Hacker News Reader

Comment by CWuestefeld | Hacker News Reader

I'm really hesitiant to like or authorize anything for fear of the author (or hacker) using it for malicious purposes

I'm not quite as fearful for myself. However, if your application requests access to my friends list, you've just struck out with me. Even if I'm inclined to trust you, I don't believe that I have the right to make that decision for my friends. I won't expose them to you, so you can't have my business if you require it.

View on HN

I agree. I recently wanted to comment on something on codinghorror.com and had to use the OpenId/Facebook login. It wanted to be able to use my FB credentials to login - fine. But then it also wanted access to my friends and activities and to be able to post things on my wall. WTF?

I denied that second query and was able to log in fine, but the question is, why the hell did they ask in the first place. Seemed underhanded to me (most people would have been confused and probably said, "Yeah, I want to log in, I guess so, sure").

How do you know if the app requests access to your friends? Even if FB warns you about this behavior (I dont think it does) how can you trust that they won't change their policy in the future without alerting you?

You explicitly grant access for each new set of permissions - accessing a friends list (and thus their publicly available information) is one of those sets. If the site changes their policy, they have to go back to the user and request permission.

This is false - accessing the friends list only requires "basic" permissions.

The friends list can be accessed without asking for permissions via the graph API and an API key if your user id is known.

Accessing your friends is not an extended permission as mentioned in another comment, any app you give permissions to can access your friends and get their ID's and Names.

Reply on news.ycombinator.com