Hacker News Reader

Comment by mindgam3 | Hacker News Reader

“Did partners get access to messages? Yes. But people had to explicitly sign in to Facebook first to use a partner’s messaging feature. Take Spotify for example. After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app.”

Does anyone have a screenshot or remember what the opt in UX was like this for this? I have been logged in to Spotify via Facebook since basically the very beginning. I worked in tech as a dev, PM, and designer of flows. I never had the understanding that my Facebook connect with Spotify gave them read/write to all my messages. It’s certainly possible that this permission was requested in an auth form that I quickly granted without realizing, which would make this more of a dubious product decision that blatantly unethical. Anyone have info?

View on HN

Looks like as of 07/2013 it was this: https://imgur.com/UdfzvGU

Source: https://stackoverflow.com/q/17561784/9027089

That's the UI that I remember from that time. Nothing in the auth dialog mentions access to Messages.

Yep, and the "Access my data at any time" basically lets them store and refresh access tokens, not give blanket access to things like messaging.

Yep, that’s pretty much how I remember it.

Giving FB the benefit of the doubt, I suppose it’s possible that there could have been an additional permissions dialog that popped up whenever messaging integration happened. But I’m usually pretty good at being paranoid about giving apps unnecessary FB perms.

Personally I derive zero utility from integrating Spotify and messenger, and my private FB messages are one of the most sensitive data streams, period. So I find it hard to believe that I would have missed this. Which makes facebook’s latest vigorous non-apology feel a bit off to me.

I mean, it does say it gives Spotify "access [to] my data at any time". Messages are just data, after all...

I feel they could have elaborated on 'data' a bit. To most people, saying 'messages' is more alarming than just saying 'data'.

And by the same token, wall posts are data too, so there should be no need to specify that explicitly if that's the way data is being interpreted.

That's exactly right. The fact that "wall posts" is in that list gives you a false notion of the granularity of the items in the list. One of those is not nearly as granular as the rest - if you assume that it is, like I did, you guess that "data" means "where you went to High School" or your "favorite movie" or some such, not "everything." Really deceptive.

In context, "my data" means "the data referred to in the above three bullet points".

Otherwise, this of the same type (though not magnitude) of thing as "Spotify may induct my firstborn into a satanic cult."

That is absolutely a dark pattern if that dialog box was intended to speak to read/write access of messages.

"Access my data at any time" is truly deceptive. The icon is one specifying "time" - a moon in the dark; night time. And the operative context seems to be "at any time". However, the grant is actually for, "data". Which is itself seemingly already being granted by the above "Posts", and "Public Information". If Facebook presumed that "data" included everything, then why did they ask for access to posts and public information above?

It is clearly deceptive. If they thought what they did was in the right, then why deceive? And if they felt like they made a mistake, why not make the new dialog boxes not deceptive?

That they do not feel that they can sustain their business model without being deceptive makes NYT articles like this all the more necessary; if people really don't care about their privacy, then go ahead and ask for their privacy - don't dance around and say you're providing a service (and omit that you're also taking their private data). If they asked clearly and they were granted the ability to farm out to third parties whole read/write access to all data, then I'd be more inclined to believe that their users were actually acquiescing.

I completely agree. They're very clear about who can access what in the first few statements, but "Access my data" is so vague.

It takes a very cynical perception to accurately assume what they mean by this, and they absolutely take advantage of this. Cynics wear the tin-foil hats in the minds of many, and nobody wants to be like that.

Permission to post on behalf of the user and read posts from the user's feed does not grant access to messages to any other app getting these permissions from a user. If they were getting access to messages, it was a special stealthy "partner only" deal not reflected in the permissions prompt as posted on imgur above.

Nice, good find. That doesn't give permission to read (or even generate) private messages, unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above.

>unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above...

Hmm. It seems this may sound weird to you and many others, but that's exactly how I interpreted it. When looking at that screen I was wondering why anyone in their right mind would grant Spotify these rights?

The only thing Spotify does is play songs for you, right? They shouldn't really need access to any of your FB data to do that.

But, you want a more social experience while you listen to music.

Maybe some people do, but I don't.

Just play "Grandma's Hands" for me while I code. I don't need my friends in Paris to know I'm listening to Bill Withers.

Seriously, why do people think they need this stuff?

I apologize if my tone was not right... to be clear, I use Spotify exactly as you describe (different choices though) and am as baffled as you about people using those other ways.

I interpreted your comment as a joke, but could see how that could be unclear. Tone is hard on the internet, probably best to explicitly say when you're being sarcastic. :-)

Yeah, but that's the thing: even if you do want to broadcast to your friends that you're listening to BW, that doesn't necessitate access to all your PMs! That just means write-to-wall or -to-updates privileges.

That’s fair, but surely the concept of sharing music with friends isn’t so crazy? Not saying it was necessarily handled well here, but it seems like a feature many would and do want.

Copy a link send it as an IM, that already worked with ICQ. Update your status message in your message client, manually or possibly provide a client side API to do that, pretty sure there are scripts that do that for pidgin / Amarok, it also is definitely possible on macOS using Automator. There is no reason to involve a server other than possibly platforms like iOS not allowing interactions between apps in this way, which I doubt.

That is one of their selling point, isn't it? You got a feed of "Friend activities" on Spotify

Alright, I confess, your interpretation was the same as my immediate hot-take reaction, but then I stopped and said waiiiiiit a sec, they can't literally mean, all the data, right? They must mean, like, "my data" in the sense of that stuff above, right?

Only now does FB reveal themselves to the be treacherous jerk they've always been and abuse whatever leeway you give them. Use recovery phone number for marketing? Why not!

Only now!!! Where have you been?

I agreed they’ve always been treacherous jerks, I meant about the counterintuitive broad reading of “my data” on this page.

One not-a-facebook-user data point here, but yeah I would interpret "my data" to mean everything. Absolutely everything.

I interpret that as saying "the data you're granting Spotify access to, they can access while you're not using the app", i.e. not broadening the scope of the data, just when they can use it.

That's not how it works. I've built a FB app in the past and had offline_access permission. It does not expand the scope of what data you can query. It just allows you to use the permissions granted whether the user is logged in or not.

that's weird. It seems very clear to me. they are giving you four distinct warnings: 3 plus my data. I would have immediately interpreted this as its clearly written - Spotify would get access to my data. So I would have never enabled it,

That auto dialog referred to the “offline_access” scope. At the time, most app access tokens would expire unless they specifically requested that the user give permission to access at any time.

It did not expand the permissions of what could be accessed.

That scope was retired in 2012 https://developers.facebook.com/docs/roadmap/completed-chang...

I wish there was a data audit log for your account. I'd like to be able to check which companies accessed what part of my data, when, and for what purpose. If I noticed something I didn't like, I could revoke permissions. If I noticed something that seemed very shady, e.g. Spotify editing my private messages, I could start an escalation.

This seems like a good way to move the burden of auditing partners onto the users for Facebook to me. Make application fill in information about why they call specific operations, make those operations and reasons available in an audit log that any user can review.

It’s been available pretty much since the first f8 in 2008, so ten years ago:

https://www.facebook.com/settings?tab=applications

That just shows which apps have which permissions. I think what is desired is a log of date and times the app accessed specific bits of data. For example, do they poll every day and hoover up all of your recent data for everything they have access to, or do they only take just what they need for the task at hand?

That cannot possibly be it, the last permission is just the "offline_access" field that was available to normal developers and I remember seeing used a lot. I refuse to believe this is what fb talks about when saying users gave permission.

Facebook thinking that dialog says “read my messages” is evidence enough that their culture is broken and requires external oversight.

That does not include a request to approve the read_mailbox permission, which I think should be required to query a user's private messages. This permission was deprecated in 2015. https://www.theregister.co.uk/2018/04/11/facebook_admits_use...

On the other hand, Facebook is known to make a lot of one-off arrangements with specific preferred partners such as Spotify to grant permissions and access normal apps can't use. I suspect that money changes hands for some of these special arrangements, or if not outright cash then intangibles with significant value, hence the "selling data" accusations.

I worked for Spotify very close to this integration. Not going into too many details, but the access they got is generally what's being reported. That said, I'm not aware of Spotify doing anything with messages other than displaying them to users; they weren't mined for data or retained. The intent was a unified messaging experience across apps, but it's been effectively dead for over four years. The only creepy thing I'm aware of that they tried with Facebook data was try to build a taste profile from "likes," and this is from public profile data.

There's a big difference between what the permissions could do and what they were actually used for. Facebook takes its contracts with trusted partners as seriously as they say. My concern would be less around "how was my (let's be honest--Facebook's) data used" and more around Facebook's growth at any cost engine.

Or the overall growth engine of tech.

I've always believed that this was one of the primary motivations for Facebook separating Messenger out into its own app: it feels separate and therefore more private, without actually being either.

The content of a post with privacy controls restricted to just one other person is functionally the same as sending a message to that person on Messenger — only the UI is different. But, to the average person, it feels completely different because it looks like texting.

Update: a second response from FB https://newsroom.fb.com/news/2018/12/facebooks-messaging-par...

It has screenshots of the messaging functionality but no clarification on how permissions were granted for this, as discussed elsewhere on this thread.

Reading this post, it simply misleads about how deep things happened: they want to say that apps had access only when logged in, carefully phasing around the fact that the apps had offline access too. Also, "they pinky promised to limit their functionality", not "we had controls in place so any of their data reads and writes was clearly trackable and labeled as such, and they couldn't download everything".

Basically their defense is: You trusted FB with data, dumb fucks.

This is not about logged in or offline.

Facebook is giving fairly precise technical information about what happened. The New York Times is being as coy as possible, using obfuscating language, to ensure it's readers do not understand what happened but assume the worst.

The reality is that Facebook allowed me to send messages from within Spotify, when and if I agreed to grant that access to Spotify. That's the baseline.

> “Did partners get access to messages? Yes. But people had to explicitly sign in to Facebook first to use a partner’s messaging feature. Take Spotify for example. After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app.”

Of course this is true. The media reports complete nonsense like "everyone had access to all your messages and your microphone and everything else ever on you and Zuckerberg sucks" and the truth is always, always that the users agreed to give up permissions and the permissions were actually pretty finely controlled. (Or Facebook was hacked.)

But that doesn't sell, so instead people conflate some data sharing with NSA-level conspiracy trolls and drum up bullshit media reports that they know Facebook cannot effectively fight since everyone currently hates them. It's absolute trash journalism.

You can check what permissions are granted to any app if your settings.

Reply on news.ycombinator.com