4 ms·

We have to remember that email-based import is a service aimed at the masses to make life easier for such people. Although most people on HN and the like will

by babul 18y ago

We have to remember that email-based import is a service aimed at the masses to make life easier for such people. Although most people on HN and the like will usually opt out or refuse such a request, many people will not care about the privacy/security issues if it means less work for them.

rglullis 18y ago
Exactly. If there is an opportunity to find a way to add features and get more users, any company will do it. This is a no-brainer. Any tech-savvy user will just simply skip this step. And the contacts API that the major providers are giving are recent. It's not like services like Yelp and FB had the choice before. Ps.: Jeff Atwood's "from the hip" writing style shows. I'm yet to find one single post from him that seems slightly insightful. Instead of spending so much time ranting, he could spend a tenth of that time thinking about why Yelp keeps that "feature". Edit: could someone please explain me why of such aggresive downmodding?
- BrandonM 18y ago
  Because you completely missed the point. It doesn't matter why Yelp keeps that "feature". It's irrelevant, because his position is that there is no situation where giving a login and password of any sort, but especially e-mail, makes any sense at all. You said that Atwood should have spent time thinking instead of just ranting, but then you kind of did the same thing.... And that's not to mention giving the "they're a company, anything goes" and "it was the only way back then" excuses; those are meaningless.
  - rglullis 18y ago
    It may make no sense to you, to me or to any tech-savvy user. But it does make sense to those who use the damn feature. No one is forced to use that. If they are using it, it's because they think it might benefit them in some way. The same goes for websites that do such thing. They know that some users might be annoyed by such "feature", but the amount of new users that will be exposed is much higher, so they keep doing it. What I find hard to believe is that the ones that complain about these kinds of mechanisms don't understand that themselves are not part of the target of said mechanism. Instead of simply ignoring it, they feel "victims" of it. And I'd like to know where I said "anything goes". If that was the case, I would say that scammers are right to do what they do because they never forced the users to give sensitive data. What I did say is that, if a webservice wanted to provide a way for the user to (semi-)automatically invite people in his contact list, the only way to do that required email and the password. Better now?
    - DougBTX 18y ago
      Sure it makes sense to them, they don't know what they are doing. What I find hard to believe is that the ones that complain about these kinds of mechanisms don't understand that themselves are not part of the target of said mechanism. These mechanisms are prominently shown to all users of the web site who want to import contacts, whether they are technical or not. There isn't a banner above them which says, "this feature is aimed only at people who don't understand the security implications." Making money by teaching someone to compromise their security is a morally bad thing to do, whether that person knows they are being taught to put themselves at risk or not.
      - rglullis 18y ago
        I'm sorry, but I just disagree. I don't see any wrongdoing in this, provided they do what they actually state they do. If they take your password and do nasty things with it, than it's a whole other story. There isn't a banner above them which says, "this feature is aimed only at people who don't understand the security implications." If you do understand the security implications, then the banner is irrelevant! Also, they are not saying that you must use the feature either, are they? What happened to freewill? Does everyone think that you are supposed to consume every feature of the service just because it's free and it's there? And to say they are "teaching to compromise security" is a gross dramatization. They are not teaching anything at all.
    - BrandonM 18y ago
      The real point is that there are now APIs to get at people's contacts, and several sites still do not use them. That is the issue, and there isn't really an excuse for it. I agree that some time ago, it may have been a (dubious-yet-) reasonable feature. Now it's just irresponsible.
  - andr 18y ago
    I'm sure Yelp's logfiles show that enough people think the opposite.
    - tptacek 18y ago
      Yes, and so do the logfiles of any phishing site.
dreish 18y ago
The danger is that this breaks what is supposed to be a taboo, lowers people's resistance to giving out their password by conditioning them to expect that nothing will go wrong, and makes it easier for others to commit fraud. So people get burned by some Nigerian scammer, decide never to do any business online again, and what good does that do for the YC crowd?
- babul 18y ago
  Agreed, but ultimately it is very difficult to educate people. Until something bad happens to them, most people will not learn.
  - calvins 18y ago
    You're saying that it is difficult to educate people, so it doesn't matter if they are taught to do incredibly dangerous things without a second thought. The fact that it is difficult to educate people makes it that much more important that companies like Yelp not do stupid things like this.
tptacek 18y ago
First, there have been as many horror stories about the mass-market features built on harvesting email contacts. Second, there are lots of convenient features that we don't build because they send a terrible message. For instance, it would be really convenient to work with your bank via email. Third, he's right: many of these services probably do bank your password, which is an absolute nightmare. Almost every web app is going to lose its database to SQL injection at some point in its lifespan.
Hexstream 18y ago
"many people will not care about the privacy/security issues if it means less work for them." ... until it bites them in the ass.

by babul 18y ago

rglullis 18y ago

Exactly. If there is an opportunity to find a way to add features and get more users, any company will do it. This is a no-brainer. Any tech-savvy user will just simply skip this step. And the contacts API that the major providers are giving are recent. It's not like services like Yelp and FB had the choice before. Ps.: Jeff Atwood's "from the hip" writing style shows. I'm yet to find one single post from him that seems slightly insightful. Instead of spending so much time ranting, he could spend a tenth of that time thinking about why Yelp keeps that "feature". Edit: could someone please explain me why of such aggresive downmodding?

BrandonM 18y ago
Because you completely missed the point. It doesn't matter why Yelp keeps that "feature". It's irrelevant, because his position is that there is no situation where giving a login and password of any sort, but especially e-mail, makes any sense at all. You said that Atwood should have spent time thinking instead of just ranting, but then you kind of did the same thing.... And that's not to mention giving the "they're a company, anything goes" and "it was the only way back then" excuses; those are meaningless.
- rglullis 18y ago
  It may make no sense to you, to me or to any tech-savvy user. But it does make sense to those who use the damn feature. No one is forced to use that. If they are using it, it's because they think it might benefit them in some way. The same goes for websites that do such thing. They know that some users might be annoyed by such "feature", but the amount of new users that will be exposed is much higher, so they keep doing it. What I find hard to believe is that the ones that complain about these kinds of mechanisms don't understand that themselves are not part of the target of said mechanism. Instead of simply ignoring it, they feel "victims" of it. And I'd like to know where I said "anything goes". If that was the case, I would say that scammers are right to do what they do because they never forced the users to give sensitive data. What I did say is that, if a webservice wanted to provide a way for the user to (semi-)automatically invite people in his contact list, the only way to do that required email and the password. Better now?
  - DougBTX 18y ago
    Sure it makes sense to them, they don't know what they are doing. What I find hard to believe is that the ones that complain about these kinds of mechanisms don't understand that themselves are not part of the target of said mechanism. These mechanisms are prominently shown to all users of the web site who want to import contacts, whether they are technical or not. There isn't a banner above them which says, "this feature is aimed only at people who don't understand the security implications." Making money by teaching someone to compromise their security is a morally bad thing to do, whether that person knows they are being taught to put themselves at risk or not.
    - rglullis 18y ago
      I'm sorry, but I just disagree. I don't see any wrongdoing in this, provided they do what they actually state they do. If they take your password and do nasty things with it, than it's a whole other story. There isn't a banner above them which says, "this feature is aimed only at people who don't understand the security implications." If you do understand the security implications, then the banner is irrelevant! Also, they are not saying that you must use the feature either, are they? What happened to freewill? Does everyone think that you are supposed to consume every feature of the service just because it's free and it's there? And to say they are "teaching to compromise security" is a gross dramatization. They are not teaching anything at all.
  - BrandonM 18y ago
    The real point is that there are now APIs to get at people's contacts, and several sites still do not use them. That is the issue, and there isn't really an excuse for it. I agree that some time ago, it may have been a (dubious-yet-) reasonable feature. Now it's just irresponsible.
- andr 18y ago
  I'm sure Yelp's logfiles show that enough people think the opposite.
  - tptacek 18y ago
    Yes, and so do the logfiles of any phishing site.

dreish 18y ago

The danger is that this breaks what is supposed to be a taboo, lowers people's resistance to giving out their password by conditioning them to expect that nothing will go wrong, and makes it easier for others to commit fraud. So people get burned by some Nigerian scammer, decide never to do any business online again, and what good does that do for the YC crowd?

babul 18y ago
Agreed, but ultimately it is very difficult to educate people. Until something bad happens to them, most people will not learn.
- calvins 18y ago
  You're saying that it is difficult to educate people, so it doesn't matter if they are taught to do incredibly dangerous things without a second thought. The fact that it is difficult to educate people makes it that much more important that companies like Yelp not do stupid things like this.

tptacek 18y ago

First, there have been as many horror stories about the mass-market features built on harvesting email contacts. Second, there are lots of convenient features that we don't build because they send a terrible message. For instance, it would be really convenient to work with your bank via email. Third, he's right: many of these services probably do bank your password, which is an absolute nightmare. Almost every web app is going to lose its database to SQL injection at some point in its lifespan.

Hexstream 18y ago

"many people will not care about the privacy/security issues if it means less work for them." ... until it bites them in the ass.