8 ms·

The 3rd party is not making the API request though. I am, just using software that didn't come from the platform vendor. Many 3rd party twitter clients have ex

by xmodem 4y ago

The 3rd party is not making the API request though. I am, just using software that didn't come from the platform vendor. Many 3rd party twitter clients have expressed a willingness to display ads if provided an API to do so. As someone who has lost precious accessibility capabilities because of restrictions on 3rd party clients, I unfortunately have to point out that I don't really have a choice of what platforms I do or don't interact with in a lot of cases. I wouldn't stay at my job for very long if I didn't tolerate Slack's BS, for instance.

fzeroracer 4y ago
Let me offer you a question then: Do you know how much data the OG App is taking from you while you authorize it to work on your behalf? How do you know it's not reading through your entire message history? Or building its own network graph of your friends to sell? How about security? How do you know it's securely storing your credentials? Or that it's not selling said credentials as well? Like in this scenario to Facebook it is in theory effectively you. Not the app operating on behalf of you with a limited set of permissions.
- josephcsible 4y ago
  Sure, there's a risk there. But it should be my choice whether or not to accept that risk, not Meta's.
  - fzeroracer 4y ago
    In this case the risk you take doesn't matter (though I argue from a security standpoint this is something you should really care about in any argument around Meta), it's the risk Meta takes by allowing it. Because if the company takes your data and runs, Meta is the one also on the hook for not securing their APIs. If it turns out they're farming passwords from users to sell to whatever group ultimately the class action lawsuit will come out with knives facing Meta. Like this is a security problem, straight up. I would hope that you can agree on this and that not securing your API is bad.
    - josephcsible 4y ago
      Should you secure your API? Of course. But you should not secure my data from me.
    - franga2000 4y ago
      What do you mean? On what planet is it a provider's fault if a third party farms logins through a custom client. It's not their fault if I get phished, if the little booklet I store my passwords in under my pillow gets stole, if my computer is infected with a RAT... so why would it be in this scenario? I only got a few posts into the thread before Twitter booted me out for not having an account, so maybe there's some context I'm missing, but what kind of "not securing your API" are you talking about? The fact that a thir party, explicitly authorized the the user, was able to make actions on the user's behalf, doesn't make it secure, it makes it functional.
      - murderfs 4y ago
        > What do you mean? On what planet is it a provider's fault if a third party farms logins through a custom client. Earth: https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...
        franga2000 4y ago
        > Cambridge Analytica then arranged an informed consent process for research in which several hundred thousand Facebook users would agree to complete a survey for payment that was only for academic use. > However, Facebook allowed this app not only to collect personal information from survey respondents but also from respondents’ Facebook friends.[13] In this way, Cambridge Analytica acquired data from millions of Facebook users FB gave them data about friends, when it was supposed to only give them data about respondents. Totally different situation.
        murderfs 4y ago
        Yes, the reason this happened was that when a user authorized the Cambridge Analytica app, it would have the ability to view information about all of that user's friends. Sound familiar?
- d110af5ccf 4y ago
  Yes, people can and will write malicious programs. Those will sometimes take the form of third party clients for a service. That is not and will never be a valid argument against them being allowed to exist. Monopolies are not ok. Abusive behavior by the dominant market players isn't ok.
  - fzeroracer 4y ago
    Yes, but my point is that said clients should have to talk through properly secured APIs and required by law. Until then, an app like this is a massive, MASSIVE security risk and I would question the sanity of any team that saw something like this and ignored it.
    - d110af5ccf 4y ago
      > should have to talk through properly secured APIs I don't follow what you mean by this. The API endpoints that a company provides ought to be secured properly. In practice they might or might not be but obviously they ought to be. I don't see what that has to do with third party clients though. A third party client is stuck interacting with whatever API the company provides, however secure or insecure it might be.
      - fzeroracer 4y ago
        I mean from another perspective this is effectively a MITM style way of interacting with Meta's API. They are behaving as another unauthorized layer between the user and Meta's API. In actual secure systems involving third party clients the client usually authorizes itself on behalf of some user requests or permissions, so while it does things for the user there's a clear and secure delegation of permissions. Have you done much work with authorization? To put it in another way let's say there was a website that said it authorized with Steam. It asked you to put in your steam username and password. Is this secure? Now let's say that same website instead redirected you back to Steam (properly) and requested authorization on behalf of you. Is this secure? Now which bucket does this app fall under?
- SturgeonsLaw 4y ago
  If you use the third party app, it might be doing all that stuff. If you use the official app, it will be doing all that stuff.

by xmodem 4y ago

fzeroracer 4y ago

Let me offer you a question then: Do you know how much data the OG App is taking from you while you authorize it to work on your behalf? How do you know it's not reading through your entire message history? Or building its own network graph of your friends to sell? How about security? How do you know it's securely storing your credentials? Or that it's not selling said credentials as well? Like in this scenario to Facebook it is in theory effectively you. Not the app operating on behalf of you with a limited set of permissions.

josephcsible 4y ago
Sure, there's a risk there. But it should be my choice whether or not to accept that risk, not Meta's.
- fzeroracer 4y ago
  In this case the risk you take doesn't matter (though I argue from a security standpoint this is something you should really care about in any argument around Meta), it's the risk Meta takes by allowing it. Because if the company takes your data and runs, Meta is the one also on the hook for not securing their APIs. If it turns out they're farming passwords from users to sell to whatever group ultimately the class action lawsuit will come out with knives facing Meta. Like this is a security problem, straight up. I would hope that you can agree on this and that not securing your API is bad.
  - josephcsible 4y ago
    Should you secure your API? Of course. But you should not secure my data from me.
  - franga2000 4y ago
    What do you mean? On what planet is it a provider's fault if a third party farms logins through a custom client. It's not their fault if I get phished, if the little booklet I store my passwords in under my pillow gets stole, if my computer is infected with a RAT... so why would it be in this scenario? I only got a few posts into the thread before Twitter booted me out for not having an account, so maybe there's some context I'm missing, but what kind of "not securing your API" are you talking about? The fact that a thir party, explicitly authorized the the user, was able to make actions on the user's behalf, doesn't make it secure, it makes it functional.
    - murderfs 4y ago
      > What do you mean? On what planet is it a provider's fault if a third party farms logins through a custom client. Earth: https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...
      - franga2000 4y ago
        > Cambridge Analytica then arranged an informed consent process for research in which several hundred thousand Facebook users would agree to complete a survey for payment that was only for academic use. > However, Facebook allowed this app not only to collect personal information from survey respondents but also from respondents’ Facebook friends.[13] In this way, Cambridge Analytica acquired data from millions of Facebook users FB gave them data about friends, when it was supposed to only give them data about respondents. Totally different situation.
        murderfs 4y ago
        Yes, the reason this happened was that when a user authorized the Cambridge Analytica app, it would have the ability to view information about all of that user's friends. Sound familiar?
d110af5ccf 4y ago
Yes, people can and will write malicious programs. Those will sometimes take the form of third party clients for a service. That is not and will never be a valid argument against them being allowed to exist. Monopolies are not ok. Abusive behavior by the dominant market players isn't ok.
- fzeroracer 4y ago
  Yes, but my point is that said clients should have to talk through properly secured APIs and required by law. Until then, an app like this is a massive, MASSIVE security risk and I would question the sanity of any team that saw something like this and ignored it.
  - d110af5ccf 4y ago
    > should have to talk through properly secured APIs I don't follow what you mean by this. The API endpoints that a company provides ought to be secured properly. In practice they might or might not be but obviously they ought to be. I don't see what that has to do with third party clients though. A third party client is stuck interacting with whatever API the company provides, however secure or insecure it might be.
    - fzeroracer 4y ago
      I mean from another perspective this is effectively a MITM style way of interacting with Meta's API. They are behaving as another unauthorized layer between the user and Meta's API. In actual secure systems involving third party clients the client usually authorizes itself on behalf of some user requests or permissions, so while it does things for the user there's a clear and secure delegation of permissions. Have you done much work with authorization? To put it in another way let's say there was a website that said it authorized with Steam. It asked you to put in your steam username and password. Is this secure? Now let's say that same website instead redirected you back to Steam (properly) and requested authorization on behalf of you. Is this secure? Now which bucket does this app fall under?
SturgeonsLaw 4y ago
If you use the third party app, it might be doing all that stuff. If you use the official app, it will be doing all that stuff.