Live data from Hacker News

Spotify and Facebook: Is that phishing?

weluse.de

31–40 of 96 posts

Re: Spotify and Facebook: Is that phishing?

#31
post #29

Earlier quoted context omitted.

Facebook and Spotify are tightly partnered together - at one point they actually REQUIRED the use of Facebook to log in. The option to register without Facebook was only reintroduced recently.

Not true, I don't use Facebook and I was one of part of the Open Beta many years ago.

In the US, when spotify first opened up to Americans you could sign up without facebook credentials. About a month later, they decided to go facebook only for new setups.

Re: Spotify and Facebook: Is that phishing?

#32
post #18

This is pretty shameless, even for Facebook.

Except it's Spotify doing it, not Facebook...

Unless Spotify has some backdoor API with Facebook, it seems like a major oversight in the Facebook API that an (any?) app can re-register a deactivated account and give itself whatever permissions it wants.

Just because Spotify accidentally (or purposefully) took advantage of that hole doesn't mean it's not Facebook at fault here.

Re: Spotify and Facebook: Is that phishing?

#33
post #29

Earlier quoted context omitted.

Facebook and Spotify are tightly partnered together - at one point they actually REQUIRED the use of Facebook to log in. The option to register without Facebook was only reintroduced recently.

Not true, I don't use Facebook and I was one of part of the Open Beta many years ago.

Spotify started requiring a Facebook login from all new users on 22nd September 2011. On 6th December 2012 they put the non-FB signup option back. You signed up before they required FB so you never saw the requirement.

Re: Spotify and Facebook: Is that phishing?

#34
I remember once when I was automatically logged in to my roommate's Spotify account on my computer just because we were on the same WiFi network (?). She had never used my computer, let alone logged in to her Spotify account on it.

I'm still not sure how or why it happened.

Re: Spotify and Facebook: Is that phishing?

#35
It is, or at least was, possible to delete your facebook account. Not just deactivate it.

http://www.facebook.com/help/224562897555674?_fb_noscript=1

That's in Swedish for me but I assume it's localized. It says that there are two options, one is deactivation, and if you don't believe you'll need your account again, the other is deletion.

Re: Spotify and Facebook: Is that phishing?

#36
So happy that I use 1password to generate random passwords for every single service I use. This wouldn't be possible if everyone was more aware of security - still, I find the way facebook treats its users increasingly disturbing and seriously consider to leave it.

Re: Spotify and Facebook: Is that phishing?

#38

It says quite clearly: "Log in with Facebook or Spotify". That means you can log in using a Facebook account or a Spotify account. The username field says "Facebook Email or Spotify Username". So when you type an email, you log in using a Facebook account. It's not that hard to understand. By the way, that account you made on the sign up page is still unused: you logged in using a Facebook account, which is a differe…

I disagree that it's clear. A placeholder in a field is no substitute for an actual label. It should be an enhancement, not a replacement. With the number of places using e-mail addresses as usernames, it's a natural mistake.

Re: Spotify and Facebook: Is that phishing?

#39
post #20

I wanted to try spotify a while back but got stuck when it required a FB account. Sounds like it's no longer required, but I suppose I still don't trust them enough to try their service.

You can signup with an email address , but the option is hidden quite low in the signup page. Best way to avoid this sort of stuff is just to sign up to spotify with throwaway email. I have found that it's worth buying a domain name and just tying it to a VPS with SMTP installed (or using a third part service that offers unlimited addresses). That way you can just generate throwaway email addresses as you need them.

You can also use Mailinator[0] and their many other domains for throwaway email addresses. In fact, you can point your MX records to mail.mailinator.com for a custom domain without running a VPS.[1]

[0] http://www.mailinator.com/ [1] http://mailinator.blogspot.com/2008/01/your-own-private-mail...

Re: Spotify and Facebook: Is that phishing?

#40

This is just Spotify not finding a user with username=[your email address] and looking for that user on Facebook. I did a test by creating an account with the email benjamintesterton@mailinator.com (not linked to a Facebook account) and username benjamintesterton. When I tried logging in with the email, it failed, but with just the username worked. If logging in with the email did work, it would mean that Spotify aut…

That is correct. It says quite clearly "Facebook Email or Spotify Username". It's the user's mistake for using their Facebook account instead of the account they just created.

Yes, true, but I thought it would be a lot more damning if they also authenticated via Spotify email, because that would mean that they accessed the Facebook account while already having authenticated the user via Spotify credentials.
Post reply on HN