Actually they did not restrict the access to your own data, but to a specific method of accessing them. Which, I am quite sure, is no legal issue for anybody
Now, those 122 friends are fully aware that their public email addresses and phone numbers are available to me. Those that do not want this, should not publish their emails or phone numbers or should not befriend me.
What Facebook is doing here is to make it hard to export my list of friends to other places, like Google's contacts or my own phone's contacts list or Google+ or whatever. I have to go over each of those 122 acquaintances and copy/paste their data manually.
What they are doing is definitely not illegal, but on the other hand I dislike Facebook so much that I'm willing to switch to a competitor that already engages in anti-competitive behavior by means of their near-monopoly, but that knows how to treat my own data.
The key here is that Facebook relationships are not people you trust. They are people you kind sorta know. That doesn't imply that they are trustworthy enough to hand over your personal information to do whatever they wish with.
Facebook can't protect you from every way your friends could mishandle the data you give them access to. If you don't want them to have access to part of your profile it's up to you to set your privacy permissions appropriately, and it's Facebook's responsibility to make that as easy as possible (which they haven't).
I don't personally use Facebook, having abandoned it almost immediately precisely because my friends were collectively volunteering all kinds of information that I considered private. Today, my friends know this is my view and it's not a problem, nor am I the only one of my group who takes this view. Obviously it took a while before my views became known, though.
In any case, this whole black-and-white idea that if you volunteer any personal information to friends on one service with privacy controls you might trust then that information is fair game for anyone to give to anyone else is just silly. If it weren't, Facebook themselves wouldn't have been pressured repeatedly into creating and maintaining all those privacy controls even though it's not really in their interests to do so and they've tried to reduce them again and failed on several occasions.
That's what I was saying: If you're going to let people see all your personal info, it should be people you would trust to use that info properly. Facebook stopping Google from importing your info but allowing Yahoo to do so won't protect you at all.
Facebook blocking one method for one company to import your data is not security; it's just corporate warfare.
Oh, I realise that. And I realise that some companies are necessarily going to get access to some basic contact information like e-mail addresses anyway if they are also in the e-mail business, because we all use mail services for e-mail to work. The fact that Google are in both the e-mail service business and the data mining business is an unfortunate coincidence in this respect, as far as I'm concerned.
I guess I just don't think it's healthy that in 2011, with all the data mining and all the poor security and genuinely harmful consequences of leaks going on, we still rely on things like unencrypted communication and centralised service providers who have direct access to personal data. We can do better now, and we would collectively be significantly safer and probably significantly happier as well if we did. Swapping Facebook spying on your entire life for Google does not seem like a particularly constructive move in that context.
This is one reason all personal communications over the Internet should long since have defaulted to encryption. I don't mind Google offering a useful service, but there's really no (technical) need for them to have access to all that data while they're doing it.
The unfortunate side effect of encryption is that it is not transparent, it requires users to be completely aware of what is and isn't encrypted and also to be completely aware of where their keys are stored and how they are treated. Defaulting to encryption would just make it so that the majority of the people are unable to communicate and or use the internet at large.
Most people do not use gmail with IMAP so suggesting client side is not going to really work. With encryption stuff like mailing lists will not work either, because you'd need to individually encrypt the message for each and every single recipient on the mailing list.
That's a load of nonsense. In the grand scheme of things, solving that problem is easy. We just haven't done it yet, because while Pandora's box is open, not enough people have yet come down with plague.
Sadly, that means things are going to have to get significantly worse before they get better. Still, as the ever-increasing leaks turn into more concrete problems like bad credit because your card was swiped, being arrested based on bad intelligence, or having your political career destroyed because the wrong private comments leaked out, sooner or later enough people with serious influence are going to get hurt for the situation to change.
we couldn't manage to devise a system where every user
has unique credentials to access sensitive systems
without those systems themselves being able to decrypt
the user's data?
It isn't, because then Google cannot render email messages in the browser for you. And if it did decryption with Javascript, it's still their client and their client can still send back information about your emails to them.
Then you've got the problem of losing functionality. I love GMail because it does a good job of searching through my emails, or filtering them. And, ever since I switched to GMail, my spam problems are over.
Of course you could argue that with encrypted emails, spam is eliminated because you can just filter away messages for which you don't have a decryption key.
But this also represents a usability problem - getting the decryption key of every user that sends you email it's a PITA; and it would also prevent unsolicited emails that you do want (like old friends contacting you for the first time, or job offers).
Really, for encrypted email to work, you have to trust the client and it cannot be the default.
But yes, it's an usability nightmare now that everyone is using webapps. And even with native apps, having to copy the private key from your computer to your smartphone would be over most people's heads.
I don't really see the difference.