15 ms·

Facebook's new features secretly add apps to your profile

141 points by AndrewWarner 16y ago

marklubi 16y ago
This should serve as a good reminder to not surf while logged into websites that may contain important personal information or that could cause personal damage if compromised.
- volare 16y ago
  I'd say it's not a reminder for many; it's news. I've always been very careful with my info on Facebook, but I never considered how easily they could invade my privacy when I'm not even on their site.
- india 16y ago
  Or you could simply turn off accept 3rd party cookies and never ever use facebook connect.
  - raganwald 16y ago
    I don't have any applications added when I visit the sites listed here, and this happens whether I have third party cookies blocked or accepted. There may be something else my system is doing to block this behaviour, or it may be a feature only rolled out to some users.
tokenadult 16y ago
I just checked my applications list on Facebook this morning, just days after when I last checked it, and I can confirm the behavior reported in this story. I didn't ask for an application to be installed at all, but two were. Yes, that is malware. After edit: just changed my Facebook status message to remind me my friends that they know other ways to reach me, with better privacy. I think it's time to take a vacation from Facebook. I don't like this contempt for customer.
- DanielBMarkham 16y ago
  I agree that it sucks. Just a logic check to make sure you are being consistent: when HackerNews does something that people complain about, are you one of those people who say the customer comes first? Or one that says that people who visit free sites shouldn't complain? I'm hoping you're consistent. I know I've long said that if I visit your site, whether I pay you anything or not, a social contract has been created. I have certain expectations. Others, however, take a much different view. If you had a list of articles on HN where folks complained about stuff, you'd find a lot of arguing on the other side. I challenge those folks to either be consistent with their previous position or change their mind. (I don't think this applies to you, but since you were the first to comment I'm using you as a bit of a straw man. Hope that's okay)
  - yellowbkpk 16y ago
    > are you one of those people who say the customer comes first? In this case, the customer is the advertiser, Facebook is the broker, and the users (and their data) are the product. With its recent action, Facebook is clearly saying "the customer comes first." > Or one that says that people who visit free sites shouldn't complain? Facebook may be free in the sense that I'm not giving them my credit card number and they are not charging me a monthly monetary fee, but the price of admission onto Facebook is your private information. Even if you don't enter anything in your profile, your friends will start to form the links (by searching for you and sending friend requests (even if you don't accept them) or tagging your face, etc.) that any marketing person pays big money for. Facebook is not free and the customer is definitely coming first.
    - DanielBMarkham 16y ago
      That made my head hurt. Somebody's doing a little bit of pretzel logic here. Let's put this more simply, if that is even possible. You visit a site. You do not pay anything, but you log on. You put stuff on the site. Regardless of the business model, do you have any sort of reasonable expectations? That's Facebook. That's HN. That's LinkedIn. That's any site that the visitor does not pay for yet is able to store things on there. Simple question.
volare 16y ago
"... if you go to an application's profile page, you can see a list of your friends who also have that app installed, essentially getting a unintentional peek at their browsing habits." This creeps me out more than anything else Facebook has done yet.
- timmaah 16y ago
  This is not a new feature.
  - kevinh 16y ago
    Yeah, they could see apps you authorized before. Not sites that add themselves, essentially showing your web browsing habits to all your friends.
    - timmaah 16y ago
      See my other comments. Apps are not randomly being "Authorized" and you can only see your friends who have "Authorized" an app. Nothing has changed..
      - kevinh 16y ago
        You're the only one who has that experience. I didn't authorize anything and I have 5 extra apps in my profile.
        timmaah 16y ago
        "Recently Used" != "Authorized"
        volare 16y ago
        The unsettling fact remains: Facebook is tracking users' activity on third party sites without express permission (though perhaps it's in the TOS; I'm not sure). And evidently, they're somewhat incompetent at hiding that information.
timmaah 16y ago
Unless I'm wrong, these are sites you have authorized via Facebook connect. They were always there. (Any site using facebook connect is an "app") And they always showed your friends who have also "connected" to that site. (Edit: Seems to be confusion between "Recently Used" and "Authorized")
- volare 16y ago
  Sorry, you are wrong. No authorization is required.
  - timmaah 16y ago
    Well then somehow it skipped adding them to my profile. Any app that shows installed for me is one I authorized.
    - volare 16y ago
      An event that trigged it for me: visiting break.com (after previously logging into facebook) resulted in a Break application being added without consent.
      - timmaah 16y ago
        I can not duplicate.. I even "Liked" break and it doesn't show up for me. These are under the "Authorized" applications or just "recently used" ?
      - robotron 16y ago
        "recently used" for me. I didn't take the time to check "authorized" before logging out.
        timmaah 16y ago
        I think that is the rub here.. Somehow they are showing as "recently used" which is completely different from "Authorized". The app does not get a session key from you and has no additional permissions or access to your account. The friends thing mentioned in the article has always been that way. Every connect site is an app, go to an app you can see friends who have installed it, as it always has
CapitalistCartr 16y ago
OK, done with another round of wading through Facebook's privacy settings, etc. and fixing what Facebook did. This is getting annoying.
- robotron 16y ago
  Truly. I'm getting sick of this. In the past I've defended Facebook and been a fan of their developer tools and relations. About had enough at this point.
- jokermatt999 16y ago
  Why even stay any more? This is becoming frequent enough that it's just ridiculous. Staying on Facebook just means that they'll continue to do this again and again. Show them it's not acceptable and delete your account.
- axod 16y ago
  Why not just assume that most stuff you post on Facebook is probably public? Saves a lot of time.
  - swernli 16y ago
    Because this isn't something you posted on Facebook, this is just visiting a site and as a consequence having an application added. As the article points out, though the app doesn't show up on your profile, a friend who looks at the application home page will you see you in a list of "friends who have this application." I agree it's hypocritical to post something on a Facebook wall and then complain if someone reads it; you post something, it's public to some extent, and you'd better be ready to face consequences of that. But this is an admitted bug that allows friends to see if you've visited a site without you having taken action other than visiting the site. That's just plain wrong.
Zakuzaa 16y ago
I came on HN just to see what Facebook might have done in these whole 24 hours of my absense from internet. And boy, am I totally freaked out. Edit: Yep, I can see apps showing up in recently used. One of the sites was vBulletin.org. I seriously do not want anyone to know that I have a forum.. at this point I am seriously considering retirement from facebook. Dear Facebook, Screw Yourself. Thanks. Edit 2: I'll be honest here - I was never much concerned about my online privacy, why? because I had faith that no comapny could get away doing something such as this. Lost my faith. Disappointed..
- fnid2 16y ago
  It amazes me that you ever had faith in facebook. Why did you think facebook would be different than other social networks? Did you think facebook would be around forever? Did you think all the work, energy, and time you put into facebook wouldn't simply evaporate? Imagine if you had invested all the time you put into facebook into your own life. Making your life better. Making the physical world around you better. That's what saddens me the most about facebook. All the hours that are going to evaporate. All the productivity there could have been. Facebook is like a battery that stores everyone's labor and we are all about to collectively chuck that battery in the trash. Well, not "we all"... I never signed up because I knew this is how it would turn out. Not to pour salt in the wound. Quite the contrary. It's more like a caring hug when it all falls apart.
digitallogic 16y ago
FYI, the gothamist network of sites (LAist, Bostonist, DCist, Phillyist, Chicagoist, SFist, Austinist, Houstonist, and Seattlest ) is doing this as well.
snewe 16y ago
This is really bad. I administer a site that uses IntenseDebate. That site has not integrated any of the Facebook Graph API at all. However, we do allow Facebook logins through Intense Debate. To my surprise, I see that this site has been added to my Facebook applications. So, if you use third party sites that in turn use Facebook's API, you effectively add Facebook Graph API to your app.
- pppglowacki 16y ago
  So does this mean all Facebook plugins introduce this flaw as well? Terrible news if so because we just integrated the "Like" button on our service.
barrkel 16y ago
I guess Ghostery's blocking of Facebook Connect is stopping this "feature" working for me.
kevinh 16y ago
Facebook seems hellbent on getting me to delete my profile. They just succeeded.
qeorge 16y ago
Tip for others cleaning their profiles: When you go to the Application Settings page make sure to change the drop-down from "Recently Used" to "Authorized." Otherwise you will not see all the apps/websites that are associated with your profile.
- DeusExMachina 16y ago
  Thank you for the advice. There were a lot of applications I didn't know had sneaked in there.
codemechanic 16y ago
Seriously freaking out guys. Getting too complex
pedalpete 16y ago
Is there any way to block this without logging out of facebook? The article says how you can get rid of an application, but not how you can stop new apps from being added (or is that just it, you can't). Would a greasemonkey script be possible which blocks facebook scripts from running when visiting a non-facebook domain?
- superkarn 16y ago
  Maybe I should use facebook in incognito mode. Or better yet, make a VM specifically for it.
terpua 16y ago
Read the article again, there's an update. It was a bug.
- luckystrike 16y ago
  Update published on the article: Facebook's Response After this story was published, Facebook spokesperson David Swain contacted us and confirmed that the appearance of unauthorized apps was a bug: "In this case, there was a bug that was showing applications on a user’s Application Settings page that the user hadn’t authorized. No information was shared with those applications and the user’s list of applications was not shown to anyone but the user. This bug has been fixed." It does appear that unauthorized apps are no longer being added to users' pages, however any unwanted applications that were previously added will still need to be removed manually.
  - mitchellhislop 16y ago
    That makes several "bugs" in a week that are glaring privacy holes. Not much better than a "feature" in my opinion.
DSwain 16y ago
To clarify, there was a bug that was showing applications on a user’s Application Settings page that the user hadn’t authorized. No information was shared with those applications and the bug has since been fixed.
edw519 16y ago
<my first and hopefully last facebook rant> I never joined facebook, myspace, or linkedin and have no intention of ever doing so. About once a week, a friend of mine tells me I really ought to join facebook, and every time, I ask them why. Lots of reasons, they tell me. To get reaquainted with long lost friends. To find out what others are up to. To let others know what you're up to. etc. etc. etc. To which I say: If we lost touch, there was probably a reason. If you want to tell me something, email me or call me. If I'm not important enough for you to single me out outside of a social network, then I don't want to know. If I want you to know anything about me, I will tell you. If I want to market myself, I will, in a manner over which I have control. If I want to find something out, google is my friend. I do not want anyone to know who I am, what I'm up to, or who I communicate with unless I specifically tell them myself. I never thought of myself as a privacy prude, but it seems like every week people are bitching about facebook privacy problems. What did you expect? I realize I'm in the minority here at hn, but I still don't get it. What's the big deal about facebook? And what did we ever do before? </rant>
- daleharvey 16y ago
  we lost touch with people for no other reason than keeping up with where they were was annoying and hard.
  - rabidgnat 16y ago
    I was reminded of this: "There's nothing sadder to me than associations held together by nothing but the glue of postage stamps. If you can't see or hear or touch a man, it's best to let him go" ~ East of Eden After reading this, I lost all guilt about losing some old friends due to moving around the country.
    - daleharvey 16y ago
      thats pretty depressing to me, most of my friends parted ways after finishing university to go travelling or get jobs. since then some have managed to move back to the same place and I see them almost weekly, some I visit or they come visit me reasonably regularly. Some I havent seen in 4 years but know I will see again.
nkassis 16y ago
I'd go to Facebook to delete my profile but that would involve logging in which means might end up making things worse. ;p
iamdave 16y ago
With all this talk of people leaving Facebook, I can't help but wonder how much of a dent this actually makes. We're the techies, we pay attention to things like this. Our friends, the nontechies don't, and they don't care. We're out numbered 5:1 by nontechies who aren't going to raise a fuss from this.
- tokenadult 16y ago
  I can't help but wonder how much of a dent this actually makes. Time will tell. But Facebook's other issue is legal and regulatory exposure, besides user loss.
LiveTheDream 16y ago
Facebook's response (via pokesperson David Swain, FTA): In this case, there was a bug that was showing applications on a user’s Application Settings page that the user hadn’t authorized. No information was shared with those applications and the user’s list of applications was not shown to anyone but the user. This bug has been fixed.
- joeyh 16y ago
  That's nice. However, the work required to stay on top of Facebook's never-ending privacy snafu has become far greater than the small aggregation/old friend contact benefit. I'm out.
- alttab 16y ago
  Sounds to me like the bug was showing you the application on the list - not actually putting it there.
  - volare 16y ago
    Yes - this still reveals that Facebook is tracking users' activity on third party sites without express permission.
deleted 16y ago
[deleted]
ralphc 16y ago
Like many of you, I have several browsers installed (I'm on a Mac). What I started doing is not log into Facebook on my "main" browser, Firefox, instead logging in with Safari, where I don't do much else. Flipping to Facebook is now a Command-Tab instead of Command-`, other than that I'm not disrupted much. So, good idea, bad idea?
- tortilla 16y ago
  Good idea, for now. Until a new "feature" is added.
- nooneelse 16y ago
  I've been doing the same. I think of them as the "browser of record" and the "accounts not yet tied to my full id browser." I'm thinking that the next steps in the arms race (if needed) are along the lines of putting one or both of them in virtual machines, having one or both use some different proxies. I like better the idea of a greasemonkey script that would block sites from reading my facebook id.
nanijoe 16y ago
These guys sure have some nerve...I just saw the below as I tried to edit my privacy settings "When your friend visits a Facebook-enhanced application or website, they may want to share certain information to make the experience more social. For example, a greeting card application may use your birthday information to prompt your friend to send a card"
- nooneelse 16y ago
  On the "Privacy Settings > Applications and Websites" page, there is a "What your friends can share about you" listing. This is the really fun thing about all this... they seem to know how to put just enough controls here and there in the labyrinth of settings so that few specific complaints really stick. While, at the same time, they never unify the intent of the controls into something that the user can see all the implications of their settings and then set them the way they want. To me, this just cries out for some visualization. Maybe some nested circles (each circle representing a friend group) around the user in the middle, arrows (representing the types of information that is shared) radiating out to the furthest circle which can see that information.
Qz 16y ago
According to an article update, the applications weren't actually authorized and were showing up when they shouldn't have been (aka they weren't actually 'installed'). Not that that restore my faith in Facebook whatsoever. I never use facebook connect anyway.
sushi 16y ago
This was getting way out of my tolerance so I deactivated my account. If facebook doesn't clear this mess I am even deleting it.
gills 16y ago
Does anyone else wonder if Facebook churns their policies just to get disinterested and annoyed users to sign in one more time to fix their settings?
dhimes 16y ago
I have a question. Under Privacy Settings -> Applications and Websites, they have this sentence in the text: When you visit a Facebook-enhanced application or website, it may access any information you have made visible to Everyone (Edit Profile Privacy) as well as your publicly available information. Now, my question: Does this mean that when I visit some website that's "Facebook-enhanced" and I don't do a damn thing, is the site going to pull the info? What the heck is a "F-E" website? The ones with the little "fb" icon they just introduced?
malloreon 16y ago
Now I only visit facebook in an incognito chrome window.
deleted 16y ago
[deleted]
lukeqsee 16y ago
Facebook's open graph is seriously scary. Since I joined Facebook (circa Sept '07) I have defended their privacy standards, I thought were doing a great job, considering the shear size of the problem. Not so anymore. In the last two months, I've read more articles about their antics than in the last 3 years. Here are the significant problems I have with them now: 1) Defaulting to public for user posts 2) Open graph - any web developer or rogue person has much more power and access to my "personal" data, where's the opt-in instead of opt-out? 3) Random and chaotic code glitches, e.g., live chats being visible, private messages getting delivered to the wrong person. As a web developer, I know it's hard. We're humans, we make mistakes, but these are inexcusable. Even remotely decent testing would have uncovered them. To sum it all up, Facebook has a great thing going, 400m users, $1b valuation, large app database. But if they want to keep their dominance and users like me, they need to seriously review their stance toward privacy and user's rights. It isn't up to par.
budu3 16y ago
Nowadays I'm afraid to surf the net whilst logged onto facebook. That's how bad it's gotten.
fnid2 16y ago
Facebook's usage is starting to decline, so they have to do everything they can -- while they still have users -- to maximize the value of their graph for the investors who are going to do whatever they have to with that graph to salvage what is left of a crumbling social network. People on facebook right now are going to be getting spammed for years and years and years, in the mail, on their birthdays, to their cell phones... You have no idea the lengths to which people will go to salvage hundreds of millions of dollars...
- jacquesm 16y ago
  > Facebook's usage is starting to decline I've had that feeling for a while now, do you have any independent figures or is that a gut feeling?
  - fnid2 16y ago
    Just a gut feeling. I've... we've known something like this was coming for a long time. Remember, MarkZ is a bit of an egomaniac. Have you seen what happens to egomaniacs when their world starts to crumble around them? Not to get overly dramatic, but you know the Russians gave him hundreds of millions of dollars. That's a lot of money. You know, in startup land, we tend to think the world works differently than the world works. Mark's investors are probably putting a huge amount of pressure on him right now and the activity on the web over the past few weeks has sent FB users leaving in droves. HN used to be full of FB fans, API fans, technical fans look how that has turned in just a couple weeks... If you were facebook and you saw your subscriber base growing and growing, then plateau, then start to decline rapidly -- uncontrollably, what would you do? What would you do if you knew that your worth was dropping just like that. Imagine having millions of dollars in the stock market today when this mess happened. You'd be sick right now. That money won't come back. Facebook's users won't come back and Mark's chances of keeping his paper billions is evaporating right before his eyes... I can see it. I can feel it. The writing is on the proverbial facebook wall.
    - jacquesm 16y ago
      According to pretty much every site that ranks websites according to traffic / visitors facebook is currently #2 and rising, some hard proof that that is more than a gut feeling would go a long way towards substantiating that this is not just a tech sector issue.
cracki 16y ago
i'm so glad don't have a facebook account. i'm also glad i deleted the account i had with a national facebook-clone a long long time ago. all this pseudo-social bullshit is getting on my nerves. go out, meet people, exchange phone numbers and email adresses and maybe even STDs, but for fuck's sake don't delude yourselves into thinking facebook means being social.

141 points by AndrewWarner 16y ago

This should serve as a good reminder to not surf while logged into websites that may contain important personal information or that could cause personal damage if compromised.

volare 16y ago
I'd say it's not a reminder for many; it's news. I've always been very careful with my info on Facebook, but I never considered how easily they could invade my privacy when I'm not even on their site.
india 16y ago
Or you could simply turn off accept 3rd party cookies and never ever use facebook connect.
- raganwald 16y ago
  I don't have any applications added when I visit the sites listed here, and this happens whether I have third party cookies blocked or accepted. There may be something else my system is doing to block this behaviour, or it may be a feature only rolled out to some users.

tokenadult 16y ago

I just checked my applications list on Facebook this morning, just days after when I last checked it, and I can confirm the behavior reported in this story. I didn't ask for an application to be installed at all, but two were. Yes, that is malware. After edit: just changed my Facebook status message to remind me my friends that they know other ways to reach me, with better privacy. I think it's time to take a vacation from Facebook. I don't like this contempt for customer.

DanielBMarkham 16y ago
I agree that it sucks. Just a logic check to make sure you are being consistent: when HackerNews does something that people complain about, are you one of those people who say the customer comes first? Or one that says that people who visit free sites shouldn't complain? I'm hoping you're consistent. I know I've long said that if I visit your site, whether I pay you anything or not, a social contract has been created. I have certain expectations. Others, however, take a much different view. If you had a list of articles on HN where folks complained about stuff, you'd find a lot of arguing on the other side. I challenge those folks to either be consistent with their previous position or change their mind. (I don't think this applies to you, but since you were the first to comment I'm using you as a bit of a straw man. Hope that's okay)
- yellowbkpk 16y ago
  > are you one of those people who say the customer comes first? In this case, the customer is the advertiser, Facebook is the broker, and the users (and their data) are the product. With its recent action, Facebook is clearly saying "the customer comes first." > Or one that says that people who visit free sites shouldn't complain? Facebook may be free in the sense that I'm not giving them my credit card number and they are not charging me a monthly monetary fee, but the price of admission onto Facebook is your private information. Even if you don't enter anything in your profile, your friends will start to form the links (by searching for you and sending friend requests (even if you don't accept them) or tagging your face, etc.) that any marketing person pays big money for. Facebook is not free and the customer is definitely coming first.
  - DanielBMarkham 16y ago
    That made my head hurt. Somebody's doing a little bit of pretzel logic here. Let's put this more simply, if that is even possible. You visit a site. You do not pay anything, but you log on. You put stuff on the site. Regardless of the business model, do you have any sort of reasonable expectations? That's Facebook. That's HN. That's LinkedIn. That's any site that the visitor does not pay for yet is able to store things on there. Simple question.

volare 16y ago

"... if you go to an application's profile page, you can see a list of your friends who also have that app installed, essentially getting a unintentional peek at their browsing habits." This creeps me out more than anything else Facebook has done yet.

timmaah 16y ago
This is not a new feature.
- kevinh 16y ago
  Yeah, they could see apps you authorized before. Not sites that add themselves, essentially showing your web browsing habits to all your friends.
  - timmaah 16y ago
    See my other comments. Apps are not randomly being "Authorized" and you can only see your friends who have "Authorized" an app. Nothing has changed..
    - kevinh 16y ago
      You're the only one who has that experience. I didn't authorize anything and I have 5 extra apps in my profile.
      - timmaah 16y ago
        "Recently Used" != "Authorized"
        volare 16y ago
        The unsettling fact remains: Facebook is tracking users' activity on third party sites without express permission (though perhaps it's in the TOS; I'm not sure). And evidently, they're somewhat incompetent at hiding that information.

timmaah 16y ago

Unless I'm wrong, these are sites you have authorized via Facebook connect. They were always there. (Any site using facebook connect is an "app") And they always showed your friends who have also "connected" to that site. (Edit: Seems to be confusion between "Recently Used" and "Authorized")

volare 16y ago
Sorry, you are wrong. No authorization is required.
- timmaah 16y ago
  Well then somehow it skipped adding them to my profile. Any app that shows installed for me is one I authorized.
  - volare 16y ago
    An event that trigged it for me: visiting break.com (after previously logging into facebook) resulted in a Break application being added without consent.
    - timmaah 16y ago
      I can not duplicate.. I even "Liked" break and it doesn't show up for me. These are under the "Authorized" applications or just "recently used" ?
    - robotron 16y ago
      "recently used" for me. I didn't take the time to check "authorized" before logging out.
      - timmaah 16y ago
        I think that is the rub here.. Somehow they are showing as "recently used" which is completely different from "Authorized". The app does not get a session key from you and has no additional permissions or access to your account. The friends thing mentioned in the article has always been that way. Every connect site is an app, go to an app you can see friends who have installed it, as it always has

CapitalistCartr 16y ago

OK, done with another round of wading through Facebook's privacy settings, etc. and fixing what Facebook did. This is getting annoying.

robotron 16y ago
Truly. I'm getting sick of this. In the past I've defended Facebook and been a fan of their developer tools and relations. About had enough at this point.
jokermatt999 16y ago
Why even stay any more? This is becoming frequent enough that it's just ridiculous. Staying on Facebook just means that they'll continue to do this again and again. Show them it's not acceptable and delete your account.
axod 16y ago
Why not just assume that most stuff you post on Facebook is probably public? Saves a lot of time.
- swernli 16y ago
  Because this isn't something you posted on Facebook, this is just visiting a site and as a consequence having an application added. As the article points out, though the app doesn't show up on your profile, a friend who looks at the application home page will you see you in a list of "friends who have this application." I agree it's hypocritical to post something on a Facebook wall and then complain if someone reads it; you post something, it's public to some extent, and you'd better be ready to face consequences of that. But this is an admitted bug that allows friends to see if you've visited a site without you having taken action other than visiting the site. That's just plain wrong.

Zakuzaa 16y ago

I came on HN just to see what Facebook might have done in these whole 24 hours of my absense from internet. And boy, am I totally freaked out. Edit: Yep, I can see apps showing up in recently used. One of the sites was vBulletin.org. I seriously do not want anyone to know that I have a forum.. at this point I am seriously considering retirement from facebook. Dear Facebook, Screw Yourself. Thanks. Edit 2: I'll be honest here - I was never much concerned about my online privacy, why? because I had faith that no comapny could get away doing something such as this. Lost my faith. Disappointed..

fnid2 16y ago
It amazes me that you ever had faith in facebook. Why did you think facebook would be different than other social networks? Did you think facebook would be around forever? Did you think all the work, energy, and time you put into facebook wouldn't simply evaporate? Imagine if you had invested all the time you put into facebook into your own life. Making your life better. Making the physical world around you better. That's what saddens me the most about facebook. All the hours that are going to evaporate. All the productivity there could have been. Facebook is like a battery that stores everyone's labor and we are all about to collectively chuck that battery in the trash. Well, not "we all"... I never signed up because I knew this is how it would turn out. Not to pour salt in the wound. Quite the contrary. It's more like a caring hug when it all falls apart.

digitallogic 16y ago

FYI, the gothamist network of sites (LAist, Bostonist, DCist, Phillyist, Chicagoist, SFist, Austinist, Houstonist, and Seattlest ) is doing this as well.

snewe 16y ago

This is really bad. I administer a site that uses IntenseDebate. That site has not integrated any of the Facebook Graph API at all. However, we do allow Facebook logins through Intense Debate. To my surprise, I see that this site has been added to my Facebook applications. So, if you use third party sites that in turn use Facebook's API, you effectively add Facebook Graph API to your app.

pppglowacki 16y ago
So does this mean all Facebook plugins introduce this flaw as well? Terrible news if so because we just integrated the "Like" button on our service.

barrkel 16y ago

I guess Ghostery's blocking of Facebook Connect is stopping this "feature" working for me.

kevinh 16y ago

Facebook seems hellbent on getting me to delete my profile. They just succeeded.

qeorge 16y ago

Tip for others cleaning their profiles: When you go to the Application Settings page make sure to change the drop-down from "Recently Used" to "Authorized." Otherwise you will not see all the apps/websites that are associated with your profile.

DeusExMachina 16y ago
Thank you for the advice. There were a lot of applications I didn't know had sneaked in there.

codemechanic 16y ago

Seriously freaking out guys. Getting too complex

pedalpete 16y ago

Is there any way to block this without logging out of facebook? The article says how you can get rid of an application, but not how you can stop new apps from being added (or is that just it, you can't). Would a greasemonkey script be possible which blocks facebook scripts from running when visiting a non-facebook domain?

superkarn 16y ago
Maybe I should use facebook in incognito mode. Or better yet, make a VM specifically for it.

terpua 16y ago

Read the article again, there's an update. It was a bug.

luckystrike 16y ago
Update published on the article: Facebook's Response After this story was published, Facebook spokesperson David Swain contacted us and confirmed that the appearance of unauthorized apps was a bug: "In this case, there was a bug that was showing applications on a user’s Application Settings page that the user hadn’t authorized. No information was shared with those applications and the user’s list of applications was not shown to anyone but the user. This bug has been fixed." It does appear that unauthorized apps are no longer being added to users' pages, however any unwanted applications that were previously added will still need to be removed manually.
- mitchellhislop 16y ago
  That makes several "bugs" in a week that are glaring privacy holes. Not much better than a "feature" in my opinion.

DSwain 16y ago

To clarify, there was a bug that was showing applications on a user’s Application Settings page that the user hadn’t authorized. No information was shared with those applications and the bug has since been fixed.

edw519 16y ago

<my first and hopefully last facebook rant> I never joined facebook, myspace, or linkedin and have no intention of ever doing so. About once a week, a friend of mine tells me I really ought to join facebook, and every time, I ask them why. Lots of reasons, they tell me. To get reaquainted with long lost friends. To find out what others are up to. To let others know what you're up to. etc. etc. etc. To which I say: If we lost touch, there was probably a reason. If you want to tell me something, email me or call me. If I'm not important enough for you to single me out outside of a social network, then I don't want to know. If I want you to know anything about me, I will tell you. If I want to market myself, I will, in a manner over which I have control. If I want to find something out, google is my friend. I do not want anyone to know who I am, what I'm up to, or who I communicate with unless I specifically tell them myself. I never thought of myself as a privacy prude, but it seems like every week people are bitching about facebook privacy problems. What did you expect? I realize I'm in the minority here at hn, but I still don't get it. What's the big deal about facebook? And what did we ever do before? </rant>

daleharvey 16y ago
we lost touch with people for no other reason than keeping up with where they were was annoying and hard.
- rabidgnat 16y ago
  I was reminded of this: "There's nothing sadder to me than associations held together by nothing but the glue of postage stamps. If you can't see or hear or touch a man, it's best to let him go" ~ East of Eden After reading this, I lost all guilt about losing some old friends due to moving around the country.
  - daleharvey 16y ago
    thats pretty depressing to me, most of my friends parted ways after finishing university to go travelling or get jobs. since then some have managed to move back to the same place and I see them almost weekly, some I visit or they come visit me reasonably regularly. Some I havent seen in 4 years but know I will see again.

nkassis 16y ago

I'd go to Facebook to delete my profile but that would involve logging in which means might end up making things worse. ;p

iamdave 16y ago

With all this talk of people leaving Facebook, I can't help but wonder how much of a dent this actually makes. We're the techies, we pay attention to things like this. Our friends, the nontechies don't, and they don't care. We're out numbered 5:1 by nontechies who aren't going to raise a fuss from this.

tokenadult 16y ago
I can't help but wonder how much of a dent this actually makes. Time will tell. But Facebook's other issue is legal and regulatory exposure, besides user loss.

LiveTheDream 16y ago

Facebook's response (via pokesperson David Swain, FTA): In this case, there was a bug that was showing applications on a user’s Application Settings page that the user hadn’t authorized. No information was shared with those applications and the user’s list of applications was not shown to anyone but the user. This bug has been fixed.

joeyh 16y ago
That's nice. However, the work required to stay on top of Facebook's never-ending privacy snafu has become far greater than the small aggregation/old friend contact benefit. I'm out.
alttab 16y ago
Sounds to me like the bug was showing you the application on the list - not actually putting it there.
- volare 16y ago
  Yes - this still reveals that Facebook is tracking users' activity on third party sites without express permission.

deleted 16y ago

[deleted]

ralphc 16y ago

Like many of you, I have several browsers installed (I'm on a Mac). What I started doing is not log into Facebook on my "main" browser, Firefox, instead logging in with Safari, where I don't do much else. Flipping to Facebook is now a Command-Tab instead of Command-`, other than that I'm not disrupted much. So, good idea, bad idea?

tortilla 16y ago
Good idea, for now. Until a new "feature" is added.
nooneelse 16y ago
I've been doing the same. I think of them as the "browser of record" and the "accounts not yet tied to my full id browser." I'm thinking that the next steps in the arms race (if needed) are along the lines of putting one or both of them in virtual machines, having one or both use some different proxies. I like better the idea of a greasemonkey script that would block sites from reading my facebook id.

nanijoe 16y ago

These guys sure have some nerve...I just saw the below as I tried to edit my privacy settings "When your friend visits a Facebook-enhanced application or website, they may want to share certain information to make the experience more social. For example, a greeting card application may use your birthday information to prompt your friend to send a card"

nooneelse 16y ago
On the "Privacy Settings > Applications and Websites" page, there is a "What your friends can share about you" listing. This is the really fun thing about all this... they seem to know how to put just enough controls here and there in the labyrinth of settings so that few specific complaints really stick. While, at the same time, they never unify the intent of the controls into something that the user can see all the implications of their settings and then set them the way they want. To me, this just cries out for some visualization. Maybe some nested circles (each circle representing a friend group) around the user in the middle, arrows (representing the types of information that is shared) radiating out to the furthest circle which can see that information.

Qz 16y ago

According to an article update, the applications weren't actually authorized and were showing up when they shouldn't have been (aka they weren't actually 'installed'). Not that that restore my faith in Facebook whatsoever. I never use facebook connect anyway.

sushi 16y ago

This was getting way out of my tolerance so I deactivated my account. If facebook doesn't clear this mess I am even deleting it.

gills 16y ago

Does anyone else wonder if Facebook churns their policies just to get disinterested and annoyed users to sign in one more time to fix their settings?

dhimes 16y ago

I have a question. Under Privacy Settings -> Applications and Websites, they have this sentence in the text: When you visit a Facebook-enhanced application or website, it may access any information you have made visible to Everyone (Edit Profile Privacy) as well as your publicly available information. Now, my question: Does this mean that when I visit some website that's "Facebook-enhanced" and I don't do a damn thing, is the site going to pull the info? What the heck is a "F-E" website? The ones with the little "fb" icon they just introduced?

malloreon 16y ago

Now I only visit facebook in an incognito chrome window.

deleted 16y ago

[deleted]

lukeqsee 16y ago

Facebook's open graph is seriously scary. Since I joined Facebook (circa Sept '07) I have defended their privacy standards, I thought were doing a great job, considering the shear size of the problem. Not so anymore. In the last two months, I've read more articles about their antics than in the last 3 years. Here are the significant problems I have with them now: 1) Defaulting to public for user posts 2) Open graph - any web developer or rogue person has much more power and access to my "personal" data, where's the opt-in instead of opt-out? 3) Random and chaotic code glitches, e.g., live chats being visible, private messages getting delivered to the wrong person. As a web developer, I know it's hard. We're humans, we make mistakes, but these are inexcusable. Even remotely decent testing would have uncovered them. To sum it all up, Facebook has a great thing going, 400m users, $1b valuation, large app database. But if they want to keep their dominance and users like me, they need to seriously review their stance toward privacy and user's rights. It isn't up to par.

budu3 16y ago

Nowadays I'm afraid to surf the net whilst logged onto facebook. That's how bad it's gotten.

fnid2 16y ago

Facebook's usage is starting to decline, so they have to do everything they can -- while they still have users -- to maximize the value of their graph for the investors who are going to do whatever they have to with that graph to salvage what is left of a crumbling social network. People on facebook right now are going to be getting spammed for years and years and years, in the mail, on their birthdays, to their cell phones... You have no idea the lengths to which people will go to salvage hundreds of millions of dollars...

jacquesm 16y ago
> Facebook's usage is starting to decline I've had that feeling for a while now, do you have any independent figures or is that a gut feeling?
- fnid2 16y ago
  Just a gut feeling. I've... we've known something like this was coming for a long time. Remember, MarkZ is a bit of an egomaniac. Have you seen what happens to egomaniacs when their world starts to crumble around them? Not to get overly dramatic, but you know the Russians gave him hundreds of millions of dollars. That's a lot of money. You know, in startup land, we tend to think the world works differently than the world works. Mark's investors are probably putting a huge amount of pressure on him right now and the activity on the web over the past few weeks has sent FB users leaving in droves. HN used to be full of FB fans, API fans, technical fans look how that has turned in just a couple weeks... If you were facebook and you saw your subscriber base growing and growing, then plateau, then start to decline rapidly -- uncontrollably, what would you do? What would you do if you knew that your worth was dropping just like that. Imagine having millions of dollars in the stock market today when this mess happened. You'd be sick right now. That money won't come back. Facebook's users won't come back and Mark's chances of keeping his paper billions is evaporating right before his eyes... I can see it. I can feel it. The writing is on the proverbial facebook wall.
  - jacquesm 16y ago
    According to pretty much every site that ranks websites according to traffic / visitors facebook is currently #2 and rising, some hard proof that that is more than a gut feeling would go a long way towards substantiating that this is not just a tech sector issue.

cracki 16y ago

i'm so glad don't have a facebook account. i'm also glad i deleted the account i had with a national facebook-clone a long long time ago. all this pseudo-social bullshit is getting on my nerves. go out, meet people, exchange phone numbers and email adresses and maybe even STDs, but for fuck's sake don't delude yourselves into thinking facebook means being social.