Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If you care about user privacy, don’t use Facebook JavaScript SDK

simplelogin.io

Post reply on HN
Print view View original

91–100 of 105 posts

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#91

Post by iudqnolq »

JohnFen wrote: post #87
iudqnolq wrote: post #69

Earlier quoted context omitted.

WhatsApp is almost certainly safer and more privacy respecting than Telegram. Telegram uses highly nonstandard cryptography (the founder hired a bunch of math competition winners and told them to design encryption from first principles ), doesn't have E2E by default (unlike Whatsapp), and is owned by a quite sketchy Russian oligarch who started spending on democracy-related causes after a falling out with Putin. Tele…

> WhatsApp is almost certainly safer and more privacy respecting than Telegram. I doubt this because WhatsApp is Facebook.

FB is bad, but Telegram has managed to be even worse, which is quite the accomplishment. Their crypto is fundamentally unsound, and their business practices dubious and unethical. See the links I posted.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#92

Post by StreamBright »

iudqnolq wrote: post #69
StreamBright wrote: post #32

Earlier quoted context omitted.

I explicitly told everybody that I turned off messenger notifications on every device and uninstalled facebook from my devices years ago. If they want to reach me they can use Signal, Telegram or Keybase. Interestingly enough even my mother (in her 70s, no idea about computers) can use Telegram without a hickup. I guess it is a matter of dedication to push your peers off from Facebook.

WhatsApp is almost certainly safer and more privacy respecting than Telegram. Telegram uses highly nonstandard cryptography (the founder hired a bunch of math competition winners and told them to design encryption from first principles ), doesn't have E2E by default (unlike Whatsapp), and is owned by a quite sketchy Russian oligarch who started spending on democracy-related causes after a falling out with Putin. Tele…

WhatsApp calls and messages were used by Facebook. The point is that even Telegram does the same they have much less data about me that they can use. It is a good enough replacement of SMS and GSM calls even with broken crypto. For sensitive communication I would definitely use Signal or Keybase instead. Those are the tools that we use for work related things like software development. Keybase is actually pretty amazing. I think even the crypto backing it is solid.

https://keybase.io/docs/crypto/overview

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#93

Post by JohnFen »

iudqnolq wrote: post #91
JohnFen wrote: post #87

Earlier quoted context omitted.

> WhatsApp is almost certainly safer and more privacy respecting than Telegram. I doubt this because WhatsApp is Facebook.

FB is bad, but Telegram has managed to be even worse, which is quite the accomplishment. Their crypto is fundamentally unsound, and their business practices dubious and unethical. See the links I posted.

You might be right -- I don't use either of them, so my interest in precisely who's worse is limited. Your argument leads me to think that they both should be avoided. In any case, regardless of whether or not Telegram is OK, nobody should be using Facebook products.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#94

Post by pricci »

allovernow wrote: post #86

Tangentially related: is there any reason to be suspicious of/careful with react/redux? We've been using it internally for front end stuff, would be nice to know if there's any weird default tracking going on, however unlikely...

I don't think so. If you serve the library yourself (don't use an external CDN to load it) there shouldn't be any connections to 3rd parties, at least I've never seen one in the 'network' tab of my browser's dev tools.

Also, I want to believe that, being open source, people would already discovered something fishy.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#95

Post by iudqnolq »

StreamBright wrote: post #92
iudqnolq wrote: post #69

Earlier quoted context omitted.

WhatsApp is almost certainly safer and more privacy respecting than Telegram. Telegram uses highly nonstandard cryptography (the founder hired a bunch of math competition winners and told them to design encryption from first principles ), doesn't have E2E by default (unlike Whatsapp), and is owned by a quite sketchy Russian oligarch who started spending on democracy-related causes after a falling out with Putin. Tele…

WhatsApp calls and messages were used by Facebook. The point is that even Telegram does the same they have much less data about me that they can use. It is a good enough replacement of SMS and GSM calls even with broken crypto. For sensitive communication I would definitely use Signal or Keybase instead. Those are the tools that we use for work related things like software development. Keybase is actually pretty amaz…

> WhatsApp calls and messages were used by Facebook.

If that's true that would be extremely serious, given that Whatsapp promises end-to-end encryption

> WhatsApp end-to-end encryption ensures only you and the person you're communicating with can read what's sent, and nobody in between, not even WhatsApp. Your messages are secured with locks, and only the recipient and you have the special keys needed to unlock and read your messages. For added protection, every message you send has an unique lock and key. All of this happens automatically: No need to turn on settings or set up special secret chats to secure your messages.

> Important: End-to-end encryption is always activated. There's no way to turn off end-to-end encryption.

https://faq.whatsapp.com/general/28030015/

Source please?

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#96

Post by harry8 »

reroute1 wrote: post #58
Jamwinner wrote: post #41

Earlier quoted context omitted.

Pretty sure working for facebook is proof or that you are in the upper 1% worldwide.

Except for all those moderation jobs, and everyday office jobs, oh wait are they just people too and not "1%ers" ???

Yeah they aren't facebrick employees - according to facebrick. To really screw people working for you hire a contracting service to be the pointy end and do the thrusting for you. Every single thing about facebrick is absolutely vile. Nobody has yet considered all the dimensions in which they are repugnant. The more you find out the more sick you feel.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#97

Post by harry8 »

reroute1 wrote: post #57
valona wrote: post #7

Why would any developer or engineer who has even an iota of consideration for privacy, web standards, and, indeed, humanity want to work for such a repugnant company as Facebook?

Repugnant is entirely your opinion and there are lots of people who disagree with you. It might be an amazing opportunity for some.

Justified opinion argued for with evidence. Like your unjustified opinion isn't. You can remedy that if you want to make your case properly though. Please do.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#99

Post by rapind »

mac_was wrote: post #17
r_singh wrote: post #4

Original article from Dev.to: https://dev.to/simplelogin/if-you-care-about-user-privacy-do... I've recently implemented authentication for my project and I would just like to say to all the relatively amateur programmers out there: for web based authentication just stick with HTTPOnly SECURE cookies with DB backed sessions that you can revoke. The reason I'm saying this is that there's way too many posts talking abou…

I don't think that storing creds is suitable for newbies either. All authentication is complex and just using HTTPOnly and DB backend is not a solution at all.

A relatively simple solution is temporary sign in tokens via email. Encrypt and timestamp in the database and pick a TTL (the shorter the more secure, the longer the more convenient). Then just email a login link with the email and token as params. Perform auth lookup on email, then secure compare the tokens (in constant time to avoid timing attacks).

You now have an auth system that avoids horrible passwords (no passwords).

The downsides are: 1) Cost to send emails for login, 2) People complaining about it being weird.

Worth it in many cases.

Re: If you care about user privacy, don’t use Facebook JavaScript SDK

#100

Post by thsealienbstrds »

mikro2nd wrote: post #29
thsealienbstrds wrote: post #23

Earlier quoted context omitted.

Individually, you have a choice. But not using e.g. WhatsApp needs to be a collective decision or it won't work because everybody else is still stuck in there.

There is no such thing as a "collective decision". There is only the decision of each person. Any movement to quit these sickness-inducing manipulators has to start somewhere otherwise you end up like those Buddhists who won't enter Nirvana until all other creatures are also ready to enter Nirvana, so they all end up hanging about outside the gates (as it were...), forever waiting. The decision to be the first,... to…

Let's say you run your own mail server. How much privacy do you really gain if 99% of the mail that comes in and goes out passes through Google servers? It doesn't matter what you do by yourself. You just can't expect everybody to run their own mail server. I run my own mail server, and while I'm happy to be self-reliant, it's hardly a win for my privacy (also, mail server administration is a pita).

Same goes for every other communication tech. Just because your endpoint is not spied upon, if every other endpoint is spied upon you gain nothing. If you don't use WhatsApp, but all your friends use WhatsApp to talk about you then you gained nothing.

If you really believe there is no such thing as collective decision-making then imho you already gave up in the fight for privacy.

But even if we boycot Google and Facebook, they are not the main problem. Their business model is the main problem. Spying on your users, training predictive models, and using those models to exploit people is simply too profitable, and therefore too attractive for any profit-seeking company to ignore.

Until we solve that problem by deciding as a society that these business models are not ok, this 1984-like world we currently live in will be our reality.

Post reply on HN