Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spotify and Facebook: Is that phishing?

weluse.de

Post reply on HN
Print view View original

21–30 of 96 posts

Re: Spotify and Facebook: Is that phishing?

#21

Post by Superanos »

dkersten wrote: post #7
RexM wrote: post #3

It says "Facebook Email or Spotify Username" in the login box before typing in a username/email. As far as I know, spotify uses username for login, and not email. By using your email, it's assuming you want to use facebook.

And yet that in no way gives them the right to use that to log into your facebook (rather than using the API to authenticate) and install the spotify facebook app (giving themselves whatever permissions they like without asking the user). Of course, the lesson here (besides that spotify cannot be trusted) is that you should never use a password for more than one account. Sure makes me glad I switched to using a passw…

Facebook and Spotify are tightly partnered together - at one point they actually REQUIRED the use of Facebook to log in. The option to register without Facebook was only reintroduced recently.

Re: Spotify and Facebook: Is that phishing?

#22

Post by benmanns »

This is just Spotify not finding a user with username=[your email address] and looking for that user on Facebook.

I did a test by creating an account with the email benjamintesterton@mailinator.com (not linked to a Facebook account) and username benjamintesterton. When I tried logging in with the email, it failed, but with just the username worked.

If logging in with the email did work, it would mean that Spotify authenticated you with their server and then abused your credential re-use to hack your Facebook account. However, this appears not to be the case.

They should just check email=[input] OR username=[input], but that may be backwards-incompatible and break the functionality of people who use their Facebook credentials to login.

Re: Spotify and Facebook: Is that phishing?

#24

Post by Superanos »

benmanns wrote: post #22

This is just Spotify not finding a user with username=[your email address] and looking for that user on Facebook. I did a test by creating an account with the email benjamintesterton@mailinator.com (not linked to a Facebook account) and username benjamintesterton. When I tried logging in with the email, it failed, but with just the username worked. If logging in with the email did work, it would mean that Spotify aut…

That is correct. It says quite clearly "Facebook Email or Spotify Username". It's the user's mistake for using their Facebook account instead of the account they just created.

Re: Spotify and Facebook: Is that phishing?

#25

Post by jiggy2011 »

drue wrote: post #20

I wanted to try spotify a while back but got stuck when it required a FB account. Sounds like it's no longer required, but I suppose I still don't trust them enough to try their service.

You can signup with an email address , but the option is hidden quite low in the signup page.

Best way to avoid this sort of stuff is just to sign up to spotify with throwaway email.

I have found that it's worth buying a domain name and just tying it to a VPS with SMTP installed (or using a third part service that offers unlimited addresses). That way you can just generate throwaway email addresses as you need them.

Re: Spotify and Facebook: Is that phishing?

#26

Post by eli »

luser001 wrote: post #2

Amazing. Also, this is yet another privacy threat that I dodged because I use the PwdHash extension ( https://www.pwdhash.com/ ). You type the same password for all sites, but the extension invisibly uniquifies them on a per-site basis.

Doesn't seem like a good fit for the paranoid. If you screw up and your master password leaks, an attacker can access all of your accounts.

I greatly prefer KeePass + Dropbox, which also lets you securely store usernames and notes. And the passwords are random and not derived from anything.

Re: Spotify and Facebook: Is that phishing?

#27

Post by noonat »

The fact that the user was logged into Facebook after giving Facebook credentials to Spotify is not the problem. The login screen communicates that this will occur. Maybe it doesn't communicate it as well as it could, but it does communicate it.

The problem is that Spotify added itself to the user's list of apps and granted itself access to the user's data without any communication that this would occur. I guess you could say that permission for Spotify to do that is implicitly granted by giving them your Facebook credentials. But these days, federated authentication and authorization are two different things for end users -- especially so for Facebook apps. Spotify should at least prompt the user before making these changes on their behalf. Very underhanded behavior.

Re: Spotify and Facebook: Is that phishing?

#29

Post by seivan »

Superanos wrote: post #21
dkersten wrote: post #7

Earlier quoted context omitted.

And yet that in no way gives them the right to use that to log into your facebook (rather than using the API to authenticate) and install the spotify facebook app (giving themselves whatever permissions they like without asking the user). Of course, the lesson here (besides that spotify cannot be trusted) is that you should never use a password for more than one account. Sure makes me glad I switched to using a passw…

Facebook and Spotify are tightly partnered together - at one point they actually REQUIRED the use of Facebook to log in. The option to register without Facebook was only reintroduced recently.

Not true, I don't use Facebook and I was one of part of the Open Beta many years ago.

Re: Spotify and Facebook: Is that phishing?

#30

Post by RexM »

seivan wrote: post #29
Superanos wrote: post #21

Earlier quoted context omitted.

Facebook and Spotify are tightly partnered together - at one point they actually REQUIRED the use of Facebook to log in. The option to register without Facebook was only reintroduced recently.

Not true, I don't use Facebook and I was one of part of the Open Beta many years ago.

If you read the reply again, they allowed you to use a username, then required facebook, then reintroduced the ability to user a username. You probably were using a username, before they started requiring facebook.
Post reply on HN