Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If you care about user privacy, don’t use Facebook JavaScript SDK

simplelogin.io

Post reply on HN
Print view View original

61–70 of 105 posts

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#61

Post by mandelbrotwurst »

some_random wrote: post #45
r_singh wrote: post #20

Earlier quoted context omitted.

Depends on what the project is and also doesn't change the fact that this doesn't happen. Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them. When they do become somewhat popular though (very small minority of course), I suspect most founders bring experts on board, as they absolutely should. > just using HTTPOnly and DB backend is not a solution at all M…

>Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them. Strong contender for Most Horrifying Thing I've Read This Morning.

It's good practice to consider the likelihood of attack in your threat model if you care about the expected payoff associated with your security efforts.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#62

Post by r_singh »

scarface74 wrote: post #55
r_singh wrote: post #20

Earlier quoted context omitted.

Depends on what the project is and also doesn't change the fact that this doesn't happen. Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them. When they do become somewhat popular though (very small minority of course), I suspect most founders bring experts on board, as they absolutely should. > just using HTTPOnly and DB backend is not a solution at all M…

You don’t bring “experts” on board. Most of them really aren’t. At most, you find a third party trusted managed service. I work in mostly the B2B space where we integrate with their Identity Providers (active directory, Okta, etc) and strongly discourage them from using our internal authentication system so they have to take responsibility for their own security. If I were working in the consumer space, I would perso…

Hey, I meant to reply on your other comment asking for third party trusted services.

Thanks for listing some, will look into them!

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#63

Post by Zelphyr »

xrisk wrote: post #11
valona wrote: post #7

Why would any developer or engineer who has even an iota of consideration for privacy, web standards, and, indeed, humanity want to work for such a repugnant company as Facebook?

Because a lot of people aren't privileged enough to be able to quit their job on the spot.

OP never said anything about quitting on the spot. The question was why would one go to work for such a company knowing, as one must these days, how vile that company is. Another facet to the question is why wouldn’t one look for and take another job after they realize how disgusting a company like Facebook is?

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#64

Post by Karunamon »

mandelbrotwurst wrote: post #61
some_random wrote: post #45

Earlier quoted context omitted.

>Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them. Strong contender for Most Horrifying Thing I've Read This Morning.

It's good practice to consider the likelihood of attack in your threat model if you care about the expected payoff associated with your security efforts.

When that threat model necessarily includes bored script kiddies and automated APTs?

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#65

Post by Zelphyr »

reroute1 wrote: post #57
valona wrote: post #7

Why would any developer or engineer who has even an iota of consideration for privacy, web standards, and, indeed, humanity want to work for such a repugnant company as Facebook?

Repugnant is entirely your opinion and there are lots of people who disagree with you. It might be an amazing opportunity for some.

I think willingly abusing user privacy for profit and lying to your government makes using the word “repugnant” pretty quantifiable.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#66

Post by Zelphyr »

diminoten wrote: post #35

Who cares what I care about, the real question is what do my users care about. It all depends on what users will tolerate in the name of convenience.

They’ll tolerate a lot if you’re providing enough value. They’ll even tolerate giving you their money if that value is high enough so why wouldn’t they tolerate having to not use a social login?

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#67

Post by reroute1 »

Zelphyr wrote: post #65
reroute1 wrote: post #57

Earlier quoted context omitted.

Repugnant is entirely your opinion and there are lots of people who disagree with you. It might be an amazing opportunity for some.

I think willingly abusing user privacy for profit and lying to your government makes using the word “repugnant” pretty quantifiable.

How are they abusing privacy? Because it doesn't align with your views of privacy that constitutes abuse? You may have an expectation of privacy and we can argue whether or not that is valid. (not really IMO, facebook doesn't owe you anything for using their service. What a private company does with their service is really not abuse)

Lying to the govt. is pretty vague. What lie in particular are you referring to?

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#69

Post by iudqnolq »

StreamBright wrote: post #32
mikro2nd wrote: post #18

Earlier quoted context omitted.

No. Really. You do have a choice. Exercising unpopular choices frequently requires a spine.

I explicitly told everybody that I turned off messenger notifications on every device and uninstalled facebook from my devices years ago. If they want to reach me they can use Signal, Telegram or Keybase. Interestingly enough even my mother (in her 70s, no idea about computers) can use Telegram without a hickup. I guess it is a matter of dedication to push your peers off from Facebook.

WhatsApp is almost certainly safer and more privacy respecting than Telegram.

Telegram uses highly nonstandard cryptography (the founder hired a bunch of math competition winners and told them to design encryption from first principles), doesn't have E2E by default (unlike Whatsapp), and is owned by a quite sketchy Russian oligarch who started spending on democracy-related causes after a falling out with Putin.

Telegram uses dubious encryption and lies about their business (for ex calling themselves a nonprofit when they aren't), and they retroactively retracted and then narrowed their bug bounty program.

WhatsApp hired the company behind Signal to help them implement Signal's encryption protocol.[1] While it's not as good as Signal because it's not open source and thus can't be independently verified, if Facebook deliberately lied about the security of a product used by governments around the world they would face serious consequences.[2]

See for example previous discussion [3].

For a detailed analysis of the flaws in their protocol, see [4]

1: https://techcrunch.com/2014/11/18/end-to-end-for-everyone/

2: https://www.nytimes.com/2019/10/26/world/asia/afghanistan-wh...

3: https://news.ycombinator.com/item?id=15281788

4: https://www.cryptofails.com/post/70546720222/telegrams-crypt...

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#70

Post by ilikehurdles »

r_singh wrote: post #62
scarface74 wrote: post #55

Earlier quoted context omitted.

You don’t bring “experts” on board. Most of them really aren’t. At most, you find a third party trusted managed service. I work in mostly the B2B space where we integrate with their Identity Providers (active directory, Okta, etc) and strongly discourage them from using our internal authentication system so they have to take responsibility for their own security. If I were working in the consumer space, I would perso…

Hey, I meant to reply on your other comment asking for third party trusted services. Thanks for listing some, will look into them!

Auth0 is another.
Post reply on HN