4 ms·
It works for photos because the threat model is about protecting local files against malicious apps. But for phone numbers, you about protecting Facebook API (
by progval 6y ago
It works for photos because the threat model is about protecting local files against malicious apps.
But for phone numbers, you about protecting Facebook API (which is publicly available via the internet) against arbitrary devices, which Facebook has no way to tell from legitimate ones
- amluto 6y agoWhat I mean is: Facebook should remove that API entirely. Apps do not need a way to look up a phone number in Facebook’s database. The “find my friends using this app” feature does not require this capability.
- progval 6y agoWhat you are proposing is that third-party apps should ask Facebook's app to find the friends, right? But Facebook's app needs to access Facebook's database somehow; and anyone can impersonate Facebook's app and query that database too.
- varispeed 6y agoI think it should be illegal for apps to help find friends. If you genuinely meet someone offline, then they could generate you a token that then you could enter on the site to "connect".
- amluto 6y agoFacebook’s phone app does not need to access the database. The whole thing could be implemented on the backend.
- progval 6y agoThis is what I meant. Replace "database" with "backend" in my previous message and it still stands.