7 ms·

Why is facebook spyware part of Spotify. I signed up to Spotify via email not facebook login.

MCKapur 6y ago
i mean, they offer FB sign in in the app, so the FB SDK is bundled with the app binary. looks like the mere presence of the library is causing crashes. someone on a related GH thread noted they commented out the code invoking the FB SDK but the issue remained.
- surferbayarea 6y ago
  Yeah these SDKs are siphoning off data without authorization like your location, songs you listen to and who knows what else (eg other processes or apps running on your phone). Eg the latest iOS exploit allows any app to get access to all SMS data. Tech companies of today trample upon individual privacy openly. Amazing!
  - MCKapur 6y ago
    i'm by a longshot no facebook fan but... are you sure the SDK can actually siphon out what songs you listen or your location from the app it's sandboxed in (which, BTW, is in its own sandbox from an iOS system POV, and also has its own set of permissions)?
    - lucasar 6y ago
      I am an iOS developer and most likely the problem is related to configuration and basic analytics, not "siphoning" app data. Offending code : if (restrictiveParams[eventName][@"is_deprecated_event"]) { [deprecatedEventSet addObject:eventName]; } So, the iOS library does not check for nil, and whatever the server is returning does not have the expected content. Lame.
      - bryansum 6y ago
        Looks like that would've probably been caught if it were written in Swift.
        K0nserv 6y ago
        if (restrictiveParams[eventName] as! [String: Any])["test"] != nil In Swift, now hopefully you wouldn't write this code but it's not entirely unlikely too. In fact the above Objective-C snippet is one of the few cases where Objective-C's forgiving `nil` behaviour doesn't save you from a crash.
    - surferbayarea 6y ago
      Well the reason FB/Foursquare/Google etc add these to 3rd party apps is so they can get data. Example if you visit a website which has a Facebook like button, your browser fetches the js files/which maybe even makes an API call to let FB know your IP (and hence location). All this data is fed to the giant system that feeds you ads. Adding their SDK to other apps/sites (even if there is no user facing need) is a common strategy used by most big companies to get data. In return the app that puts in the SDK gets $ from the company.
      - lucasar 6y ago
        You have no idea what you're talking about. Apps use the Facebook library because a good portion of end-users want to be able to login with a Facebook button --or Google, or whatever that doesn't require them to create a user/password account. It's just that simple.
        surferbayarea 6y ago
        I have been witness to such business partnerships to embed SDKs to siphon telemetry/other data. The world is not as simple as you think...
        MCKapur 6y ago
        well, this would be extremely believable
        ratww 6y ago
        If you only need login, then you can have the same functionality without the Facebook SDK or Google SDK by using OAuth.
      - traek 6y ago
        Of the companies you named, Foursquare's business model explicitly revolves around paying apps for user location data and selling it. I doubt (and at least from my experience around SV, haven't seen) that FB/Google are paying apps to include their SDKs.
    - bvandewalle 6y ago
      you are assuming that the Spotify app is not simply handing that data over. I would not be surprised if there is a financial agreement in place.
    - zlorch 6y ago
      I think he's talking in general. I worked at Spotify for a while and I can tell you the only reason they have the FB SDK bundled is to provide login. They dont use FB for any tracking or attribution at all, for that they have other frameworks. They are aware of the FB SDK misbehaving in some cases and do take steps to prevent it.
- aconley314 6y ago
  Then if this can be fixed by a server side change as suggested below, that's worrisome, since it suggests it is communicating with FB even if you don't invoke it.
  - MCKapur 6y ago
    the real question though is if the library is not even imported into the main app and just left hanging around, linked, would it still crash? i'd be curious to know
    - nicoburns 6y ago
      Apparently yes: https://news.ycombinator.com/item?id=23097887 https://news.ycombinator.com/item?id=23097887
    - saagarjha 6y ago
      Correct, as the code is run as the dynamic linker pulls in the library (which is usually at application startup).
- Lammy 6y ago
  Yes, requiring the SDK to implement Facebook Login is the decision that's being criticized. Facebook encourages SDK usage obviously for the data collection it enables, but even they provide an OAuth-only login flow that doesn't require the SDK at all: https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/ https://developers.facebook.com/docs/facebook-login/manually...
three_seagrass 6y ago
They had some big partnership deal about 8 years ago which involved some low level integration. It also gave Spotify access to more Facebook user information than what was originally authorized, like letting Spotify read users' FB messages. I remember being grandfathered into not having it and Spotify would ask me every time I logged in to integrate my FB account.
tinus_hn 6y ago
Would you expect a separate app for people who login using Facebook and people who login without?
- Nextgrid 6y ago
  You can implement Facebook login server-side with basic oAuth. No requests to Facebook are necessary until the user actually wants to log in with Facebook.
  - tinus_hn 6y ago
    That’s something you have no control over if you use the Facebook SDK
harryf 6y ago
It’s part of most apps you use on your phone - Facebook is great for app download campaigns and adding the SDK means end to end visibility on marketing. So “everyone” is using it. In an abstract sense this is similar to how Facebook (ab)used the like button on 3rd party sites to track anyone using that site. Only it’s much worse because with an app SDK they have access to much more sensitive data.
riazrizvi 6y ago
Spotify is a web app, that is wrapped into clients on different platforms. The app is constantly pinging googletagservices.com, edgesuite.net, fbcdn.net, fbsbx.com, google.com, googlesyndication.com and doubleclick.net, however you are using the app. It doesn't matter if you only listen to one, unshared, downloaded playlist. Constant tracking.
- deleted 6y ago
  [deleted]
deleted 6y ago
[deleted]
floatingatoll 6y ago
Facebook chose to make Facebook Login spyware, and Spotify didn't think anyone would mind when they did, because who cares about tracking? and/or wasn't aware, because who could realize this from the unclear Facebook docs? (Either is possible!) That was a very pre-2019 decision, and now that Facebook just set the world on fire, we're probably going to see a lot fewer Login with Facebook.
- Nextgrid 6y ago
  The ironic thing is that you can actually implement Facebook login in a privacy-respectful manner by using standard oAuth where Facebook is only contacted when the user decides to log in with it (which is mostly fine as they have an account anyway and thus consent to Facebook tracking).
  - dan15 6y ago
    It's likely that apps that load the SDK are using other features of it, such as Facebook Analytics (which is similar to Google Analytics), not just login with Facebook.

i mean, they offer FB sign in in the app, so the FB SDK is bundled with the app binary. looks like the mere presence of the library is causing crashes. someone on a related GH thread noted they commented out the code invoking the FB SDK but the issue remained.

surferbayarea 6y ago
Yeah these SDKs are siphoning off data without authorization like your location, songs you listen to and who knows what else (eg other processes or apps running on your phone). Eg the latest iOS exploit allows any app to get access to all SMS data. Tech companies of today trample upon individual privacy openly. Amazing!
- MCKapur 6y ago
  i'm by a longshot no facebook fan but... are you sure the SDK can actually siphon out what songs you listen or your location from the app it's sandboxed in (which, BTW, is in its own sandbox from an iOS system POV, and also has its own set of permissions)?
  - lucasar 6y ago
    I am an iOS developer and most likely the problem is related to configuration and basic analytics, not "siphoning" app data. Offending code : if (restrictiveParams[eventName][@"is_deprecated_event"]) { [deprecatedEventSet addObject:eventName]; } So, the iOS library does not check for nil, and whatever the server is returning does not have the expected content. Lame.
    - bryansum 6y ago
      Looks like that would've probably been caught if it were written in Swift.
      - K0nserv 6y ago
        if (restrictiveParams[eventName] as! [String: Any])["test"] != nil In Swift, now hopefully you wouldn't write this code but it's not entirely unlikely too. In fact the above Objective-C snippet is one of the few cases where Objective-C's forgiving `nil` behaviour doesn't save you from a crash.
  - surferbayarea 6y ago
    Well the reason FB/Foursquare/Google etc add these to 3rd party apps is so they can get data. Example if you visit a website which has a Facebook like button, your browser fetches the js files/which maybe even makes an API call to let FB know your IP (and hence location). All this data is fed to the giant system that feeds you ads. Adding their SDK to other apps/sites (even if there is no user facing need) is a common strategy used by most big companies to get data. In return the app that puts in the SDK gets $ from the company.
    - lucasar 6y ago
      You have no idea what you're talking about. Apps use the Facebook library because a good portion of end-users want to be able to login with a Facebook button --or Google, or whatever that doesn't require them to create a user/password account. It's just that simple.
      - surferbayarea 6y ago
        I have been witness to such business partnerships to embed SDKs to siphon telemetry/other data. The world is not as simple as you think...
        MCKapur 6y ago
        well, this would be extremely believable
      - ratww 6y ago
        If you only need login, then you can have the same functionality without the Facebook SDK or Google SDK by using OAuth.
    - traek 6y ago
      Of the companies you named, Foursquare's business model explicitly revolves around paying apps for user location data and selling it. I doubt (and at least from my experience around SV, haven't seen) that FB/Google are paying apps to include their SDKs.
  - bvandewalle 6y ago
    you are assuming that the Spotify app is not simply handing that data over. I would not be surprised if there is a financial agreement in place.
  - zlorch 6y ago
    I think he's talking in general. I worked at Spotify for a while and I can tell you the only reason they have the FB SDK bundled is to provide login. They dont use FB for any tracking or attribution at all, for that they have other frameworks. They are aware of the FB SDK misbehaving in some cases and do take steps to prevent it.
aconley314 6y ago
Then if this can be fixed by a server side change as suggested below, that's worrisome, since it suggests it is communicating with FB even if you don't invoke it.
- MCKapur 6y ago
  the real question though is if the library is not even imported into the main app and just left hanging around, linked, would it still crash? i'd be curious to know
  - nicoburns 6y ago
    Apparently yes: https://news.ycombinator.com/item?id=23097887 https://news.ycombinator.com/item?id=23097887
  - saagarjha 6y ago
    Correct, as the code is run as the dynamic linker pulls in the library (which is usually at application startup).
Lammy 6y ago
Yes, requiring the SDK to implement Facebook Login is the decision that's being criticized. Facebook encourages SDK usage obviously for the data collection it enables, but even they provide an OAuth-only login flow that doesn't require the SDK at all: https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/ https://developers.facebook.com/docs/facebook-login/manually...

three_seagrass 6y ago

They had some big partnership deal about 8 years ago which involved some low level integration. It also gave Spotify access to more Facebook user information than what was originally authorized, like letting Spotify read users' FB messages. I remember being grandfathered into not having it and Spotify would ask me every time I logged in to integrate my FB account.

tinus_hn 6y ago

Would you expect a separate app for people who login using Facebook and people who login without?

Nextgrid 6y ago
You can implement Facebook login server-side with basic oAuth. No requests to Facebook are necessary until the user actually wants to log in with Facebook.
- tinus_hn 6y ago
  That’s something you have no control over if you use the Facebook SDK

harryf 6y ago

It’s part of most apps you use on your phone - Facebook is great for app download campaigns and adding the SDK means end to end visibility on marketing. So “everyone” is using it. In an abstract sense this is similar to how Facebook (ab)used the like button on 3rd party sites to track anyone using that site. Only it’s much worse because with an app SDK they have access to much more sensitive data.

riazrizvi 6y ago

Spotify is a web app, that is wrapped into clients on different platforms. The app is constantly pinging googletagservices.com, edgesuite.net, fbcdn.net, fbsbx.com, google.com, googlesyndication.com and doubleclick.net, however you are using the app. It doesn't matter if you only listen to one, unshared, downloaded playlist. Constant tracking.

deleted 6y ago
[deleted]

deleted 6y ago

[deleted]

floatingatoll 6y ago

Facebook chose to make Facebook Login spyware, and Spotify didn't think anyone would mind when they did, because who cares about tracking? and/or wasn't aware, because who could realize this from the unclear Facebook docs? (Either is possible!) That was a very pre-2019 decision, and now that Facebook just set the world on fire, we're probably going to see a lot fewer Login with Facebook.

Nextgrid 6y ago
The ironic thing is that you can actually implement Facebook login in a privacy-respectful manner by using standard oAuth where Facebook is only contacted when the user decides to log in with it (which is mostly fine as they have an account anyway and thus consent to Facebook tracking).
- dan15 6y ago
  It's likely that apps that load the SDK are using other features of it, such as Facebook Analytics (which is similar to Google Analytics), not just login with Facebook.