Hacker News Reader

Comment by efsavage | Hacker News Reader

This privacy problem is trivially solvable. Facebook should generate a surrogate key for user/app relationships, and only share that with the apps. Then my ID cannot be tied back to me by anyone but facebook, and I cannot even be tracked across applications by the same developer.

View on HN

We have talked a lot about solutions like this, but most of them end up more trouble than the encryption proposal. For example, developers need to link back to your profile page and your friends' profile pages in their UI - do we change all those URLs individually for all applications, too (since they contain a user ID)?

I think it is a clever idea, but it ends up breaking down in a lot of ways, and it has the bad quality that it is not backwards compatible with existing applications.

Why not create a new URL handler that takes an app-specific user ID that redirects to the correct profile page only if the logged-in user has permission to view the page?

That way, you would normally only be able to see what the world would see; but if you try to view your or your friend's profile, it's fluid?

This is a great ground-up solution, but I would consider it far from trivial in practice for Facebook at this point.

The current ids have completely permeated every part of their public APIs and likely every part of their internal systems...

True, I meant trivial in terms of complexity (as opposed to encryption). Implementation/migration would be tricky, but not impossible.

Also, anyone who's worked with their APIs before knows not to underestimate Facebook's commitment to the "move fast, break things" mantra.

Reply on news.ycombinator.com