Hacker News Reader

Comment by TeMPOraL | Hacker News Reader

At various stages of Spotify's life, Facebook login was required to use the service. I'm a long-time user, and I've learned about the messages feature from HN. It wasn't really even advertised in the UI, and not the reason I - or many other people - connected Facebook to it.

View on HN

Ok, but were you ever asked if you wanted to grant permissions for that? Did you ever see the UI I linked?

Or is your claim that you gave only permission for profile and friends but the Spotify client had messaging permission as well?

I can't recall having any idea that Spotify would have access to my messages.

>At various stages of Spotify's life, Facebook login was required to use the service.

I disagree. I have perused various trials for Spotify and other services over the years and never once had to resort to using a Federated ID/login.

Well you're disagreeing with a proven fact, so yeah... When Spotify released in 2011 Facebook was absolutely required. They removed that requirement a year later or so.

Oh wow you are totally right. It had never occurred to me that Spotify requiring Facebook to use the service was a means for them to gain access to your Facebook account.

Social logins is - and was, back then - a thing people are used to.

i can’t tell if this is snark, but as an app developer, i have considered facebook login as a means for a relatively frictionless user experience, not as a way for me to gain access to a users facebook account.

No no, if you added social login to your app it's because you're evil. You want to monetize your users, selling their data like it's 2014. You're literally Cambridge Analytica. /s

But security-wise, it is the same.

Not at all. FUD. If you're going to make a statement like that at least come with some facts. There is a massive difference between me getting login permission TO MY OWN APP, and accessing a users facebook account, or masquerading as them on other apps.

...until Facebook mishandles their end, for example, the API.

Which they have been shown to about a dozen times over this month.

I think you have either misunderstood the reports, misunderstand the API, or misunderstand how to integrate it. There is literally no way for me to accidentally steal a users data. You may not like facebook, but accusing me of putting my users data in jeopardy is just fucking cheeky.

Reply on news.ycombinator.com