13 ms·
Clearing Up a Few Things About Facebook’s Partners
- forapurpose 8y agoIn case people want to read the original story and discussion: https://news.ycombinator.com/item?id=18712382 https://news.ycombinator.com/item?id=18712382
- deleted 8y ago[deleted]
- verdverm 8y agoTitle seems aggressive, yes? I spent an hour trying to remove all of the advertisement connections, have no idea how far into it I got. Mostly realtors and car dealerships
- deleted 8y ago[deleted]
- cryoshon 8y agothere's nothing to clear up. the statement is a non-denial denial when you read it closely.
- askafriend 8y agoI don't understand your point. It reads like a fairly clear and descriptive statement to me and in-line with actual facts reported by the newsmedia (without the messy presentation of the newsmedia).
- jeromebaek 8y agoThey are no good at all at apologizing. They somehow manage to be consistently condescending. Facebookers, take this into account next time (or the next dozen times) you have to write up an apology. https://news.ycombinator.com/item?id=6116544 https://news.ycombinator.com/item?id=6116544
- mrnobody_67 8y agoHe's been apologizing since 2006... think they'd get better at it by now. https://www.fastcompany.com/40547045/a-brief-history-of-mark-zuckerberg-apologizing-or-not-apologizing-for-stuff https://www.fastcompany.com/40547045/a-brief-history-of-mark...
- kkhire 8y agoCan someone clear this up (preferably if you've worked with the FB API): when NYT published that spotify and netflix have accessed to private messages, isn't that simply for them to do a POST call for sharing a tv show or song?
- ubernostrum 8y agoFacebook appears to have designed their system in such a way that permissions were not granular enough to do things like "Spotify can only post certain types of messages". Instead it had to be "Spotify has full read/write access to all private messages". Given Facebook's history it's hard to believe that the lack of granularity, and resulting incentivizing of users to grant as much access to personal data as possible, was an accidental oversight.
- compiler-guy 8y agoSeems to me that it was more of a "who cares" oversight than an accidental one.
- bduerst 8y agoLooking at the Spotify sign-in image from 2013 that jahlove found above, Spotify didn't even ask for that auth permission. The full messaging access seemed to be a hidden bonus for their larger partners.
- chillacy 8y agoThis article seems to imply that Spotify ran an entire messenger client within its front end, which does require full read write access, just like your email client requires access to your email right? It’s more dangerous because Spotify is a website and so could store your messages in theory.
- PaybackTony 8y agoI think what they are failing to address here, and what is incredibly misleading of them in this message, is that they fail to define what "public information" or "public activity" means to them. They define this in their TOS & Privacy Policy as pretty much anything you do on facebook, or a separate property that integrates with them, that you don't EXPLICITLY set as private. This statement tries to make it sound like they use very little data, when in all actuality most of what you do on FB is considered "public" to them even if they don't show this stuff publicly. That's not okay.
- onetimemanytime 8y agoSo CuteApp allows you to read FB messages and email from their app. They cut deal with FB but you still need to want to do it and then enter your FB credentials while in CuteApp. Unless messages are saved in the app, unsecured, I see no problem. FB users read his messages somewhere else but using their FB credentials. (If I understood it correctly)
- bdibs 8y agoThe bigger issue is that the vast majority of users aren't informed about what they're granting access to. If they truly knew half of what these applications were doing with their "private" information, I can guarantee less than half would continue using it.
- hackinthebochs 8y agoNo you can't guarantee that. From my experience, most people simply don't care.
- ameister14 8y agoNo, CuteApp allows you to read FB messages and email from their app. They cut a deal with FB and even if you don't use the service, CuteApp can still access your messages. You don't actually know about the service - it isn't in the permissions and you didn't give explicit consent for it. Doesn't matter.
- justinsaccount 8y agoDo you have any evidence to back up these claims?
- ameister14 8y agoYes, actually. 1. There is no record of an explicit permissions check, and there are records of other checks. 2. Facebook has acknowledged (multiple times, now) giving read/write access as long as you were logged in through Facebook to one of these systems - you don't have to explicitly enable it and engage the message service, which is what OP was saying. 3. They say: "No third party was reading your private messages, or writing messages to your friends without your permission." They aren't saying that no third party was reading or writing messages, just that you gave it permission to do so. Unfortunately, that permission was, again, not explicitly given. It was a blanket (access data) permission. Facebook has a documented and admitted history of obfuscating what permissions you are actually giving it - the messaging app being one example.
- zephyrnh 8y agoI assume someone at Facebook, hopefully the person that wrote this, or someone who has more influence over this issue, is reading. I am an engineer. I understand technology better than most of the general population. When I sign in to my Facebook account to use Spotify, I am absolutely not expecting that Spotify will now have access to read every single one of my private messages. This is a gross violation of trust, and if this is what happened, then the fact that you not only made this mistake, but also then published this blog post defending it, marks a low point for Facebook. Perhaps irrecoverably so for me. "After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app. Our API provided partners with access to the person’s messages in order to power this type of feature." This is a write permission. So you needed to give Spotify permission to create a message. It seems that your system combines the read and write permissions, since you just grouped them together by saying "access to the person's messages". It also seems from your defense that you see absolutely no issue with this. In order to share a song through Spotify, you are giving them access to every single private message the user has ever written. I find it hard to believe that Facebook refuses to acknowledge any fault in this: The initial product decision, the upholding of this decision through previous privacy investigations, and this PR response. Am I misinterpreting the facts or scale of this?
- marrone12 8y agoWell if you want to receive a message that someone sends you then you'd also need to grant Spotify read permissions. In essence, you'd be using Spotify as a client app for fb messenger. How else could that work without Spotify getting read/write access to your messages?
- zephyrnh 8y agoI assume the point here to send someone a message on FB with a Spotify link, so they click on it in their messages and it opens up the Spotify app. If you just want to send a message from one Spotify user directly to another in Spotify, you don't need FB messages at all, right? Spotify has a list of all your FB friend IDs already and knows which Spotify accounts each is connected to
- dangerboysteve 8y agoCrisis management playbook in action.
- kerng 8y agoWhat did I just read? Is this a legitimate Facebook post? Are they actively trying to defend and justify their actions? First step in crisis management would be to acknowledge the crisis for what it is. Without that stage Facebook will never get out of this. It's like Microsoft's security before Bill Gates's trustworthy computing memo. Facebook you have to change.
- 40acres 8y agoI was too young to really keep abreast of the Microsoft anti-trust lawsuit, but I've never seen a technology company come under so much sustained pressure than Facebook over the past 18 months. The New York Times in particular has definitely made it a mission to air out all of Facebook's dirty laundry. Overall, I don't think that this will result in users becoming more concerned about privacy (although their governments may) but it does seem like Facebook from a product perspective is vulnerable, even considering the amazing backstops that are Instagram and WhatsApp.
- ImaCake 8y agoMy anecdata is that I have been reading the news about facebook and have started using it less. I also only run it inside a firefox container.
- notacoward 8y ago> The New York Times in particular has definitely made it a mission to air out all of Facebook's dirty laundry. There are two thoughts here that people here assume are mutually exclusive, but they're really not. (1) What NYT has reported is true, and highlights some serious issues that Facebook needs to address. (2) NYT also, without saying anything untrue, takes negative news about Facebook out of context and gives it more prominence/repetition than is appropriate. Both of these are possible simultaneously. I happen to believe both are true. The "providing a platform" argument was much more relevant at the time most of these actions occurred, even if that doesn't fully excuse them. And even if this significant news, that might not justify burying other important stories (e.g. imminent government shutdown) so that it can be top of the news multiple times in the next week. As it surely will, even if there are no new revelations. As for the substance of the OP or the NYT story to which it responds: no comment. Facebook PR is going to have to do this one without me. >:-(
- jaabe 8y agoWhat? Facebook has so far admitted to everything, or in other words, the gross mishandling of privacy of a billion people for a decade and an unwillingness to improve. Is your point that we shouldn’t worry about Facebook being an evil company because there are worse things out there? Why can’t we worry about multiple things at once? Even if we go down the road of whataboutism, don’t you think Facebook has earned its place in the spotlight? Facebook has shown itself to be an existential threat to liberal democracy and truth in recent years, it’s hard to imagine a bigger threat than that. I mean, if it wasn’t for a gazillion fake accounts gaming interest groups on Facebook, a lot less people would think things like climate change was fake. Which means that at its very worst, Facebook is being used to kill the planet. Don’t get me wrong, I still think Facebook can be really good, at its best, and that’s exactly why I think the focus on their missteps is welcome. We need to tell them where the line is, so we can get more good and less bad.
- mindgam3 8y ago“Did partners get access to messages? Yes. But people had to explicitly sign in to Facebook first to use a partner’s messaging feature. Take Spotify for example. After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app.” Does anyone have a screenshot or remember what the opt in UX was like this for this? I have been logged in to Spotify via Facebook since basically the very beginning. I worked in tech as a dev, PM, and designer of flows. I never had the understanding that my Facebook connect with Spotify gave them read/write to all my messages. It’s certainly possible that this permission was requested in an auth form that I quickly granted without realizing, which would make this more of a dubious product decision that blatantly unethical. Anyone have info?
- jahlove 8y agoLooks like as of 07/2013 it was this: https://imgur.com/UdfzvGU https://imgur.com/UdfzvGU Source: https://stackoverflow.com/q/17561784/9027089 https://stackoverflow.com/q/17561784/9027089
- martian 8y agoThat's the UI that I remember from that time. Nothing in the auth dialog mentions access to Messages.
- bduerst 8y agoYep, and the "Access my data at any time" basically lets them store and refresh access tokens, not give blanket access to things like messaging.
- mindgam3 8y agoYep, that’s pretty much how I remember it. Giving FB the benefit of the doubt, I suppose it’s possible that there could have been an additional permissions dialog that popped up whenever messaging integration happened. But I’m usually pretty good at being paranoid about giving apps unnecessary FB perms. Personally I derive zero utility from integrating Spotify and messenger, and my private FB messages are one of the most sensitive data streams, period. So I find it hard to believe that I would have missed this. Which makes facebook’s latest vigorous non-apology feel a bit off to me.
- drugme 8y agoDo we have any reason to believe anything this company says about anything anymore? It's like they know they're in a very deep hole - yet with every press release they just keep digging themselves in deeper.
- AdmiralAsshat 8y ago> To be clear: none of these partnerships or features gave companies access to information without people’s permission, nor did they violate our 2012 settlement with the FTC. Always take note of the defense, "It was legal." It is the last defense of an opponent who knows they have lost the moral battle.
- Humdeee 8y agoThe whole article seems odd. I have no training in public relations, but I assumed the narrative would try to at least seem sincere about end-user's privacy concerns. There's none of that at all, not that it would be believable at this point anyhow. But it reads like a bully trying to justify to a teacher why he chose to eat another kid's lunch. It's clear fb has no moral guilt here and actually implies that all blame is shifted off of themselves.
- adrr 8y agoIt's extremely poor PR. I was caught up in the 2012 FTC investigation on social networks and data brokers. Public just wants to hear how you are going to protect their data. Doesn't matter if you're right or wrong. Pushing that you weren't wrong narrative just alienates your users even more.
- ad-hominem 8y agoLet's clear up a few things about facebook's partners. You asked for this. You wanted to send each other messages about the catalina wine mixer through spotify, and they wanted to pay us a boatload of cash for access to the messages. Look, it's a win-win. You don't get to volunteer one hundred million bits of personal information to us, let us abuse your trust continuously over more than a decade, and then act outraged about it. You wanted us to do it, and you don't actually care that we're sharing it. Go back to uploading photos of your dog and your parties, organizing all your social events with your friends, and looking at our site on your phone every five minutes, with GPS positioning attached. Quit bitching. We're facebook. You knew who we were from the beginning. Dumb fucks. Sincerely, Mark "T1000" zuckerberg
- deleted 8y ago[deleted]
- Humdeee 8y ago> We’re already in the process of reviewing all our APIs and the partners who can access them. Translation: chmod 777 *
- deleted 8y ago[deleted]
- defterGoose 8y agoRemember when fb blog posts used to be about cool tech problems? How much more unfun and 'last year' can this platform get?
- i_am_proteus 8y agoThe language of this post seems extremely carefully chosen and to present as 'let me explain why what Facebook did was fine' and 'Facebook is full of great features that people use.' The language is somewhere in between reductive and manipulative. "this work was about helping people" and "people could have more social experiences" and "People want to use Facebook features" and then: "Our integration partners had to get authorization from people. You would have had to sign in with your Facebook account to use the integration offered by Apple, Amazon or another integration partner." I read the last quote as "we used a dark pattern[1] to get your permission for this" [1]https://darkpatterns.org/ https://darkpatterns.org/
- jahlove 8y agothis isn't clear to you? https://i.imgur.com/UdfzvGU.png https://i.imgur.com/UdfzvGU.png
- i_am_proteus 8y agoThere's a reason the post wasn't worded as "you would have had to explicitly give permission for Spotify to access all of your messages." It is my opinion that Facebook recognizes exactly how unethical their behavior was, as evidenced by the language they choose to use to describe their behavior.
- Havoc 8y agoSo basically it's totally OK because someone clicked sign in with fb? I bet the majority didn't realise that implied giving access to private messages. Seems pretty dark pattern-y at best >this work was about helping people do two things One of the most disengenious things I've read in a while. Nothing about this was about helping users. I hope they get slaughtered on the markets tomorrow (again).
- stonecraftwolf 8y agoFacebook can’t be regulated into the ground and then sued into a fine dust fast enough. It is really hard to overstate the ambient anger out there at a general sense of exploitation. FB have made themselves a lightning rod for that anger. Couldn’t happen to a more exploitive, manipulative company.
- echevil 8y agoI think a very common problem with OAuth (way beyond Facebook) is that people often underestimate the permission they are giving to a 3rd party. For example, if you use some email client to manage your Gmail, the email client would request permission to "manage your Gmail", exactly what you want, but that actually gives the 3rd party permission not only to read all your mails, but to send out emails on behalf of you.
- echevil 8y agoIs it just me that couldn't find the feature in Spotify desk app to actually send a message to a friend from the app?
- danabramov 8y agoThese features were removed in 2015.
- m0zg 8y agoAnd now you know why Google is _really_ shutting down Google+ earlier than planned. Someone should also take a look at Android, where there are some insane permissions available, like accessing your messages and call log. I wonder how much those have been abused by third parties far less trusted than e.g. Spotify. Granted, you have to consent to all of this crap, but 99% of users perceive this as a speed bump and click OK without reading, and the remaining 1% won't touch Android with a 10 foot pole after seeing one of those permission dialogs.
- dirkgently 8y agoAh the inevitable, "it's all Google's fault" reply.
- dirkgently 8y agoLooks like you know for a fact that an App on Android is somehow granted more permission compared to the same App in ios - without users knowing it. Care to prove your blatant lie with some evidence, or you are just going to bash Google/Android because it's the thing to do on HN?
- m0zg 8y agoThere's no way to get call log access or messages access on iOS. There's at least a dozen other insane permissions that exist (and are frequently requested by apps) on Android and don't exist on iOS. Is this sufficient "evidence" for you? Do you seriously believe that these Android permissions are never misused? Because there's easily discoverable evidence to the contrary. With a 1 billion+ installed base, I'd hope this would get much more scrutiny than it's getting.
- sys_64738 8y agoWhy would I believe the fibs from an ad company?
- bogomipz 8y agoThe Title should be corrected. The title of post is actually: "Let’s Clear Up a Few Things About Facebook’s Partners" This distinction is notable for it's patronizing tone. Of course the assumption that we all have it wrong. "There's nothing to see here, please move along." Everything that was done was done to make the world a more connected place and for us to have more "social interactions." This post is a case study in how not to do PR. There's wasn't even a remote hint of concern for what their users might be feeling in the wake of this story. But perhaps it doesn't matter anyway since this company has zero credibility at this point.
- bengrunfeld 8y agoSince FB has quite a few strikes against it at this point, believing it's own arguments about why it is faultless is difficult to swallow. Rather, if there is an honest suspicion that there was a serious breach of privacy, an independent and impartial auditor should examine the case. Third party auditors are regularly used throughout industry to assess security and user experience. I see no reason why they shouldn't be used in this case to certify that user privacy was not breached in an untoward manor.
- sambroner 8y agoThe FIRST thing I see when I visit this site (on mobile) is a popup telling me this... ```To personalize content, tailor and measure ads and provide a safer experience, we use cookies. By tapping on the site you agree to our use of cookies on and off Facebook. Learn more, including about controls: Cookie Policy. Cookie Policy``` I know they have to do that, and it was already there... but doesn't that feel like a slap in the face?
- objektif 8y agoIts funny how the article keeps repeating “people had to explicitly sign in” to give access. Well that should not be enough let 3rd party apps read my messages.
- RyanShook 8y agoI gave a social network all my private information and am now shocked they’ve been using it in social ways. —Every Facebook user ever
- Teichopsia 8y agoIt's hilarious. Facebook misbehaves like a three year old and lies to your face about it. Fifteen years later and the same dysfunctional relationship continues. In a few days, in a couple of weeks there will be some post from their engineering department regarding some fantastic thing they are working on, they released, whatever. And this hate love debate will dissipate to the far end of your minds. When will you say enough?
- dgzl 8y agoThis is their remorse: "Still, we recognize that we’ve needed tighter management over how partners and developers can access information using our APIs"
- slics 8y agoIt all boils down to convinience. People are so easy manipulated with just a little incentive. Just keep one thing in mind. If at any given time there is a product or service that has no cost or fee to use, the first thing should pop in your head is: “There is nothing free in this world.” If you hit Accept / OK for a free service / product the blame is on you/us, not them.
- etxm 8y ago> To personalize content, tailor and measure ads and provide a safer experience, we use cookies. By tapping on the site you agree to our use of cookies on and off Facebook. Learn more, including about controls: Cookie Policy > By tapping on the site > use of cookies on and off Facebook So an accidental interaction when trying to navigate away after seeing your cookie policy opts me into your cookie policy. You bastards are full on assholes, huh?
- eridius 8y agoThere's no way "any interaction with the page" could possibly legally constitute agreeing to any sort of policy. I hope someone sues them over this.
- jpatokal 8y ago> Did partners get access to messages? > Yes. (o_O; ...and every time I think FB can't get any worse, it does. Serious Q: is there a way to find out what services I've ever authorized into using my Facebook account, and nuke those links/permissions? I haven't done that in years, but who knows how many of these there are still lying around.
- ilovecaching 8y agoThis is just more NYT slander to finish off their biggest advertising rival. Nothing about this was out of the ordinary or hidden from the user. The next article will be the NYT saying Zuck broke the public’s trust because Facebook had this thing called an API which is totally evil and corrupt. It probably stands for Anti-Privacy Interface.
- sidcool 8y agoIf not the US, other nations should take stringent measures to reign in the out of control Facebook horse. They have broken most ethical and moral boundaries of trust. They not only treated users like a product, but exploited them. I hope they find their day in the court of law.
- armini 8y agoThere are 3 parts to a genuine apology. 1 we’re sorry 2 we messed up 3 here’s what we’re doing to fix it This is a poor attempt at an apology. It just shows how desperately they acted to grow users with little to no regard for user privacy. That’s a typical footprint for a mercenary company, not one who’s mission is to respect its users. Just look at how Apple apologized about their battery dilemma. Here’s a great way to show you care about your users https://www.apple.com/au/iphone-battery-and-performance/ https://www.apple.com/au/iphone-battery-and-performance/
- jhacker123 8y ago> Just look at how Apple apologized about their battery dilemma. Here’s a great way to show you care about your users In Apple's case, users are also customers and everybody take genuine care about their customers. In Fb's case, users are not their customers, they are product for them. and product are meant to be for sell, and this is what they do.
- CaptainZapp 8y agoIn addition : Apolgies become far less effective if you start to sound like a broken record[1] [1] https://www.fastcompany.com/40547045/a-brief-history-of-mark-zuckerberg-apologizing-or-not-apologizing-for-stuff https://www.fastcompany.com/40547045/a-brief-history-of-mark...
- bertil 8y agoThis is all the more confusing that Facebook internally is genuinely great at that. I was hoping that with Schrage out, those half-assed statements would be gone but nope…
- chj 8y agoThis has been the de facto practice for ages in API integration. Everyone is doing it. When you grant Dropbox access to an app, can you say Dropbox is colluding with app developer?
- ummonk 8y agoThat is what confuses me. It is a widespread issue in the industry, but somehow Facebook is getting singled out for it. And the particular integrations in question were disabled years ago.
- bambax 8y ago> Today, we’re facing questions about whether Facebook gave large tech companies access to people’s information and, if so, why we did this. > To put it simply, this work was about helping people... Putting it simply would be to answer YES to the first question instead of sleazing your way into a thousand words false apology where you don't admit to have ever done anything wrong besides leaving old APIs running for longer than they should have (!) Also, nothing Facebook does is about "helping people". That is not their business. Their business is exploitation.
- chillacy 8y agoIs all business exploitation? And capitalism is the problem? Businesses have to have customers and users to survive, even tobacco companies provide value to users even if their product kills them. If Facebook provides 0 value, stop using them and all the other rational people will too. If they provide a modicum of value, then people will use them if the value delivered is below the cost (cost includes privacy violation and bad trust).
- deleted 8y ago[deleted]
- dep_b 8y agoThere's just one thing that really struck me: "Apple, Amazon, Blackberry and Yahoo" I think the person who wrote this piece first ordered those companies on alphabetic order to look as neutral as possible, then somebody standing behind the editor leaned over and said "Perhaps you could move Apple to the first spot?" There isn't a single comma accidental in this article. Anyway: as somebody pointed out the dialog clearly stated that Spotify could access your data even without using Spotify. I think people should be a bit more conscious about what they trust to a third party to begin with. No, you're not paranoid running your own mail server.
- AJRF 8y ago“Did partners get access to messages? Yes.” That’s all the article needed to be.
- sriku 8y agoI cannot proceed to reading the article because I refuse to accept fb's cookie policy that doesn't seem to give a way to read the content without accepting a cookie from them.