Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If you care about user privacy, don’t use Facebook JavaScript SDK

simplelogin.io

Post reply on HN
Print view View original

51–60 of 105 posts

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#51

Post by nguyenkims »

Article author and SimpleLogin creator here. Surprised and happy that my small rant at Facebook got so much attention from HN!

I wanted to give a bit of context on this article, the story is a bit long though and there was no TLDR.

Here it goes: I wanted to protect my online privacy and having worked in advertising before, I know that user email, in addition to the cookie, is usually the common denominator to cross-reference user data. I tried, therefore, to generate a random email whenever I signed up on a new website via temporary email services like temp-mail but there are 3 issues: a. I can't remember which email I used. This problem is alleviated with password manager though. b. No way to reset password later as the email is already expired. This is also not fair if the website happens to be a good (aka not spammy) one and just want to contact me. c. The flow is unbearable: I need to go to temp-mail, generate a random email, go back to the website, check temp-mail for the activation email, etc.

I dreamt to have a universal login button, like the "Login with Facebook/Google" one but without all the tracking and that can generate a random email at runtime. So SimpleLogin was born.

When creating SimpleLogin SDK, I tried to reverse-engineer popular SDKs like Facebook and Google to learn from them and discovered their not-very-ethical approaches. I haven't found any article talking about these practices so I decided to write one up.

Voilà.

I want to be as transparent as possible about the technology I'm using so if anyone has any questions, please feel free!

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#52

Post by falcolas »

diminoten wrote: post #35

Who cares what I care about, the real question is what do my users care about. It all depends on what users will tolerate in the name of convenience.

As pointed out in the article, not using the SDK does not preclude authenticating with a Facebook account. It just requires a bit more work on your end to protect your non-Facebook users.

So it does come down to what you care about.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#53

Post by topologistics »

diminoten wrote: post #38
valona wrote: post #7

Why would any developer or engineer who has even an iota of consideration for privacy, web standards, and, indeed, humanity want to work for such a repugnant company as Facebook?

Features, userbase, talent; the same reasons a developer or engineer would work with any company. Let's play a game; how many degrees separated from Facebook is HN and YC? You go first, take a guess!

I can't be certain how many degrees separated the two are, but I have established a lower bound on the answer

Let d:(x,y)->n be the degrees of separation between x and y. Since d(x,y)=0 implies x=y, and we know that FB and HN are not identical, we have d(FB,HN)>0.

Then, since d takes integral values we know that d(FB,HN)>=1 in any case.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#54

Post by decasteve »

diminoten wrote: post #40
Jamwinner wrote: post #36

Earlier quoted context omitted.

If you think deferring ethics to the customer clears your conscience, you need some self examination.

Ethics? The problem is practical; do your users want the features or do they care about privacy? Let them make the choice, and don't hide it from them. That's the ethical behavior. It's unethical to assume everyone values everything the same, including privacy. Some people don't care about it as much as you do, nor should they.

Given a hospital patient who doesn’t value taking care of their health, should it be ok to administer X-rays without concern for radiation exposure? If the patient doesn’t care, is it ok then?

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#55

Post by scarface74 »

r_singh wrote: post #20
mac_was wrote: post #17

Earlier quoted context omitted.

I don't think that storing creds is suitable for newbies either. All authentication is complex and just using HTTPOnly and DB backend is not a solution at all.

Depends on what the project is and also doesn't change the fact that this doesn't happen. Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them. When they do become somewhat popular though (very small minority of course), I suspect most founders bring experts on board, as they absolutely should. > just using HTTPOnly and DB backend is not a solution at all M…

You don’t bring “experts” on board. Most of them really aren’t. At most, you find a third party trusted managed service.

I work in mostly the B2B space where we integrate with their Identity Providers (active directory, Okta, etc) and strongly discourage them from using our internal authentication system so they have to take responsibility for their own security.

If I were working in the consumer space, I would personally use AWS’s Cognito since that’s what I’m familiar with and it integrates with everything - Google, Facebook, Twitter, Apple, Amazon etc.

I’m sure there are other services that serve similar functions.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#56

Post by ramigb »

z92 wrote: post #2

That brings up the question : does Facebook get any less information because you used a 3rd party OAuth library to authenticate from FB, instead of using FB's own SDK which injects an iframe?

Less information? maybe! but still they will know what website/app you logged in to.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#57

Post by reroute1 »

valona wrote: post #7

Why would any developer or engineer who has even an iota of consideration for privacy, web standards, and, indeed, humanity want to work for such a repugnant company as Facebook?

Repugnant is entirely your opinion and there are lots of people who disagree with you. It might be an amazing opportunity for some.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#58

Post by reroute1 »

Jamwinner wrote: post #41
xrisk wrote: post #11

Earlier quoted context omitted.

Because a lot of people aren't privileged enough to be able to quit their job on the spot.

Pretty sure working for facebook is proof or that you are in the upper 1% worldwide.

Except for all those moderation jobs, and everyday office jobs, oh wait are they just people too and not "1%ers" ???
Post reply on HN