Hacker News Reader

Comment by jimrandomh | Hacker News Reader

The worst part of the Facebook/Oculus integration is that there's no way to log out--you can't even revoke the login remotely via the Facebook settings page which can do that for any other device--so anyone who has access to your headset has access to your Facebook account and your Messenger history, forever.

With Quest 1, which had a separate account system, I would frequently show off the headset by letting people try it on. With Quest 2, anyone who tries it on would have full access to my Facebook account and Messenger history, so I can't do that. And no, they don't give you any sort of warning about this, you have to figure it out yourself.

(I reported this to their bug bounty program on October 26. The submission was rejected as a duplicate. I rechecked today and it was still not fixed.)

View on HN

Clearly not being able to log out is a feature, not a bug. Mother Facebook is looking out for you by ensuring you're incentivized not to share your hardware with other people. After all, who knows what nefarious things they might do to it! And you wouldn't even be able to hang out with them in VR! If they wanted a headset, they should just get their own.

But, you might say, what if they can't afford to get their own Oculus? Facebook, aren't you just limiting your own audience by having this policy? Trust us, we've thought of everything.

With the new Oculus Direct program, you can just tell your friends they can rent-to-own a headset at $0 down, 0% APR for 12 months. And as a Oculus Direct Ohana Team Member, you can even get a credit to your own Oculus bill for every new user who signs up for Oculus Direct from your referrals, as well as a credit for every new user they sign up, and so on! And if you grow your network wide enough, you can build that network into a business!

You're assuming that there is a coherent driving force here.

I suspect that its more a case that they literally haven't thought about it.

Forgive my ignorance, but how could something as simple as logging out most likely be something "that they literally haven't thought about"?

I, at least, would assume that that would be considered a basic/essential feature.

Probably all of the engineers working at Oculus thought about it.

That doesn't mean the company's "collective mind" thought about it, however.

I'm sure they've thought about it, and rejected it.

If the product heads haven't given thought to this despite being more than aware of the current anti-trust environment, then they're just incompetent.

more likely the company's "collective mind" intentionally deprioritized/removed this feature

The lengths some people are willing to go to absolve FB of wrongdoing here are pretty incredible. Concretely, I'm sure the problem has been brought up plenty of times by plenty of people. However, the log out button got clogged up in the phlogiston at FB and they're having a hell of a time looking for it!

I think it's not an attempt at absolution so much as Hanlon's Razor.

If anything I think the fact that organizations have an emergent "collective mind" that is semi-independent from any individual suggests that organizations should be held to an even higher standard of behavior than they have been.

To be fair, I think the emergent "collective mind" is likely far stupider more instinctual than the minds of the individuals. (hence why considering incentive structures is important)

That aside, I agree that yes, organizations should be held to a higher standard than they have been.

I suspect they were so caught up in the idiotic idea that you have to be logged in to Facebook to use the thing that they figured logging out would just make the thing useless, so why allow that? It still seems like having multiple users should have been thought about.

> absolve FB of wrongdoing

much as it is trendy, you really have to think past the binary $company good/evil argument.

My argument is as follows:

1) there is no logout button for your oculus account. Its not a flow that already exists. You need to factory-reset your device to log out.

2) the team that was put in charge of linking FB accounts to oculus are not the same team that owns the home screen gui.

3) working between teams is a hard problem

4) adding a logout flow is a boat load of work, because the rift os was never designed to do logging out, because why would you need to log out of an oculus device, barring cockups?

Personally I think its a mistake to force linking accounts. I can see why they want it, it makes future multiplayer and AR integrations better.

If you see enough UX flows you would probably less surprised that an essential feature is 1 missing, 2 inaccessible. A professor of architecture used to ask the question at senior presentations: “where is the door?”. People should have heard him ask that question before and yet somehow people forgot to include something as practical and fundamental as door in their elaborate models. It’s not like these people are idiots, they’re just regular people who have other priorities and are trying to get things out the door before the next review cycle.

Ugh I had a CAD architecture class in engineering school and the final project was to design a restaurant and we did an amazing job building the best restaurant in the world until the teacher asked... where's the kitchen?

Whoops. We got so excited about the pool table and the bar and the reception area that we forgot the only thing that makes a restaurant actually a restaurant... a place to cook food.

I hate to say it but that means your design also failed to consider the foot traffic to and from the kitchen which also affects the dining experience :-) designing stuff can be hard...

It would have been a fantastic bring-your-own-food social lounge though!

There's a reason I work in IT and not architecture these days :)

I'm sorry but there is no way that facebook "didn't think about logging out." They thought about it and decided they didn't want to implement it, whatever the reason is may be up for dispute but, they definitely thought about it.

That doesn't really matter. Facebook has more than used up its credit of trust. Anyone that is not suspicious when FB messes up yet again hasn't paid attention to what they're up to.

That's a very cynical take. From what I hear support for multiple user profiles is shipping soon, it's just not done yet.

And that release will introduce a "bug" where the microphone will always be on. A totally unrelated bug will release advertising metrics from the audio and headset user login history to advertisers. They'll fix the bugs but unwittingly cause...

A cynical take? Oculus is a locked down ecosystem that fb purposefully sharded off.

Anything but cynicism regarding this product is w-e-i-r-d.

I'm more in agreement with you here. imo This is more a stupidity and not malice situation, but the other side has plenty of valid points, most of which is from Facebook's own history. They're not a good actor historically and the best way to predict the future is to look at history.

I don't see Facebook alone in this. The whole gaming industry is headed this direction. Most of my game purchases are in Steam. PS5 has a digital only version.

In addition many physical copies, if not most or all, mostly are either straight up a redemption for an online key or are functionally telling your system to go download it.

Optical drives haven’t been standard issue in PCs for a while now.

We need to allow multiple app stores with DRM per store, it's the only solution to avoid a monopolistic store that I see. It won't happen except through the legal system, I think.

I mean, on PC we already have that, plus a few DRM-free stores like GoG

There's a difference between forcing you to use a gaming account for a gaming service, and forcing you to use a social media account entirely irrelevant to gaming with your entire real-life identity (and web history, ad profiling, and in-store purchases) to use a gaming service.

I don't see too much that Facebook collects about you that Steam doesn't. If you aren't using a Facebook desktop app Steam probably knows quite a bit more about you actually.

If you are really concerned about your "real-life identity" I'd recommend not publishing it in a service that is made for public consumption

An Xbox now requires a Microsoft account, which also has associated web history, ad profiling and purchase history.

But you can make a separate one just for Xbox and they won’t ban you, unlike Facebook. And you don’t have to use your real name.

It may not be enforced, but the Microsoft ToS states "You agree not to use any false, inaccurate or misleading information when signing up for your Microsoft account." (https://www.microsoft.com/en-gb/servicesagreement/), and the signup flow does require a full name.

> Mother Facebook is looking out for you by ensuring you're incentivized not to share your hardware with other people.

Fighting its own lonely battle against Covid. /s

I really don't understand why so many people would finance a headset instead of just setting the cash aside in a stable investment and owning 12 months later.

For immediate necessities like a car or mobile phone I get it, but a VR headset isn't a necessity. Own later instead of financing. You might even be able to buy used at half price in 12 months.

The best most ironic part of the forced Facebook login is that you still have to manually add your Facebook friends as your Oculus friends. Unlike with IG, it doesn't even suggest your Facebook friends to be friends. If adding Facebook friends who joined Oculus was automatic, at least you can argue there was immediate utility, but as of right now it feels like they're just signalling that FB will watch your every move and spy on you.

As a person without a facebook account, I feel locked out of many things I shouldn't be.

Oculus is a small example, but I shouldn't be forced to have one to be notified of my town council meetings, for instance. I realize now that the way the open web died was FB making it super easy to create walled off websites for people, vs real websites.

Facebook really did and does fill a need that's been open for a very long time: a central communications/notification platform. It's been tried time and time again, with both open standards and closed standards, but Facebook is the one that caught on (very unfortunately).

For a few years I ran a successful business in my small-but-bustling town of using the Facebook Events API to pull in all the events in the area and putting them on a single calendar, then pushing those events back to my business's Facebook page before the event started. At that point everyone in town can either visit my website or follow my Facebook page, and now they have one central place to get all the town's news. I could never convince business owners to put all their events on my site directly, because "our audience is all on Facebook already" but people would have to follow a couple dozen pages and check them each individually (because Facebook won't show you everything you've followed).

Facebook eventually shut down that API (with no notice, against their own SLAs) and I kept scraping the data by hand because the residents and the businesses found it so useful. Then the pandemic hit and these small businesses had no money to pay me and they weren't holding events anymore anyway. But even after we're done with the pandemic I doubt I'll be picking it back up because Facebook is an abusive business partner to begin with, and the people you're then forced to interact with on Facebook are some of the worst and most toxic human beings I've ever met. I've had death threats from my own neighbors because an event I advertised was sold out. I've had Facebook followers stop me on the street and complain to me about taxes and zoning because they can't tell the difference between a news outlet and the city government.

But it really does highlight that Facebook is meeting a demand that nothing else, not email or RSS or SMS or anything has been able to meet. It's just a shame that they're the worst possible company to make a social network that you'd actually want to interact with.

The Quest OS is Android based and multiple accounts in Android is still kind of buggy and niche.

Game purchases are per user account not per device, which means you'd need to redownload any games anyway? It not really set up with the same kind of simplicity an Xbox or Playstation has as far as account tracking goes.

Its not really an excuse but I could see why there are problems to solve with it and they might have just deprioritized it. You can still wipe and re-login and re-download but that's a pain.

Maybe they'll add a guest mode or something.

I get the idea that the device can only know about one account at a time, but it's absurd that you can't do a factory reset on the hardware and then revoke the credentials from your FB account. ("I no longer own this hardware...", or "my Oculus was stolen".)

>it's absurd that you can't do a factory reset on the hardware and then revoke the credentials from your FB account.

You can do that. I literally did it 2 weeks ago, when I was giving away my Quest 1 headset to someone. Was a pretty smooth and simple process.

I mean, I think the worst part is the implicit loss of privacy baked into tying the accounts and the eventual data goldmine VR/AR will be for FB.

I think you're complaint is valid and I'm sure you don't mean it this way but... comments like this rub me wrong because that can be fixed with a better system, and likely will when enough people complain. It gets in the way of sharing and spreading VR which I'm sure they want to do.

Once it's fixed it will be another step on the path to saying "well FB's privacy in VR isn't as bad as it used to be!" and that's the road to acceptance.

So you can’t sell it either?

Reminds me of digital games that cost the same as a physical copy, but you can’t resell.

I'm not sure about all Oculus products, but I had an Oculus Go and I was able to reset it, so I was able to sell it.

Can confirm the same from my own experience with Oculus Q1+Q2

Isn't there some sort of hard reset?

You can't sell it? Is such a limitation even allowed by law?

You can factory reset it.

Idk where this comes from, you absolutely can. Hardware factory reset on Oculus Quest devices (both 1 and 2) is a thing. I did it myself last month, as I was giving away my Quest 1 headset, it is pretty simple.

It would be extremely strange if that wasn't possible.

Jeez talk about being unable to log out in Messenger without having to log in a new user, its annoying AF.

Those fuckers who thought and approved of that should be kicked in the nuts by steel-toe-shoe-wearing professionally frustrated soccer players.

> The worst part of the Facebook/Oculus integration is that there's no way to log out--you can't even revoke the login remotely via the Facebook settings page which can do that for any other device--so anyone who has access to your headset has access to your Facebook account and your Messenger history, forever.

I guess the solution to this is obvious: delete your facebook account if your Oculus is lost or stolen... I might be inclined to just delete my Facebook altogether if I were an Oculus owner.

I'd even go as far as suggesting that everyone delete their Facebook accounts now.

This makes me wonder, what does happen if you're logged in to Quest 2 with your Facebook account, and then you delete your Facebook profile? Do you lose access to the Quest? Do you get a fresh device? Do you get to keep your purchases, since I assume the purchases are now linked to your Facebook account?

I would never get that thing because of facebook

Does this effectively mean you can't sell the devices once used? [Edit]: Looks like you can reset it, so you can sell it.

Reply on news.ycombinator.com