Hacker News Reader

Comment by rwhitman | Hacker News Reader

I just came off of a project where we built the entire auth system on facebook. No other regi options - just facebook.

I will never do that again. If that was to become the standard, facebook shot themselves in the foot with their crappy APIs anyhow (see http://news.ycombinator.com/item?id=1731427 )

And I have a facebook account, and I'm really hesitiant to like or authorize anything for fear of the author (or hacker) using it for malicious purposes or Facebook one day making my actions public etc. I think a lot of folks are too.

FB may have been seen by some folks over the last few months as the magic solution to universal social media authentication but I think its becoming apparent that it is not. And thats a good thing.

View on HN

I'm really hesitiant to like or authorize anything for fear of the author (or hacker) using it for malicious purposes

I'm not quite as fearful for myself. However, if your application requests access to my friends list, you've just struck out with me. Even if I'm inclined to trust you, I don't believe that I have the right to make that decision for my friends. I won't expose them to you, so you can't have my business if you require it.

I agree. I recently wanted to comment on something on codinghorror.com and had to use the OpenId/Facebook login. It wanted to be able to use my FB credentials to login - fine. But then it also wanted access to my friends and activities and to be able to post things on my wall. WTF?

I denied that second query and was able to log in fine, but the question is, why the hell did they ask in the first place. Seemed underhanded to me (most people would have been confused and probably said, "Yeah, I want to log in, I guess so, sure").

How do you know if the app requests access to your friends? Even if FB warns you about this behavior (I dont think it does) how can you trust that they won't change their policy in the future without alerting you?

You explicitly grant access for each new set of permissions - accessing a friends list (and thus their publicly available information) is one of those sets. If the site changes their policy, they have to go back to the user and request permission.

This is false - accessing the friends list only requires "basic" permissions.

The friends list can be accessed without asking for permissions via the graph API and an API key if your user id is known.

Accessing your friends is not an extended permission as mentioned in another comment, any app you give permissions to can access your friends and get their ID's and Names.

The replies here show that Fb have done a good job of making privacy settings confusing.

Reply on news.ycombinator.com