5 ms·

Looks like as of 07/2013 it was this: https://imgur.com/UdfzvGU https://imgur.com/UdfzvGU Source: https://stackoverflow.com/q/17561784/9027089 https://stackove

Looks like as of 07/2013 it was this: https://imgur.com/UdfzvGU https://imgur.com/UdfzvGU Source: https://stackoverflow.com/q/17561784/9027089 https://stackoverflow.com/q/17561784/9027089

martian 8y ago
That's the UI that I remember from that time. Nothing in the auth dialog mentions access to Messages.
- bduerst 8y ago
  Yep, and the "Access my data at any time" basically lets them store and refresh access tokens, not give blanket access to things like messaging.
mindgam3 8y ago
Yep, that’s pretty much how I remember it. Giving FB the benefit of the doubt, I suppose it’s possible that there could have been an additional permissions dialog that popped up whenever messaging integration happened. But I’m usually pretty good at being paranoid about giving apps unnecessary FB perms. Personally I derive zero utility from integrating Spotify and messenger, and my private FB messages are one of the most sensitive data streams, period. So I find it hard to believe that I would have missed this. Which makes facebook’s latest vigorous non-apology feel a bit off to me.
- jahlove 8y ago
  I mean, it does say it gives Spotify "access [to] my data at any time". Messages are just data, after all...
  - milin 8y ago
    I feel they could have elaborated on 'data' a bit. To most people, saying 'messages' is more alarming than just saying 'data'.
    - _asummers 8y ago
      And by the same token, wall posts are data too, so there should be no need to specify that explicitly if that's the way data is being interpreted.
      - m_fayer 8y ago
        That's exactly right. The fact that "wall posts" is in that list gives you a false notion of the granularity of the items in the list. One of those is not nearly as granular as the rest - if you assume that it is, like I did, you guess that "data" means "where you went to High School" or your "favorite movie" or some such, not "everything." Really deceptive.
  - SilasX 8y ago
    In context, "my data" means "the data referred to in the above three bullet points". Otherwise, this of the same type (though not magnitude) of thing as "Spotify may induct my firstborn into a satanic cult."
- toufka 8y ago
  That is absolutely a dark pattern if that dialog box was intended to speak to read/write access of messages. "Access my data at any time" is truly deceptive. The icon is one specifying "time" - a moon in the dark; night time. And the operative context seems to be "at any time". However, the grant is actually for, "data". Which is itself seemingly already being granted by the above "Posts", and "Public Information". If Facebook presumed that "data" included everything, then why did they ask for access to posts and public information above? It is clearly deceptive. If they thought what they did was in the right, then why deceive? And if they felt like they made a mistake, why not make the new dialog boxes not deceptive? That they do not feel that they can sustain their business model without being deceptive makes NYT articles like this all the more necessary; if people really don't care about their privacy, then go ahead and ask for their privacy - don't dance around and say you're providing a service (and omit that you're also taking their private data). If they asked clearly and they were granted the ability to farm out to third parties whole read/write access to all data, then I'd be more inclined to believe that their users were actually acquiescing.
  - save_ferris 8y ago
    I completely agree. They're very clear about who can access what in the first few statements, but "Access my data" is so vague. It takes a very cynical perception to accurately assume what they mean by this, and they absolutely take advantage of this. Cynics wear the tin-foil hats in the minds of many, and nobody wants to be like that.
  - patja 8y ago
    Permission to post on behalf of the user and read posts from the user's feed does not grant access to messages to any other app getting these permissions from a user. If they were getting access to messages, it was a special stealthy "partner only" deal not reflected in the permissions prompt as posted on imgur above.
- dirkgently 8y ago
  > my private FB messages are one of the most sensitive data streams, period. So you are still trusting FB with your most sensitive data. The mind boggles at the sheer lack of self-respect from FB users. Sorry but I have no sympathy for those who are handing over their data to FB and then bitching about FB abusing it. To me, all FB users are like Trump supporters - they continue to support him even after all that has happened in last 4 years. FB users keep using it even after FB is abusing their data from the day ut started
SilasX 8y ago
Nice, good find. That doesn't give permission to read (or even generate) private messages, unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above.
- bilbo0s 8y ago
  >unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above... Hmm. It seems this may sound weird to you and many others, but that's exactly how I interpreted it. When looking at that screen I was wondering why anyone in their right mind would grant Spotify these rights? The only thing Spotify does is play songs for you, right? They shouldn't really need access to any of your FB data to do that.
  - Jare 8y ago
    But, you want a more social experience while you listen to music.
    - bilbo0s 8y ago
      Maybe some people do, but I don't. Just play "Grandma's Hands" for me while I code. I don't need my friends in Paris to know I'm listening to Bill Withers. Seriously, why do people think they need this stuff?
      - Jare 8y ago
        I apologize if my tone was not right... to be clear, I use Spotify exactly as you describe (different choices though) and am as baffled as you about people using those other ways.
        alangpierce 8y ago
        I interpreted your comment as a joke, but could see how that could be unclear. Tone is hard on the internet, probably best to explicitly say when you're being sarcastic. :-)
ALittleLight 8y ago
I wish there was a data audit log for your account. I'd like to be able to check which companies accessed what part of my data, when, and for what purpose. If I noticed something I didn't like, I could revoke permissions. If I noticed something that seemed very shady, e.g. Spotify editing my private messages, I could start an escalation. This seems like a good way to move the burden of auditing partners onto the users for Facebook to me. Make application fill in information about why they call specific operations, make those operations and reasons available in an audit log that any user can review.
- bertil 8y ago
  It’s been available pretty much since the first f8 in 2008, so ten years ago: https://www.facebook.com/settings?tab=applications https://www.facebook.com/settings?tab=applications
  - patja 8y ago
    That just shows which apps have which permissions. I think what is desired is a log of date and times the app accessed specific bits of data. For example, do they poll every day and hoover up all of your recent data for everything they have access to, or do they only take just what they need for the task at hand?
cedivad 8y ago
That cannot possibly be it, the last permission is just the "offline_access" field that was available to normal developers and I remember seeing used a lot. I refuse to believe this is what fb talks about when saying users gave permission.
JumpCrisscross 8y ago
Facebook thinking that dialog says “read my messages” is evidence enough that their culture is broken and requires external oversight.
patja 8y ago
That does not include a request to approve the read_mailbox permission, which I think should be required to query a user's private messages. This permission was deprecated in 2015. https://www.theregister.co.uk/2018/04/11/facebook_admits_users_granted_apps_permission_to_go_into_their_inboxes/ https://www.theregister.co.uk/2018/04/11/facebook_admits_use... On the other hand, Facebook is known to make a lot of one-off arrangements with specific preferred partners such as Spotify to grant permissions and access normal apps can't use. I suspect that money changes hands for some of these special arrangements, or if not outright cash then intangibles with significant value, hence the "selling data" accusations.

Looks like as of 07/2013 it was this: https://imgur.com/UdfzvGU https://imgur.com/UdfzvGU Source: https://stackoverflow.com/q/17561784/9027089 https://stackoverflow.com/q/17561784/9027089

martian 8y ago

That's the UI that I remember from that time. Nothing in the auth dialog mentions access to Messages.

bduerst 8y ago
Yep, and the "Access my data at any time" basically lets them store and refresh access tokens, not give blanket access to things like messaging.

mindgam3 8y ago

Yep, that’s pretty much how I remember it. Giving FB the benefit of the doubt, I suppose it’s possible that there could have been an additional permissions dialog that popped up whenever messaging integration happened. But I’m usually pretty good at being paranoid about giving apps unnecessary FB perms. Personally I derive zero utility from integrating Spotify and messenger, and my private FB messages are one of the most sensitive data streams, period. So I find it hard to believe that I would have missed this. Which makes facebook’s latest vigorous non-apology feel a bit off to me.

jahlove 8y ago
I mean, it does say it gives Spotify "access [to] my data at any time". Messages are just data, after all...
- milin 8y ago
  I feel they could have elaborated on 'data' a bit. To most people, saying 'messages' is more alarming than just saying 'data'.
  - _asummers 8y ago
    And by the same token, wall posts are data too, so there should be no need to specify that explicitly if that's the way data is being interpreted.
    - m_fayer 8y ago
      That's exactly right. The fact that "wall posts" is in that list gives you a false notion of the granularity of the items in the list. One of those is not nearly as granular as the rest - if you assume that it is, like I did, you guess that "data" means "where you went to High School" or your "favorite movie" or some such, not "everything." Really deceptive.
- SilasX 8y ago
  In context, "my data" means "the data referred to in the above three bullet points". Otherwise, this of the same type (though not magnitude) of thing as "Spotify may induct my firstborn into a satanic cult."
toufka 8y ago
That is absolutely a dark pattern if that dialog box was intended to speak to read/write access of messages. "Access my data at any time" is truly deceptive. The icon is one specifying "time" - a moon in the dark; night time. And the operative context seems to be "at any time". However, the grant is actually for, "data". Which is itself seemingly already being granted by the above "Posts", and "Public Information". If Facebook presumed that "data" included everything, then why did they ask for access to posts and public information above? It is clearly deceptive. If they thought what they did was in the right, then why deceive? And if they felt like they made a mistake, why not make the new dialog boxes not deceptive? That they do not feel that they can sustain their business model without being deceptive makes NYT articles like this all the more necessary; if people really don't care about their privacy, then go ahead and ask for their privacy - don't dance around and say you're providing a service (and omit that you're also taking their private data). If they asked clearly and they were granted the ability to farm out to third parties whole read/write access to all data, then I'd be more inclined to believe that their users were actually acquiescing.
- save_ferris 8y ago
  I completely agree. They're very clear about who can access what in the first few statements, but "Access my data" is so vague. It takes a very cynical perception to accurately assume what they mean by this, and they absolutely take advantage of this. Cynics wear the tin-foil hats in the minds of many, and nobody wants to be like that.
- patja 8y ago
  Permission to post on behalf of the user and read posts from the user's feed does not grant access to messages to any other app getting these permissions from a user. If they were getting access to messages, it was a special stealthy "partner only" deal not reflected in the permissions prompt as posted on imgur above.
dirkgently 8y ago
> my private FB messages are one of the most sensitive data streams, period. So you are still trusting FB with your most sensitive data. The mind boggles at the sheer lack of self-respect from FB users. Sorry but I have no sympathy for those who are handing over their data to FB and then bitching about FB abusing it. To me, all FB users are like Trump supporters - they continue to support him even after all that has happened in last 4 years. FB users keep using it even after FB is abusing their data from the day ut started

SilasX 8y ago

Nice, good find. That doesn't give permission to read (or even generate) private messages, unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above.

bilbo0s 8y ago
>unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above... Hmm. It seems this may sound weird to you and many others, but that's exactly how I interpreted it. When looking at that screen I was wondering why anyone in their right mind would grant Spotify these rights? The only thing Spotify does is play songs for you, right? They shouldn't really need access to any of your FB data to do that.
- Jare 8y ago
  But, you want a more social experience while you listen to music.
  - bilbo0s 8y ago
    Maybe some people do, but I don't. Just play "Grandma's Hands" for me while I code. I don't need my friends in Paris to know I'm listening to Bill Withers. Seriously, why do people think they need this stuff?
    - Jare 8y ago
      I apologize if my tone was not right... to be clear, I use Spotify exactly as you describe (different choices though) and am as baffled as you about people using those other ways.
      - alangpierce 8y ago
        I interpreted your comment as a joke, but could see how that could be unclear. Tone is hard on the internet, probably best to explicitly say when you're being sarcastic. :-)

ALittleLight 8y ago

I wish there was a data audit log for your account. I'd like to be able to check which companies accessed what part of my data, when, and for what purpose. If I noticed something I didn't like, I could revoke permissions. If I noticed something that seemed very shady, e.g. Spotify editing my private messages, I could start an escalation. This seems like a good way to move the burden of auditing partners onto the users for Facebook to me. Make application fill in information about why they call specific operations, make those operations and reasons available in an audit log that any user can review.

bertil 8y ago
It’s been available pretty much since the first f8 in 2008, so ten years ago: https://www.facebook.com/settings?tab=applications https://www.facebook.com/settings?tab=applications
- patja 8y ago
  That just shows which apps have which permissions. I think what is desired is a log of date and times the app accessed specific bits of data. For example, do they poll every day and hoover up all of your recent data for everything they have access to, or do they only take just what they need for the task at hand?

cedivad 8y ago

That cannot possibly be it, the last permission is just the "offline_access" field that was available to normal developers and I remember seeing used a lot. I refuse to believe this is what fb talks about when saying users gave permission.

JumpCrisscross 8y ago

Facebook thinking that dialog says “read my messages” is evidence enough that their culture is broken and requires external oversight.

patja 8y ago

That does not include a request to approve the read_mailbox permission, which I think should be required to query a user's private messages. This permission was deprecated in 2015. https://www.theregister.co.uk/2018/04/11/facebook_admits_users_granted_apps_permission_to_go_into_their_inboxes/ https://www.theregister.co.uk/2018/04/11/facebook_admits_use... On the other hand, Facebook is known to make a lot of one-off arrangements with specific preferred partners such as Spotify to grant permissions and access normal apps can't use. I suspect that money changes hands for some of these special arrangements, or if not outright cash then intangibles with significant value, hence the "selling data" accusations.