If you care about user privacy, don’t use Facebook JavaScript SDK • Hacker News Board

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#71

Post by Bartweiss » Mon, Nov 25, 2019, 4:21 PM UTC

mac_was wrote: post #17

r_singh wrote: post #4

Original article from Dev.to: https://dev.to/simplelogin/if-you-care-about-user-privacy-do... I've recently implemented authentication for my project and I would just like to say to all the relatively amateur programmers out there: for web based authentication just stick with HTTPOnly SECURE cookies with DB backed sessions that you can revoke. The reason I'm saying this is that there's way too many posts talking abou…

I don't think that storing creds is suitable for newbies either. All authentication is complex and just using HTTPOnly and DB backend is not a solution at all.

I'm generally allergic to "let the Big 5 run your services", but I have to admit that "sign in with Google" looks like a major improvement on "hand PII to whoever tried to home-roll auth".

With a password manager and careful shepherding of your PII, maybe there's not much risk; if someone takes over the site your account is compromised either way, and nothing else is lost. But most people don't actually use password managers, and lots of sites that accept Google sign-in require lots more data to actually create an account on the site. (Plus, losing password stores is not necessarily the same as losing all control.) Newbies storing creds is a perennial source of leaked credentials that get used to attack more important sites.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#72

Post by xrisk » Mon, Nov 25, 2019, 4:27 PM UTC

Zelphyr wrote: post #63

xrisk wrote: post #11

Earlier quoted context omitted.

Because a lot of people aren't privileged enough to be able to quit their job on the spot.

OP never said anything about quitting on the spot. The question was why would one go to work for such a company knowing, as one must these days, how vile that company is. Another facet to the question is why wouldn’t one look for and take another job after they realize how disgusting a company like Facebook is?

Probably makes them more money I gues.

I wouldn't personally – I'm about as anti-Facebook as it gets, but a lot of people (especially people not coming from a "tech" background) don't really appreciate the kind of shit Facebook pulls.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#73

Post by iudqnolq » Mon, Nov 25, 2019, 4:28 PM UTC

taneq wrote: post #33

StreamBright wrote: post #32

Earlier quoted context omitted.

I explicitly told everybody that I turned off messenger notifications on every device and uninstalled facebook from my devices years ago. If they want to reach me they can use Signal, Telegram or Keybase. Interestingly enough even my mother (in her 70s, no idea about computers) can use Telegram without a hickup. I guess it is a matter of dedication to push your peers off from Facebook.

> If they want to reach me they can use Signal, Telegram or Keybase. Maybe even... gasp SMS. Or "telephone".

SMS can be intercepted and read by essentially every country in the world and many criminal groups because of how flawed the protocol is. While smaller countries can't do mass ingress and automated analysis, they can still input your number into a system and then see what you text.

https://www.theguardian.com/technology/2016/apr/19/ss7-hack-...

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#74

Post by raxxorrax » Mon, Nov 25, 2019, 4:29 PM UTC

reroute1 wrote: post #67

Zelphyr wrote: post #65

Earlier quoted context omitted.

I think willingly abusing user privacy for profit and lying to your government makes using the word “repugnant” pretty quantifiable.

How are they abusing privacy? Because it doesn't align with your views of privacy that constitutes abuse? You may have an expectation of privacy and we can argue whether or not that is valid. (not really IMO, facebook doesn't owe you anything for using their service. What a private company does with their service is really not abuse) Lying to the govt. is pretty vague. What lie in particular are you referring to?

I think the original statement included this detail:

> engineer who has even an iota of consideration for privacy

I think it isn't hard to say current practices in tech willfully deceive users about the usage and the value of their data because that would be orthogonal to their business interest.

I think framing it like that is vastly more honest. Not down-playing expectations of privacy.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#75

Post by reroute1 » Mon, Nov 25, 2019, 4:41 PM UTC

raxxorrax wrote: post #74

reroute1 wrote: post #67

Earlier quoted context omitted.

How are they abusing privacy? Because it doesn't align with your views of privacy that constitutes abuse? You may have an expectation of privacy and we can argue whether or not that is valid. (not really IMO, facebook doesn't owe you anything for using their service. What a private company does with their service is really not abuse) Lying to the govt. is pretty vague. What lie in particular are you referring to?

I think the original statement included this detail: > engineer who has even an iota of consideration for privacy I think it isn't hard to say current practices in tech willfully deceive users about the usage and the value of their data because that would be orthogonal to their business interest. I think framing it like that is vastly more honest. Not down-playing expectations of privacy.

OK, but by this definition of "willful deception" all social media companies and related engineering jobs can be lumped into a "repugnant" category?

I think that is reductive of engineers opinions for one, and over-stating the behavior of these companies. How are people being deceived? Are they being lied to in the privacy agreements? That would be obviously deceptive and I can agree they should be transparent, but it's very public that data is part of the revenue generation for these places nowadays.

I think if people just expect to have a free service and give nothing up in return that isnt really a reasonable expectation anymore, so I don't find it deceptive or repugnant. Maybe there is an alternative where social media platforms don't rely on personal data and advertisements and I'd be all for that, but it doesn't exist now.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#76

Post by wool_gather » Mon, Nov 25, 2019, 4:42 PM UTC

emmaglossy wrote: post #12

r_singh wrote: post #4

Original article from Dev.to: https://dev.to/simplelogin/if-you-care-about-user-privacy-do... I've recently implemented authentication for my project and I would just like to say to all the relatively amateur programmers out there: for web based authentication just stick with HTTPOnly SECURE cookies with DB backed sessions that you can revoke. The reason I'm saying this is that there's way too many posts talking abou…

I think even when integrating a social login, a developer still needs to create a secure cookie and has "user" table in his/her database. Using social login is rather a convenient option for users as they don't have to create a new account.

Sure, but the stored credential is not reusable in another context. Which is not true for the majority of passwords. As a bonus, the authorization is probably also revocable via the external identity provider, although that's more about service-to-service permissions than account compromise.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#77

Post by K0SM0S » Mon, Nov 25, 2019, 4:54 PM UTC

dylan604 wrote: post #26

MobileVet wrote: post #19

> If you care about user privacy, don’t use Facebook. Fixed that for you...

I was going to say the same thing, only in the form of "Duh". Also in the news today, the sky is blue, grass is green, and fire is hot. How in 2019 would any developer believe that any social platform cares about privacy is beyond me. If a social platform is offering anything (the platform itself, SDKs, APIs, etc) for free, then they are going to make money from you some other way. What ever they are offering cost th…

Indeed obvious to some but necessary to hammer until everyone gets it — especially the business types who make decisions, as new devs themselves would quickly grow to learn this.

> What ever they are offering cost them money to develop, but they did not do that as a charity.

True! Yet... I keep thinking about `http` (the protocol), or Apache, IRC, and countless other software techs that were just 'given' to (and are maintained by) the world, courtesy of their makers, and/or bodies like IETF work groups, etc.

Case in point: "social" is basic at an elementary level (it's just CRUD, over-the-network), but at scale becomes insanely costly. The limitation/exclusivity factor thus doesn't seem to be software magic but rather infrastructure, piles of money, before sustainability or profitability come into play. This is what the monopolies stem from, only compounded by some Meltcafe/"network" effect (friction to switch, passive positive peer pressure inwards, passive negative outwards).

So in thinking of an alternative future path for social tools (SDK) and meta-tools (platforms, interop, work groups, etc), I think it's worth considering the infrastructure problem first. My money is on distributed and (partially but 'enough') decentralized systems (think bittorrent, tor, even DNS fundamentally), but regardless it belongs to the wider category of mutualization of resources (cloud vs on-prems debate, E2E crypt, etc). The solution must be preferable in terms of cost otherwise it's just not gonna happen.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#78

Post by diminoten » Mon, Nov 25, 2019, 5:22 PM UTC

SketchySeaBeast wrote: post #48

diminoten wrote: post #43

Earlier quoted context omitted.

There's no ethical argument for depriving someone of food but people fast all the time. Further, the war crimes my gym trainer is guilty of know no bounds! You can give up your "human rights" for convenience/pleasure as long as you can reassert them down the line.

Fasting and training are both conscious deliberate choices - how will you frame the loss of privacy in such a manner that it can be agreed to with the same degree of intention? Most people have no idea and don't understand - if you wanna go with the "opt in" solution, you're going to have to make a compelling argument that the people making the decisions are educated enough to make them.

The same way a trainer or doctor frames the health risks involved; you explain it and hope people are listening.

Signing in via Facebook is also a deliberate choice.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#79

Post by diminoten » Mon, Nov 25, 2019, 5:22 PM UTC

decasteve wrote: post #54

diminoten wrote: post #40

Earlier quoted context omitted.

Ethics? The problem is practical; do your users want the features or do they care about privacy? Let them make the choice, and don't hide it from them. That's the ethical behavior. It's unethical to assume everyone values everything the same, including privacy. Some people don't care about it as much as you do, nor should they.

Given a hospital patient who doesn’t value taking care of their health, should it be ok to administer X-rays without concern for radiation exposure? If the patient doesn’t care, is it ok then?

Given a person who doesn't like their nose, should it be okay to provide cosmetic surgery to that person, despite the risks any surgery comes with? If the patient doesn't care, is it ok then?

Given a person who wants to jump out of a plane, should it be okay to let them, even though it's a relatively high-risk activity? If the jumper doesn't care, is it ok then?

Given a person who wants to run for national public office, should it be okay for them to release their prior year tax returns, even though it's an exposure of their privacy? If the candidate doesn't care, is it ok then?

Turns out, this isn't an easy game to play, so stop trying to decide for others what they want for themselves. You don't know their situation.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#80

Post by diminoten » Mon, Nov 25, 2019, 5:22 PM UTC

falcolas wrote: post #52

diminoten wrote: post #35

Who cares what I care about, the real question is what do my users care about. It all depends on what users will tolerate in the name of convenience.

As pointed out in the article, not using the SDK does not preclude authenticating with a Facebook account. It just requires a bit more work on your end to protect your non-Facebook users. So it does come down to what you care about.

"Don't use" and "only use for people who actively opt-in" are two separate things, so no it doesn't come down to what you care about.

I'm saying give people choice, let them figure out what they care about. Making the choice for them is bad business and bad ethics. You don't know better than your users.