Hacker News Reader

> clamping down on the spread of false information

It seems this user is at the corner of 47th and 3rd, so we won't tell them how oil companies lied about global warming. Did I get that right?

I'd imagine it would look more like "these twenty people are all in the same building in Russia posting a whole lot of opinionated content about America", if it was a true story.

> If I say I don't want you to track my location, I mean exactly that. Not respecting users' wishes like this is a terrible thing to do.

Isn't this more of an OS level issue?

There are ways to track location outside of the operating system.

For example, even Facebook says (and the comment you replied to noted) it uses photo tagging and what wifi network you're connected to in order to determine location.

> There are ways to track location outside of the operating system.

> For example, even Facebook says (and the comment you replied to noted) it uses photo tagging and what wifi network you're connected to in order to determine location.

By photo tagging, do you mean GPS coordinates? Isn't that done by the app that takes the picture?

Can't I disable Wi-Fi?

If my wireless ISP is giving everyone free access to my location through some sort of IP address or rDNS scheme, isn't this an ISP issue? I mean, can't you make this exact complaint about every single thing you use that connects through an IP address?

By photo tagging, do you mean GPS coordinates? Isn't that done by the app that takes the picture?

On Facebook and many other social apps you can manually specify the location a photograph was taken. Some apps will ask you for the location if it's not available from the operating system or metadata.

Can't I disable Wi-Fi?

Sure. Go nuts. But you have to connect to the internet somehow to use the app, so if you're not on wifi, it can get your location from your cellular network.

Yeah, I notice you didn't address the last paragraph. Any reason you responded so selectively?

OS can block access to location, but they can still have a coarse location from your IP, tagged photos, checked-in locations, message content and so on. Disabling location tracking in FB should also disable this on the FB server side.

> Disabling location tracking in FB should also disable this on the FB server side.

Facebook is free to do with their servers as they please. Don't like it? Don't use it. I don't.

How do we know you aren’t lying?

No, it isn't. Just like breaking into someones house to steal his data isn't an issue of homeowner not having a 2mil$ vault.

> No, it isn't. Just like breaking into someones house to steal his data isn't an issue of homeowner not having a 2mil$ vault.

To my knowledge, facebook isn't breaking into anything. This is a terrible analogy.

> the company said it uses the information for several purposes, including alerting users when their accounts have been accessed in an unusual place

Recently Twitch has started screaming when I log in in an incognito window. They send me an email with a 6-digit code that I have to enter because an attempt was made to access my account from an unknown machine.

Left unmentioned is any conceivable reason I would care if someone else did log in to my Twitch account. The alert and the one-time code are pure nuisance.

For you, not much. For people who make their livelihood on it, a lot.

If you’re lazy and share passwords between accounts like some people do it’s also good to know that your password might be leaked.

But I won't get an alert if this blocks someone else from accessing my account. The email will go to the address associated with the account, and the odds of me checking that address without knowing I need to are nearly zero. And all of that is as it should be, because attempts to compromise my Twitch account do not matter in any way at all.

You'd need to be a lot more important than a non-streaming Twitch account before I'm going to provide an email address that can reach me reliably.

"But how is Twitch supposed to know whether I'm a streaming account or a non-streaming account?"

I'd personally rather it be secure by default than unsecure by default.

The contrast here isn't "secure by default" vs "unsecure by default". It's whether a legitimate login can come from any computer, or only a computer Twitch recognizes as having logged in to the same account in the past. I'm not saying they should stop asking for your password.

So we have "secure by default" or "secure, and also incredibly irritating, by default".

Security in depth. It's reasonable to require 2FA for new devices.

They're not requiring 2FA for new devices:

1. I'm logging in from the same device every time. They're just freaking out because I'm in an incognito browser window.

2. They're not asking for more than one factor. The one-time code is sent to my email address. Control of the email address is already sufficient to take over the account, regardless of whether I know the account password.

If you're not able to identify new devices, is it still reasonable to prevent logins from those unidentifiable "new devices"?

I was under the impression that because of the lack of tracking in incognito, most sites regard it as a "new device". Regardless, your second point stands, makes sense. That is dumb.