5 ms·
This privacy problem is trivially solvable. Facebook should generate a surrogate key for user/app relationships, and only share that with the apps. Then my ID
by efsavage 16y ago
This privacy problem is trivially solvable. Facebook should generate a surrogate key for user/app relationships, and only share that with the apps. Then my ID cannot be tied back to me by anyone but facebook, and I cannot even be tracked across applications by the same developer.
- GICodeWarrior 16y agoThis is a great ground-up solution, but I would consider it far from trivial in practice for Facebook at this point. The current ids have completely permeated every part of their public APIs and likely every part of their internal systems...
- efsavage 16y agoTrue, I meant trivial in terms of complexity (as opposed to encryption). Implementation/migration would be tricky, but not impossible. Also, anyone who's worked with their APIs before knows not to underestimate Facebook's commitment to the "move fast, break things" mantra.
- finiteloop 16y agoWe have talked a lot about solutions like this, but most of them end up more trouble than the encryption proposal. For example, developers need to link back to your profile page and your friends' profile pages in their UI - do we change all those URLs individually for all applications, too (since they contain a user ID)? I think it is a clever idea, but it ends up breaking down in a lot of ways, and it has the bad quality that it is not backwards compatible with existing applications.
- zbanks 16y agoWhy not create a new URL handler that takes an app-specific user ID that redirects to the correct profile page only if the logged-in user has permission to view the page? That way, you would normally only be able to see what the world would see; but if you try to view your or your friend's profile, it's fluid?