Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was annoyed with sites asking for too many Facebook privileges and made this

github.com

Post reply on HN
Print view View original

101–110 of 146 posts

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#101

Post by dreamdu5t »

sshumaker wrote: post #29

I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.

You do realize that privacy and sharing are mutually exclusive right?

Facebook's utility is in sharing personal information.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#103

Post by jaylevitt »

sshumaker wrote: post #29

I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.

Facebook is rolling out a change that'll do this for all permission dialogs everywhere: http://www.insidefacebook.com/2011/10/14/app-authentication-...

As a Facebook Connect developer, I too hate the all-or-nothing approach, but there's no easy way to avoid it until this new flow becomes standard.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#104

Post by innoncent1 »

blhack wrote: post #24

Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…

Advertisers pay platform owners to have sex with user data. That does not sound nice, but it's an analogy that most people can understand.

The advertisers are the Johns (paying customers). The platform owners are the pimps. The users are the whores. Once you understand that, things become crystal clear. The more whores a platform owner has, the more they can charge the Johns to fuck the data. Pimps fight over whores and try to keep them from leaving. They fight over territory too.

What you want? White males between 24 and 28 in the 12345 zip code who like sports cars and are college graduates. We've got 18,000 of them. How much cash you got?

It's big business. Smart money is on the G pimp. They own more street corners.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#106

Post by uxp »

cheald wrote: post #74
bigiain wrote: post #70

Earlier quoted context omitted.

I see it as being very similar to something like noflash - if I choose to install and run noflash it "breaks" some websites. Sometimes that's exactly what I wanted it to do - sometimes it's collateral damage, and when/if I notice it I can go in and whitelist something I broke to make it work again. Unless you're worried that somehow this extension will get sneaky-loaded without the user understanding what it does, I…

Flashblock is a great example of the problem. Google Music wouldn't work on my wife's computer, causing a lot of frustration for her, until I noticed the flashblock icon. Google was using a hidden div with a flash player to play the music. When Flashblock shows a big placeholder rather than the Youtube video, you know what's happening. It's not always obvious, though, and it takes someone who knows that Flash players…

I agree with your point. Even I took a few seconds longer wondering why Google Music didn't run on my version of Chrome until I correctly guessed that there was a hidden flash player somewhere I couldn't see, and I'm a developer myself.

But, I do think the other side of the argument still stands. If someone decides to use a 25 pound sledge hammer to frame a house, that person shouldn't get mad when on occasion his tools end up causing more frustration than the project he's working on. Whitelisting tools like Flashblock/Clicktoflash or NoScript are sledge hammers to the web. When it's just a few things littered here and there on a site that is widely non-flash based, it's not a problem to take everything out at once. Fine tuning at that point requires a bit more care and a lot more effort, but it's hardly the fault of the plugin developer when it doesn't work in every case. Toggle it on off and see if it works, and move on.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#107

Post by sneak »

bigiain wrote: post #73
phillmv wrote: post #61

Earlier quoted context omitted.

I signed up for airbnb using my facebook account and I noticed that they give away your DOB. I immediately changed my DOB on facebook and vowed to avoid authenticating with apps. I generally avoid putting in real information on facebook but the amount of stuff they give away is frightening. It's a heaven for social engineering and spear phishing.

"I immediately changed my DOB on facebook" Hmmm, I wonder what Facebook does when someone changes something like their DOB? Or name/address/email/phone? Or any other marketing-useful data in your profile? If _I_ were part of the Facebook Evil-Data-Mining Division, I'd certainly be looking to see if I can discern patterns like "This phillmv guy's _real_ birthday is 12/03/1975, but when he changes it for sites he doesn…

Terrifying, as 1st April 1980 is exactly my DOB for this purpose. April fools unite!

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#108

Post by bigiain »

innoncent1 wrote: post #104
blhack wrote: post #24

Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…

Advertisers pay platform owners to have sex with user data. That does not sound nice, but it's an analogy that most people can understand. The advertisers are the Johns (paying customers). The platform owners are the pimps. The users are the whores. Once you understand that, things become crystal clear. The more whores a platform owner has, the more they can charge the Johns to fuck the data. Pimps fight over whores…

Crass, but oh-so-on-the-money...

(I might have to A/B test this against my usual "if you're not paying for it, you're not the customer, you're the product" version...)

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#109

Post by saurik »

phillmv wrote: post #61
blhack wrote: post #24

Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…

I signed up for airbnb using my facebook account and I noticed that they give away your DOB. I immediately changed my DOB on facebook and vowed to avoid authenticating with apps. I generally avoid putting in real information on facebook but the amount of stuff they give away is frightening. It's a heaven for social engineering and spear phishing.

Applications must ask you for the user_birthday permission to have access to this field.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#110

Post by saurik »

blhack wrote: post #24

Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…

Facebook is not trying to be a "general authentication provider": they are trying to be a "social application enabler". If you have no interest in making a social application, which to Facebook means you fundamentally at bare minimum are going to need their friends list (or they, and I, would question what you even mean by "social"), then you should not use Facebook's authentication mechanism.

Really, it comes down to this statement you made: "this is one of the appealing parts of facebook auth, imho" "This is with the most basic authentication mechanism that facebook offers." It also is not Facebook's fault if "most apps ask for" a permission you do not want to grant. In fact, it is the fault of the other users on the service who don't care about granting that permission: instead of complaining to Facebook, you should complain to the developers, and honestly instead of complaining to the developers, you should spend your time educating the public on "least priviledge".

To instead claim that is Facebook's fault is an exactly analogous argument to claiming that all computing platforms should be closed, as it is then also Google's fault if a lot of developers ask for permission to run native code on their Android devices, instead of just using Java (which is at least memory safe): better to just avoid the whole mess and remove the functionality, right?

Post reply on HN