Hacker News Reader

Comment by zuppy | Hacker News Reader

that's not the only purpose of the SDK, we're using it for social login (login with Facebook).

You can implement OAuth entirely server-side without any client support beyond displaying a web view. No need to include spyware and the approach is reusable for any OAuth provider.

You can’t, it’s against their policy, if they catch you they’ll revoke your access.

developers.facebook.com/policy/ 8.2 (which states “Native IOS and Android apps that implement Facebook Login must use our official SDKs for login.” This has a help icon next to it that opens a dialog on their site that shows a couple pictures and then explains “Android apps should use the default login behavior defined by the SDK, which may use the web-view Login dialog. On iOS, only kiosk apps may use a web-view Login dialog.”

You understand the subtext here right? They literally want you to install their malware on users devices so you can use their SSO. That's the entire ploy. It's how they ensure their malware spreads.

A generic login experience on the web (where the entire login flow is implemented in the browser and the login button just redirects to Safari, including for email/password accounts) should work around it. You can provide technical reasons as excuses for why it's impossible for your app to include edge cases for each login provider to be included natively in the app.

So do what the GP was hinting at and drop support for Facebook login, drop the SDK, wash your hands and sleep better as well.

this is not how real life works, you don’t get to choose all the features and you can’t quit jobs every time you’re asked to integrate a sdk. also, you are suggesting that it is a good option to drop support for all the customer accounts that have used fb login, this is silly.

sometimes i wonder if you people lost all the connections with the reality... or if you were ever employed.

I've been everything from making more money than I needed to homeless and borrowing couches and front porches in winter.

I've also refused to include Facebook in my life even though the majority of my extended family practically live there and rarely communicate outside of FB posts. My wife and I just get text messages on the rare occasions instead.

Yes, been employed and unemployed. And I'm under no illusions that FB login support will get dropped anytime soon. I can still lobby for the desirable alternative.

Why load it unless it’s being actively used for authentication?

Well, how do you get consistent tracking then?

Obs: I'm being sarcastic but since it's either this or developer laziness, I'm betting on tracking since I always start from the principle that the developers analysed the situation and made an explicit choice.

Except, you know, when does a developer ever have a choice? You are asked to put the SDK in and you do it...

this, combined with a wrong past technical decision that we can not change it instantly. unfortunately it's not as easy to fix mobile bugs as it is on the web, as you have to both pass the approval process and wait for the full rollout to clients.

in our case, it's just a wrong decision, we don't use it for tracking.

also, if you use facebook login, the terms and conditions force you to use their SDK (which automatically initialises when included and does this crap).

https://developers.facebook.com/policy/ - 8.2

"Native iOS and Android apps that implement Facebook Login must use our official SDKs for login. "

Just to clarify, when I say "the developer" I don't necessarily mean the person writing the code: I mean the organisation developing the software, so they definitely have the choice.

In terms of the person writing the code, they can certainly push back. Being asked to add the Facebook SDK is either a red flag enough for him/her to do so, or they don't mind. In either case, they've made that choice.

> we don't use it for tracking

True, you're just facilitating, not profiting.

Such a clear and obvious good reason to drop support and walk away.

Some people like to keep their job...

But it's all or nothing right?

Spyware isn't not spyware because it's useful to a minority of users sometimes. You throw all of your users under the tracking bus by doing this.

You can implement that without the SDK. This is no excuse!

Reply on news.ycombinator.com