Hacker News Reader

Comment by jahlove | Hacker News Reader

Looks like as of 07/2013 it was this: https://imgur.com/UdfzvGU

Source: https://stackoverflow.com/q/17561784/9027089

I wish there was a data audit log for your account. I'd like to be able to check which companies accessed what part of my data, when, and for what purpose. If I noticed something I didn't like, I could revoke permissions. If I noticed something that seemed very shady, e.g. Spotify editing my private messages, I could start an escalation.

This seems like a good way to move the burden of auditing partners onto the users for Facebook to me. Make application fill in information about why they call specific operations, make those operations and reasons available in an audit log that any user can review.

It’s been available pretty much since the first f8 in 2008, so ten years ago:

https://www.facebook.com/settings?tab=applications

That just shows which apps have which permissions. I think what is desired is a log of date and times the app accessed specific bits of data. For example, do they poll every day and hoover up all of your recent data for everything they have access to, or do they only take just what they need for the task at hand?

Nice, good find. That doesn't give permission to read (or even generate) private messages, unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above.

>unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above...

Hmm. It seems this may sound weird to you and many others, but that's exactly how I interpreted it. When looking at that screen I was wondering why anyone in their right mind would grant Spotify these rights?

The only thing Spotify does is play songs for you, right? They shouldn't really need access to any of your FB data to do that.

But, you want a more social experience while you listen to music.

Maybe some people do, but I don't.

Just play "Grandma's Hands" for me while I code. I don't need my friends in Paris to know I'm listening to Bill Withers.

Seriously, why do people think they need this stuff?

I apologize if my tone was not right... to be clear, I use Spotify exactly as you describe (different choices though) and am as baffled as you about people using those other ways.

I interpreted your comment as a joke, but could see how that could be unclear. Tone is hard on the internet, probably best to explicitly say when you're being sarcastic. :-)

Yeah, but that's the thing: even if you do want to broadcast to your friends that you're listening to BW, that doesn't necessitate access to all your PMs! That just means write-to-wall or -to-updates privileges.

That’s fair, but surely the concept of sharing music with friends isn’t so crazy? Not saying it was necessarily handled well here, but it seems like a feature many would and do want.

Copy a link send it as an IM, that already worked with ICQ. Update your status message in your message client, manually or possibly provide a client side API to do that, pretty sure there are scripts that do that for pidgin / Amarok, it also is definitely possible on macOS using Automator. There is no reason to involve a server other than possibly platforms like iOS not allowing interactions between apps in this way, which I doubt.

That is one of their selling point, isn't it? You got a feed of "Friend activities" on Spotify

Alright, I confess, your interpretation was the same as my immediate hot-take reaction, but then I stopped and said waiiiiiit a sec, they can't literally mean, all the data, right? They must mean, like, "my data" in the sense of that stuff above, right?

Only now does FB reveal themselves to the be treacherous jerk they've always been and abuse whatever leeway you give them. Use recovery phone number for marketing? Why not!

Only now!!! Where have you been?

I agreed they’ve always been treacherous jerks, I meant about the counterintuitive broad reading of “my data” on this page.

One not-a-facebook-user data point here, but yeah I would interpret "my data" to mean everything. Absolutely everything.

I interpret that as saying "the data you're granting Spotify access to, they can access while you're not using the app", i.e. not broadening the scope of the data, just when they can use it.

That's not how it works. I've built a FB app in the past and had offline_access permission. It does not expand the scope of what data you can query. It just allows you to use the permissions granted whether the user is logged in or not.

that's weird. It seems very clear to me. they are giving you four distinct warnings: 3 plus my data. I would have immediately interpreted this as its clearly written - Spotify would get access to my data. So I would have never enabled it,

That auto dialog referred to the “offline_access” scope. At the time, most app access tokens would expire unless they specifically requested that the user give permission to access at any time.

It did not expand the permissions of what could be accessed.

That scope was retired in 2012 https://developers.facebook.com/docs/roadmap/completed-chang...

Yep, that’s pretty much how I remember it.

Giving FB the benefit of the doubt, I suppose it’s possible that there could have been an additional permissions dialog that popped up whenever messaging integration happened. But I’m usually pretty good at being paranoid about giving apps unnecessary FB perms.

Personally I derive zero utility from integrating Spotify and messenger, and my private FB messages are one of the most sensitive data streams, period. So I find it hard to believe that I would have missed this. Which makes facebook’s latest vigorous non-apology feel a bit off to me.

I mean, it does say it gives Spotify "access [to] my data at any time". Messages are just data, after all...

I feel they could have elaborated on 'data' a bit. To most people, saying 'messages' is more alarming than just saying 'data'.

And by the same token, wall posts are data too, so there should be no need to specify that explicitly if that's the way data is being interpreted.

That's exactly right. The fact that "wall posts" is in that list gives you a false notion of the granularity of the items in the list. One of those is not nearly as granular as the rest - if you assume that it is, like I did, you guess that "data" means "where you went to High School" or your "favorite movie" or some such, not "everything." Really deceptive.

In context, "my data" means "the data referred to in the above three bullet points".

Otherwise, this of the same type (though not magnitude) of thing as "Spotify may induct my firstborn into a satanic cult."

That is absolutely a dark pattern if that dialog box was intended to speak to read/write access of messages.

"Access my data at any time" is truly deceptive. The icon is one specifying "time" - a moon in the dark; night time. And the operative context seems to be "at any time". However, the grant is actually for, "data". Which is itself seemingly already being granted by the above "Posts", and "Public Information". If Facebook presumed that "data" included everything, then why did they ask for access to posts and public information above?

It is clearly deceptive. If they thought what they did was in the right, then why deceive? And if they felt like they made a mistake, why not make the new dialog boxes not deceptive?

That they do not feel that they can sustain their business model without being deceptive makes NYT articles like this all the more necessary; if people really don't care about their privacy, then go ahead and ask for their privacy - don't dance around and say you're providing a service (and omit that you're also taking their private data). If they asked clearly and they were granted the ability to farm out to third parties whole read/write access to all data, then I'd be more inclined to believe that their users were actually acquiescing.

I completely agree. They're very clear about who can access what in the first few statements, but "Access my data" is so vague.

It takes a very cynical perception to accurately assume what they mean by this, and they absolutely take advantage of this. Cynics wear the tin-foil hats in the minds of many, and nobody wants to be like that.

Permission to post on behalf of the user and read posts from the user's feed does not grant access to messages to any other app getting these permissions from a user. If they were getting access to messages, it was a special stealthy "partner only" deal not reflected in the permissions prompt as posted on imgur above.

That cannot possibly be it, the last permission is just the "offline_access" field that was available to normal developers and I remember seeing used a lot. I refuse to believe this is what fb talks about when saying users gave permission.

That's the UI that I remember from that time. Nothing in the auth dialog mentions access to Messages.

Yep, and the "Access my data at any time" basically lets them store and refresh access tokens, not give blanket access to things like messaging.

Facebook thinking that dialog says “read my messages” is evidence enough that their culture is broken and requires external oversight.

That does not include a request to approve the read_mailbox permission, which I think should be required to query a user's private messages. This permission was deprecated in 2015. https://www.theregister.co.uk/2018/04/11/facebook_admits_use...

On the other hand, Facebook is known to make a lot of one-off arrangements with specific preferred partners such as Spotify to grant permissions and access normal apps can't use. I suspect that money changes hands for some of these special arrangements, or if not outright cash then intangibles with significant value, hence the "selling data" accusations.

Reply on news.ycombinator.com