4 ms·

> we should advocate that users have the right to delegate data-access through APIs to third-parties From my PoV, for my purposes, as a technically minded user

> we should advocate that users have the right to delegate data-access through APIs to third-parties From my PoV, for my purposes, as a technically minded user I might agree. But thinking about the numpty-on-the-street, this could be a privacy nightmare with people being easily conned into allowing a random application full unrestricted access to slurp their data. This can happen already, of course, but the provider could detect a remote API scraper and try to block it, and a user-local malware scanner can be trained spot a rogue browser extension that scrapes the UI, but if API access like that is mandated they'll have to provide the access and won't be able to tell the difference between that which the user requested and that which the user was conned into requesting.

bilbo0s 7y ago
Again though, all that needs to be done is to make sure that the liability for leaked data falls on the user. That's the other part of it right? You delegated access to your account, so InstaFaceTwitter is no longer responsible for what happens to the data on that account. They are only responsible for making sure they give anyone presenting the keys you authorized access to edit and read data on your account. I mean, there are obviously responsibilities that naturally come with having delegated that access. And word will get around. The first GDPR violations because some user delegated access to their account and the entity that was authorized slurped up all of that user's contacts' personally identifiable data without the contacts being notified, will undoubtedly set the tone. That's still likely a GDPR violation. This doesn't change any of that. The only thing that changes is that the consequences for the GDPR violations now fall on the entity that was authorized, or maybe on the user who authorized the entity? (Not sure which?) But it obviously would not fall on Twitter since it is only complying with the law. It's important that legal and criminal liability is matched to authorization or delegation. In practice, it will be the threat of legal liability that ensures data security and data privacy, so that needs to follow delegation to ensure incentives are always aligned properly.
- codetrotter 7y ago
  > all that needs to be done is to make sure that the liability for leaked data falls on the user I don’t think that was the point of what the parent commenter was saying. As I read it, they were talking not about liability but the likely negative side effect of having more people be conned out of their private data that will then be abused. Who is liable is a secondary concern. The main problem is the fact that people’s private data end up in the wrong hands.
pjc50 7y ago
The solution I think that the PDS2 "open" banking system has come up with is that all the API integrators are also subject to regulatory approval. So you can't just spin up a shadowy data-slurping shell and connect it to people's bank accounts.
- whatshisface 7y ago
  Then we'd have to apply for website licenses at the California Department of Cyber Vehicles. I hope my website is up to the Cyber Building Code. Yikes.
  - mopsi 7y ago
    Would you rather have everyone who can afford a car drive around without any oversight? Building Code for websites is something I would be willing to support, e.g. no plain-text password storage allowed.
    - scarejunba 7y ago
      Meanwhile, the reality of building code: User must rotate their password every 7 days or be locked out pending in-person approval. The software must enforce this restriction while allowing a two-hour grace period on days when daylight savings changes. You: this is retarded and anti-security. Them: the lawyers are on their way. Stay put.
      - mopsi 7y ago
        The building codes I am familiar with (fire alarm systems) are completely sane "best practice" guides. I recently renovated a 1950s building, among other things I designed and wired a fire alarm system from scratch, and passed inspection on first attempt. The building code gave very valuable pointers: what kind of cables should I use, how zones should be wired, how many sensors I should have, how they should be placed, how long backup batteries should last, etc.
        7y ago
jedieaston 7y ago
Can’t you already post through the Facebook API, just in a non-standardized format? I know you can’t anymore for Instagram, but I thought that third parties could post to your feed with your authorization.
- ceejayoz 7y ago
  The API can post to Pages and Groups (with Facebook's approval and review of your use case), but not to personal profiles. (It used to be possible, but they removed that API after Cambridge Analytica.)

bilbo0s 7y ago

Again though, all that needs to be done is to make sure that the liability for leaked data falls on the user. That's the other part of it right? You delegated access to your account, so InstaFaceTwitter is no longer responsible for what happens to the data on that account. They are only responsible for making sure they give anyone presenting the keys you authorized access to edit and read data on your account. I mean, there are obviously responsibilities that naturally come with having delegated that access. And word will get around. The first GDPR violations because some user delegated access to their account and the entity that was authorized slurped up all of that user's contacts' personally identifiable data without the contacts being notified, will undoubtedly set the tone. That's still likely a GDPR violation. This doesn't change any of that. The only thing that changes is that the consequences for the GDPR violations now fall on the entity that was authorized, or maybe on the user who authorized the entity? (Not sure which?) But it obviously would not fall on Twitter since it is only complying with the law. It's important that legal and criminal liability is matched to authorization or delegation. In practice, it will be the threat of legal liability that ensures data security and data privacy, so that needs to follow delegation to ensure incentives are always aligned properly.

codetrotter 7y ago
> all that needs to be done is to make sure that the liability for leaked data falls on the user I don’t think that was the point of what the parent commenter was saying. As I read it, they were talking not about liability but the likely negative side effect of having more people be conned out of their private data that will then be abused. Who is liable is a secondary concern. The main problem is the fact that people’s private data end up in the wrong hands.

pjc50 7y ago

The solution I think that the PDS2 "open" banking system has come up with is that all the API integrators are also subject to regulatory approval. So you can't just spin up a shadowy data-slurping shell and connect it to people's bank accounts.

whatshisface 7y ago
Then we'd have to apply for website licenses at the California Department of Cyber Vehicles. I hope my website is up to the Cyber Building Code. Yikes.
- mopsi 7y ago
  Would you rather have everyone who can afford a car drive around without any oversight? Building Code for websites is something I would be willing to support, e.g. no plain-text password storage allowed.
  - scarejunba 7y ago
    Meanwhile, the reality of building code: User must rotate their password every 7 days or be locked out pending in-person approval. The software must enforce this restriction while allowing a two-hour grace period on days when daylight savings changes. You: this is retarded and anti-security. Them: the lawyers are on their way. Stay put.
    - mopsi 7y ago
      The building codes I am familiar with (fire alarm systems) are completely sane "best practice" guides. I recently renovated a 1950s building, among other things I designed and wired a fire alarm system from scratch, and passed inspection on first attempt. The building code gave very valuable pointers: what kind of cables should I use, how zones should be wired, how many sensors I should have, how they should be placed, how long backup batteries should last, etc.
      - 7y ago

jedieaston 7y ago

Can’t you already post through the Facebook API, just in a non-standardized format? I know you can’t anymore for Instagram, but I thought that third parties could post to your feed with your authorization.

ceejayoz 7y ago
The API can post to Pages and Groups (with Facebook's approval and review of your use case), but not to personal profiles. (It used to be possible, but they removed that API after Cambridge Analytica.)