13 ms·

Introducing Anonymous Login and an Updated Facebook Login

454 points by adidash 12y ago

melindajb 12y ago
another idea, but thinking the following: 1. anyone who wants to use a site has to create an account with a fb "anonymous" login. there would be no more "free" access" because then you can start to tie free user behavior to actual conversion. 2. Once the user wants to pay, this is tied to giving more information--at least name and email address. Will be interesting to see the details, because tying free behavior to conversion is a holy grail for marketers.
Touche 12y ago
Wish this went farther and Facebook only did the "this guy exists" exchange, otherwise not keeping a record that the request ever happened.
moot 12y ago
HELL HAS FROZEN OVER
- skizm 12y ago
  When can we see this integrated with 4chan?
  - moot 12y ago
    We actually implemented Facebook Connect for April Fool's back in 2010. It was a real app and posted your 4chan post(s) to your Facebook wall. EDIT: Here's a screenshot -- http://i.imgur.com/p0peJp6.png http://i.imgur.com/p0peJp6.png The best part was the reviews. They were all either 1 or 5 stars. People were shocked it actually worked.
    - loceng 12y ago
      Hilarious.
    - damon_c 12y ago
      That is so beautifully subtle... just casually sitting there like nothing out of the ordinary.
- bigbento 12y ago
  When are we going to hear the news? > In a move to bolster its new 'Anonymous' strategy, Facebook has acquired 4chan for $30 billion in an all-cash deal > "It's been an incredible journey", said 4chan founder Christopher Poole at a press conference in Menlo Park, CA. "Our anonymous users have been the driving force behind 4chan, and we look forward to bringing that experience to Facebook"
  - moot 12y ago
    That may in fact be the harbinger of the Apocalypse.
- shawn-furyan 12y ago
  Not really. Facebook isn't giving up any information at all. So it's nothing particularly unexpected. Actually, it's kind of up FB's alley, because it allows them to gather info on web/app usage patterns of their users while leaking a lot less info to third parties. If anything this program gives FB more control over user information relative to third parties than the current FB Connect program. [edit 2:38 CDT to add the string "/app"]
Jemaclus 12y ago
I suppose it still tells that service that I have a FB account. Better than telling them everything about me, I guess?
- minimaxir 12y ago
  Additionally, Facebook knows which apps you are using anonymously, which could have problematic implications when incorporated with Graph Search.
  - angryasian 12y ago
    this is exactly what it is. They can still target ads and understand your preferences and behaviour.
    - pyronite 12y ago
      The horror!
- nollidge 12y ago
  > I suppose it still tells that service that I have a FB account. Which barely more invasive than telling them you breathe air, no?
- hackinthebochs 12y ago
  What meaningful information can a service glean from that when probably 90% of the western internet using world has one?
- zmmmmm 12y ago
  This is the big question. I assume it is telling Facebook and NOT the app developer, so basically it's all win for Facebook and all loss for the developer who implements it (other than attracting the few extra users who care so much about their privacy that they won't divulge their Facebook data). I'm curious what happens to functions inside the app that need identity. Do they work as normal but the app developer can't see the information? Or does everything the user does prompt for a login, so the app developer can be pretty assured that nobody will go for any length of time using the app before they give up and log in?
minimaxir 12y ago
How long until Facebook releases a photo app with Anonymous Login as its central feature?
danielrakh 12y ago
This is great. As an iOS developer this lowers the barrier of entry for people to try out your app.
loceng 12y ago
Isn't the issue that we don't want to share information with Facebook?
- krapp 12y ago
  Facebook is never going to see that as a problem worth solving.
  - test1235 12y ago
    Facebook is never going to see that as a problem.
  - hackinthebochs 12y ago
    That isn't facebook's problem to solve, its your problem. You are fully equipped to solve it yourself (i.e. don't use facebook).
- junto 12y ago
  Spot on. Isn't the issue that a leopard doesn't change his spots. Facebook has historically shown a blatant disregard for user's privacy. They store everything even when purporting to have deleted it and privacy is contrary to their underlying core business. Privacy and Facebook is an oxymoron
- pavanky 12y ago
  If you are getting products / services for free you have no right to demand that of them. Simply stop using facebook or any other social networking site for that matter.
  - loceng 12y ago
    It's not free - there are ads and they are intrusive.
  - shawn-furyan 12y ago
    I don't see the connection between direct payment for service and the right to demand things (not that the gp was 'demanding', but whatever...). I don't think that most paid apps codify a right for users to demand things of them, and actually terms of service for paid proprietary software have a tendency to be as restrictive as possible of end user rights. But Facebook is a service that monetizes user attention, and so I think that users are just as justified in complaining about, or trying to work around facets of Facebook that they see as misfeatures as they would be for software that they directly paid for. They don't have a lot of power to individually change anything, but they do have the right to complain in open forums. I don't think that the business model really has any bearing on this.
cliveowen 12y ago
"People tell us" People don't tell you anything, they don't have a way to do it. Facebook just does whatever it wants without caring about the users, lets cut the BS.
- deleted 12y ago
  [deleted]
- officemonkey 12y ago
  A supervisor is a person.
  - coherentpony 12y ago
    Companies are people too.
  - cliveowen 12y ago
    That's obviously not what they meant.
jawns 12y ago
Over the years, Facebook has dabbled with a bunch of different ways of apps requesting/handling user permissions and data. This is not, actually, the first time Facebook has enabled this level of granularity, as far as users being able to grant permissions piecemeal. It used to be (not sure if it still is) that an app could request one permission here, one permission there, at various points in its application flow. But with each request (in which you could bundle a bunch of different permissions) it was either an "all or none" decision for the user. This new approach just makes things a little easier, because you can present all of the permissions and data request up front and let the user pick and choose what should be granted. I think this Facebook thing is really going to take off one day.
- smackfu 12y ago
  I really liked their last iteration, where posting to Facebook was walled off from the rest of the permissions, and separately prompted.
- rmc 12y ago
  IME when logging in via Facebook, I can choose to not allow that site to have the ability to do certain things (like not post to my wall etc) I also develop an application that uses Facebook login, and we (using django-social-auth) request one set of permissions initially, and request more later if the user wants to do advanced stuff.
yawgmoth 12y ago
This seems like a fairly natural step for Facebook, as increasing app dependency on Facebook for account authorization is a step towards building a platform.
bhartzer 12y ago
So when are anonymous logins a part of Facebook's privacy plan?
programminggeek 12y ago
This is a horrible idea for app developers. If someone wants to sign up for my app, but doesn't want to create a real user account with an email address and personally identifiable information, then I don't have a real customer relationship or anything of value. So, why even make them log in? I guess I just don't see the point of requiring a user account if it isn't adding value to either the user or the app creator. One more reason not to use Facebook as a login mechanism I guess.
- xahrepap 12y ago
  Because, it's a lot easier to just sign up using your Facebook account rather than trying to remember yet another password. But I don't want every little site to know my personal information. It's none of their business. I just want to log in quickly. Logging in to a site provides more value than just sharing personal information. For me, I rarely, if ever, want a site to know my personal information. That's why I rarely use Facebook login service. Now I will.
  - ebbflowgo 12y ago
    I agree with this.
  - gtremper 12y ago
    Agreed, however, there are a few pieces of information that I find useful for Facebook to share. Namely my profile picture and sometimes my friends list. Though gravitar somewhat solves the profile picture problem.
- morgante 12y ago
  > So, why even make them log in? As a programmer, I surely hope you don't think the only purpose of user accounts is to gain personal information. Hacker News does not ask for personal information. Does that mean we shouldn't have to log in on HN?
  - libria 12y ago
    > Hacker News does not ask for personal information. Does that mean we shouldn't have to log in on HN? I think he's looking at it from a product/sales lead perspective. HN isn't trying to sell us anything.
danudey 12y ago
I never use Facebook Login for sites/apps, not because I don't trust the sites/apps with my FB data but because I don't trust FB with my app usage data. Now, if I could log into Facebook without giving them access to my data, that would be a killer feature.
- michaelmior 12y ago
  How would you allow an app to log you in with Facebook without Facebook knowing about it?
- ihuman 12y ago
  Isn't that the entire point of Facebook though? You give Facebook your data so they can give it to your friends.
- etler 12y ago
  If a website loads the javascript facebook API on their site, and you're logged into facebook in general, they know who you are and what page you were on when the script was loaded whether you give the site permission or not. When the http request is made to facebook, they get their domain cookie back which has your user info in it. On top of that, when their javascript runs they get full access to all the data of the window that made the request meaning they get the other site's cookie as well absolutely everything else. If you don't want to be tracked by facebook online, you only have a few options. Disable cookies, disable javascript, or only login to facebook in an incognito window. Otherwise, they can track exactly who you are and where you go on any site that makes any request to facebook. Even still, if any request is made to facebook, they can still anonymously track you even if you aren't logged in. As for apps, I don't think the facebook api would be able to find out the specific usage of the app unless the app purposefully gave it up, although they would know when you login.
  - codesuela 12y ago
    There is also Disconnect.me and Ghostery if you want to block facebook and other trackers without disabling JS
  - 12y ago
morgante 12y ago
As a developer and user, I love this. For many small apps, it just doesn't make sense to ask people to create a username/password, but I still want a way of authenticating them. This move gives me a way to leverage Facebook for that without users giving up any privacy. A total win/win.
- aw3c2 12y ago
  Actually at least for me, the concerns are the opposite. I do not want Facebook to know what I am doing. I do not mind you getting my name (though I would consider it rude not not accept a pseudonym of my choice).
- bigfoot13442 12y ago
  As a developer with a production mobile app that uses Facebook for more than just sign in, I hate this. It changes a lot of the fundamental things that we use in a way that is detrimental to our user's experience. Before, login with Facebook provided a better and more convenient user experience. Now it just seems clunky. Without the information that we get from Facebook for a user that decides to sign in with Facebook, we don't even have a user.
marojejian 12y ago
The most important thing FB can do is win universal login. And the #1 thing it can do to promote that is restore some faith in its privacy commitment. This is a very smart move. Of course let's see how they implement it. If the process is too complex, it won't work for users. Given their reputation on privacy - it will be hard to recover. But (almost) no other company has as good a shot at this opportunity.
- EGreg 12y ago
  Why should one company control identity and authentication on the web? What we really need is a decentralized identity platform.
  - ForHackernews 12y ago
    https://developer.mozilla.org/en-US/Persona https://developer.mozilla.org/en-US/Persona
    - EGreg 12y ago
      https://news.ycombinator.com/item?id=7364465 https://news.ycombinator.com/item?id=7364465
  - deftnerd 12y ago
    I'm working on this problem right now at blockauth.com. Launch is still months away but its an interesting mix of Blockchain publishing, ICANN style franchising, and paranoid levels of verification. The end result will be a federation of OpenID providers that all vouch for a user to confirm that they are a real unique person all while not giving any personal details about them unless they approve. Basically its what Facebook is proposing but we do background checks on the accounts to ensure they aren't bots. Our privacy policy will be a lot more serious too. No marketing or targeted advertising.
    - EGreg 12y ago
      Why do you need all that? Just curious. I am the author of http://platform.qbix.com http://platform.qbix.com, and it includes decentralized identity. Each app can run on its own machine/cluster, and communicate with other apps. Each app is itself a user in Q. When a person using a user-agent authenticates with an app, they can either do it natively (providing, say, their email address) or they can select an external app that they already logged into. The user-agent stores the domain of that app, and it's a simple matter of doing oAuth with that app. Except, of course, the user id isn't given out by the user's "home server" but instead a different "xid" (stands of external id) is given to each consumer app. In short, an app can start life as a consumer of identity and eventually offer to provide identity. The identity provider doesn't just support oAuth, but ideally would allow the user to publish streams that others can subscribe to and view, import contacts and manage access control (privacy) based on those contacts and labels. Finally, they should be able to connect endpoints (such as their mobile phone, email, facebook account etc.) to receive notifications sent to their account by some apps they've authenticated with. Whenever an app would need to display personal information back to a user, they could do it without ever knowing their personal info: http://www.faqs.org/patents/app/20120110469#b http://www.faqs.org/patents/app/20120110469#b What do you think? In the future we might also encrypt this stuff so governments and others can't get it by simply breaking into the database. I don't have any expertise in this last part, so if anyone does I'd be curious to learn.
deleted 12y ago
[deleted]
izzydata 12y ago
What is the point of this? I don't want to have to login with facebook at all. If some site has facebook login requirements I simply don't use that site anymore. If you use facebook login for your site then you are shooting yourself in the foot if you care about users.
- ceejayoz 12y ago
  It's basically Facebook's version of OpenID/Persona. Single-sign-on without the hook into your FB data.
- yeukhon 12y ago
  Exactly. Because someone else want to have that feature. You are not the only person who is using the web.
  - axanoeychron 12y ago
    I'm confused. You're actually saying the exact same thing as him and assuming something in the process. You're saying that he is not considering other people when he is actually saying the opposite: that people should think of ALL users. I'm guessing 'What is the point of this?' got you but reading that closely is more this: not everyone is sold on the idea of FB in general as the answer to anything so an alternative product doesn't do him any favors. Like trying to sell someone who doesn't want to drink a smaller bottle of alcohol. I don't want to sign in with Facebook full stop. I really agree that you shouldn't force people to use a third party service to sign in. If you're contemplating login, please consider people like us! Do Facebook login as your MVP but please do consider us!
    - deleted 12y ago
      [deleted]
      - axanoeychron 12y ago
        Am I though? Isn't that what we are doing - we are expressing our views on a site that targets startups, site and app developers who might be considering what login technology to use? Afterall, those sites are under construction - they have not been created and developers can weigh the pros/cons. A site that has already been created that only offers Facebook login, I cannot use. Hence our dilemma and the importance of expressing our views in this message board. Edit: Parent deleted so this reply may not make sense.
EGreg 12y ago
So basically fb gives each app a unique uid for that user so they can't be tracked across apps right? And returns no info for them? Has anyone actually tried using this?
afternooner 12y ago
This is the exact opposite of the product I want. The group I least want in control of my data is Facebook and their ever changing security/privacy policies.
- hackinthebochs 12y ago
  Then don't use facebook login? How is this an interesting point to make at all on this topic?
melindajb 12y ago
Will developers be able to reject customers who insist on anonymity? If not, I'm inclined to lean away from offering Facebook login.
jfernandez 12y ago
Seems like an interesting choice for a demo video to showcase Flipboard (i.e. regarding their own stake in this realm of products, Paper). Granted this isn't about that, but that was fun to think about.
asnyder 12y ago
Wow, it seems like they finally got rid of the minimum e-mail, profile, friends and all that jazz. Just finished reading the dev docs and it seems we can finally limit the minimum scope. Facebook can now just be used as a standard login. Though they now need to educate users so that they don't still feel that their privacy is being violated.
nollidge 12y ago
If anybody else is wondering what the hell "f8" is: http://en.wikipedia.org/wiki/Facebook_f8 http://en.wikipedia.org/wiki/Facebook_f8
- smickie 12y ago
  It's like their annual conference for developers. Like Apple's WWDC. Or Microsoft's... (not sure what it's called). I love the name F8. It's a great play on words.
outside1234 12y ago
tl;dr: App gets no data and Facebook still gets the same data. Total win for Facebook.
- mcintyre1994 12y ago
  Total win for the user though. Short of using their javascript to spy on the webpage you're on they don't really get any usage data anyway?
ISL 12y ago
A win for new sites that are starting up and can leverage the FB sign-in framework. An example: I've wanted to try out https://giveit100.com/ https://giveit100.com/ since launch, but have been waiting for an alternative sign-in. Thanks FB!
- ElliotH 12y ago
  Corrective upvote applied. But maybe don't put a comment to your downvoter in your comments? Downvotes get fixed, and anybody can check your profile to find out whether you are associated.
  - ISL 12y ago
    Fair 'nuf! Will nuke the edit.
- laureny 12y ago
  You could have created another FB account just for these situation instead of waiting. That's what I've been doing, and I will probably continue to do so since even logging in anonymously on Facebook tells Facebook, and whoever else they feel like sharing it with, e.g. advertisers, that I logged in.
  - r00fus 12y ago
    Isn't that against FB TOS? Also, what a pain - at least per-site pwds are easily managed via 1Pass or LastPass, but having dozens of FB pwds sounds crazy.
    - laureny 12y ago
      Dozens? I only have two, my real one and my fake one. I'm always logged in my fake one on my non-default browser.
numair 12y ago
You're an idiot if you implement this. On iOS, use the device token and implement truly anonymous login without having to deal with anyone else brokering your users' data; I'm not sure what the Android equivalent is, but it can't be much more difficult. Remember, Facebook is the same company that cuts deals with shady data brokers like the Datalogix (the company that buys your grocery store discount card data and re-sells it, among other things) to build a comprehensive profile of everything you do. Using them for this pseudo-anonymous "anonymous login" helps them a lot more than it will ever help you, as a standalone developer. I can't wait for Facebook to trademark the term "Anonymous Login," just to complete the irony. Remember, if it was actually anonymous, you wouldn't need Facebook's help to implement it.
- selmnoo 12y ago
  > Remember, if it was actually anonymous, you wouldn't need Facebook's help to implement it. That sums it up nicely. And actually, the thing is I could totally see Facebook enabling truly 'anonymous logins' and whatnot, because it can afford to do it at this point. It is too entrenched as the social king, no other competitor comes close to it, and it's not going to fall down anytime soon because it'll be buoyed by networks effects for quite some time... and so it makes sense to ease things up a little to improve their public image. But, the way they got there, to the top, was by using dirty and despicable dark patterns, like 'Privacy Zuckering': http://darkpatterns.org/library/privacy_zuckering/ http://darkpatterns.org/library/privacy_zuckering/ For this reason alone, I would stay the hell away from anything Facebook.
  - lugg 12y ago
    It truly is an interesting move. Last night my housemate was telling me about MS's moves in the office365 space, I was gobsmacked by what they're up to these days. I actually commented "time to buy some MS shares", pigs were flying. And now this.. It does make sense though. Developers only really want a way to verify the user exists and isn't some spammy bot. Verification like facebook login is the easiest way to go. The problem has always been - far too many people avoid signing up with facebook as it shares "god only knows what" with the site. This works around both issues and really is the only way they can become the single signon entity. Which is what they've been aiming for. As for "not bothering to implement" (aap), if you already need to handle facebook connect login, its going to be minor to add anon login facebook handles all the identity stuff leaving your app clean of yet another verification loop which annoys the hell out of users. Sure there is the "apps need that data to make money" situation, but as a matter of fact, the people signing on anonymously were a) going to create a fake facebook or b) signup manually and give you a mailinator address.
jchysk 12y ago
This isn't anonymous login. Facebook still knows what you're logging into. LaunchKey is true anonymous authentication.
deleted 12y ago
[deleted]
jtchang 12y ago
This is what happens when users are screaming "I want my privacy back" and you are stuck between corporate goals of monetizing users and user experience.
- IBM 12y ago
  Which is a refreshing change compared to how Google has been in recent years.
gdeglin 12y ago
I'm bouncing between thinking this is great and this is awful. Ultimately I'm very curious how developers will use it. The main risk seems to be what happens if Facebook decides to remove Anonymous login. You may have many accounts on your site that had logged in anonymously and participated, but now no longer have a way back in. This seems like an awful scenario, and yet a very possible one -- Facebook is quick to change and remove features on Platform.
- randartie 12y ago
  You have to register your app with facebook, thus this feature could be removed from all new apps while still preserving existing functionality for apps registered before the feature gets removed (if it ever does get removed).
  - gdeglin 12y ago
    Fair point, and hopefully this qualifies under Facebook's pledge to maintain backwards compatibility for 2 years. But of course there's also the issue that this becomes something that developers themselves can't easily remove once they add it to their app. Or worse, if Facebook decides to block a developer's app from platform. At least with regular Facebook login, most developers requested Email so users could always request that a password be sent to them as an alternate login mechanism. Developers should be mindful that Facebook explicitly prohibits using Platform to build "competing social networks" (An unfortunately broad category): http://techcrunch.com/2013/01/24/my-precious-social-graph/ http://techcrunch.com/2013/01/24/my-precious-social-graph/ And they have a history of enforcing this with the bans of Yandex, Wonder, Vine, and Voxer.
harmonicon 12y ago
Does an ad-free, data-collection free and paid subscription based version of Facebook has any chance in the market?
neil_s 12y ago
Nice one. I've been using a Chrome extension called fPrivacy to do this presently on the web, since very few websites actually check to see if they've got all the extraneous information they requested. But it sometimes breaks the login process, so it'll be nice to get rid of it. Next top feature Facebook should introduce: Automatically generate a new anonymous email address for each app. I can then go into Facebook settings later and prevent any of those addresses from forwarding to my personal address if that app starts spamming or gets hacked. They did have an anonymous email feature at some point, but it wasn't fully ready yet.
primitivesuave 12y ago
It's a great idea in theory, but a pile of shit in reality. What's the point in using third-party authentication if you get zero data from it? Unlike Facebook, my goal is not to sell user data to the highest bidder, it's to have the user skip the steps where they enter their real name and confirm their email address.
- wankerrific 12y ago
  This. Facebook is a glorified user registration system on mobile. As a developer, I have no incentive to use FB anonymous login.
- jawns 12y ago
  While it certainly seems like it does you no good, I can definitely see a legitimate use case for it. Suppose you're creating a site -- let's call it Hacker News -- that requires a user to log in, and all you care about is the part where they enter their username and password. From there, you're able to assign the user a unique ID and persist their preferences (e.g. header color) across sessions. It's not exactly a difficult project to roll your own login system, but Anonymous Login gives you the added advantage of being able to "upsell" users into providing more information, if they feel comfortable sharing it.
- nacs 12y ago
  The anonymous login allows users to become less anonymous by providing real info if they wish to do so later. So you have the potential to get > 0 data. This would basically make it easier to access or try out all the FB-only-login apps without giving the app owner all the personal info.
- habosa 12y ago
  having FB login as an option increases your conversion rate. The more ways someone can get an account, the more likely they'll find one they like (to a point).
deleted 12y ago
[deleted]
EGreg 12y ago
The only benefit of anonymous facebook login over a native session is the supposed "cost" of creating too many accounts, and enabling things like a http://en.wikipedia.org/wiki/Sybil_attack http://en.wikipedia.org/wiki/Sybil_attack Actually I would like to ask if anyone here knows of more good solutions for making creating accounts expensive. Captchas ain't it anymore. The best one I know is Phone Verification. http://www.blackhatworld.com/blackhat-seo/making-money/596992-way-bypass-craigslist-phone-verification.html http://www.blackhatworld.com/blackhat-seo/making-money/59699... Buying a cellphone in order to get an account is expensive enough. But is there something better?
cowchase 12y ago
I'm surprised nobody has mentioned SQRL for truly anonymous identification and authentication yet https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
marincounty 12y ago
I've used a sudonym for years. FB depresses me? I guess because I see my friends ageing. I did reserve my real name; in case I ever really liked FB, but I am still using a civil war veterans name.
drdaeman 12y ago
We seem to start to really fail making distinction between anonymity and pseudonymity. "Anonymous login" means you provide no identity information whatsoever. If you're "person #123456789" or "f93f9211-9f49-4bad-ad34-e00f8c536b0f" or whatever - you're not anonymous.
geoffsanders 12y ago
If you want truly anonymous login, might I recommend https://launchkey.com https://launchkey.com Obviously there's nothing truly anonymous about this service if Facebook knows everything about you...
ganjianwei 12y ago
This is likely to get traction because generally: - people have already signed up with Facebook - people don't trust app developers with their FB data, and don't trust app devs not to post crap to their timelines - people hate signing up for another service again with email and password (you have to give out your email, you have to create/reuse and remember a password) The more open question is if it will cannibalize FB logins or get incremental people to sign up with FB (people want to do this anonymously but didn't have the option and gave up).
- kytmizuno 12y ago
  I would hope this goes towards the iOS permission model. You would almost always login anonymously. Then pieces of information are requested on demand when a user takes action that specifically needs that information.
- rhizome 12y ago
  App developers have never been responsible for a leak. I literally cannot find a reference in the Google to an app company leaking user data they were authorized by FB to hold. You know what I can find? Facebook having leaky permissions for a year and a half.
grrowl 12y ago
By the way, Facebook already knows you're using an app before you log in, when the app pings Facebook to check the login status. This only prevents usage information leaking back to the app itself.
mahyar 12y ago
Anyone knows when the changes become effective?
gradstudent 12y ago
I'd like to know why "Anonymous Login" is not the default and single login option.
donniezazen 12y ago
Anonymity on Internet is a myth.
peterbe 12y ago
Too late. Users don't trust facebook no matter what scopes you [don't] ask for and tell people "we never post on your wall".
ecocentrik 12y ago
Facebook keeps framing thier role in providing OAUTH as one where they are protecting their users from all the bad guys on the outside. I thought it was clever marketing when I first saw them take this position but it seemed obvious to me that anybody who implemented Facebook login was giving Facebook the upper hand. One party gets free advertising and the other gets a scary looking permissions page that makes them look like an identity thief. In the process, the first party transmutes their bad press into the appreance of good will in countering the second party's apparent bad intentions. Everybody must have caught on to Facebook's bad will psych game by now so why would anyone keep using Facebook Login?This latest change just moves the bad will to your login page. Every time someone moves to log in they will be reminded who Facebook thinks should be trusted and it's never going to be you.
Pxtl 12y ago
This is one case where Facebook is really showing Google how it's done. I mean, Google is failing to get Google Plus accepted as a social layer for Google's own pages, while Facebook is working on getting Facebook accepted as a social layer for every other site on the Internet.
oliomel 12y ago
I don't know if this is silly, but... what happens when people blindly trust a button and someone decides to exploit that by making a fake one open a phishing pop up requesting your Facebook credentials? Has this been done?

454 points by adidash 12y ago

another idea, but thinking the following: 1. anyone who wants to use a site has to create an account with a fb "anonymous" login. there would be no more "free" access" because then you can start to tie free user behavior to actual conversion. 2. Once the user wants to pay, this is tied to giving more information--at least name and email address. Will be interesting to see the details, because tying free behavior to conversion is a holy grail for marketers.

Touche 12y ago

Wish this went farther and Facebook only did the "this guy exists" exchange, otherwise not keeping a record that the request ever happened.

moot 12y ago

HELL HAS FROZEN OVER

skizm 12y ago
When can we see this integrated with 4chan?
- moot 12y ago
  We actually implemented Facebook Connect for April Fool's back in 2010. It was a real app and posted your 4chan post(s) to your Facebook wall. EDIT: Here's a screenshot -- http://i.imgur.com/p0peJp6.png http://i.imgur.com/p0peJp6.png The best part was the reviews. They were all either 1 or 5 stars. People were shocked it actually worked.
  - loceng 12y ago
    Hilarious.
  - damon_c 12y ago
    That is so beautifully subtle... just casually sitting there like nothing out of the ordinary.
bigbento 12y ago
When are we going to hear the news? > In a move to bolster its new 'Anonymous' strategy, Facebook has acquired 4chan for $30 billion in an all-cash deal > "It's been an incredible journey", said 4chan founder Christopher Poole at a press conference in Menlo Park, CA. "Our anonymous users have been the driving force behind 4chan, and we look forward to bringing that experience to Facebook"
- moot 12y ago
  That may in fact be the harbinger of the Apocalypse.
shawn-furyan 12y ago
Not really. Facebook isn't giving up any information at all. So it's nothing particularly unexpected. Actually, it's kind of up FB's alley, because it allows them to gather info on web/app usage patterns of their users while leaking a lot less info to third parties. If anything this program gives FB more control over user information relative to third parties than the current FB Connect program. [edit 2:38 CDT to add the string "/app"]

Jemaclus 12y ago

I suppose it still tells that service that I have a FB account. Better than telling them everything about me, I guess?

minimaxir 12y ago
Additionally, Facebook knows which apps you are using anonymously, which could have problematic implications when incorporated with Graph Search.
- angryasian 12y ago
  this is exactly what it is. They can still target ads and understand your preferences and behaviour.
  - pyronite 12y ago
    The horror!
nollidge 12y ago
> I suppose it still tells that service that I have a FB account. Which barely more invasive than telling them you breathe air, no?
hackinthebochs 12y ago
What meaningful information can a service glean from that when probably 90% of the western internet using world has one?
zmmmmm 12y ago
This is the big question. I assume it is telling Facebook and NOT the app developer, so basically it's all win for Facebook and all loss for the developer who implements it (other than attracting the few extra users who care so much about their privacy that they won't divulge their Facebook data). I'm curious what happens to functions inside the app that need identity. Do they work as normal but the app developer can't see the information? Or does everything the user does prompt for a login, so the app developer can be pretty assured that nobody will go for any length of time using the app before they give up and log in?

minimaxir 12y ago

How long until Facebook releases a photo app with Anonymous Login as its central feature?

danielrakh 12y ago

This is great. As an iOS developer this lowers the barrier of entry for people to try out your app.

loceng 12y ago

Isn't the issue that we don't want to share information with Facebook?

krapp 12y ago
Facebook is never going to see that as a problem worth solving.
- test1235 12y ago
  Facebook is never going to see that as a problem.
- hackinthebochs 12y ago
  That isn't facebook's problem to solve, its your problem. You are fully equipped to solve it yourself (i.e. don't use facebook).
junto 12y ago
Spot on. Isn't the issue that a leopard doesn't change his spots. Facebook has historically shown a blatant disregard for user's privacy. They store everything even when purporting to have deleted it and privacy is contrary to their underlying core business. Privacy and Facebook is an oxymoron
pavanky 12y ago
If you are getting products / services for free you have no right to demand that of them. Simply stop using facebook or any other social networking site for that matter.
- loceng 12y ago
  It's not free - there are ads and they are intrusive.
- shawn-furyan 12y ago
  I don't see the connection between direct payment for service and the right to demand things (not that the gp was 'demanding', but whatever...). I don't think that most paid apps codify a right for users to demand things of them, and actually terms of service for paid proprietary software have a tendency to be as restrictive as possible of end user rights. But Facebook is a service that monetizes user attention, and so I think that users are just as justified in complaining about, or trying to work around facets of Facebook that they see as misfeatures as they would be for software that they directly paid for. They don't have a lot of power to individually change anything, but they do have the right to complain in open forums. I don't think that the business model really has any bearing on this.

cliveowen 12y ago

"People tell us" People don't tell you anything, they don't have a way to do it. Facebook just does whatever it wants without caring about the users, lets cut the BS.

deleted 12y ago
[deleted]
officemonkey 12y ago
A supervisor is a person.
- coherentpony 12y ago
  Companies are people too.
- cliveowen 12y ago
  That's obviously not what they meant.

jawns 12y ago

Over the years, Facebook has dabbled with a bunch of different ways of apps requesting/handling user permissions and data. This is not, actually, the first time Facebook has enabled this level of granularity, as far as users being able to grant permissions piecemeal. It used to be (not sure if it still is) that an app could request one permission here, one permission there, at various points in its application flow. But with each request (in which you could bundle a bunch of different permissions) it was either an "all or none" decision for the user. This new approach just makes things a little easier, because you can present all of the permissions and data request up front and let the user pick and choose what should be granted. I think this Facebook thing is really going to take off one day.

smackfu 12y ago
I really liked their last iteration, where posting to Facebook was walled off from the rest of the permissions, and separately prompted.
rmc 12y ago
IME when logging in via Facebook, I can choose to not allow that site to have the ability to do certain things (like not post to my wall etc) I also develop an application that uses Facebook login, and we (using django-social-auth) request one set of permissions initially, and request more later if the user wants to do advanced stuff.

yawgmoth 12y ago

This seems like a fairly natural step for Facebook, as increasing app dependency on Facebook for account authorization is a step towards building a platform.

bhartzer 12y ago

So when are anonymous logins a part of Facebook's privacy plan?

programminggeek 12y ago

This is a horrible idea for app developers. If someone wants to sign up for my app, but doesn't want to create a real user account with an email address and personally identifiable information, then I don't have a real customer relationship or anything of value. So, why even make them log in? I guess I just don't see the point of requiring a user account if it isn't adding value to either the user or the app creator. One more reason not to use Facebook as a login mechanism I guess.

xahrepap 12y ago
Because, it's a lot easier to just sign up using your Facebook account rather than trying to remember yet another password. But I don't want every little site to know my personal information. It's none of their business. I just want to log in quickly. Logging in to a site provides more value than just sharing personal information. For me, I rarely, if ever, want a site to know my personal information. That's why I rarely use Facebook login service. Now I will.
- ebbflowgo 12y ago
  I agree with this.
- gtremper 12y ago
  Agreed, however, there are a few pieces of information that I find useful for Facebook to share. Namely my profile picture and sometimes my friends list. Though gravitar somewhat solves the profile picture problem.
morgante 12y ago
> So, why even make them log in? As a programmer, I surely hope you don't think the only purpose of user accounts is to gain personal information. Hacker News does not ask for personal information. Does that mean we shouldn't have to log in on HN?
- libria 12y ago
  > Hacker News does not ask for personal information. Does that mean we shouldn't have to log in on HN? I think he's looking at it from a product/sales lead perspective. HN isn't trying to sell us anything.

danudey 12y ago

I never use Facebook Login for sites/apps, not because I don't trust the sites/apps with my FB data but because I don't trust FB with my app usage data. Now, if I could log into Facebook without giving them access to my data, that would be a killer feature.

michaelmior 12y ago
How would you allow an app to log you in with Facebook without Facebook knowing about it?
ihuman 12y ago
Isn't that the entire point of Facebook though? You give Facebook your data so they can give it to your friends.
etler 12y ago
If a website loads the javascript facebook API on their site, and you're logged into facebook in general, they know who you are and what page you were on when the script was loaded whether you give the site permission or not. When the http request is made to facebook, they get their domain cookie back which has your user info in it. On top of that, when their javascript runs they get full access to all the data of the window that made the request meaning they get the other site's cookie as well absolutely everything else. If you don't want to be tracked by facebook online, you only have a few options. Disable cookies, disable javascript, or only login to facebook in an incognito window. Otherwise, they can track exactly who you are and where you go on any site that makes any request to facebook. Even still, if any request is made to facebook, they can still anonymously track you even if you aren't logged in. As for apps, I don't think the facebook api would be able to find out the specific usage of the app unless the app purposefully gave it up, although they would know when you login.
- codesuela 12y ago
  There is also Disconnect.me and Ghostery if you want to block facebook and other trackers without disabling JS
- 12y ago

morgante 12y ago

As a developer and user, I love this. For many small apps, it just doesn't make sense to ask people to create a username/password, but I still want a way of authenticating them. This move gives me a way to leverage Facebook for that without users giving up any privacy. A total win/win.

aw3c2 12y ago
Actually at least for me, the concerns are the opposite. I do not want Facebook to know what I am doing. I do not mind you getting my name (though I would consider it rude not not accept a pseudonym of my choice).
bigfoot13442 12y ago
As a developer with a production mobile app that uses Facebook for more than just sign in, I hate this. It changes a lot of the fundamental things that we use in a way that is detrimental to our user's experience. Before, login with Facebook provided a better and more convenient user experience. Now it just seems clunky. Without the information that we get from Facebook for a user that decides to sign in with Facebook, we don't even have a user.

marojejian 12y ago

The most important thing FB can do is win universal login. And the #1 thing it can do to promote that is restore some faith in its privacy commitment. This is a very smart move. Of course let's see how they implement it. If the process is too complex, it won't work for users. Given their reputation on privacy - it will be hard to recover. But (almost) no other company has as good a shot at this opportunity.

EGreg 12y ago
Why should one company control identity and authentication on the web? What we really need is a decentralized identity platform.
- ForHackernews 12y ago
  https://developer.mozilla.org/en-US/Persona https://developer.mozilla.org/en-US/Persona
  - EGreg 12y ago
    https://news.ycombinator.com/item?id=7364465 https://news.ycombinator.com/item?id=7364465
- deftnerd 12y ago
  I'm working on this problem right now at blockauth.com. Launch is still months away but its an interesting mix of Blockchain publishing, ICANN style franchising, and paranoid levels of verification. The end result will be a federation of OpenID providers that all vouch for a user to confirm that they are a real unique person all while not giving any personal details about them unless they approve. Basically its what Facebook is proposing but we do background checks on the accounts to ensure they aren't bots. Our privacy policy will be a lot more serious too. No marketing or targeted advertising.
  - EGreg 12y ago
    Why do you need all that? Just curious. I am the author of http://platform.qbix.com http://platform.qbix.com, and it includes decentralized identity. Each app can run on its own machine/cluster, and communicate with other apps. Each app is itself a user in Q. When a person using a user-agent authenticates with an app, they can either do it natively (providing, say, their email address) or they can select an external app that they already logged into. The user-agent stores the domain of that app, and it's a simple matter of doing oAuth with that app. Except, of course, the user id isn't given out by the user's "home server" but instead a different "xid" (stands of external id) is given to each consumer app. In short, an app can start life as a consumer of identity and eventually offer to provide identity. The identity provider doesn't just support oAuth, but ideally would allow the user to publish streams that others can subscribe to and view, import contacts and manage access control (privacy) based on those contacts and labels. Finally, they should be able to connect endpoints (such as their mobile phone, email, facebook account etc.) to receive notifications sent to their account by some apps they've authenticated with. Whenever an app would need to display personal information back to a user, they could do it without ever knowing their personal info: http://www.faqs.org/patents/app/20120110469#b http://www.faqs.org/patents/app/20120110469#b What do you think? In the future we might also encrypt this stuff so governments and others can't get it by simply breaking into the database. I don't have any expertise in this last part, so if anyone does I'd be curious to learn.

deleted 12y ago

[deleted]

izzydata 12y ago

What is the point of this? I don't want to have to login with facebook at all. If some site has facebook login requirements I simply don't use that site anymore. If you use facebook login for your site then you are shooting yourself in the foot if you care about users.

ceejayoz 12y ago
It's basically Facebook's version of OpenID/Persona. Single-sign-on without the hook into your FB data.
yeukhon 12y ago
Exactly. Because someone else want to have that feature. You are not the only person who is using the web.
- axanoeychron 12y ago
  I'm confused. You're actually saying the exact same thing as him and assuming something in the process. You're saying that he is not considering other people when he is actually saying the opposite: that people should think of ALL users. I'm guessing 'What is the point of this?' got you but reading that closely is more this: not everyone is sold on the idea of FB in general as the answer to anything so an alternative product doesn't do him any favors. Like trying to sell someone who doesn't want to drink a smaller bottle of alcohol. I don't want to sign in with Facebook full stop. I really agree that you shouldn't force people to use a third party service to sign in. If you're contemplating login, please consider people like us! Do Facebook login as your MVP but please do consider us!
  - deleted 12y ago
    [deleted]
    - axanoeychron 12y ago
      Am I though? Isn't that what we are doing - we are expressing our views on a site that targets startups, site and app developers who might be considering what login technology to use? Afterall, those sites are under construction - they have not been created and developers can weigh the pros/cons. A site that has already been created that only offers Facebook login, I cannot use. Hence our dilemma and the importance of expressing our views in this message board. Edit: Parent deleted so this reply may not make sense.

EGreg 12y ago

So basically fb gives each app a unique uid for that user so they can't be tracked across apps right? And returns no info for them? Has anyone actually tried using this?

afternooner 12y ago

This is the exact opposite of the product I want. The group I least want in control of my data is Facebook and their ever changing security/privacy policies.

hackinthebochs 12y ago
Then don't use facebook login? How is this an interesting point to make at all on this topic?

melindajb 12y ago

Will developers be able to reject customers who insist on anonymity? If not, I'm inclined to lean away from offering Facebook login.

jfernandez 12y ago

Seems like an interesting choice for a demo video to showcase Flipboard (i.e. regarding their own stake in this realm of products, Paper). Granted this isn't about that, but that was fun to think about.

asnyder 12y ago

Wow, it seems like they finally got rid of the minimum e-mail, profile, friends and all that jazz. Just finished reading the dev docs and it seems we can finally limit the minimum scope. Facebook can now just be used as a standard login. Though they now need to educate users so that they don't still feel that their privacy is being violated.

nollidge 12y ago

If anybody else is wondering what the hell "f8" is: http://en.wikipedia.org/wiki/Facebook_f8 http://en.wikipedia.org/wiki/Facebook_f8

smickie 12y ago
It's like their annual conference for developers. Like Apple's WWDC. Or Microsoft's... (not sure what it's called). I love the name F8. It's a great play on words.

outside1234 12y ago

tl;dr: App gets no data and Facebook still gets the same data. Total win for Facebook.

mcintyre1994 12y ago
Total win for the user though. Short of using their javascript to spy on the webpage you're on they don't really get any usage data anyway?

ISL 12y ago

A win for new sites that are starting up and can leverage the FB sign-in framework. An example: I've wanted to try out https://giveit100.com/ https://giveit100.com/ since launch, but have been waiting for an alternative sign-in. Thanks FB!

ElliotH 12y ago
Corrective upvote applied. But maybe don't put a comment to your downvoter in your comments? Downvotes get fixed, and anybody can check your profile to find out whether you are associated.
- ISL 12y ago
  Fair 'nuf! Will nuke the edit.
laureny 12y ago
You could have created another FB account just for these situation instead of waiting. That's what I've been doing, and I will probably continue to do so since even logging in anonymously on Facebook tells Facebook, and whoever else they feel like sharing it with, e.g. advertisers, that I logged in.
- r00fus 12y ago
  Isn't that against FB TOS? Also, what a pain - at least per-site pwds are easily managed via 1Pass or LastPass, but having dozens of FB pwds sounds crazy.
  - laureny 12y ago
    Dozens? I only have two, my real one and my fake one. I'm always logged in my fake one on my non-default browser.

numair 12y ago

You're an idiot if you implement this. On iOS, use the device token and implement truly anonymous login without having to deal with anyone else brokering your users' data; I'm not sure what the Android equivalent is, but it can't be much more difficult. Remember, Facebook is the same company that cuts deals with shady data brokers like the Datalogix (the company that buys your grocery store discount card data and re-sells it, among other things) to build a comprehensive profile of everything you do. Using them for this pseudo-anonymous "anonymous login" helps them a lot more than it will ever help you, as a standalone developer. I can't wait for Facebook to trademark the term "Anonymous Login," just to complete the irony. Remember, if it was actually anonymous, you wouldn't need Facebook's help to implement it.

selmnoo 12y ago
> Remember, if it was actually anonymous, you wouldn't need Facebook's help to implement it. That sums it up nicely. And actually, the thing is I could totally see Facebook enabling truly 'anonymous logins' and whatnot, because it can afford to do it at this point. It is too entrenched as the social king, no other competitor comes close to it, and it's not going to fall down anytime soon because it'll be buoyed by networks effects for quite some time... and so it makes sense to ease things up a little to improve their public image. But, the way they got there, to the top, was by using dirty and despicable dark patterns, like 'Privacy Zuckering': http://darkpatterns.org/library/privacy_zuckering/ http://darkpatterns.org/library/privacy_zuckering/ For this reason alone, I would stay the hell away from anything Facebook.
- lugg 12y ago
  It truly is an interesting move. Last night my housemate was telling me about MS's moves in the office365 space, I was gobsmacked by what they're up to these days. I actually commented "time to buy some MS shares", pigs were flying. And now this.. It does make sense though. Developers only really want a way to verify the user exists and isn't some spammy bot. Verification like facebook login is the easiest way to go. The problem has always been - far too many people avoid signing up with facebook as it shares "god only knows what" with the site. This works around both issues and really is the only way they can become the single signon entity. Which is what they've been aiming for. As for "not bothering to implement" (aap), if you already need to handle facebook connect login, its going to be minor to add anon login facebook handles all the identity stuff leaving your app clean of yet another verification loop which annoys the hell out of users. Sure there is the "apps need that data to make money" situation, but as a matter of fact, the people signing on anonymously were a) going to create a fake facebook or b) signup manually and give you a mailinator address.

jchysk 12y ago

This isn't anonymous login. Facebook still knows what you're logging into. LaunchKey is true anonymous authentication.

deleted 12y ago

[deleted]

jtchang 12y ago

This is what happens when users are screaming "I want my privacy back" and you are stuck between corporate goals of monetizing users and user experience.

IBM 12y ago
Which is a refreshing change compared to how Google has been in recent years.

gdeglin 12y ago

I'm bouncing between thinking this is great and this is awful. Ultimately I'm very curious how developers will use it. The main risk seems to be what happens if Facebook decides to remove Anonymous login. You may have many accounts on your site that had logged in anonymously and participated, but now no longer have a way back in. This seems like an awful scenario, and yet a very possible one -- Facebook is quick to change and remove features on Platform.

randartie 12y ago
You have to register your app with facebook, thus this feature could be removed from all new apps while still preserving existing functionality for apps registered before the feature gets removed (if it ever does get removed).
- gdeglin 12y ago
  Fair point, and hopefully this qualifies under Facebook's pledge to maintain backwards compatibility for 2 years. But of course there's also the issue that this becomes something that developers themselves can't easily remove once they add it to their app. Or worse, if Facebook decides to block a developer's app from platform. At least with regular Facebook login, most developers requested Email so users could always request that a password be sent to them as an alternate login mechanism. Developers should be mindful that Facebook explicitly prohibits using Platform to build "competing social networks" (An unfortunately broad category): http://techcrunch.com/2013/01/24/my-precious-social-graph/ http://techcrunch.com/2013/01/24/my-precious-social-graph/ And they have a history of enforcing this with the bans of Yandex, Wonder, Vine, and Voxer.

harmonicon 12y ago

Does an ad-free, data-collection free and paid subscription based version of Facebook has any chance in the market?

neil_s 12y ago

Nice one. I've been using a Chrome extension called fPrivacy to do this presently on the web, since very few websites actually check to see if they've got all the extraneous information they requested. But it sometimes breaks the login process, so it'll be nice to get rid of it. Next top feature Facebook should introduce: Automatically generate a new anonymous email address for each app. I can then go into Facebook settings later and prevent any of those addresses from forwarding to my personal address if that app starts spamming or gets hacked. They did have an anonymous email feature at some point, but it wasn't fully ready yet.

primitivesuave 12y ago

It's a great idea in theory, but a pile of shit in reality. What's the point in using third-party authentication if you get zero data from it? Unlike Facebook, my goal is not to sell user data to the highest bidder, it's to have the user skip the steps where they enter their real name and confirm their email address.

wankerrific 12y ago
This. Facebook is a glorified user registration system on mobile. As a developer, I have no incentive to use FB anonymous login.
jawns 12y ago
While it certainly seems like it does you no good, I can definitely see a legitimate use case for it. Suppose you're creating a site -- let's call it Hacker News -- that requires a user to log in, and all you care about is the part where they enter their username and password. From there, you're able to assign the user a unique ID and persist their preferences (e.g. header color) across sessions. It's not exactly a difficult project to roll your own login system, but Anonymous Login gives you the added advantage of being able to "upsell" users into providing more information, if they feel comfortable sharing it.
nacs 12y ago
The anonymous login allows users to become less anonymous by providing real info if they wish to do so later. So you have the potential to get > 0 data. This would basically make it easier to access or try out all the FB-only-login apps without giving the app owner all the personal info.
habosa 12y ago
having FB login as an option increases your conversion rate. The more ways someone can get an account, the more likely they'll find one they like (to a point).

deleted 12y ago

[deleted]

EGreg 12y ago

The only benefit of anonymous facebook login over a native session is the supposed "cost" of creating too many accounts, and enabling things like a http://en.wikipedia.org/wiki/Sybil_attack http://en.wikipedia.org/wiki/Sybil_attack Actually I would like to ask if anyone here knows of more good solutions for making creating accounts expensive. Captchas ain't it anymore. The best one I know is Phone Verification. http://www.blackhatworld.com/blackhat-seo/making-money/596992-way-bypass-craigslist-phone-verification.html http://www.blackhatworld.com/blackhat-seo/making-money/59699... Buying a cellphone in order to get an account is expensive enough. But is there something better?

cowchase 12y ago

I'm surprised nobody has mentioned SQRL for truly anonymous identification and authentication yet https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm

marincounty 12y ago

I've used a sudonym for years. FB depresses me? I guess because I see my friends ageing. I did reserve my real name; in case I ever really liked FB, but I am still using a civil war veterans name.

drdaeman 12y ago

We seem to start to really fail making distinction between anonymity and pseudonymity. "Anonymous login" means you provide no identity information whatsoever. If you're "person #123456789" or "f93f9211-9f49-4bad-ad34-e00f8c536b0f" or whatever - you're not anonymous.

geoffsanders 12y ago

If you want truly anonymous login, might I recommend https://launchkey.com https://launchkey.com Obviously there's nothing truly anonymous about this service if Facebook knows everything about you...

ganjianwei 12y ago

This is likely to get traction because generally: - people have already signed up with Facebook - people don't trust app developers with their FB data, and don't trust app devs not to post crap to their timelines - people hate signing up for another service again with email and password (you have to give out your email, you have to create/reuse and remember a password) The more open question is if it will cannibalize FB logins or get incremental people to sign up with FB (people want to do this anonymously but didn't have the option and gave up).

kytmizuno 12y ago
I would hope this goes towards the iOS permission model. You would almost always login anonymously. Then pieces of information are requested on demand when a user takes action that specifically needs that information.
rhizome 12y ago
App developers have never been responsible for a leak. I literally cannot find a reference in the Google to an app company leaking user data they were authorized by FB to hold. You know what I can find? Facebook having leaky permissions for a year and a half.

grrowl 12y ago

By the way, Facebook already knows you're using an app before you log in, when the app pings Facebook to check the login status. This only prevents usage information leaking back to the app itself.

mahyar 12y ago

Anyone knows when the changes become effective?

gradstudent 12y ago

I'd like to know why "Anonymous Login" is not the default and single login option.

donniezazen 12y ago

Anonymity on Internet is a myth.

peterbe 12y ago

Too late. Users don't trust facebook no matter what scopes you [don't] ask for and tell people "we never post on your wall".

ecocentrik 12y ago

Facebook keeps framing thier role in providing OAUTH as one where they are protecting their users from all the bad guys on the outside. I thought it was clever marketing when I first saw them take this position but it seemed obvious to me that anybody who implemented Facebook login was giving Facebook the upper hand. One party gets free advertising and the other gets a scary looking permissions page that makes them look like an identity thief. In the process, the first party transmutes their bad press into the appreance of good will in countering the second party's apparent bad intentions. Everybody must have caught on to Facebook's bad will psych game by now so why would anyone keep using Facebook Login?This latest change just moves the bad will to your login page. Every time someone moves to log in they will be reminded who Facebook thinks should be trusted and it's never going to be you.

Pxtl 12y ago

This is one case where Facebook is really showing Google how it's done. I mean, Google is failing to get Google Plus accepted as a social layer for Google's own pages, while Facebook is working on getting Facebook accepted as a social layer for every other site on the Internet.

oliomel 12y ago

I don't know if this is silly, but... what happens when people blindly trust a button and someone decides to exploit that by making a fake one open a phishing pop up requesting your Facebook credentials? Has this been done?