3 ms·

The threat is going from rather hypothetical to more and more concrete. The phone is an appliance that runs software. It would require some substantial effort

The threat is going from rather hypothetical to more and more concrete. The phone is an appliance that runs software. It would require some substantial effort to get around that barrier - reducing the risk of it actually happening. Now we're seeing that it didn't require any baked-in compromise in the hardware, firmware, or Android distribution. It's available via API.

colechristensen 8y ago
The difference is between having a window that's easy for a thief to break and giving the thief a key to your house and asking them to sign something promising not to steal. I would like, at least, for a thief to have to put some effort into it.
- lallysingh 8y ago
  And a lot of thieves won't break the window.
- lukeschlather 8y ago
  This is a really bad analogy, and misleading. A better analogy is like Facebook is a bank with safe deposit boxes. I give my key to my phone, and then my phone goes and gets something from the box for me. There is no window to break. My phone can take the key and send it to the phone manufacturer who can then get into my safe deposit box whenever they want. The only way having an API makes this easier is that the manufacturer's Facebook app is more obscure than the browser, but the manufacturer's browser can just as easily steal keys, and it's no more or less illegal.
  - tripzilch 8y ago
    Except that providing an API to a third party, without controls, makes Facebook complicit. They don't get to provide such an API to a third party and then disavow themselves of any responsibility what it is used for. Whereas if the manufacturer backdoors the browser of the phone to steal or siphon data from Facebook users, Facebook's only fault is creating the unnecessary data hazard itself (which is merely irresponsible instead of illegal in the US).
    - lukeschlather 8y ago
      As I understand it the API has controls. There's no fundamental difference between the APIs we're talking about and the web interface, except the API is easier to use programmatically.

colechristensen 8y ago

The difference is between having a window that's easy for a thief to break and giving the thief a key to your house and asking them to sign something promising not to steal. I would like, at least, for a thief to have to put some effort into it.

lallysingh 8y ago
And a lot of thieves won't break the window.
lukeschlather 8y ago
This is a really bad analogy, and misleading. A better analogy is like Facebook is a bank with safe deposit boxes. I give my key to my phone, and then my phone goes and gets something from the box for me. There is no window to break. My phone can take the key and send it to the phone manufacturer who can then get into my safe deposit box whenever they want. The only way having an API makes this easier is that the manufacturer's Facebook app is more obscure than the browser, but the manufacturer's browser can just as easily steal keys, and it's no more or less illegal.
- tripzilch 8y ago
  Except that providing an API to a third party, without controls, makes Facebook complicit. They don't get to provide such an API to a third party and then disavow themselves of any responsibility what it is used for. Whereas if the manufacturer backdoors the browser of the phone to steal or siphon data from Facebook users, Facebook's only fault is creating the unnecessary data hazard itself (which is merely irresponsible instead of illegal in the US).
  - lukeschlather 8y ago
    As I understand it the API has controls. There's no fundamental difference between the APIs we're talking about and the web interface, except the API is easier to use programmatically.