4 ms·

Is it fake? The relationship isn't just between the user and facebook (thus, auth) it's between the user, facebook, and the third-party app. The concern is that

by pfraze 5y ago

Is it fake? The relationship isn't just between the user and facebook (thus, auth) it's between the user, facebook, and the third-party app. The concern is that the 3rd-parties act maliciously; see the challenges with browser extensions. I'm not making excuses for the big companies -- I'm just trying to evaluate the challenges properly. If the core of the problem really is the behaviors of 3p apps, the security model for them is what a solution needs to address.

AtlasBarfed 5y ago
Then you get into... authorization. Yes, facebook and other social platforms have issues with people snagging account access, usually by shared password vectors, but come on. This is still basic meat and potatoes auth for a more open social "pan-platform".
- pfraze 5y ago
  Well I'm more thinking of the problem that browser extensions had, where people would make something handy or fun, be granted perms by the user, then get sold to people looking to mine user data. Extension authors get solicitations for these sales constantly, and the sale prices can be really tempting for devs. A friend of mine just made a silly "cursor sparkles" extension and he's mentioned multiple of these emails. Regardless of how you feel about it, the Cambridge Analytica ordeal was entirely about using benign quiz apps to mine user data, and the pressure that Facebook received was to fix their security. That's a huge incentive to lock down fair access. So if this is the situation, we need to address it if we're going to fix the technical pressures that create monopolies.
  - jatone 5y ago
    that's a user problem. they granted the extension permission to access the data. that's on them. You will never be able to solve that problem. after all a user can just hand out their credentials if they want to. Facebook's issues stems from the fact they allowed apps in their market to access data they didn't need to function / hide exactly how much access these applications are granted. the reality here is auth is the solution; for browser extensions we need better UX. if a extension is asking for access to your navigation / page data that needs to be flagged and warned about during the setup flow. many of these auth systems make the risky API access grants appear extremely benign.

by pfraze 5y ago

AtlasBarfed 5y ago

Then you get into... authorization. Yes, facebook and other social platforms have issues with people snagging account access, usually by shared password vectors, but come on. This is still basic meat and potatoes auth for a more open social "pan-platform".

pfraze 5y ago
Well I'm more thinking of the problem that browser extensions had, where people would make something handy or fun, be granted perms by the user, then get sold to people looking to mine user data. Extension authors get solicitations for these sales constantly, and the sale prices can be really tempting for devs. A friend of mine just made a silly "cursor sparkles" extension and he's mentioned multiple of these emails. Regardless of how you feel about it, the Cambridge Analytica ordeal was entirely about using benign quiz apps to mine user data, and the pressure that Facebook received was to fix their security. That's a huge incentive to lock down fair access. So if this is the situation, we need to address it if we're going to fix the technical pressures that create monopolies.
- jatone 5y ago
  that's a user problem. they granted the extension permission to access the data. that's on them. You will never be able to solve that problem. after all a user can just hand out their credentials if they want to. Facebook's issues stems from the fact they allowed apps in their market to access data they didn't need to function / hide exactly how much access these applications are granted. the reality here is auth is the solution; for browser extensions we need better UX. if a extension is asking for access to your navigation / page data that needs to be flagged and warned about during the setup flow. many of these auth systems make the risky API access grants appear extremely benign.