10 ms·

I would like to know why some people stopped using Facebook claiming that the main reason is "the recent databreach". If you don't want to use Facebook for how

I would like to know why some people stopped using Facebook claiming that the main reason is "the recent databreach". If you don't want to use Facebook for how they handle your data in the first place, it seems perfectly fine to me. But, the data breach exploiting 3 vulnerabilities seems to be bad luck, I don't really think they're not committed to security in that sense. I'd like to know opinions from others.

oautholaf 8y ago
I actually refused to use Spotify for years because they required Facebook login. I gave in eventually as Rdio lost to Spotify in the market. Like many, though, I am deeply concerned about Facebook's policy direction and leadership. I did disconnect my Spotify account from my Facebook account the hard way (with customer support) a few months ago. In general I am enthusiastic about federated signin, but I don't want to do business with Facebook.
- mi_lk 8y ago
  What do you mean that Spotify requires Facebook login, I don't have a fb account and are using it just fine. E: Missed the past tense. I just checked, you can sign up with your email address.
  - RafiqM 8y ago
    It used to. In fact Spotify shared the same auth database with Facebook (not oAuth, the literal same password - change it in FB, it changed in Spotify and vice versa)
    - jocoda 8y ago
      Started doing FB only login in Sep 2011, but if you already had an email login you could keep it. Lasted for about a year then it was dropped.
- jliptzin 8y ago
  Couldn't you just make a new, empty facebook account just for spotify login with no real personal info on it?
messit 8y ago
IMAO Facebook IS a data breach where people voluntarily comply to, not just some vulnerabilities. Login with Facebook is a pretty stupid thing to do anyway, happily giving away even more data.. Cannot think of 1 valid reason to do that except for being too lazy to generate a new password.
- thelastidiot 8y ago
  That's the whole point of OpenID. One account with one credentials, multiple profiles on multiple sites. Lazyness is good. Much better than creating n acoounts on multiple sites using the same passwords, getting the weakest site to be compromised silently and hackers streaming back to your other accounts from that one. I'd rather trust fb.com 2fa security team over joeschmoe.com's one.
  - rectang 8y ago
    With the benefit of hindsight, that OpenID allows the ID authority to engage in tracking is a significant design flaw.
  - MiddleEndian 8y ago
    I've used facebook/google logins for some small projects in the past. In theory it should be easy. The user doesn't need to remember their username let alone a password, or even if they made an account already. They can just click to log in. There were two main issues. The first is that people don't trust facebook or google even if they already were signed into their services. They didn't want to give them any more information. The second was that it was a huge pain to maintain and test. Facebook and google changed how the services worked semi-regularly and it was not trivial to find their documentation on how to update everything (and during that time nobody could log into your service). It should have been easy, but it wasn't and it was not worth it.
daveFNbuck 8y ago
The recent data breach made many people realize that you're always just 1 instance of bad luck away from having a bunch of aggregated personal data stolen. It's pretty reasonable to decide you're better off removing yourself as a target than hoping Facebook will never again experience bad luck.
- arihant 8y ago
  It's not reasonable at all. You're 1 instance of bad luck away from death. But that's hardly a reason to not leave home.
  - ReverseCold 8y ago
    It's hardly a reason to leave home, but it's definitely a reason to, for example, not go skydiving. You obviously can't remove all risk, but you sure can reduce it.
    - zrobotics 8y ago
      That might not be the best example, though. You are more likely to die driving to the airport than you are to die while skydiving. That is an activity which is similar to riding a roller coaster: it seems much more dangerous than it actually is.
      - daveFNbuck 8y ago
        > You are more likely to die driving to the airport than you are to die while skydiving. Can you back that up? I thought this was true too but did a quick check anyway and I found skydiving death rates are 8 in a million but driving death rates are 7.1 per billion kilometers. Driving to the airport is probably more dangerous than your average drive, but it still looks like the car trip is less likely to kill you.
  - mattnewton 8y ago
    Presumably you get value from leaving home, and these people realized they weren’t getting value from Facebook. Personally I have still friends I cannot switch to other platforms so I am stuck checking my Facebook messages once a month, but that is the only reason I still have an account, and I have unliked everything else from the service.
mrweasel 8y ago
To me the data breaches was just the final straw. Naively perhaps I never believed that they would be so careless with my data as it turned out. Then on top they can’t even keep it out of the hands of people who don’t have a contract with Facebook. I think that it could be the GDPR that is now forcing Facebook to be more open about breaches, and previously they may have been keeping them secret.
mehrdadn 8y ago
> But, the data breach exploiting 3 vulnerabilities seems to be bad luck To me it seemed to stem from at least one fundamentally alarming design problem on their part, not "bad luck". [1] [1] https://news.ycombinator.com/item?id=18203396 https://news.ycombinator.com/item?id=18203396

oautholaf 8y ago

I actually refused to use Spotify for years because they required Facebook login. I gave in eventually as Rdio lost to Spotify in the market. Like many, though, I am deeply concerned about Facebook's policy direction and leadership. I did disconnect my Spotify account from my Facebook account the hard way (with customer support) a few months ago. In general I am enthusiastic about federated signin, but I don't want to do business with Facebook.

mi_lk 8y ago
What do you mean that Spotify requires Facebook login, I don't have a fb account and are using it just fine. E: Missed the past tense. I just checked, you can sign up with your email address.
- RafiqM 8y ago
  It used to. In fact Spotify shared the same auth database with Facebook (not oAuth, the literal same password - change it in FB, it changed in Spotify and vice versa)
  - jocoda 8y ago
    Started doing FB only login in Sep 2011, but if you already had an email login you could keep it. Lasted for about a year then it was dropped.
jliptzin 8y ago
Couldn't you just make a new, empty facebook account just for spotify login with no real personal info on it?

messit 8y ago

IMAO Facebook IS a data breach where people voluntarily comply to, not just some vulnerabilities. Login with Facebook is a pretty stupid thing to do anyway, happily giving away even more data.. Cannot think of 1 valid reason to do that except for being too lazy to generate a new password.

thelastidiot 8y ago
That's the whole point of OpenID. One account with one credentials, multiple profiles on multiple sites. Lazyness is good. Much better than creating n acoounts on multiple sites using the same passwords, getting the weakest site to be compromised silently and hackers streaming back to your other accounts from that one. I'd rather trust fb.com 2fa security team over joeschmoe.com's one.
- rectang 8y ago
  With the benefit of hindsight, that OpenID allows the ID authority to engage in tracking is a significant design flaw.
- MiddleEndian 8y ago
  I've used facebook/google logins for some small projects in the past. In theory it should be easy. The user doesn't need to remember their username let alone a password, or even if they made an account already. They can just click to log in. There were two main issues. The first is that people don't trust facebook or google even if they already were signed into their services. They didn't want to give them any more information. The second was that it was a huge pain to maintain and test. Facebook and google changed how the services worked semi-regularly and it was not trivial to find their documentation on how to update everything (and during that time nobody could log into your service). It should have been easy, but it wasn't and it was not worth it.

daveFNbuck 8y ago

The recent data breach made many people realize that you're always just 1 instance of bad luck away from having a bunch of aggregated personal data stolen. It's pretty reasonable to decide you're better off removing yourself as a target than hoping Facebook will never again experience bad luck.

arihant 8y ago
It's not reasonable at all. You're 1 instance of bad luck away from death. But that's hardly a reason to not leave home.
- ReverseCold 8y ago
  It's hardly a reason to leave home, but it's definitely a reason to, for example, not go skydiving. You obviously can't remove all risk, but you sure can reduce it.
  - zrobotics 8y ago
    That might not be the best example, though. You are more likely to die driving to the airport than you are to die while skydiving. That is an activity which is similar to riding a roller coaster: it seems much more dangerous than it actually is.
    - daveFNbuck 8y ago
      > You are more likely to die driving to the airport than you are to die while skydiving. Can you back that up? I thought this was true too but did a quick check anyway and I found skydiving death rates are 8 in a million but driving death rates are 7.1 per billion kilometers. Driving to the airport is probably more dangerous than your average drive, but it still looks like the car trip is less likely to kill you.
- mattnewton 8y ago
  Presumably you get value from leaving home, and these people realized they weren’t getting value from Facebook. Personally I have still friends I cannot switch to other platforms so I am stuck checking my Facebook messages once a month, but that is the only reason I still have an account, and I have unliked everything else from the service.

mrweasel 8y ago

To me the data breaches was just the final straw. Naively perhaps I never believed that they would be so careless with my data as it turned out. Then on top they can’t even keep it out of the hands of people who don’t have a contract with Facebook. I think that it could be the GDPR that is now forcing Facebook to be more open about breaches, and previously they may have been keeping them secret.

mehrdadn 8y ago

> But, the data breach exploiting 3 vulnerabilities seems to be bad luck To me it seemed to stem from at least one fundamentally alarming design problem on their part, not "bad luck". [1] [1] https://news.ycombinator.com/item?id=18203396 https://news.ycombinator.com/item?id=18203396