3 ms·

You would see ads for people to install the "Cambridge Facebook Client -- Earn $2/month just by using Facebook!" While they silently slurp up the same informati

You would see ads for people to install the "Cambridge Facebook Client -- Earn $2/month just by using Facebook!" While they silently slurp up the same information on not just that person, but their friends.

shkkmo 7y ago
Why would this be any different from browsers and browser extensions?
- SpicyLemonZest 7y ago
  It's not different. The current state of the browser extension ecosystem can cause and has caused massive data privacy violations; browser vendors are locking down previously open APIs to try and remediate that, breaking some functionality that developers want. Context: https://securitywithsam.com/2019/07/dataspii-leak-via-browser-extensions/ https://securitywithsam.com/2019/07/dataspii-leak-via-browse... https://www.zdnet.com/article/apple-neutered-ad-blockers-in-safari-but-unlike-chrome-users-didnt-say-a-thing/ https://www.zdnet.com/article/apple-neutered-ad-blockers-in-...
  - shkkmo 7y ago
    I'm not saying that browser extensions don't present risks of data privacy violations, they clearly do and you should only use extensions from companies that you are willing to trust with this level of access. What I am saying is that these risks ALREADY exist with browser extensions and facebook and providing an API to allow alternative clients for accessing facebook would be an analogous type risk and security expectations. (Although I would argue that an API could be lower risk if you can grant the API key for your client a specific set of permissions.) My point is: A site where you use facebook SSO carries a very different type of risk and set of privacy expectations than a client that you use to login to facebook.
    - SpicyLemonZest 7y ago
      I think that's a fair claim.
    - scarface74 7y ago
      Even if you do “trust” the company now, there have been plenty of instances where trusted extensions were sold to less than trustworthy companies after the extension had millions of installs.

shkkmo 7y ago

Why would this be any different from browsers and browser extensions?

SpicyLemonZest 7y ago
It's not different. The current state of the browser extension ecosystem can cause and has caused massive data privacy violations; browser vendors are locking down previously open APIs to try and remediate that, breaking some functionality that developers want. Context: https://securitywithsam.com/2019/07/dataspii-leak-via-browser-extensions/ https://securitywithsam.com/2019/07/dataspii-leak-via-browse... https://www.zdnet.com/article/apple-neutered-ad-blockers-in-safari-but-unlike-chrome-users-didnt-say-a-thing/ https://www.zdnet.com/article/apple-neutered-ad-blockers-in-...
- shkkmo 7y ago
  I'm not saying that browser extensions don't present risks of data privacy violations, they clearly do and you should only use extensions from companies that you are willing to trust with this level of access. What I am saying is that these risks ALREADY exist with browser extensions and facebook and providing an API to allow alternative clients for accessing facebook would be an analogous type risk and security expectations. (Although I would argue that an API could be lower risk if you can grant the API key for your client a specific set of permissions.) My point is: A site where you use facebook SSO carries a very different type of risk and set of privacy expectations than a client that you use to login to facebook.
  - SpicyLemonZest 7y ago
    I think that's a fair claim.
  - scarface74 7y ago
    Even if you do “trust” the company now, there have been plenty of instances where trusted extensions were sold to less than trustworthy companies after the extension had millions of installs.