I was annoyed with sites asking for too many Facebook privileges and made this • Hacker News Board

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#71

Post by scott_s » Mon, Nov 28, 2011, 9:58 PM UTC

cheald wrote: post #67

scott_s wrote: post #63

Earlier quoted context omitted.

Apps usually request that stuff for some reason, and the vast majority of users don't have enough understanding of the systems to know which permissions are safe to revoke. Breaking the app is the point of doing this. It's often not clear that, say, a FB app will post, as the user, to their own stream. I think most people don't want this, and want the app to break if it tries. You're thinking of "safety" from the per…

You're absolutely right - the point is to break the app. This is great if the user breaks the apps in exactly the ways they want, but my point is that users rarely understand the scope of the app, and may (and likely will) end up revoking permissions that break functionality they want. For example. I sign up with Foobar's Widgets with my Facebook account, and manually deny the "publish_stream" permission, because I j…

What you described is exactly the behavior I want. Your point that users rarely understand the scope of the app is, for me, an argument in favor of this. To me, the solution is simple: if the app does not have the permission to do something it needs to do, it has to prompt the user with "I need permission x to do y." This model requires no imagination for users - they don't need to understand the scope of the app upfront, or even need a deep understanding of FB's permissions.

I use exactly zero FB apps primarily because I have no trust in the FB sharing model, and I don't want to spend time grooming individual permissions per app.

I also suspect that we have different notions of "abusive behavior." You're probably thinking of outright scammers. I'm thinking of overzealous developers who think their gizmo is so awesome that of course most people would want to shout about it from the hilltops.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#72

Post by bigiain » Mon, Nov 28, 2011, 10:00 PM UTC

cheald wrote: post #55

bigiain wrote: post #48

Earlier quoted context omitted.

I'm not entirely sure that's a valid objection for something who's installation instructions include "clone this git repo, then open chrome in developer mode". Perhaps before it becomes a point'n'click install there might need to be more explanation about what might break, but anyone capable of installing it in its current form _ought_ to be capable of working out it's various means of breakage...

I agree in this case. If it's a git repo, not a problem. But, it's not the first time I've seen this issue raised, and the common response is "heck yeah, I want to do that!" It's not inconceivable to imagine that someone packages this into a mass-usable extension eventually. One Google search led me here: https://chrome.google.com/webstore/detail/mlnhcepfaddcopbegg... People, in general, don't understand what the per…

"It's a broken solution to a broken problem"

Sure.

That doesn't mean we need to accept Facebook's status quo - which resolves the inevitable brokenness in the direction of:

"Oh well, your privacy and that of your friends is the price you have to pay to let poorly written apps to work."

We should at least have the option to choose:

"I'll have a little more control over my privacy and a bit more respect for my friends, and if that means the new social-media-viral-casual-gaming-sensation-de-jour fails to work for me 'cause it thought it could spam my friends and didn't properly check for success (or intentionally crashed on failure), then that's fine too, maybe I'll do something else with that time."

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#73

Post by bigiain » Mon, Nov 28, 2011, 10:08 PM UTC

phillmv wrote: post #61

blhack wrote: post #24

Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…

I signed up for airbnb using my facebook account and I noticed that they give away your DOB. I immediately changed my DOB on facebook and vowed to avoid authenticating with apps. I generally avoid putting in real information on facebook but the amount of stuff they give away is frightening. It's a heaven for social engineering and spear phishing.

"I immediately changed my DOB on facebook"

Hmmm, I wonder what Facebook does when someone changes something like their DOB? Or name/address/email/phone? Or any other marketing-useful data in your profile?

If _I_ were part of the Facebook Evil-Data-Mining Division, I'd certainly be looking to see if I can discern patterns like "This phillmv guy's _real_ birthday is 12/03/1975, but when he changes it for sites he doesn't trust he tends to use either 1st April 1980, or 22nd Sept (which is his girlfriends birthday) instead. And he usually changes his zipcode to the one his parents used to live at before they moved to Pittsburg."

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#74

Post by cheald » Mon, Nov 28, 2011, 10:08 PM UTC

bigiain wrote: post #70

cheald wrote: post #57

Earlier quoted context omitted.

The app "breaking" isn't necessarily as cut-and-dried as "Threw an unhandled exception". Functionality that fails to work as the user expected (because the user revoked a key permission enabling that functionality) is "broken", and results in bug reports, which results in developer time spent trying to reproduce an issue that was introduced because the user violated one of the basic assumptions in the app. You should…

I see it as being very similar to something like noflash - if I choose to install and run noflash it "breaks" some websites. Sometimes that's exactly what I wanted it to do - sometimes it's collateral damage, and when/if I notice it I can go in and whitelist something I broke to make it work again. Unless you're worried that somehow this extension will get sneaky-loaded without the user understanding what it does, I…

Flashblock is a great example of the problem. Google Music wouldn't work on my wife's computer, causing a lot of frustration for her, until I noticed the flashblock icon. Google was using a hidden div with a flash player to play the music. When Flashblock shows a big placeholder rather than the Youtube video, you know what's happening. It's not always obvious, though, and it takes someone who knows that Flash players are often used for this sort of thing to solve the problem. If I wasn't home, my wife would have just assumed that the product didn't work on her computer and given up on it.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#75

Post by mhpotter » Mon, Nov 28, 2011, 10:13 PM UTC

bigiain wrote: post #73

phillmv wrote: post #61

Earlier quoted context omitted.

I signed up for airbnb using my facebook account and I noticed that they give away your DOB. I immediately changed my DOB on facebook and vowed to avoid authenticating with apps. I generally avoid putting in real information on facebook but the amount of stuff they give away is frightening. It's a heaven for social engineering and spear phishing.

"I immediately changed my DOB on facebook" Hmmm, I wonder what Facebook does when someone changes something like their DOB? Or name/address/email/phone? Or any other marketing-useful data in your profile? If _I_ were part of the Facebook Evil-Data-Mining Division, I'd certainly be looking to see if I can discern patterns like "This phillmv guy's _real_ birthday is 12/03/1975, but when he changes it for sites he doesn…

The Evil-Data-Mining Division is the only one they have.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#76

Post by danudey » Mon, Nov 28, 2011, 10:13 PM UTC

cheald wrote: post #67

scott_s wrote: post #63

Earlier quoted context omitted.

Apps usually request that stuff for some reason, and the vast majority of users don't have enough understanding of the systems to know which permissions are safe to revoke. Breaking the app is the point of doing this. It's often not clear that, say, a FB app will post, as the user, to their own stream. I think most people don't want this, and want the app to break if it tries. You're thinking of "safety" from the per…

You're absolutely right - the point is to break the app. This is great if the user breaks the apps in exactly the ways they want, but my point is that users rarely understand the scope of the app, and may (and likely will) end up revoking permissions that break functionality they want. For example. I sign up with Foobar's Widgets with my Facebook account, and manually deny the "publish_stream" permission, because I j…

When the user first authenticates (and removes certain permissions) then Facebook will return what you were allowed for. If Foobar ignores the auth failure for publish_stream and just assumes that everything will be ok, then yes, they ARE at fault for designing their app poorly and making assumptions about what they get back from Facebook.

What they SHOULD do is store the list of permissions the user has, and when they click on the 'Share to Facebook' button, check the permission and if you don't have it, re-auth with additional permissions.

Some web apps do this automatically. I had an app (I forget which) that I authenticated to with Facebook just to log in. Eventually, I found some feature that I wanted to use that required further Facebook permissions, and it re-prompted me with the additional permissions it needed. It's not really that hard.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#77

Post by cheald » Mon, Nov 28, 2011, 10:13 PM UTC

bigiain wrote: post #72

cheald wrote: post #55

Earlier quoted context omitted.

I agree in this case. If it's a git repo, not a problem. But, it's not the first time I've seen this issue raised, and the common response is "heck yeah, I want to do that!" It's not inconceivable to imagine that someone packages this into a mass-usable extension eventually. One Google search led me here: https://chrome.google.com/webstore/detail/mlnhcepfaddcopbegg... People, in general, don't understand what the per…

"It's a broken solution to a broken problem" Sure. That doesn't mean we need to accept Facebook's status quo - which resolves the inevitable brokenness in the direction of: "Oh well, your privacy and that of your friends is the price you have to pay to let poorly written apps to work." We should at least have the option to choose: "I'll have a little more control over my privacy and a bit more respect for my friends,…

I agree that we should have the right to choose. I also have enough experience doing support for customers to know that most people are boneheaded about this stuff, and will immediately jump to blaming the developer for their buggy software, causing support headaches and user discontent.

For the HN audience - hackers, who know this technology, and understand the risks, and can correlate their revoking permissions with the effects down the road - this extension is great. I'm probably gonna install it later today.

For the general user audience, this is like handing someone a loaded shotgun and telling them they can use it to scratch itches on their feet.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#78

Post by bigiain » Mon, Nov 28, 2011, 10:13 PM UTC

psawaya wrote: post #58

vdm wrote: post #49

Earlier quoted context omitted.

This could be like early Windows firewalls all over again; popping up windows every time you try to do something, until you just disable it.

Maybe. I think the idea of "blocking" a program makes a lot less sense to the novice user compared to choosing if a program can e-mail you or post on your wall. I agree that they could easily become a nuisance and lead to the user reflexively clicking "accept", though.

Maybe there needs to be a reverse version of this - all of your _friends_ who get spammed by the app writing in your stream ought to be able to vote

[] continue receiving updates from this user using foo-app

[] block updates from this user's instance of foo-app

[] block all automated updates from this user's stream

([] unfriend this clearly unhinged "install every shiney-thing" user)

Then any user with more than a certain threshold of blocks would need to get permission from a majority of his social network before being allowed to authorise apps :-)

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#79

Post by danudey » Mon, Nov 28, 2011, 10:14 PM UTC

cheald wrote: post #57

chadrs wrote: post #46

Earlier quoted context omitted.

I have to disagree. First, I actually do have this warning in the README. Second, if the app breaks when it doesn't have enough permissions, that's really just the laziness of the app developer. Handle the error gracefully if you really need the permission, and prompt for it again, explaining what you need it for.

The app "breaking" isn't necessarily as cut-and-dried as "Threw an unhandled exception". Functionality that fails to work as the user expected (because the user revoked a key permission enabling that functionality) is "broken", and results in bug reports, which results in developer time spent trying to reproduce an issue that was introduced because the user violated one of the basic assumptions in the app. You should…

Considering how non-difficult it is to check Facebook's reply and make sure you received authentication for the permissions you requested, there's no excuse for 'basic assumptions'.

Whenever you're dealing with a third-party service, you can't afford to make any assumptions, or you're bound to end up with a broken app, broken interactions, or incorrect data.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#80

Post by Splines » Mon, Nov 28, 2011, 10:15 PM UTC

OT, but does anyone know of a way to find all the "things" that you've done on Facebook? It'd be nice to know if a rogue fb app has posted on me in some obscure location that I don't see on my screen. I've tried messing around with the graph API (looking at all posts by me), but I can only see activity on my own wall, and not any others.

A few weeks ago my wife accidentally clicked on some fb malware and it auto-posted bad links on other people's walls. It was frustrating to find out where all those places were. A programmatic way to do this would be good to know.