same dialog that people have effectively now been trained to basically click-through. I really think this dialog needs two things: 1) Something that highlights the fact you are a…

1) The fact that there is a second item below "Access my basic information" would seem to make that fact abundantly clear. I'm not sure how much more explicit it can get. 2) While I agree that it would be good to give users a greater level of control, most apps are unfortunately not designed to play nicely with varying levels of permissions. Such a change would require significant advance notice to Platform developer…

1) With many permission requests, there will be far more than just two items on the screen. Look at other dialog boxes for FB permission - just one or two options is not the norm, it's just the example...
Post reply on HN