5 ms·

It wasn't about signing up to the accounts using FB though (as far as I understand it). These were services that acted as clients for the private messaging so t

It wasn't about signing up to the accounts using FB though (as far as I understand it). These were services that acted as clients for the private messaging so they could send media directly to your friends via FB messages. I could see the granularity being too low (maybe they should have only had access to messages created in that 3rd party service), but I don't think it was necessarily nefarious that they had blanket access to all private messages, that was just the most straight forward way to implement it during a time period when people were way more excited about open APIs then they were about strict privacy.

wil421 8y ago
I was just using the sign in via FB or Google as an example of times where user might not know what they are consenting to. I wouldn’t assume this gives the 3rd party access to my emails. This is exactly where we need congress to step in and regulate personal data. I’ve built rest APIs at work and I almost always restrict this type of behavior. Why weren’t they only given access to create PMs and update PMs they create? No requests to pull all the PMs of a certain user.
- miracle2k 8y ago
  You may well have been asked for explicit consent to message access. The New York Times is specifically vague about this. They could tell us what kind of access was asked for, but they do not even mention that any kind of access was asked for. Why?
  - wil421 8y ago
    According to the Verge Apple had acces to data even if the user explicitly disabled data sharing. >Giving Apple access to users’ Facebook contacts and calendar entries, even if they had disabled data sharing, as part of a partnership that still exists.
    - miracle2k 8y ago
      > According to the Verge Apple had acces to data even if the user explicitly disabled data sharing. First, the Verge article (https://www.theverge.com/2018/12/18/18147616/facebook-user-data-giveaway-nyt-apple-amazon-spotify-netflix https://www.theverge.com/2018/12/18/18147616/facebook-user-d...) did not do any original reporting, they are referencing the New York Times. This is another thing - people think stories have more weight and truth than they do because you've got a 100 publications writing about some other publications article. The New York Times article makes this claim, but does not explain what "explicitly disabling data sharing" means. Are they saying that I sign in to Spotify, I am asked to give access, I say no, but Spotify still gets the data? That would indeed be bad. It is unlikely this has happened. If this did happen, it would be worth a couple of words of explanation more, no? They are instead likely referring to this dialog: https://c-7npsfqifvt0x24dofu4x2edctjtubujdx2edpn.g00.cnet.com/g00/3_c-7x78x78x78.dofu.dpn_/c-7NPSFQIFVT0x24iuuqtx3ax2fx2fdofu4.dctjtubujd.dpnx2fjnhx2fDbIakrzwCx78x78-gApFjIbGLOf7ZJFx3dx2f681y1x2f3129x2f14x2f32x2f075d6d7g-cee3-53g9-c2e8-88795g023bf1x2ftdsffo-tipu-3129-14-31-bu-2-49-26-qn.qohx3fj21d.nbslx3djnbhf_$/$/$/$/$/$/$/$/$ https://c-7npsfqifvt0x24dofu4x2edctjtubujdx2edpn.g00.cnet.co... Best guess, they are saying, although my friend disabled all the options in this dialog, I was still able to grant third parties access to my contact list and my messages, which included my friends data - that makes sense to me: I can't use a chat app if half the messages you sent me are missing. In any case, we have to guess what really happened, because the New York Times can't be bothered to tell us.
detaro 8y ago
To me, it isn't really clear what it is about. Facebook said: > Did partners get access to messages? Yes. But people had to explicitly sign in to Facebook first to use a partner’s messaging feature. Take Spotify for example. After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app. Our API provided partners with access to the person’s messages in order to power this type of feature. Spotify pushed "log in with Facebook" and as far as I know, for a while it was the only way to use Spotify, and I would have expected Facebook to word the above stronger if they had additional steps to give access to messages. Do you know additional details? (really wish both sides here would present detailed flows)
- chillacy 8y ago
  Good for asking for more details, it seems like most people have already made up their minds without asking for any details, just fill in the blanks to fit the narrative.
ac29 8y ago
>These were services that acted as clients for the private messaging so they could send media directly to your friends via FB messages. So why wasn't the access write-only? If the only purpose for 3rd party access to messages was to send messages, there is no reason they should have been able to read any messages. Seems like a pretty trivial, obvious function - I certainly have keys for send-only access to email accounts to let web apps send things on my behalf with minimal possible privacy exposure.
- victorvation 8y ago
  You could both send and receive messages from within the Spotify app.

wil421 8y ago

I was just using the sign in via FB or Google as an example of times where user might not know what they are consenting to. I wouldn’t assume this gives the 3rd party access to my emails. This is exactly where we need congress to step in and regulate personal data. I’ve built rest APIs at work and I almost always restrict this type of behavior. Why weren’t they only given access to create PMs and update PMs they create? No requests to pull all the PMs of a certain user.

miracle2k 8y ago
You may well have been asked for explicit consent to message access. The New York Times is specifically vague about this. They could tell us what kind of access was asked for, but they do not even mention that any kind of access was asked for. Why?
- wil421 8y ago
  According to the Verge Apple had acces to data even if the user explicitly disabled data sharing. >Giving Apple access to users’ Facebook contacts and calendar entries, even if they had disabled data sharing, as part of a partnership that still exists.
  - miracle2k 8y ago
    > According to the Verge Apple had acces to data even if the user explicitly disabled data sharing. First, the Verge article (https://www.theverge.com/2018/12/18/18147616/facebook-user-data-giveaway-nyt-apple-amazon-spotify-netflix https://www.theverge.com/2018/12/18/18147616/facebook-user-d...) did not do any original reporting, they are referencing the New York Times. This is another thing - people think stories have more weight and truth than they do because you've got a 100 publications writing about some other publications article. The New York Times article makes this claim, but does not explain what "explicitly disabling data sharing" means. Are they saying that I sign in to Spotify, I am asked to give access, I say no, but Spotify still gets the data? That would indeed be bad. It is unlikely this has happened. If this did happen, it would be worth a couple of words of explanation more, no? They are instead likely referring to this dialog: https://c-7npsfqifvt0x24dofu4x2edctjtubujdx2edpn.g00.cnet.com/g00/3_c-7x78x78x78.dofu.dpn_/c-7NPSFQIFVT0x24iuuqtx3ax2fx2fdofu4.dctjtubujd.dpnx2fjnhx2fDbIakrzwCx78x78-gApFjIbGLOf7ZJFx3dx2f681y1x2f3129x2f14x2f32x2f075d6d7g-cee3-53g9-c2e8-88795g023bf1x2ftdsffo-tipu-3129-14-31-bu-2-49-26-qn.qohx3fj21d.nbslx3djnbhf_$/$/$/$/$/$/$/$/$ https://c-7npsfqifvt0x24dofu4x2edctjtubujdx2edpn.g00.cnet.co... Best guess, they are saying, although my friend disabled all the options in this dialog, I was still able to grant third parties access to my contact list and my messages, which included my friends data - that makes sense to me: I can't use a chat app if half the messages you sent me are missing. In any case, we have to guess what really happened, because the New York Times can't be bothered to tell us.

detaro 8y ago

To me, it isn't really clear what it is about. Facebook said: > Did partners get access to messages? Yes. But people had to explicitly sign in to Facebook first to use a partner’s messaging feature. Take Spotify for example. After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app. Our API provided partners with access to the person’s messages in order to power this type of feature. Spotify pushed "log in with Facebook" and as far as I know, for a while it was the only way to use Spotify, and I would have expected Facebook to word the above stronger if they had additional steps to give access to messages. Do you know additional details? (really wish both sides here would present detailed flows)

chillacy 8y ago
Good for asking for more details, it seems like most people have already made up their minds without asking for any details, just fill in the blanks to fit the narrative.

ac29 8y ago

>These were services that acted as clients for the private messaging so they could send media directly to your friends via FB messages. So why wasn't the access write-only? If the only purpose for 3rd party access to messages was to send messages, there is no reason they should have been able to read any messages. Seems like a pretty trivial, obvious function - I certainly have keys for send-only access to email accounts to let web apps send things on my behalf with minimal possible privacy exposure.

victorvation 8y ago
You could both send and receive messages from within the Spotify app.