Spotify and Facebook: Is that phishing? • Hacker News Board

Re: Spotify and Facebook: Is that phishing?

#61

Post by ehamberg » Fri, Feb 22, 2013, 10:42 PM UTC

jiggy2011 wrote: post #42

benmanns wrote: post #39

Earlier quoted context omitted.

You can also use Mailinator[0] and their many other domains for throwaway email addresses. In fact, you can point your MX records to mail.mailinator.com for a custom domain without running a VPS.[1] [0] http://www.mailinator.com/ [1] http://mailinator.blogspot.com/2008/01/your-own-private-mail...

True, but those services are quite limited and not that secure in that anybody who knows the email address can login to your account.

Not necessarily. They also give you a “gibberish” address to the account. So if I use “foobar” as my mailbox on mailinator, they will list an address like M8R-wk43th@mailinator too, that does not let people log in.

Re: Spotify and Facebook: Is that phishing?

#62

Post by drivebyacct2 » Fri, Feb 22, 2013, 10:43 PM UTC

Use separate passwords. This is Spotify's screwup as much as Facebook's. I noticed the same thing (because I use separate passwords) and was able to avoid this. Stupid Spotify. That's why I run my own Subsonic server. No uploading, nobody else's limits, etc.

Re: Spotify and Facebook: Is that phishing?

#63

Post by wubbfindel » Fri, Feb 22, 2013, 10:50 PM UTC

Elessar wrote: post #12

ActVen wrote: post #8

If this type of behavior continues to be tolerated by users, the entire industry will suffer the backlash at some point. A few companies using obfuscated or unclear defaults will make it more likely that the government will bring down heavy legislation on all companies.

Why is everyone jumping to blame Spotify for maliciousness? All I see is that they have a bug where they instantly assume emails = Facebook login. Then they try logging in using that email, and because this user reuses passwords, it works. It takes two to Tango, but I see incompetence on both sides rather than maliciousness.

It's not a "bug" if they specifically ask the user for their "facebook email" or their "spotify username" - which of course they do!

So if the user provides their facebook email and the correct password to match, which this user did, the correct behaviour is to log the user in via facebook. Which of course Spotify did.

No bug there. I'd say that this is mostly user error - but possibly Spotify could make it more obvious.

Re: Spotify and Facebook: Is that phishing?

#64

Post by timrpeterson » Fri, Feb 22, 2013, 10:56 PM UTC

I noticed the exact same thing last year when I deactivated my Facebook account and then tried to sign up with Spotify.

This absurd behavior was the last straw with me with Facebook. I deleted my FB account that day. I can't believe facebook has so many users still. This company has just been one big screw up since day one.

Re: Spotify and Facebook: Is that phishing?

#65

Post by arturkim » Fri, Feb 22, 2013, 10:56 PM UTC

berdon wrote: post #52

Did anyone else read this and then scroll to the top only to realize they'd been reading and comprehending german the entire time and then suddenly forgot it? I did. :/

I actually hadn't scrolled up. I had to revisit the page to understand what you were talking about.

Re: Spotify and Facebook: Is that phishing?

#66

Post by Comkid » Fri, Feb 22, 2013, 10:58 PM UTC

It should be noted that Spotify is directly integrated into Facebook

https://www.facebook.com/music

You have the ability to pause and play music from Facebook (which I doubt exists for any other music player with any sort of Facebook integration)

Re: Spotify and Facebook: Is that phishing?

#67

Post by scottmp10 » Fri, Feb 22, 2013, 11:04 PM UTC

ineedtosleep wrote: post #6

I'm ashamed that this doesn't surprise me much. This looks like a huge oversight on Facebook's part, but with the countless reports on Facebook failing with privacy here, there and everywhere, it's like I don't care anymore. The thing that numbs me even more is that client work, no matter how good of an argument one gives, will always have some form of third-party social login because it's oh-so-important and users w…

It isn't an oversight by Facebook - it is by design. Facebook was a part of the decision to use Facebook login credentials to log into Spotify. Additionally, Facebook does not list access to your friend list (and your friend's email addresses) in their list of permissions. Rather, those details are implicit in using Facebook to authenticate.

As an example, using FB to authenticate with Quora does not list access to friends list in the permissions but Quora will send an email to every friend of yours already on Quora to notify them that you joined.

Another issue with this is that if you have never given any Facebook permission to Blizzard, but happen to use the same email address as listed on your Facebook account then Blizzard will attach your real name to your account without your permission.

Re: Spotify and Facebook: Is that phishing?

#68

Post by mixedbit » Fri, Feb 22, 2013, 11:05 PM UTC

dendory wrote: post #60

I somehow thought that apps could no longer 'login' to social network accounts using usernames/passwords, so that they would have to use OAuth instead? There should be a way that Facebook and Twitter would prevent an app from using login information in order to bypass the 'app authorization' dialog which is supposed to be shown to users to tell them what the app can do to their account.

You mean they can't do it from Terms of Service point of view? Because from a technical perspective there is nothing that could prevent an app or any other piece of software to login as you once you've passed your credentials (in this case username and password) to such app.

Re: Spotify and Facebook: Is that phishing?

#69

Post by stanleydrew » Fri, Feb 22, 2013, 11:09 PM UTC

Jgrubb wrote: post #17

stanleydrew wrote: post #10

Earlier quoted context omitted.

I don't understand this comment. Many companies share investors, especially at the level of Facebook and Spotify. Are you trying to suggest that a mutual investor somehow has enough product control to strong-arm Facebook and Spotify into this?

Are you suggesting that a mutual (or any) investor has no influence whatsoever?

At the level of implementation of individual features like what happens when a user logs in with an email address instead of a username, I am absolutely suggesting that the influence is so minimal as to be irrelevant.

Re: Spotify and Facebook: Is that phishing?

#70

Post by stanleydrew » Fri, Feb 22, 2013, 11:12 PM UTC

Create wrote: post #15

stanleydrew wrote: post #10

Earlier quoted context omitted.

I don't understand this comment. Many companies share investors, especially at the level of Facebook and Spotify. Are you trying to suggest that a mutual investor somehow has enough product control to strong-arm Facebook and Spotify into this?

I am not suggesting anything. Please listen to Eben's talk: it is much more serious than an "accidentally" entangled account.

To be clear I think this is very serious. There is a reason I deleted my Facebook account in 2009 and have never had a Spotify account.

But you were clearly trying to suggest that shared investors have something to do with this. There's no other information in your comment except that the two companies share investors. And in the context of this incident the only possible implication of your comment is that shared investors somehow influenced this. Otherwise why post the comment at all?