6 ms·

While I agree w/ some of the points Stallman makes, essays like this that rely on hyperbole to rile up readers turn me off and detract from the issues the autho

by revicon 12y ago

While I agree w/ some of the points Stallman makes, essays like this that rely on hyperbole to rile up readers turn me off and detract from the issues the author is trying to bring attention to. One example: Stallman states "Facebook's mobile app snoops on SMS messages" and links to this article: http://www.efytimes.com/e1/fullnews.asp?edid=128859 http://www.efytimes.com/e1/fullnews.asp?edid=128859 "... during installation, the Facebook mobile app for Android platform seeks certain 'permissions' with the latest update going a step ahead in asking users to allow the app 'Read your text messages (SMS or MMS)'." So during installation (on android), Facebook is asking permission to access SMS, which you can choose to enable or not. This is a far cry from his statement that "Facebook's mobile app snoops on SMS messages." There are good points in this essay, but the amount of alarmism mixed in makes it much harder to sift through.

kragen 12y ago
It is not correct to say that you can choose to enable this permission or not; or, rather, it is true only in a narrow technical sense — if you choose not to enable this permission, standard Android will refuse to install the Facebook app. And what legitimate reason could Facebook possibly have to request that permission in the first place? There may be some examples of hyperbole in that article, but the example you chose is not one of them.
- tedunangst 12y ago
  Phone number verification? I have an iPhone, which doesn't ever let apps read text messages, which actually would be nice sometimes when my banking app would like to verify it's running on my phone, as opposed to somebody else's phone.
  - darklajid 12y ago
    Why would Facebook need to verify a phone number? It's a social network, used for jokes, farmville and whatnot. Most people I know that are on FB don't even use their 'real' name. IF someone provides a telephone number in his account details, FB can treat it like a string. I understand why FB would like to 'verify a number', but why should we allow that to happen? Why is this a valid reason to ask for permissions on my phone?
    - tedunangst 12y ago
      If you don't let people use two factor auth, they bitch about your lack of security. If you let people use two factor auth, they bitch that you're collecting phone numbers. Can't win.
      - detaro 12y ago
        What Facebook 2FA uses SMS and the app? All I know is either sending codes per SMS you enter on the web page or using a code generator app. Setting it up doesn't even require the Facebook app, let alone it reading SMS. Am I missing something? (I don't use Facebook much)
        tedunangst 12y ago
        Not sure. I neither provided Facebook with my phone number, nor use Android, so I can't say whether it could verify for your phone number like that or not. But reading SMS codes seems like something an app could do instead of making the user enter it by hand.
      - darklajid 12y ago
        The problem is scope. TFA is nice. Maybe mandatory when you're providing a service that passes a certain threshold? But that permission obviously isn't the right answer. FB should ask for permissions to read _all_ SMS to make TFA via SMS a tiny bit more comfortable? No. TFA solutions exist. Google Authenticator (I wouldn't trust Google with anything, but that's "open" as far as I know) or the Yubico aequivalent are perfectly fine choices for T/HOTP. If you want to send SMS instead (why??), let the user enjoy their platform's copy/paste support to give you the code. There is not a single reasonable argument, why Facebook (or.. any. Seriously: I cannot think of ONE reason) should be able to read your text messages. Bringing up TFA is probably (hey, not my native language, I certainly never joined a debating group or whatnot) a failure to argue the point and has a nice latin name or something. Maybe about a true of false Scotsman or what do I know.. If I say "FB shouldn't read texts" that has no relation to "FB should not implement TFA". Nor is it reasonable to imply that they cannot, without that permission.

by revicon 12y ago

kragen 12y ago

It is not correct to say that you can choose to enable this permission or not; or, rather, it is true only in a narrow technical sense — if you choose not to enable this permission, standard Android will refuse to install the Facebook app. And what legitimate reason could Facebook possibly have to request that permission in the first place? There may be some examples of hyperbole in that article, but the example you chose is not one of them.

tedunangst 12y ago
Phone number verification? I have an iPhone, which doesn't ever let apps read text messages, which actually would be nice sometimes when my banking app would like to verify it's running on my phone, as opposed to somebody else's phone.
- darklajid 12y ago
  Why would Facebook need to verify a phone number? It's a social network, used for jokes, farmville and whatnot. Most people I know that are on FB don't even use their 'real' name. IF someone provides a telephone number in his account details, FB can treat it like a string. I understand why FB would like to 'verify a number', but why should we allow that to happen? Why is this a valid reason to ask for permissions on my phone?
  - tedunangst 12y ago
    If you don't let people use two factor auth, they bitch about your lack of security. If you let people use two factor auth, they bitch that you're collecting phone numbers. Can't win.
    - detaro 12y ago
      What Facebook 2FA uses SMS and the app? All I know is either sending codes per SMS you enter on the web page or using a code generator app. Setting it up doesn't even require the Facebook app, let alone it reading SMS. Am I missing something? (I don't use Facebook much)
      - tedunangst 12y ago
        Not sure. I neither provided Facebook with my phone number, nor use Android, so I can't say whether it could verify for your phone number like that or not. But reading SMS codes seems like something an app could do instead of making the user enter it by hand.
    - darklajid 12y ago
      The problem is scope. TFA is nice. Maybe mandatory when you're providing a service that passes a certain threshold? But that permission obviously isn't the right answer. FB should ask for permissions to read _all_ SMS to make TFA via SMS a tiny bit more comfortable? No. TFA solutions exist. Google Authenticator (I wouldn't trust Google with anything, but that's "open" as far as I know) or the Yubico aequivalent are perfectly fine choices for T/HOTP. If you want to send SMS instead (why??), let the user enjoy their platform's copy/paste support to give you the code. There is not a single reasonable argument, why Facebook (or.. any. Seriously: I cannot think of ONE reason) should be able to read your text messages. Bringing up TFA is probably (hey, not my native language, I certainly never joined a debating group or whatnot) a failure to argue the point and has a nice latin name or something. Maybe about a true of false Scotsman or what do I know.. If I say "FB shouldn't read texts" that has no relation to "FB should not implement TFA". Nor is it reasonable to imply that they cannot, without that permission.