10 ms·

Spotify and Facebook: Is that phishing?

324 points by linx 14y ago

luser001 14y ago
Amazing. Also, this is yet another privacy threat that I dodged because I use the PwdHash extension (https://www.pwdhash.com/ https://www.pwdhash.com/). You type the same password for all sites, but the extension invisibly uniquifies them on a per-site basis.
- zx2c4 14y ago
  Shameless plug -- Pass: The Standard Unix Password Manager http://zx2c4.com/projects/password-store/ http://zx2c4.com/projects/password-store/ It works damn well.
- duijf 14y ago
  To be honest, that looks like it has a some drawbacks when used with different domains that use the same authentication backend. Think Google's different domains (google.com, google.co.uk, google.nl, gmail.com etc.) The demo gives a different hashed password whenever the TLD differs. And seeing that Google by default redirects you to the homepage of whatever country you're in at the moment, you might end up getting burned by the extension when travelling.
  - karl_gluck 14y ago
    The problem of sharing passwords across domains is one of the things that prompted me to write the password-generating service Cryptasia [1]. In short, Cryptasia uses a Google Spreadsheet entirely owned & controlled by each user as a 3rd party data store. Each row contains the friendly name of the site, the login URL, the password generation key, a list of allowed characters, which characters are required, and the length of the password to create. By using the same generator key and character sets, one can have the same password for multiple websites. The password can also be changed for a website without having to change your master passphrase, since just changing the generator key (say, adding a "1" afterward) completely changes the created password. I know it's not as easy to use as a browser extension, but when I visited Europe it was nice to be able to hop on any computer in one of the hotels and check my email. I can throw this on Github if anyone's interested (the source-code is all in unobscured JS, too). [1] crypt.asia or http://www.cryptasia.com http://www.cryptasia.com
  - luser001 14y ago
    > you might end up getting burned by the extension when travelling. Good point. This could happen. I'm assuming by "burned" you mean "unable to login". If so, you can always type in your home country's domain into the webapp version and get the correct hashed password. I agree this isn't ideal. Just saying that there's a plan B.
- eli 14y ago
  Doesn't seem like a good fit for the paranoid. If you screw up and your master password leaks, an attacker can access all of your accounts. I greatly prefer KeePass + Dropbox, which also lets you securely store usernames and notes. And the passwords are random and not derived from anything.
  - luser001 14y ago
    > Doesn't seem like a good fit for the paranoid. Agreed. But OTOH it's a very lightweight solution, which is an advantage. And in any case, it's MUCH better than using the same unhashed password everywhere. I'm claiming that using PwdHash is strictly better than not using it. YMMV.
  - zeidrich 14y ago
    While it's not a perfect solution, most of the time you are not trying to protect yourself from a dedicated, thinking, hacker. Instead you're protecting yourself against automated systems that share passwords. Unless it was commonplace it would avoid a majority of those issues.
RexM 14y ago
It says "Facebook Email or Spotify Username" in the login box before typing in a username/email. As far as I know, spotify uses username for login, and not email. By using your email, it's assuming you want to use facebook.
- dkersten 14y ago
  And yet that in no way gives them the right to use that to log into your facebook (rather than using the API to authenticate) and install the spotify facebook app (giving themselves whatever permissions they like without asking the user). Of course, the lesson here (besides that spotify cannot be trusted) is that you should never use a password for more than one account. Sure makes me glad I switched to using a password manager that uses randomly generated different passwords for each service I sign up to.
  - Superanos 14y ago
    Facebook and Spotify are tightly partnered together - at one point they actually REQUIRED the use of Facebook to log in. The option to register without Facebook was only reintroduced recently.
    - seivan 14y ago
      Not true, I don't use Facebook and I was one of part of the Open Beta many years ago.
      - RexM 14y ago
        If you read the reply again, they allowed you to use a username, then required facebook, then reintroduced the ability to user a username. You probably were using a username, before they started requiring facebook.
      - mitchty 14y ago
        In the US, when spotify first opened up to Americans you could sign up without facebook credentials. About a month later, they decided to go facebook only for new setups.
Create 14y ago
Facebook and Spotify share a number of investors: billionaire Li Ka Shing has a stake in Facebook and Spotify. Yuri Milner’s DST Global, which owns roughly 10% of Facebook, is also in negotiations to buy a stake in Spotify. Facebook’s founding president and Napster founder Sean Parker, sits on the board of Spotify. http://benjamin.sonntag.fr/Moglen-at-Re-Publica-Freedom-of-thought-requires-free-media http://benjamin.sonntag.fr/Moglen-at-Re-Publica-Freedom-of-t...
- stanleydrew 14y ago
  I don't understand this comment. Many companies share investors, especially at the level of Facebook and Spotify. Are you trying to suggest that a mutual investor somehow has enough product control to strong-arm Facebook and Spotify into this?
  - Create 14y ago
    I am not suggesting anything. Please listen to Eben's talk: it is much more serious than an "accidentally" entangled account.
    - stanleydrew 14y ago
      To be clear I think this is very serious. There is a reason I deleted my Facebook account in 2009 and have never had a Spotify account. But you were clearly trying to suggest that shared investors have something to do with this. There's no other information in your comment except that the two companies share investors. And in the context of this incident the only possible implication of your comment is that shared investors somehow influenced this. Otherwise why post the comment at all?
  - ersii 14y ago
    I assume the parent post does - and so do I, in at least this particular case. Seeing how closly knit Facebook and Spotify are. There's not just a shared investor group - there's also a partnership between the two companies. And it's pretty strong, as in; yes, it does seem like they have shared product control or at least great influences on each others product management Mark Zuckerberg is listed and quoted as one of the references on their sign up page, by the way.
ineedtosleep 14y ago
I'm ashamed that this doesn't surprise me much. This looks like a huge oversight on Facebook's part, but with the countless reports on Facebook failing with privacy here, there and everywhere, it's like I don't care anymore. The thing that numbs me even more is that client work, no matter how good of an argument one gives, will always have some form of third-party social login because it's oh-so-important and users will _always_ use it.
- andrewroycarter 14y ago
  We kind of have a different problem. Clients all want it in the apps we make, but analytics show that very few users use those features. Which sucks because it takes forever to implement all that stuff -_-
  - wtvanhest 14y ago
    Do you know of any 3rd party data on that (perhaps a blog post or published data)? Intuitively I believe what you are saying, but I really want to show someone else.
- ghayes 14y ago
  The issue here isn't with Facebook privacy. If I guess (or you tell me) your bank's online login information, does that give me the right to log-in to your account and start mucking with things? Facebook has an API to access your account through OAuth and Graph; Spotify should never login on your behalf.
  - jonknee 14y ago
    That would be illegal (highly illegal actually). It should also be illegal to do what Spotify is doing, but I'll go out on a limb and say that they won't be held accountable. People have gone to jail for incrementing IDs in GET variables, accessing Facebook accounts without permission and installing apps goes way way beyond that.
    - 14y ago
ActVen 14y ago
If this type of behavior continues to be tolerated by users, the entire industry will suffer the backlash at some point. A few companies using obfuscated or unclear defaults will make it more likely that the government will bring down heavy legislation on all companies.
- Elessar 14y ago
  Why is everyone jumping to blame Spotify for maliciousness? All I see is that they have a bug where they instantly assume emails = Facebook login. Then they try logging in using that email, and because this user reuses passwords, it works. It takes two to Tango, but I see incompetence on both sides rather than maliciousness.
  - ActVen 14y ago
    I never used the word malicious. I used the word "behavior". Behavior encapsulates incompetence, poor design, maliciousnesses, etc. I don't presume to know what was the behind the implementation...I just don't think it should be tolerated.
  - wubbfindel 14y ago
    It's not a "bug" if they specifically ask the user for their "facebook email" or their "spotify username" - which of course they do! So if the user provides their facebook email and the correct password to match, which this user did, the correct behaviour is to log the user in via facebook. Which of course Spotify did. No bug there. I'd say that this is mostly user error - but possibly Spotify could make it more obvious.
    - jimzvz 14y ago
      So reactivating the facebook account and adding the app to the facebook account without the user agreeing to either is fine for you?
      - wubbfindel 14y ago
todd3834 14y ago
Simple solution, don't use the same password for all of your accounts and read the instructions, it says username or facebook email.
- thinkling 14y ago
  Not only don't use the same password, but don't give your FB password to another app or website. Duh.
kmfrk 14y ago
This is pretty shameless, even for Facebook.
- tlrobinson 14y ago
  Except it's Spotify doing it, not Facebook...
  - mjschultz 14y ago
    Unless Spotify has some backdoor API with Facebook, it seems like a major oversight in the Facebook API that an (any?) app can re-register a deactivated account and give itself whatever permissions it wants. Just because Spotify accidentally (or purposefully) took advantage of that hole doesn't mean it's not Facebook at fault here.
Superanos 14y ago
It says quite clearly: "Log in with Facebook or Spotify". That means you can log in using a Facebook account or a Spotify account. The username field says "Facebook Email or Spotify Username". So when you type an email, you log in using a Facebook account. It's not that hard to understand. By the way, that account you made on the sign up page is still unused: you logged in using a Facebook account, which is a different account from the one you just registered, so you have two spotify users now - one you signed up w/o Facebook and one you actually logged into.
- mikeash 14y ago
  I disagree that it's clear. A placeholder in a field is no substitute for an actual label. It should be an enhancement, not a replacement. With the number of places using e-mail addresses as usernames, it's a natural mistake.
- fusiongyro 14y ago
  It says "Log in with Facebook or Spotify," not "Log in with Spotify, or log in with Facebook, reactivating a disabled account if necessary, and then grant us a bunch of permissions." Nobody cares that it attempted a Facebook authentication. We care that it silently reactivated the Facebook account and silently gave itself permissions.
drue 14y ago
I wanted to try spotify a while back but got stuck when it required a FB account. Sounds like it's no longer required, but I suppose I still don't trust them enough to try their service.
- jiggy2011 14y ago
  You can signup with an email address , but the option is hidden quite low in the signup page. Best way to avoid this sort of stuff is just to sign up to spotify with throwaway email. I have found that it's worth buying a domain name and just tying it to a VPS with SMTP installed (or using a third part service that offers unlimited addresses). That way you can just generate throwaway email addresses as you need them.
  - benmanns 14y ago
    You can also use Mailinator[0] and their many other domains for throwaway email addresses. In fact, you can point your MX records to mail.mailinator.com for a custom domain without running a VPS.[1] [0] http://www.mailinator.com/ http://www.mailinator.com/ [1] http://mailinator.blogspot.com/2008/01/your-own-private-mailinator.html http://mailinator.blogspot.com/2008/01/your-own-private-mail...
    - jiggy2011 14y ago
      True, but those services are quite limited and not that secure in that anybody who knows the email address can login to your account.
      - ehamberg 14y ago
        Not necessarily. They also give you a “gibberish” address to the account. So if I use “foobar” as my mailbox on mailinator, they will list an address like M8R-wk43th@mailinator too, that does not let people log in.
    - apapli 14y ago
      I have a google apps for business account (a former free one before they started charging). I just create lots of alias emails associated with a domain name I used to use and still own. Works like a charm and they are always accepted. I hear mailinator email addresses don't always get accepted by some services (though I haven't experienced this myself to verify).
benmanns 14y ago
This is just Spotify not finding a user with username=[your email address] and looking for that user on Facebook. I did a test by creating an account with the email benjamintesterton@mailinator.com (not linked to a Facebook account) and username benjamintesterton. When I tried logging in with the email, it failed, but with just the username worked. If logging in with the email did work, it would mean that Spotify authenticated you with their server and then abused your credential re-use to hack your Facebook account. However, this appears not to be the case. They should just check email=[input] OR username=[input], but that may be backwards-incompatible and break the functionality of people who use their Facebook credentials to login.
- jonknee 14y ago
  Not just finding a user on Facebook with an email address, because they also log into the Facebook account and add their app to it. (Hence the re-activation email as well.) Very shady.
  - cbhl 14y ago
    I really doubt this is Spotify's fault. Facebook has quite the trigger-finger when it comes to reactivation -- clicking a like button with the right cookies will do it, IIRC.
    - jonknee 14y ago
      How would the app be installed?
- Superanos 14y ago
  That is correct. It says quite clearly "Facebook Email or Spotify Username". It's the user's mistake for using their Facebook account instead of the account they just created.
  - benmanns 14y ago
    Yes, true, but I thought it would be a lot more damning if they also authenticated via Spotify email, because that would mean that they accessed the Facebook account while already having authenticated the user via Spotify credentials.
runn1ng 14y ago
It's funny though that Facebook frequently asks you for your password to your e-mail account. For very similar kind of thing.
mikec3k 14y ago
No, it's not phishing.
- jonknee 14y ago
  What would you call it? Asking for information for activity X and using it to do activity Y without your permission sounds exactly like phishing to me.
Kiro 14y ago
I remember once when I was automatically logged in to my roommate's Spotify account on my computer just because we were on the same WiFi network (?). She had never used my computer, let alone logged in to her Spotify account on it. I'm still not sure how or why it happened.
INTPenis 14y ago
It is, or at least was, possible to delete your facebook account. Not just deactivate it. http://www.facebook.com/help/224562897555674?_fb_noscript=1 http://www.facebook.com/help/224562897555674?_fb_noscript=1 That's in Swedish for me but I assume it's localized. It says that there are two options, one is deactivation, and if you don't believe you'll need your account again, the other is deletion.
oellegaard 14y ago
So happy that I use 1password to generate random passwords for every single service I use. This wouldn't be possible if everyone was more aware of security - still, I find the way facebook treats its users increasingly disturbing and seriously consider to leave it.
andreyf 14y ago
If you don't want someone to mess with your Facebook account, then perhaps you shouldn't give them your Facebook login and password...
- analog 14y ago
  Well yes of course, you shouldn't use the same user:pass for different sites. But a lot of people do, and that opens them up to being hacked if the password for one site is revealed. Spotify are knowingly logging into the OPs Facebook account without OPs permission. Shouldn't this qualify as unauthorised access, as in a Federal offence?
noonat 14y ago
The fact that the user was logged into Facebook after giving Facebook credentials to Spotify is not the problem. The login screen communicates that this will occur. Maybe it doesn't communicate it as well as it could, but it does communicate it. The problem is that Spotify added itself to the user's list of apps and granted itself access to the user's data without any communication that this would occur. I guess you could say that permission for Spotify to do that is implicitly granted by giving them your Facebook credentials. But these days, federated authentication and authorization are two different things for end users -- especially so for Facebook apps. Spotify should at least prompt the user before making these changes on their behalf. Very underhanded behavior.
- szidev 14y ago
  Here's the tricky part: they do ask for permission to post on your behalf when you open the app. It's pretty muted, at the bottom of a popup, and dwarfed by a larger, more colorful call to action. Here's a screenshot: http://i.imgur.com/oWDstiC.png http://i.imgur.com/oWDstiC.png It's also not entirely obvious to me what happens in every case. If I close the popup, does it still count as my giving consent? If I close the app? My guess is that most people skim over the copy and click the big blue button, totally disregarding the checkbox down there.
  - pbhjpbhj 14y ago
    Well spotted. But a user who'd disabled/cancelled/deactivated their FB account would assume that action was moot rather than that Spotify were going to illegally access a secondary service posing as you in order to enable that activity.
axx 14y ago
I'm may be wrong here, but isn't it the case, that Facebooks re-activates your account, as soon as you login with Facebook Connect on a 3rd-Party site? I really hate that, but what if you're using something like coughBangYourFriendscough Spotify, deactivate your Facebook account and can't use Spotify anymore? Maybe you're a paying customer to Spotify? How do you cancel your membership if you can't login anymore? To me this seems like a Big Communication Problem™ between the User and the App/Facebook. The Facebook API needs a functionality that says "Using a deactivated account for Facebook Connect re-activates your old account automatically". I totally disagree on methods like this, but i seems plausible in that way.
whaevr 14y ago
Spotify up on the front page of HN 2 days in a row now..and for all the wrong reasons. Hah
berdon 14y ago
Did anyone else read this and then scroll to the top only to realize they'd been reading and comprehending german the entire time and then suddenly forgot it? I did. :/
- arturkim 14y ago
  I actually hadn't scrolled up. I had to revisit the page to understand what you were talking about.
xordon 14y ago
To Summarize: 1. using the same password for spotify and facebook is a dumb thing to do. don't do it. 2. by entering an email address instead of a username means spotify will use facebook auth (it should be made more obvious to users). 3. using facebook api to auth will re-enable your facebook account (apparently restoring photo's and friends lists). 4. facebook adds spotify as an app and gives it access to your facebook account data without explicit permission.
ssapkota 14y ago
That is why I always use different password for different services.
dendory 14y ago
I somehow thought that apps could no longer 'login' to social network accounts using usernames/passwords, so that they would have to use OAuth instead? There should be a way that Facebook and Twitter would prevent an app from using login information in order to bypass the 'app authorization' dialog which is supposed to be shown to users to tell them what the app can do to their account.
- mixedbit 14y ago
  You mean they can't do it from Terms of Service point of view? Because from a technical perspective there is nothing that could prevent an app or any other piece of software to login as you once you've passed your credentials (in this case username and password) to such app.
drivebyacct2 14y ago
Use separate passwords. This is Spotify's screwup as much as Facebook's. I noticed the same thing (because I use separate passwords) and was able to avoid this. Stupid Spotify. That's why I run my own Subsonic server. No uploading, nobody else's limits, etc.
timrpeterson 14y ago
I noticed the exact same thing last year when I deactivated my Facebook account and then tried to sign up with Spotify. This absurd behavior was the last straw with me with Facebook. I deleted my FB account that day. I can't believe facebook has so many users still. This company has just been one big screw up since day one.
Comkid 14y ago
It should be noted that Spotify is directly integrated into Facebook https://www.facebook.com/music https://www.facebook.com/music You have the ability to pause and play music from Facebook (which I doubt exists for any other music player with any sort of Facebook integration)
tomarthur 14y ago
Spotify is able to do this because they have partnered with Facebook. Facebook has white listed them for a set of API's that allow them to convert a Facebook User/Password into a Facebook auth token. Any time this whitelisted API is called the application that called it is automatically added to the users list of applications. Spotify is then white listed (by Facebook) for a second set of API's that allow them to add any permission available to the Facebook access token they were issued. This is why you see permissions being added to the application that were not clearly communicated. Facebook requires partners that are on these white lists to clearly communicate what is happening, but IMO Spotify does a particularly poor job of this.
dspillett 14y ago
This is why no two services know me by exactly the same email address, and different passwords are used everywhere. If I want to share some of my information with your app I will do so deliberately, otherwise you are not getting anything. What's that you say? I can only sign-up via facebook? Well then fine, I guess that means I'll be living without what-ever you are hawking.
qeorge 14y ago
I'd want to know if the OP ever had a Spotify account before, with the same email (m*@gmail.com). I suspect he has, and that Spotify account was previously linked to the FB account. Another strong possibility is that he has an existing Spotify account which was created using Facebook Connect. Creating an account with FB Connect would provide Spotify his email, and Spotify would likely have created a user record for that email (this is the recommended behavior from FB). If either is true, then I think this is what happened: - Spotify has an old user record in their database, associated with his Facebook account. He might not realize this, especially if his Spotify account was created via FB Connect. - When he created the new Spotify account, Spotify had a bug/feature which linked the new Spotify account with the old Spotify account. - Spotify then sent a "logged in via FB Connect" signal to Facebook, which caused his Facebook account to reactivate. This is normal behavior for Facebook - FB interprets any login gesture as a signal that you want to reactivate your account (be it a 3rd party login via FB connect, opening the FB app on your phone, or logging into the FB website) This seems plausible to me, and wouldn't indicate any malice. Whereas Spotify's engineers writing a screen scraper to login to Facebook and secretly install an app seems exceedingly unlikely.

324 points by linx 14y ago

Amazing. Also, this is yet another privacy threat that I dodged because I use the PwdHash extension (https://www.pwdhash.com/ https://www.pwdhash.com/). You type the same password for all sites, but the extension invisibly uniquifies them on a per-site basis.

zx2c4 14y ago
Shameless plug -- Pass: The Standard Unix Password Manager http://zx2c4.com/projects/password-store/ http://zx2c4.com/projects/password-store/ It works damn well.
duijf 14y ago
To be honest, that looks like it has a some drawbacks when used with different domains that use the same authentication backend. Think Google's different domains (google.com, google.co.uk, google.nl, gmail.com etc.) The demo gives a different hashed password whenever the TLD differs. And seeing that Google by default redirects you to the homepage of whatever country you're in at the moment, you might end up getting burned by the extension when travelling.
- karl_gluck 14y ago
  The problem of sharing passwords across domains is one of the things that prompted me to write the password-generating service Cryptasia [1]. In short, Cryptasia uses a Google Spreadsheet entirely owned & controlled by each user as a 3rd party data store. Each row contains the friendly name of the site, the login URL, the password generation key, a list of allowed characters, which characters are required, and the length of the password to create. By using the same generator key and character sets, one can have the same password for multiple websites. The password can also be changed for a website without having to change your master passphrase, since just changing the generator key (say, adding a "1" afterward) completely changes the created password. I know it's not as easy to use as a browser extension, but when I visited Europe it was nice to be able to hop on any computer in one of the hotels and check my email. I can throw this on Github if anyone's interested (the source-code is all in unobscured JS, too). [1] crypt.asia or http://www.cryptasia.com http://www.cryptasia.com
- luser001 14y ago
  > you might end up getting burned by the extension when travelling. Good point. This could happen. I'm assuming by "burned" you mean "unable to login". If so, you can always type in your home country's domain into the webapp version and get the correct hashed password. I agree this isn't ideal. Just saying that there's a plan B.
eli 14y ago
Doesn't seem like a good fit for the paranoid. If you screw up and your master password leaks, an attacker can access all of your accounts. I greatly prefer KeePass + Dropbox, which also lets you securely store usernames and notes. And the passwords are random and not derived from anything.
- luser001 14y ago
  > Doesn't seem like a good fit for the paranoid. Agreed. But OTOH it's a very lightweight solution, which is an advantage. And in any case, it's MUCH better than using the same unhashed password everywhere. I'm claiming that using PwdHash is strictly better than not using it. YMMV.
- zeidrich 14y ago
  While it's not a perfect solution, most of the time you are not trying to protect yourself from a dedicated, thinking, hacker. Instead you're protecting yourself against automated systems that share passwords. Unless it was commonplace it would avoid a majority of those issues.

RexM 14y ago

It says "Facebook Email or Spotify Username" in the login box before typing in a username/email. As far as I know, spotify uses username for login, and not email. By using your email, it's assuming you want to use facebook.

dkersten 14y ago
And yet that in no way gives them the right to use that to log into your facebook (rather than using the API to authenticate) and install the spotify facebook app (giving themselves whatever permissions they like without asking the user). Of course, the lesson here (besides that spotify cannot be trusted) is that you should never use a password for more than one account. Sure makes me glad I switched to using a password manager that uses randomly generated different passwords for each service I sign up to.
- Superanos 14y ago
  Facebook and Spotify are tightly partnered together - at one point they actually REQUIRED the use of Facebook to log in. The option to register without Facebook was only reintroduced recently.
  - seivan 14y ago
    Not true, I don't use Facebook and I was one of part of the Open Beta many years ago.
    - RexM 14y ago
      If you read the reply again, they allowed you to use a username, then required facebook, then reintroduced the ability to user a username. You probably were using a username, before they started requiring facebook.
    - mitchty 14y ago
      In the US, when spotify first opened up to Americans you could sign up without facebook credentials. About a month later, they decided to go facebook only for new setups.

Create 14y ago

Facebook and Spotify share a number of investors: billionaire Li Ka Shing has a stake in Facebook and Spotify. Yuri Milner’s DST Global, which owns roughly 10% of Facebook, is also in negotiations to buy a stake in Spotify. Facebook’s founding president and Napster founder Sean Parker, sits on the board of Spotify. http://benjamin.sonntag.fr/Moglen-at-Re-Publica-Freedom-of-thought-requires-free-media http://benjamin.sonntag.fr/Moglen-at-Re-Publica-Freedom-of-t...

stanleydrew 14y ago
I don't understand this comment. Many companies share investors, especially at the level of Facebook and Spotify. Are you trying to suggest that a mutual investor somehow has enough product control to strong-arm Facebook and Spotify into this?
- Create 14y ago
  I am not suggesting anything. Please listen to Eben's talk: it is much more serious than an "accidentally" entangled account.
  - stanleydrew 14y ago
    To be clear I think this is very serious. There is a reason I deleted my Facebook account in 2009 and have never had a Spotify account. But you were clearly trying to suggest that shared investors have something to do with this. There's no other information in your comment except that the two companies share investors. And in the context of this incident the only possible implication of your comment is that shared investors somehow influenced this. Otherwise why post the comment at all?
- ersii 14y ago
  I assume the parent post does - and so do I, in at least this particular case. Seeing how closly knit Facebook and Spotify are. There's not just a shared investor group - there's also a partnership between the two companies. And it's pretty strong, as in; yes, it does seem like they have shared product control or at least great influences on each others product management Mark Zuckerberg is listed and quoted as one of the references on their sign up page, by the way.

ineedtosleep 14y ago

I'm ashamed that this doesn't surprise me much. This looks like a huge oversight on Facebook's part, but with the countless reports on Facebook failing with privacy here, there and everywhere, it's like I don't care anymore. The thing that numbs me even more is that client work, no matter how good of an argument one gives, will always have some form of third-party social login because it's oh-so-important and users will _always_ use it.

andrewroycarter 14y ago
We kind of have a different problem. Clients all want it in the apps we make, but analytics show that very few users use those features. Which sucks because it takes forever to implement all that stuff -_-
- wtvanhest 14y ago
  Do you know of any 3rd party data on that (perhaps a blog post or published data)? Intuitively I believe what you are saying, but I really want to show someone else.
ghayes 14y ago
The issue here isn't with Facebook privacy. If I guess (or you tell me) your bank's online login information, does that give me the right to log-in to your account and start mucking with things? Facebook has an API to access your account through OAuth and Graph; Spotify should never login on your behalf.
- jonknee 14y ago
  That would be illegal (highly illegal actually). It should also be illegal to do what Spotify is doing, but I'll go out on a limb and say that they won't be held accountable. People have gone to jail for incrementing IDs in GET variables, accessing Facebook accounts without permission and installing apps goes way way beyond that.
  - 14y ago

ActVen 14y ago

If this type of behavior continues to be tolerated by users, the entire industry will suffer the backlash at some point. A few companies using obfuscated or unclear defaults will make it more likely that the government will bring down heavy legislation on all companies.

Elessar 14y ago
Why is everyone jumping to blame Spotify for maliciousness? All I see is that they have a bug where they instantly assume emails = Facebook login. Then they try logging in using that email, and because this user reuses passwords, it works. It takes two to Tango, but I see incompetence on both sides rather than maliciousness.
- ActVen 14y ago
  I never used the word malicious. I used the word "behavior". Behavior encapsulates incompetence, poor design, maliciousnesses, etc. I don't presume to know what was the behind the implementation...I just don't think it should be tolerated.
- wubbfindel 14y ago
  It's not a "bug" if they specifically ask the user for their "facebook email" or their "spotify username" - which of course they do! So if the user provides their facebook email and the correct password to match, which this user did, the correct behaviour is to log the user in via facebook. Which of course Spotify did. No bug there. I'd say that this is mostly user error - but possibly Spotify could make it more obvious.
  - jimzvz 14y ago
    So reactivating the facebook account and adding the app to the facebook account without the user agreeing to either is fine for you?
    - wubbfindel 14y ago

todd3834 14y ago

Simple solution, don't use the same password for all of your accounts and read the instructions, it says username or facebook email.

thinkling 14y ago
Not only don't use the same password, but don't give your FB password to another app or website. Duh.

kmfrk 14y ago

This is pretty shameless, even for Facebook.

tlrobinson 14y ago
Except it's Spotify doing it, not Facebook...
- mjschultz 14y ago
  Unless Spotify has some backdoor API with Facebook, it seems like a major oversight in the Facebook API that an (any?) app can re-register a deactivated account and give itself whatever permissions it wants. Just because Spotify accidentally (or purposefully) took advantage of that hole doesn't mean it's not Facebook at fault here.

Superanos 14y ago

It says quite clearly: "Log in with Facebook or Spotify". That means you can log in using a Facebook account or a Spotify account. The username field says "Facebook Email or Spotify Username". So when you type an email, you log in using a Facebook account. It's not that hard to understand. By the way, that account you made on the sign up page is still unused: you logged in using a Facebook account, which is a different account from the one you just registered, so you have two spotify users now - one you signed up w/o Facebook and one you actually logged into.

mikeash 14y ago
I disagree that it's clear. A placeholder in a field is no substitute for an actual label. It should be an enhancement, not a replacement. With the number of places using e-mail addresses as usernames, it's a natural mistake.
fusiongyro 14y ago
It says "Log in with Facebook or Spotify," not "Log in with Spotify, or log in with Facebook, reactivating a disabled account if necessary, and then grant us a bunch of permissions." Nobody cares that it attempted a Facebook authentication. We care that it silently reactivated the Facebook account and silently gave itself permissions.

drue 14y ago

I wanted to try spotify a while back but got stuck when it required a FB account. Sounds like it's no longer required, but I suppose I still don't trust them enough to try their service.

jiggy2011 14y ago
You can signup with an email address , but the option is hidden quite low in the signup page. Best way to avoid this sort of stuff is just to sign up to spotify with throwaway email. I have found that it's worth buying a domain name and just tying it to a VPS with SMTP installed (or using a third part service that offers unlimited addresses). That way you can just generate throwaway email addresses as you need them.
- benmanns 14y ago
  You can also use Mailinator[0] and their many other domains for throwaway email addresses. In fact, you can point your MX records to mail.mailinator.com for a custom domain without running a VPS.[1] [0] http://www.mailinator.com/ http://www.mailinator.com/ [1] http://mailinator.blogspot.com/2008/01/your-own-private-mailinator.html http://mailinator.blogspot.com/2008/01/your-own-private-mail...
  - jiggy2011 14y ago
    True, but those services are quite limited and not that secure in that anybody who knows the email address can login to your account.
    - ehamberg 14y ago
      Not necessarily. They also give you a “gibberish” address to the account. So if I use “foobar” as my mailbox on mailinator, they will list an address like M8R-wk43th@mailinator too, that does not let people log in.
  - apapli 14y ago
    I have a google apps for business account (a former free one before they started charging). I just create lots of alias emails associated with a domain name I used to use and still own. Works like a charm and they are always accepted. I hear mailinator email addresses don't always get accepted by some services (though I haven't experienced this myself to verify).

benmanns 14y ago

This is just Spotify not finding a user with username=[your email address] and looking for that user on Facebook. I did a test by creating an account with the email benjamintesterton@mailinator.com (not linked to a Facebook account) and username benjamintesterton. When I tried logging in with the email, it failed, but with just the username worked. If logging in with the email did work, it would mean that Spotify authenticated you with their server and then abused your credential re-use to hack your Facebook account. However, this appears not to be the case. They should just check email=[input] OR username=[input], but that may be backwards-incompatible and break the functionality of people who use their Facebook credentials to login.

jonknee 14y ago
Not just finding a user on Facebook with an email address, because they also log into the Facebook account and add their app to it. (Hence the re-activation email as well.) Very shady.
- cbhl 14y ago
  I really doubt this is Spotify's fault. Facebook has quite the trigger-finger when it comes to reactivation -- clicking a like button with the right cookies will do it, IIRC.
  - jonknee 14y ago
    How would the app be installed?
Superanos 14y ago
That is correct. It says quite clearly "Facebook Email or Spotify Username". It's the user's mistake for using their Facebook account instead of the account they just created.
- benmanns 14y ago
  Yes, true, but I thought it would be a lot more damning if they also authenticated via Spotify email, because that would mean that they accessed the Facebook account while already having authenticated the user via Spotify credentials.

runn1ng 14y ago

It's funny though that Facebook frequently asks you for your password to your e-mail account. For very similar kind of thing.

mikec3k 14y ago

No, it's not phishing.

jonknee 14y ago
What would you call it? Asking for information for activity X and using it to do activity Y without your permission sounds exactly like phishing to me.

Kiro 14y ago

I remember once when I was automatically logged in to my roommate's Spotify account on my computer just because we were on the same WiFi network (?). She had never used my computer, let alone logged in to her Spotify account on it. I'm still not sure how or why it happened.

INTPenis 14y ago

It is, or at least was, possible to delete your facebook account. Not just deactivate it. http://www.facebook.com/help/224562897555674?_fb_noscript=1 http://www.facebook.com/help/224562897555674?_fb_noscript=1 That's in Swedish for me but I assume it's localized. It says that there are two options, one is deactivation, and if you don't believe you'll need your account again, the other is deletion.

oellegaard 14y ago

So happy that I use 1password to generate random passwords for every single service I use. This wouldn't be possible if everyone was more aware of security - still, I find the way facebook treats its users increasingly disturbing and seriously consider to leave it.

andreyf 14y ago

If you don't want someone to mess with your Facebook account, then perhaps you shouldn't give them your Facebook login and password...

analog 14y ago
Well yes of course, you shouldn't use the same user:pass for different sites. But a lot of people do, and that opens them up to being hacked if the password for one site is revealed. Spotify are knowingly logging into the OPs Facebook account without OPs permission. Shouldn't this qualify as unauthorised access, as in a Federal offence?

noonat 14y ago

The fact that the user was logged into Facebook after giving Facebook credentials to Spotify is not the problem. The login screen communicates that this will occur. Maybe it doesn't communicate it as well as it could, but it does communicate it. The problem is that Spotify added itself to the user's list of apps and granted itself access to the user's data without any communication that this would occur. I guess you could say that permission for Spotify to do that is implicitly granted by giving them your Facebook credentials. But these days, federated authentication and authorization are two different things for end users -- especially so for Facebook apps. Spotify should at least prompt the user before making these changes on their behalf. Very underhanded behavior.

szidev 14y ago
Here's the tricky part: they do ask for permission to post on your behalf when you open the app. It's pretty muted, at the bottom of a popup, and dwarfed by a larger, more colorful call to action. Here's a screenshot: http://i.imgur.com/oWDstiC.png http://i.imgur.com/oWDstiC.png It's also not entirely obvious to me what happens in every case. If I close the popup, does it still count as my giving consent? If I close the app? My guess is that most people skim over the copy and click the big blue button, totally disregarding the checkbox down there.
- pbhjpbhj 14y ago
  Well spotted. But a user who'd disabled/cancelled/deactivated their FB account would assume that action was moot rather than that Spotify were going to illegally access a secondary service posing as you in order to enable that activity.

axx 14y ago

I'm may be wrong here, but isn't it the case, that Facebooks re-activates your account, as soon as you login with Facebook Connect on a 3rd-Party site? I really hate that, but what if you're using something like coughBangYourFriendscough Spotify, deactivate your Facebook account and can't use Spotify anymore? Maybe you're a paying customer to Spotify? How do you cancel your membership if you can't login anymore? To me this seems like a Big Communication Problem™ between the User and the App/Facebook. The Facebook API needs a functionality that says "Using a deactivated account for Facebook Connect re-activates your old account automatically". I totally disagree on methods like this, but i seems plausible in that way.

whaevr 14y ago

Spotify up on the front page of HN 2 days in a row now..and for all the wrong reasons. Hah

berdon 14y ago

Did anyone else read this and then scroll to the top only to realize they'd been reading and comprehending german the entire time and then suddenly forgot it? I did. :/

arturkim 14y ago
I actually hadn't scrolled up. I had to revisit the page to understand what you were talking about.

xordon 14y ago

To Summarize: 1. using the same password for spotify and facebook is a dumb thing to do. don't do it. 2. by entering an email address instead of a username means spotify will use facebook auth (it should be made more obvious to users). 3. using facebook api to auth will re-enable your facebook account (apparently restoring photo's and friends lists). 4. facebook adds spotify as an app and gives it access to your facebook account data without explicit permission.

ssapkota 14y ago

That is why I always use different password for different services.

dendory 14y ago

I somehow thought that apps could no longer 'login' to social network accounts using usernames/passwords, so that they would have to use OAuth instead? There should be a way that Facebook and Twitter would prevent an app from using login information in order to bypass the 'app authorization' dialog which is supposed to be shown to users to tell them what the app can do to their account.

mixedbit 14y ago
You mean they can't do it from Terms of Service point of view? Because from a technical perspective there is nothing that could prevent an app or any other piece of software to login as you once you've passed your credentials (in this case username and password) to such app.

drivebyacct2 14y ago

Use separate passwords. This is Spotify's screwup as much as Facebook's. I noticed the same thing (because I use separate passwords) and was able to avoid this. Stupid Spotify. That's why I run my own Subsonic server. No uploading, nobody else's limits, etc.

timrpeterson 14y ago

I noticed the exact same thing last year when I deactivated my Facebook account and then tried to sign up with Spotify. This absurd behavior was the last straw with me with Facebook. I deleted my FB account that day. I can't believe facebook has so many users still. This company has just been one big screw up since day one.

Comkid 14y ago

It should be noted that Spotify is directly integrated into Facebook https://www.facebook.com/music https://www.facebook.com/music You have the ability to pause and play music from Facebook (which I doubt exists for any other music player with any sort of Facebook integration)

tomarthur 14y ago

Spotify is able to do this because they have partnered with Facebook. Facebook has white listed them for a set of API's that allow them to convert a Facebook User/Password into a Facebook auth token. Any time this whitelisted API is called the application that called it is automatically added to the users list of applications. Spotify is then white listed (by Facebook) for a second set of API's that allow them to add any permission available to the Facebook access token they were issued. This is why you see permissions being added to the application that were not clearly communicated. Facebook requires partners that are on these white lists to clearly communicate what is happening, but IMO Spotify does a particularly poor job of this.

dspillett 14y ago

This is why no two services know me by exactly the same email address, and different passwords are used everywhere. If I want to share some of my information with your app I will do so deliberately, otherwise you are not getting anything. What's that you say? I can only sign-up via facebook? Well then fine, I guess that means I'll be living without what-ever you are hawking.

qeorge 14y ago

I'd want to know if the OP ever had a Spotify account before, with the same email (m*@gmail.com). I suspect he has, and that Spotify account was previously linked to the FB account. Another strong possibility is that he has an existing Spotify account which was created using Facebook Connect. Creating an account with FB Connect would provide Spotify his email, and Spotify would likely have created a user record for that email (this is the recommended behavior from FB). If either is true, then I think this is what happened: - Spotify has an old user record in their database, associated with his Facebook account. He might not realize this, especially if his Spotify account was created via FB Connect. - When he created the new Spotify account, Spotify had a bug/feature which linked the new Spotify account with the old Spotify account. - Spotify then sent a "logged in via FB Connect" signal to Facebook, which caused his Facebook account to reactivate. This is normal behavior for Facebook - FB interprets any login gesture as a signal that you want to reactivate your account (be it a 3rd party login via FB connect, opening the FB app on your phone, or logging into the FB website) This seems plausible to me, and wouldn't indicate any malice. Whereas Spotify's engineers writing a screen scraper to login to Facebook and secretly install an app seems exceedingly unlikely.