4 ms·

The Facebook integration with Spotify allowed you to send messages and receive from within Spotify. Could you think of a way to implement this without giving th

The Facebook integration with Spotify allowed you to send messages and receive from within Spotify. Could you think of a way to implement this without giving the Spotify client access to those messages? What’s more, users explicitly opted in, giving Spotify permission to do so. [1] No reasonable person would use Spotify to send and receive messages after explicitly granting the client permissions and then claim “but I don’t expect Spotify to have access to my private messages” [1] - https://stackoverflow.com/questions/17561784/django-social-auth-extended-facebook-permissions-like-spotify https://stackoverflow.com/questions/17561784/django-social-a...

TeMPOraL 8y ago
At various stages of Spotify's life, Facebook login was required to use the service. I'm a long-time user, and I've learned about the messages feature from HN. It wasn't really even advertised in the UI, and not the reason I - or many other people - connected Facebook to it.
- bestnameever 8y ago
  Oh wow you are totally right. It had never occurred to me that Spotify requiring Facebook to use the service was a means for them to gain access to your Facebook account.
  - TeMPOraL 8y ago
    Social logins is - and was, back then - a thing people are used to.
  - supermatt 8y ago
    i can’t tell if this is snark, but as an app developer, i have considered facebook login as a means for a relatively frictionless user experience, not as a way for me to gain access to a users facebook account.
    - nindalf 8y ago
      No no, if you added social login to your app it's because you're evil. You want to monetize your users, selling their data like it's 2014. You're literally Cambridge Analytica. /s
    - acct1771 8y ago
      But security-wise, it is the same.
      - supermatt 8y ago
        Not at all. FUD. If you're going to make a statement like that at least come with some facts. There is a massive difference between me getting login permission TO MY OWN APP, and accessing a users facebook account, or masquerading as them on other apps.
        acct1771 8y ago
        ...until Facebook mishandles their end, for example, the API. Which they have been shown to about a dozen times over this month.
        supermatt 8y ago
        I think you have either misunderstood the reports, misunderstand the API, or misunderstand how to integrate it. There is literally no way for me to accidentally steal a users data. You may not like facebook, but accusing me of putting my users data in jeopardy is just fucking cheeky.
- nindalf 8y ago
  Ok, but were you ever asked if you wanted to grant permissions for that? Did you ever see the UI I linked? Or is your claim that you gave only permission for profile and friends but the Spotify client had messaging permission as well?
  - reitanqild 8y ago
    I can't recall having any idea that Spotify would have access to my messages.
- johnnycab 8y ago
  >At various stages of Spotify's life, Facebook login was required to use the service. I disagree. I have perused various trials for Spotify and other services over the years and never once had to resort to using a Federated ID/login.
  - fivefive55 8y ago
    Well you're disagreeing with a proven fact, so yeah... When Spotify released in 2011 Facebook was absolutely required. They removed that requirement a year later or so.
DoctorOetker 8y ago
but how will a user discover the new app will allow him/her to send messages from within Spotify before installation? If the user only discovers afterward, then there is no valid informed consent...
supermatt 8y ago
as a spotify user since they only used facebook login, i wasn’t even aware of this messaging feature. blind consent is not consent
xg15 8y ago
Even if I wanted to use Spotify's messaging client, I'd imagine a layman's expectation would be that Spotify needed access to send and receive it's own messages - it's not that obvious it needs to be able to read that email to your boss you wrote three years ago. Of course as a technician with knowledge of how OAuth and web APIs work, the implication that it really needs access to all messages seems a lot more reasonable - but I don't think this view is necessarily valid in a larger context. Implementing more fine-grained permissions is absolutely possible. See e.g. Telegram: Even though Telegram bots appear as mostly ordinary users, they by default cannot access the messages of the channels they joined - they can only access commands that users were explicitly sending to them. You need a special permission to have a bot actually be able to access a channel like a human user would.

TeMPOraL 8y ago

At various stages of Spotify's life, Facebook login was required to use the service. I'm a long-time user, and I've learned about the messages feature from HN. It wasn't really even advertised in the UI, and not the reason I - or many other people - connected Facebook to it.

bestnameever 8y ago
Oh wow you are totally right. It had never occurred to me that Spotify requiring Facebook to use the service was a means for them to gain access to your Facebook account.
- TeMPOraL 8y ago
  Social logins is - and was, back then - a thing people are used to.
- supermatt 8y ago
  i can’t tell if this is snark, but as an app developer, i have considered facebook login as a means for a relatively frictionless user experience, not as a way for me to gain access to a users facebook account.
  - nindalf 8y ago
    No no, if you added social login to your app it's because you're evil. You want to monetize your users, selling their data like it's 2014. You're literally Cambridge Analytica. /s
  - acct1771 8y ago
    But security-wise, it is the same.
    - supermatt 8y ago
      Not at all. FUD. If you're going to make a statement like that at least come with some facts. There is a massive difference between me getting login permission TO MY OWN APP, and accessing a users facebook account, or masquerading as them on other apps.
      - acct1771 8y ago
        ...until Facebook mishandles their end, for example, the API. Which they have been shown to about a dozen times over this month.
        supermatt 8y ago
        I think you have either misunderstood the reports, misunderstand the API, or misunderstand how to integrate it. There is literally no way for me to accidentally steal a users data. You may not like facebook, but accusing me of putting my users data in jeopardy is just fucking cheeky.
nindalf 8y ago
Ok, but were you ever asked if you wanted to grant permissions for that? Did you ever see the UI I linked? Or is your claim that you gave only permission for profile and friends but the Spotify client had messaging permission as well?
- reitanqild 8y ago
  I can't recall having any idea that Spotify would have access to my messages.
johnnycab 8y ago
>At various stages of Spotify's life, Facebook login was required to use the service. I disagree. I have perused various trials for Spotify and other services over the years and never once had to resort to using a Federated ID/login.
- fivefive55 8y ago
  Well you're disagreeing with a proven fact, so yeah... When Spotify released in 2011 Facebook was absolutely required. They removed that requirement a year later or so.

DoctorOetker 8y ago

but how will a user discover the new app will allow him/her to send messages from within Spotify before installation? If the user only discovers afterward, then there is no valid informed consent...

supermatt 8y ago

as a spotify user since they only used facebook login, i wasn’t even aware of this messaging feature. blind consent is not consent

xg15 8y ago

Even if I wanted to use Spotify's messaging client, I'd imagine a layman's expectation would be that Spotify needed access to send and receive it's own messages - it's not that obvious it needs to be able to read that email to your boss you wrote three years ago. Of course as a technician with knowledge of how OAuth and web APIs work, the implication that it really needs access to all messages seems a lot more reasonable - but I don't think this view is necessarily valid in a larger context. Implementing more fine-grained permissions is absolutely possible. See e.g. Telegram: Even though Telegram bots appear as mostly ordinary users, they by default cannot access the messages of the channels they joined - they can only access commands that users were explicitly sending to them. You need a special permission to have a bot actually be able to access a channel like a human user would.