5 ms·

"I have to say, I'm really impressed with Facebook for coming out and making this their issue" I don't find it impressive or surprising. This is a major issue

by larrys 15y ago

"I have to say, I'm really impressed with Facebook for coming out and making this their issue" I don't find it impressive or surprising. This is a major issue that would change what people would want to share. No sharing - no facebook. It's obvious that they need to do whatever they can fair, unfair, legal, fud to stop employers from requesting access to a facebook users page. Another commenter (jerf http://news.ycombinator.com/item?id=3745916 http://news.ycombinator.com/item?id=3745916 ) brought up the issue of legal standing which I agree with. Facebook probably doesn't have legal standing (that is clear) but the mere fact they are raising the issue will stall the process and give them time to come up with a solution. And instill "carry on as usual nothing to see here" into facebook users. They are getting out in front of the problem before it spins out of control.

yuliyp 15y ago
Why wouldn't Facebook have legal standing? They're the ones whose servers are being accessed without authorization (employer does not have authorization to use someone else's credentials).
- larrys 15y ago
  They are getting the credentials by asking the potential employee for them. So it's not without authorization. Even if they wanted to build a case of coercion or duress they would need the cooperation of the employee to do this. And most importantly what is the specific harm done to facebook by this individual action? If I give you my facebook credentials and you login what damage has been done (to facebook in my specific case)? If I was the opposing attorney I would raise the issue of whether they police and take action when people share their passwords in other cases. My guess is they have never taken action on something like this in the past. And as far as changing their TOS what are they going to say? We forbid you from sharing your password with an employer (some might want to do this for some reason) or we forbid you to share with anyone? And if that is the case they have to police all sharing of passwords which, with hundreds of millions of users is simply not going to happen.
  - nooneelse 15y ago
    Say you let me have a copy of your house key (in case you lock yourself out or sometimes I come in to water your plants maybe watch a little TV and you are cool with both of those). Someone then asks me for the key, and I let them have a copy of it. Do they have your permission to enter your house at all? I sorta think not. Permission to enter with a key does not necessarily transfer with possession of the key.
    - larrys 15y ago
      How do you get an analogy between a facebook password (which you pick by the way not them) and "copy of your house key"? The analogy would be you rent a house and are given a key. And then you can give that key to someone else (like the cleaning person). You can also give the key to someone on Airbnb but that might be prohibited by other language ("you can't rent"). Your key example would be "does the employer have the right to give your password (which you gave them) to someone else". The answer to that is obviously "no" unless you told them it is ok to do.
      - nooneelse 15y ago
        Your Facebook user name and password is exactly like your copy of a key that lets you into their house. Your having picked the character strings used doesn't matter. You are entering their system when you use that key. Them letting you put a bit of your furniture in their house (i.e. content you own) doesn't mean the house itself is yours. Nor does it mean that your permission to enter their system necessarily transfers to other people even given that you happen to give those other people a copy of the key.
        mikeash 15y ago
        It's probably not productive to use poor analogies here. Accessing a computer system without authorization from the owner of that system is a crime. Facebook doesn't give authorization for employers to access their employee's accounts on their system, and explicitly forbids their users from transferring their own authorization to others. As far as I can see, there is simply no way to construe an employer's access as authorized by the owner of the system i.e. Facebook.

by larrys 15y ago

yuliyp 15y ago

Why wouldn't Facebook have legal standing? They're the ones whose servers are being accessed without authorization (employer does not have authorization to use someone else's credentials).

larrys 15y ago
They are getting the credentials by asking the potential employee for them. So it's not without authorization. Even if they wanted to build a case of coercion or duress they would need the cooperation of the employee to do this. And most importantly what is the specific harm done to facebook by this individual action? If I give you my facebook credentials and you login what damage has been done (to facebook in my specific case)? If I was the opposing attorney I would raise the issue of whether they police and take action when people share their passwords in other cases. My guess is they have never taken action on something like this in the past. And as far as changing their TOS what are they going to say? We forbid you from sharing your password with an employer (some might want to do this for some reason) or we forbid you to share with anyone? And if that is the case they have to police all sharing of passwords which, with hundreds of millions of users is simply not going to happen.
- nooneelse 15y ago
  Say you let me have a copy of your house key (in case you lock yourself out or sometimes I come in to water your plants maybe watch a little TV and you are cool with both of those). Someone then asks me for the key, and I let them have a copy of it. Do they have your permission to enter your house at all? I sorta think not. Permission to enter with a key does not necessarily transfer with possession of the key.
  - larrys 15y ago
    How do you get an analogy between a facebook password (which you pick by the way not them) and "copy of your house key"? The analogy would be you rent a house and are given a key. And then you can give that key to someone else (like the cleaning person). You can also give the key to someone on Airbnb but that might be prohibited by other language ("you can't rent"). Your key example would be "does the employer have the right to give your password (which you gave them) to someone else". The answer to that is obviously "no" unless you told them it is ok to do.
    - nooneelse 15y ago
      Your Facebook user name and password is exactly like your copy of a key that lets you into their house. Your having picked the character strings used doesn't matter. You are entering their system when you use that key. Them letting you put a bit of your furniture in their house (i.e. content you own) doesn't mean the house itself is yours. Nor does it mean that your permission to enter their system necessarily transfers to other people even given that you happen to give those other people a copy of the key.
      - mikeash 15y ago
        It's probably not productive to use poor analogies here. Accessing a computer system without authorization from the owner of that system is a crime. Facebook doesn't give authorization for employers to access their employee's accounts on their system, and explicitly forbids their users from transferring their own authorization to others. As far as I can see, there is simply no way to construe an employer's access as authorized by the owner of the system i.e. Facebook.