7 ms·
If you care about user privacy, don’t use Facebook JavaScript SDK
- z92 7y agoThat brings up the question : does Facebook get any less information because you used a 3rd party OAuth library to authenticate from FB, instead of using FB's own SDK which injects an iframe?
- iscoelho 7y agoThe point of the article was that Facebook gets information on not only those who are using Facebook to login, but those who aren't, because the "Login with Facebook" button is an iframe when using the SDK. OAuth does not have this issue. If you choose to login with Facebook, it is implicit that Facebook receives information.
- ramigb 7y agoLess information? maybe! but still they will know what website/app you logged in to.
- taneq 7y agoThe last two words of the title seem rather superfluous.
- emmaglossy 7y agoSometimes you don't really have a choice if all your friends and family use Facebook...
- marve 7y agoIsn't that choosing to be part of the problem then?
- mikro2nd 7y agoNo. Really. You do have a choice. Exercising unpopular choices frequently requires a spine.
- thsealienbstrds 7y agoIndividually, you have a choice. But not using e.g. WhatsApp needs to be a collective decision or it won't work because everybody else is still stuck in there.
- IggleSniggle 7y agoI know some of this is regional, but despite the myriad chat services, I quit them all and have been doing just fine with email and SMS. Can't use phone numbers since it's all spam all the time, tho.
- mikro2nd 7y agoThere is no such thing as a "collective decision". There is only the decision of each person. Any movement to quit these sickness-inducing manipulators has to start somewhere otherwise you end up like those Buddhists who won't enter Nirvana until all other creatures are also ready to enter Nirvana, so they all end up hanging about outside the gates (as it were...), forever waiting. The decision to be the first,... to lead,... to tread without trepidation where others fear to go,... that's what I called growing a spine. "Won't work because everybody else is still stuck in there" is simply an expression of that fear.
- diminoten 7y agoYou're acting like we can't use multiple systems, or that people care if they can interact with us...
- thsealienbstrds 7y agoLet's say you run your own mail server. How much privacy do you really gain if 99% of the mail that comes in and goes out passes through Google servers? It doesn't matter what you do by yourself. You just can't expect everybody to run their own mail server. I run my own mail server, and while I'm happy to be self-reliant, it's hardly a win for my privacy (also, mail server administration is a pita). Same goes for every other communication tech. Just because your endpoint is not spied upon, if every other endpoint is spied upon you gain nothing. If you don't use WhatsApp, but all your friends use WhatsApp to talk about you then you gained nothing. If you really believe there is no such thing as collective decision-making then imho you already gave up in the fight for privacy. But even if we boycot Google and Facebook, they are not the main problem. Their business model is the main problem. Spying on your users, training predictive models, and using those models to exploit people is simply too profitable, and therefore too attractive for any profit-seeking company to ignore. Until we solve that problem by deciding as a society that these business models are not ok, this 1984-like world we currently live in will be our reality.
- r_singh 7y agoOriginal article from Dev.to: https://dev.to/simplelogin/if-you-care-about-user-privacy-do-not-use-facebook-js-sdk-1j3e https://dev.to/simplelogin/if-you-care-about-user-privacy-do... I've recently implemented authentication for my project and I would just like to say to all the relatively amateur programmers out there: for web based authentication just stick with HTTPOnly SECURE cookies with DB backed sessions that you can revoke. The reason I'm saying this is that there's way too many posts talking about JWT (which isn't suitable for newbies), Oauth (which is more useful if you have separate authentication and resource servers) and other token based mechanisms which are what cookies are except more suitable for non web based clients.
- emmaglossy 7y agoI think even when integrating a social login, a developer still needs to create a secure cookie and has "user" table in his/her database. Using social login is rather a convenient option for users as they don't have to create a new account.
- wool_gather 7y agoSure, but the stored credential is not reusable in another context. Which is not true for the majority of passwords. As a bonus, the authorization is probably also revocable via the external identity provider, although that's more about service-to-service permissions than account compromise.
- sgn 7y agoYes, I'm in favour of using Secure Cookies for authentication. But, the TDD (Trend Driven Development) people won't agree with them. They want to work with those shiny trends for a shiny resume. JWT is horrible for the web, it need JavaScript, some needs Local Storage, which is worse than Cookies itself, and the revocation is complex.
- mac_was 7y agoI don't think that storing creds is suitable for newbies either. All authentication is complex and just using HTTPOnly and DB backend is not a solution at all.
- deleted 7y ago[deleted]
- valona 7y agoWhy would any developer or engineer who has even an iota of consideration for privacy, web standards, and, indeed, humanity want to work for such a repugnant company as Facebook?
- deleted 7y ago[deleted]
- lsiebert 7y agoNot a FBer myself, but I do know that people do worse things for less pay.
- xrisk 7y agoBecause a lot of people aren't privileged enough to be able to quit their job on the spot.
- q3k 7y agoI would argue that at least engineers working at Facebook likely have the monetary means to change jobs.
- Jamwinner 7y agoPretty sure working for facebook is proof or that you are in the upper 1% worldwide.
- reroute1 7y agoExcept for all those moderation jobs, and everyday office jobs, oh wait are they just people too and not "1%ers" ???
- harry8 7y agoYeah they aren't facebrick employees - according to facebrick. To really screw people working for you hire a contracting service to be the pointy end and do the thrusting for you. Every single thing about facebrick is absolutely vile. Nobody has yet considered all the dimensions in which they are repugnant. The more you find out the more sick you feel.
- buboard 7y agoAlternatively, only use SDK in login page, and keep the login page separate, or use a click even to load it. And after login is done, you no longer need to load the SDK ever again.
- MobileVet 7y ago> If you care about user privacy, don’t use Facebook. Fixed that for you...
- dylan604 7y agoI was going to say the same thing, only in the form of "Duh". Also in the news today, the sky is blue, grass is green, and fire is hot. How in 2019 would any developer believe that any social platform cares about privacy is beyond me. If a social platform is offering anything (the platform itself, SDKs, APIs, etc) for free, then they are going to make money from you some other way. What ever they are offering cost them money to develop, but they did not do that as a charity. This maybe a bit preaching to the choir, but that's how you get the choir to sing. Plus, maybe someone new reads this.
- kgraves 7y agoEvery internet company ever since 2010. 2010s: "We take your security very seriously." 2020s: "We value your privacy."
- K0SM0S 7y agoIndeed obvious to some but necessary to hammer until everyone gets it — especially the business types who make decisions, as new devs themselves would quickly grow to learn this. > What ever they are offering cost them money to develop, but they did not do that as a charity. True! Yet... I keep thinking about `http` (the protocol), or Apache, IRC, and countless other software techs that were just 'given' to (and are maintained by) the world, courtesy of their makers, and/or bodies like IETF work groups, etc. Case in point: "social" is basic at an elementary level (it's just CRUD, over-the-network), but at scale becomes insanely costly. The limitation/exclusivity factor thus doesn't seem to be software magic but rather infrastructure, piles of money, before sustainability or profitability come into play. This is what the monopolies stem from, only compounded by some Meltcafe/"network" effect (friction to switch, passive positive peer pressure inwards, passive negative outwards). So in thinking of an alternative future path for social tools (SDK) and meta-tools (platforms, interop, work groups, etc), I think it's worth considering the infrastructure problem first. My money is on distributed and (partially but 'enough') decentralized systems (think bittorrent, tor, even DNS fundamentally), but regardless it belongs to the wider category of mutualization of resources (cloud vs on-prems debate, E2E crypt, etc). The solution must be preferable in terms of cost otherwise it's just not gonna happen.
- dep_b 7y agoI've always tried to get rid of it in the native apps I built in favor of the web based login. It's absurdly big in terms of added download size for a login screen and usually used once. Even with the native SDK it's still a jarring experience in most apps and if you pre-cache the screen it's about as instant as the native implementation. And you app starts don't get tracked every time.
- Tepix 7y agoHeise offers a privacy friendly alternative (German) called socialshareprivacy : https://www.heise.de/extras/socialshareprivacy/ https://www.heise.de/extras/socialshareprivacy/
- diminoten 7y agoWho cares what I care about, the real question is what do my users care about. It all depends on what users will tolerate in the name of convenience.
- Jamwinner 7y agoIf you think deferring ethics to the customer clears your conscience, you need some self examination.
- diminoten 7y agoEthics? The problem is practical; do your users want the features or do they care about privacy? Let them make the choice, and don't hide it from them. That's the ethical behavior. It's unethical to assume everyone values everything the same, including privacy. Some people don't care about it as much as you do, nor should they.
- Jamwinner 7y agoOkay, should I assume you dont value yours? Privacy is a human right. There is no ethical argument for depriving humans of their rights. If you want to argue that privacy is not a right, we can start there.
- diminoten 7y agoThere's no ethical argument for depriving someone of food but people fast all the time. Further, the war crimes my gym trainer is guilty of know no bounds! You can give up your "human rights" for convenience/pleasure as long as you can reassert them down the line.
- SketchySeaBeast 7y agoFasting and training are both conscious deliberate choices - how will you frame the loss of privacy in such a manner that it can be agreed to with the same degree of intention? Most people have no idea and don't understand - if you wanna go with the "opt in" solution, you're going to have to make a compelling argument that the people making the decisions are educated enough to make them.
- tr33house 7y agoI thought this was more commonly known... In terms of understanding browser history, The Facebook like button and Google's ad pixels and Chrome web browser are perhaps the biggest offenders. I'd argue that they were specifically created for the express purpose of collecting more user information - for better ad targeting and whatever else
- AndrewStephens 7y agoThe moral of the story is that any time your page requests resources or javascript from a third-party source, you are handing over some information about your users to that third-party. Did you get your user's consent to do that? Probably not.
- nguyenkims 7y agoArticle author and SimpleLogin creator here. Surprised and happy that my small rant at Facebook got so much attention from HN! I wanted to give a bit of context on this article, the story is a bit long though and there was no TLDR. Here it goes: I wanted to protect my online privacy and having worked in advertising before, I know that user email, in addition to the cookie, is usually the common denominator to cross-reference user data. I tried, therefore, to generate a random email whenever I signed up on a new website via temporary email services like temp-mail but there are 3 issues: a. I can't remember which email I used. This problem is alleviated with password manager though. b. No way to reset password later as the email is already expired. This is also not fair if the website happens to be a good (aka not spammy) one and just want to contact me. c. The flow is unbearable: I need to go to temp-mail, generate a random email, go back to the website, check temp-mail for the activation email, etc. I dreamt to have a universal login button, like the "Login with Facebook/Google" one but without all the tracking and that can generate a random email at runtime. So SimpleLogin was born. When creating SimpleLogin SDK, I tried to reverse-engineer popular SDKs like Facebook and Google to learn from them and discovered their not-very-ethical approaches. I haven't found any article talking about these practices so I decided to write one up. Voilà. I want to be as transparent as possible about the technology I'm using so if anyone has any questions, please feel free!
- sproketboy 7y agoIf you care about user privacy, don’t use Facebook. FTFA
- taormina 7y agoIf you care about user privacy, don’t use <any> Facebook SDK.
- allovernow 7y agoTangentially related: is there any reason to be suspicious of/careful with react/redux? We've been using it internally for front end stuff, would be nice to know if there's any weird default tracking going on, however unlikely...
- judge2020 7y agoThere's no issue with using those. Facebook tracking end-users via libraries would be extremely detrimental.
- pricci 7y agoI don't think so. If you serve the library yourself (don't use an external CDN to load it) there shouldn't be any connections to 3rd parties, at least I've never seen one in the 'network' tab of my browser's dev tools. Also, I want to believe that, being open source, people would already discovered something fishy.
- tomaszs 7y agoNever used it. As much as i don't like user account as a concept, and don't like implementing it either, implementation of any Oauth, Facebook login or any other is just nightmare. No users no problem i guess :)