4 ms·

I signed up for airbnb using my facebook account and I noticed that they give away your DOB. I immediately changed my DOB on facebook and vowed to avoid authen

by phillmv 15y ago

I signed up for airbnb using my facebook account and I noticed that they give away your DOB. I immediately changed my DOB on facebook and vowed to avoid authenticating with apps. I generally avoid putting in real information on facebook but the amount of stuff they give away is frightening. It's a heaven for social engineering and spear phishing.

bigiain 15y ago
"I immediately changed my DOB on facebook" Hmmm, I wonder what Facebook does when someone changes something like their DOB? Or name/address/email/phone? Or any other marketing-useful data in your profile? If _I_ were part of the Facebook Evil-Data-Mining Division, I'd certainly be looking to see if I can discern patterns like "This phillmv guy's _real_ birthday is 12/03/1975, but when he changes it for sites he doesn't trust he tends to use either 1st April 1980, or 22nd Sept (which is his girlfriends birthday) instead. And he usually changes his zipcode to the one his parents used to live at before they moved to Pittsburg."
- mhpotter 15y ago
  The Evil-Data-Mining Division is the only one they have.
- mattbot5000 15y ago
  Facebook also limits the number of times you can change your DOB, though I'm not sure what that limit is.
  - phillmv 15y ago
    This is extremely hateful. Like with the Google Plus real name thing.
- sneak 15y ago
  Terrifying, as 1st April 1980 is exactly my DOB for this purpose. April fools unite!
saurik 15y ago
Applications must ask you for the user_birthday permission to have access to this field.
r00fus 15y ago
My "fakebook" personal data is mostly false, including birthday and age (wtf, combined, that's one of the keys used for auth verification at banks!) It doesn't help when I got 30 incorrect "happy birthday" wishes, but that was when I decided I should just hide all my (fake) data from friends too... real friends know who I am, anyway.
dtsingletary 15y ago
Frankly, I'd wonder why you want to be a customer of AirBNB, then. Not because they're asking for this, but because it seems like a pretty valid piece of information for a company that banks on authenticity and trust between its buyers and sellers. I understand this for less reputable apps and companies, but if you're willing to circumvent the information they've requested through an authenticator (and data provider) of choice, and your reaction is to poison that data, then a) Why are you authing with Facebook? (You answered that, I guess: you won't do it now) b) Do you distrust the site you're using to find someone to share some housing with? Would any solution for authentically sharing data be acceptable?
- phillmv 15y ago
  >Why are you authing with Facebook? Because it's easy and there are network advantages - it slurps down a profile picture automatically and fills in a bunch of otherwise useful fields. At no point in time does anyone need to know what my DOB is. It's not a valid piece of information. You can already track me down using my credit card. The reason why I'm prickly about my DOB is because it's used as a "relatively unique identifier". It's the first question my bank asks me because… it's meant to be semi private in the first place. I can't change the security practices of banks, but I can lower the odds of being seriously screwed by managing my disclosure of "relatively unique identifiers". > Do you distrust the site you're using to find someone to share some housing with? Of course! There are almost no organizations worthy of your trust. I'm forced to trust Google, but that's about it. In regards to AirBNB, while I'm sure their current management is a-OK this says nothing about what will happen with the data if they go bankrupt in a couple of years. I had a client who shall go unnamed turn around and sell a dump of their database to marketers. I was pretty surprised when I saw random test accounts suddenly get spammed. >Would any solution for authentically sharing data be acceptable? Yeah. The problem currently is that it's far too permissive by default, and you can't arbitrarily untick permissions. Just because your application wants the ability to tweet using my account doesn't mean I think you should have that right. When you want to escalate the permission, you can ask me beforehand and I will then judge whether you're worthwhile. The current state of affairs, where by default everyone gets everything and we're pushing this on users who don't know any better is totally fucking atrocious.

by phillmv 15y ago

bigiain 15y ago

"I immediately changed my DOB on facebook" Hmmm, I wonder what Facebook does when someone changes something like their DOB? Or name/address/email/phone? Or any other marketing-useful data in your profile? If _I_ were part of the Facebook Evil-Data-Mining Division, I'd certainly be looking to see if I can discern patterns like "This phillmv guy's _real_ birthday is 12/03/1975, but when he changes it for sites he doesn't trust he tends to use either 1st April 1980, or 22nd Sept (which is his girlfriends birthday) instead. And he usually changes his zipcode to the one his parents used to live at before they moved to Pittsburg."

mhpotter 15y ago
The Evil-Data-Mining Division is the only one they have.
mattbot5000 15y ago
Facebook also limits the number of times you can change your DOB, though I'm not sure what that limit is.
- phillmv 15y ago
  This is extremely hateful. Like with the Google Plus real name thing.
sneak 15y ago
Terrifying, as 1st April 1980 is exactly my DOB for this purpose. April fools unite!

saurik 15y ago

Applications must ask you for the user_birthday permission to have access to this field.

r00fus 15y ago

My "fakebook" personal data is mostly false, including birthday and age (wtf, combined, that's one of the keys used for auth verification at banks!) It doesn't help when I got 30 incorrect "happy birthday" wishes, but that was when I decided I should just hide all my (fake) data from friends too... real friends know who I am, anyway.

dtsingletary 15y ago

Frankly, I'd wonder why you want to be a customer of AirBNB, then. Not because they're asking for this, but because it seems like a pretty valid piece of information for a company that banks on authenticity and trust between its buyers and sellers. I understand this for less reputable apps and companies, but if you're willing to circumvent the information they've requested through an authenticator (and data provider) of choice, and your reaction is to poison that data, then a) Why are you authing with Facebook? (You answered that, I guess: you won't do it now) b) Do you distrust the site you're using to find someone to share some housing with? Would any solution for authentically sharing data be acceptable?

phillmv 15y ago
>Why are you authing with Facebook? Because it's easy and there are network advantages - it slurps down a profile picture automatically and fills in a bunch of otherwise useful fields. At no point in time does anyone need to know what my DOB is. It's not a valid piece of information. You can already track me down using my credit card. The reason why I'm prickly about my DOB is because it's used as a "relatively unique identifier". It's the first question my bank asks me because… it's meant to be semi private in the first place. I can't change the security practices of banks, but I can lower the odds of being seriously screwed by managing my disclosure of "relatively unique identifiers". > Do you distrust the site you're using to find someone to share some housing with? Of course! There are almost no organizations worthy of your trust. I'm forced to trust Google, but that's about it. In regards to AirBNB, while I'm sure their current management is a-OK this says nothing about what will happen with the data if they go bankrupt in a couple of years. I had a client who shall go unnamed turn around and sell a dump of their database to marketers. I was pretty surprised when I saw random test accounts suddenly get spammed. >Would any solution for authentically sharing data be acceptable? Yeah. The problem currently is that it's far too permissive by default, and you can't arbitrarily untick permissions. Just because your application wants the ability to tweet using my account doesn't mean I think you should have that right. When you want to escalate the permission, you can ask me beforehand and I will then judge whether you're worthwhile. The current state of affairs, where by default everyone gets everything and we're pushing this on users who don't know any better is totally fucking atrocious.