Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If you care about user privacy, don’t use Facebook JavaScript SDK

simplelogin.io

Post reply on HN
Print view View original

81–90 of 105 posts

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#81

Post by diminoten »

topologistics wrote: post #53
diminoten wrote: post #38

Earlier quoted context omitted.

Features, userbase, talent; the same reasons a developer or engineer would work with any company. Let's play a game; how many degrees separated from Facebook is HN and YC? You go first, take a guess!

I can't be certain how many degrees separated the two are, but I have established a lower bound on the answer Let d:(x,y)->n be the degrees of separation between x and y. Since d(x,y)=0 implies x=y, and we know that FB and HN are not identical, we have d(FB,HN)>0. Then, since d takes integral values we know that d(FB,HN)>=1 in any case.

"They are not the same company" is, while true, not a guess. Come on, take a real guess! When was the last time Zuck spoke at YC? When was the last time YC worked with Facebook? How many of the folks at YC either come directly from Facebook or have invested in Facebook at one time?

Your hands aren't clean here, if you actually cared about avoiding Facebook at all costs, you wouldn't be here. The fact is, you don't (nor should you).

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#82

Post by falcolas »

diminoten wrote: post #80
falcolas wrote: post #52

Earlier quoted context omitted.

As pointed out in the article, not using the SDK does not preclude authenticating with a Facebook account. It just requires a bit more work on your end to protect your non-Facebook users. So it does come down to what you care about.

"Don't use" and "only use for people who actively opt-in" are two separate things, so no it doesn't come down to what you care about. I'm saying give people choice, let them figure out what they care about. Making the choice for them is bad business and bad ethics. You don't know better than your users.

Non-Facebook users are unable to opt out of Facebook tracking if you use the Facebook sdk. That’s the point of using the oauth standard, it allows those users a choice not available with the sdk.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#83

Post by netsharc »

cremp wrote: post #50
MobileVet wrote: post #19

> If you care about user privacy, don’t use Facebook. Fixed that for you...

Except for the shadow profiles that they make of the 'non-users.' Whether you like it or not, Facebook et al are tracking you regardless if you have an account.

This is why Firefox' container for FB is a good idea.

Zuck even got asked about shadow profiles in his senate/congress hearing and he meekly weaseled out of answering by saying "I'll get my team to get back to you on that.". Translation: "I know the answer but telling you will destroy what's left of my reputation, and if I lie to you I risk perjuring myself and jail time.".

He also rattled something along the lines of "there's this thing called cookies", and the peanut gallery on Twitter misunderstood that deflection as him explaining to old senators what cookies are...

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#84

Post by diminoten »

falcolas wrote: post #82
diminoten wrote: post #80

Earlier quoted context omitted.

"Don't use" and "only use for people who actively opt-in" are two separate things, so no it doesn't come down to what you care about. I'm saying give people choice, let them figure out what they care about. Making the choice for them is bad business and bad ethics. You don't know better than your users.

Non-Facebook users are unable to opt out of Facebook tracking if you use the Facebook sdk. That’s the point of using the oauth standard, it allows those users a choice not available with the sdk.

You can choose to load the SDK or not, e.g. only when the "Log In With Facebook" button is pushed.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#85

Post by dylan604 »

K0SM0S wrote: post #77
dylan604 wrote: post #26

Earlier quoted context omitted.

I was going to say the same thing, only in the form of "Duh". Also in the news today, the sky is blue, grass is green, and fire is hot. How in 2019 would any developer believe that any social platform cares about privacy is beyond me. If a social platform is offering anything (the platform itself, SDKs, APIs, etc) for free, then they are going to make money from you some other way. What ever they are offering cost th…

Indeed obvious to some but necessary to hammer until everyone gets it — especially the business types who make decisions, as new devs themselves would quickly grow to learn this. > What ever they are offering cost them money to develop, but they did not do that as a charity. True! Yet... I keep thinking about `http` (the protocol), or Apache, IRC, and countless other software techs that were just 'given' to (and are…

> True! Yet... I keep thinking about `http` (the protocol), or Apache, IRC, and countless other software techs that were just 'given' to (and are maintained by) the world, courtesy of their makers, and/or bodies like IETF work groups, etc.

The difference here is that the social platforms have been developed as a for profit company. Granted, FB has improved some of their underlying technologies, and released them back to the public in the way open source is meant. I do give them credit for that. However, the SDKs and APIs etc are direct work made by the platform. These tools are made specifically for interacting with that platform. They have every right to monetize that work. While some of us (at least I do) believe their method of making that money is super shady/unethical/etc, it is their business model. Other companies like Apache, Redhat, etc also offer us free things to use/play with while monetizing their enterprise/support services. A much more ethical method in my opinion.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#87

Post by JohnFen »

iudqnolq wrote: post #69
StreamBright wrote: post #32

Earlier quoted context omitted.

I explicitly told everybody that I turned off messenger notifications on every device and uninstalled facebook from my devices years ago. If they want to reach me they can use Signal, Telegram or Keybase. Interestingly enough even my mother (in her 70s, no idea about computers) can use Telegram without a hickup. I guess it is a matter of dedication to push your peers off from Facebook.

WhatsApp is almost certainly safer and more privacy respecting than Telegram. Telegram uses highly nonstandard cryptography (the founder hired a bunch of math competition winners and told them to design encryption from first principles ), doesn't have E2E by default (unlike Whatsapp), and is owned by a quite sketchy Russian oligarch who started spending on democracy-related causes after a falling out with Putin. Tele…

> WhatsApp is almost certainly safer and more privacy respecting than Telegram.

I doubt this because WhatsApp is Facebook.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#88

Post by falcolas »

diminoten wrote: post #84
falcolas wrote: post #82

Earlier quoted context omitted.

Non-Facebook users are unable to opt out of Facebook tracking if you use the Facebook sdk. That’s the point of using the oauth standard, it allows those users a choice not available with the sdk.

You can choose to load the SDK or not, e.g. only when the "Log In With Facebook" button is pushed.

A little bit of research indicates that this is still a non-trivial amount of work from the developer; that the developer has to make the choice to protect the privacy of their non-Facebook users by dynamically loading the Facebook SDK.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#89

Post by oaiey »

some_random wrote: post #45
r_singh wrote: post #20

Earlier quoted context omitted.

Depends on what the project is and also doesn't change the fact that this doesn't happen. Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them. When they do become somewhat popular though (very small minority of course), I suspect most founders bring experts on board, as they absolutely should. > just using HTTPOnly and DB backend is not a solution at all M…

>Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them. Strong contender for Most Horrifying Thing I've Read This Morning.

Exactly. Like if user privacy does not matter but just cold cash. Thanks to statements like this there is GDPR.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#90

Post by judge2020 »

allovernow wrote: post #86

Tangentially related: is there any reason to be suspicious of/careful with react/redux? We've been using it internally for front end stuff, would be nice to know if there's any weird default tracking going on, however unlikely...

There's no issue with using those. Facebook tracking end-users via libraries would be extremely detrimental.
Post reply on HN