Facebook Now Shares Phone Number & Address With Third-Party Apps

http://www.readwriteweb.com/archives/facebook_now_shares_phone_number_address_with_thir.php?sms_ss=hackernews&at_xt=4d3346d0e7608241%2C0

by rwwmike • 16 years ago

184 78 16 years ago

readwriteweb.com

ssclafani• 16 years ago

Less sensational headline: Facebook Now Allows You to Share Your Phone Number & Address With Third-Party Apps

yellowbkpk• 16 years ago

Right, but the point RWW was trying to make is that the dialog doesn't exactly scream "we're sharing your phone number!" It looks very similar to any other dialog 90% of the Internet might click through without so much as a glance.

nhangen6• 16 years ago

Exactly, and what I really don't like about this is not that they are doing it, but they won't share it with their users unless the tech world makes a big deal out of it, which they will. So they announce it on the dev blog, but not the public blog, which I think is poor form at a minimum.

I looked through my profile info and I didn't see a way to hide my phone or address from applications, which means that I have to choose to not post them on Facebook, or provide access any time I want to use an app that requests them.

Obviously, this is much more useful to developers than it is users.

ajg19772• 16 years ago

Not really. That implies Facebook are offering a way to push your phone number and data into third party apps.

What they are infact doing is now allowing third-parties to request extra, and very very personal, information about you using the same dialog that people have effectively now been trained to basically click-through.

I really think this dialog needs two things:

1) Something that highlights the fact you are allowing third-parties access beyond your basic profile. All personal information is not equal.

2) A way for the user to opt out of sharing this extra information. As a result, the app may have to deny you access if it really really does need your address (why it would is hard to imagine), but this "all or nothing" approach seems wrong to me.

fuzzmeister2• 16 years ago

1) The fact that there is a second item below "Access my basic information" would seem to make that fact abundantly clear. I'm not sure how much more explicit it can get.

2) While I agree that it would be good to give users a greater level of control, most apps are unfortunately not designed to play nicely with varying levels of permissions. Such a change would require significant advance notice to Platform developers.

yason• 16 years ago

The next thing to do would be to wait for them to swap the defaults and make it so that you have to specifically opt-out of the scheme, or have your contact information casually shared with a set of third parties. Then we could scream for privacy and spread instructions on how to disable that using this week's user interface to the privacy settings.

loewenskind4• 16 years ago

Yes, this is exactly the danger here and something Facebook has done to its users several times already.

snissn• 16 years ago

>implies content actually isn't worth sensationalizing

nhangen6• 16 years ago

If this is true, then why was it announced to developers and not users?

jschuur2• 16 years ago

It's announced to users where it matters: when they are asked for permission to share their data.

nhangen6• 16 years ago

Just want to add that the parent, which I've been downvoted for, was in response to this, and not the OP:

"Less sensational headline: Facebook Now Allows You to Share Your Phone Number & Address With Third-Party Apps"

beoba• 16 years ago

Where's the option to choose which items get sent? Looks like all or nothing.

chapel• 16 years ago

I have been wondering that for a while; why isn't there a conditional permissions system that you can choose what gets shared or not. It wouldn't be that hard for app developers to sanity check for what is available or not, and tell the user if it is an issue.

The all of nothing mentality is flawed, much like most of Facebook's decisions it seems. (imo)

JanezStupar• 16 years ago

It is not flawed by any means - from Facebook POV.

michael_dorfman2• 16 years ago

The app has to warn you as to what is getting sent; you then get to decide if you want the app or not.

In other words, it's not really "all or nothing" as much as "whatever this particular app asks for, or pass on this app."

stanleydrew2• 16 years ago

Exactly. Give this app "all" of the information it is requesting or give "nothing." People want more granular control.

jdp232• 16 years ago

Facebook has refused to provide that option.

btipling3• 16 years ago

They used to provide this option but it actually made the API harder to work with. You could deny or approve one permission at a time and the developer had to handle it (and by handling that really meant always checking for permissions before actions and bugging the user for the permission whenever they tried something that required it). As a developer I prefer the new way, which is also how Android development works. Giving line-item veto to a user is a terrible idea. If they don't like the permissions, don't use the app. It's good for Facebook's api too because now people aren't constantly checking which permissions are available before they do something, probably reducing the stress on the API quite a bit.

obeattie• 16 years ago

As I remember, permissions on FB used to be exactly this back in the olden days of connect (you'd get a dialogue for each permission with an accept/reject, rather than a batched one). I can see why they removed that implementation because clicking "Allow" 5 times was obnoxious, but it's not exactly impossible for them to put a checkbox next to each one instead.

MatthewCampbell• 16 years ago

That's half true. It's all or nothing on first use, but you can revoke any non-required permissions later: http://www.facebook.com/settings/?tab=applications

aditya• 16 years ago

You can't take back the data tha you already gave to the app, however. Revoking permissions prevents the app from accessing your info in the future, but it's sort of limited once you've already given that data to the app

motters• 16 years ago

I seem to remember that not so long ago it was standard advice not to give out your address or phone number to people you don't know on the internet.

WillyF• 16 years ago

Most people also didn't use their real name online. Facebook played a huge role in changing that.

nhangen6• 16 years ago

With privacy settings set properly, you aren't doing that at all. You're sharing your address and phone # with your friends. From what I can gather, this bypasses those settings.

FirstHopSystems• 16 years ago

With a multi-billion dollar valuation, I'm sure that the majority of Facebook's value is in all information it gathers about you. Is this any surprise to anyone? One way or another Facebook is trying to monetize your info. Maybe it's just me but there always seem to be some kind of news fading away about Facebook privacy. I'm my theory that's why they are worth so much. Don't think they are going to stop doing this anytime soon.

Opt-out..hahaha maybe opt-out of only the really obvious ways Facebook is selling your info.

beaumartinez2• 16 years ago

ReadWriteWeb-sponsered submission? Check the URL, it has a tracking string (for want of a better word) with "hackernews".

code_duck• 16 years ago

If you look at the bio of the submitter, he writes for ReadWriteWeb and, I believe, wrote the article. Nothing wrong with that; people often submit their own work here.

rwwmike4• 16 years ago

You are correct. I write for ReadWriteWeb, wrote the article and I think that the URL has that code in it because I clicked on the Hacker News button on the article to share it.

andysinclair• 16 years ago

But how many people have added their full address and phone number to their Facebook profiles anyway? I would bet that the majority of people have their city/town set and not their full address and won't have specified their phone number at all.

However, this really could be quite useful if used legitimately, i.e. Facebook commerce, having shipping address available; location aware apps etc.

estel• 16 years ago

Anecdotally, something like 30% of my friends list (not particularly tech-savvy skewed) probably share their phone numbers.

It's also one of the most useful features of the whole site, if I'm out somewhere and realise I suddenly need to call someone whose number I can grab from Facebook.

jschuur2• 16 years ago

I use Facebook for my friends. Why wouldn't I add my real contact details?

I'm not afraid of my friends.

cd34• 16 years ago

http://www.facebook.com/friends/edit/?sk=phonebook

Very easy way to check which of your friends has published their phone number.

EGreg• 16 years ago

I've been developing Facebook Connect applications for a long time, and I'm wondering - hasn't facebook had this feature already for email addresses?

One of the permissions read: "Send me email" (optional: send through a facebook proxy)

So now, you can also let the apps know phone number through the graph? I don't find that too big of a step. CAN-SPAM still applies. Perhaps they should set up proxies for the phone number, though.

What I find more funny is that ReadWriteWeb writes:

"Thankfully, this sort of information cannot be shared via your friends' careless actions, unlike other profile information."

which is in direct opposition to the attitude that blogs had on the same issue when Google complained that facebook was "trapping your contacts" by not letting you export them. Now they are thankful facebook doesn't do this :)

gergles2• 16 years ago

Letting your friends export your information through a facebook feature is substantially different than letting any shady "Platform" app get it.

rwwmike4• 16 years ago

Who owns your online identity is a completely different thing than letting this sort of contact information leak through the carelessness of your friends. Other profile information of yours, if you don't correct FB's settings, can be given to third-parties by way of your friend saying okay.

That is, thankfully your friend can't decide they want to share there contact information with some app and vicariously share yours too.

Big difference.

ChipsAndSalsa• 16 years ago

The idea of allowing users to control what individual permissions they have is good in theory, very hard in practice. It faces two main challenges that I can think of:

1) There are UI issues that have been raised elsewhere in this thread - mainly, that users get confused when shown a set of complex options. Having watched usability studies where users are given a lot of relatively complex options, I'd suspect that a model where users have to pick among the permissions to give an app is going to fail massively (ie, user turns on everything without actually understanding anything, turns off everything by default or just cancels out of the app install altogether.) A model where apps request permissions right when it's needed will be annoying users with all the dialogs needed.

2) Some apps don't work if they don't get all the permissions they need (imagine an address book app for an email program - if you don't get email address it just doesn't work.) Adding a lot of conditionals to change how your app works based on what permissions they get can be expensive and adds a lot of unnecessary test cases.

In my opinion, Facebook's decision give more granular permissions, but to make it an all or nothing proposition allows them to protect their users by removing spammy/malicious apps, and simplifies the applications built on their platform . This puts responsibility on them to actively remove malicious applications, and on developers to pick only the permissions they need. Given that users tend to make bad decisions given a set of complex options that they don't understand, it seems like they made a rational choice. AppStores on the various phone platforms have a similar decision to make as to how to best protect users from apps, and there isn't consensus as to the best model in that arena either.

They do need to step up their activity to remove malicious apps in light of giving regular applications this option.

nhangen6• 16 years ago

Just because it is difficult in practice does not make it any less important. That sounds like a Facebook problem more than a user problem.

gergles2• 16 years ago

"Remove malicious apps" doesn't undo the damage they caused. A reactionary approach only works until the first gigantic breach occurs, at which point people will finally start to ask "why do I have to give ShittyGame every permission under the sun?"

It's the same on Android. Why do I have to give any app that wants to display ads in my face permission to read my phone number and device serial number? Hell, on some carriers that's all you need to clone the phone and steal service from it. What possible reason could there be for that? It's poor design, and there's no reason I need to give "Bob's Fun Game" my telephone number just so it can have a unique ID to datamine later. Generate one on startup and use that.

The problems are similar and the solutions are similar - line-item veto for permissions, period. If your app can't handle it, crash - I'd rather have a broken app than risk my privacy for it.

JasonPunyon• 16 years ago

Just in case anyone else is wondering...

http://webapps.stackexchange.com/questions/1/how-do-i-delete...

mobileed• 16 years ago

No, Facebook doesn't share this information - you do! Let's be clear here. Those who are dumb enough to put their PII data on Facebook and the alike are sharing their information. My God, can we stop blaming someone else for our stupidity?

jarek2• 16 years ago

Facebook is in a weird middle spot between totally public and totally private. You log in, and you primarily interact with friends, but then a friend can allow an application to programmatically access your data... People have problems parsing the situation. Further, Facebook used to be much more private, and the constant adjustment of goalposts doesn't help.

tlack2• 16 years ago

I wonder if Facebook developed this functionality to aide companies bringing their ecommerce efforts directly onto Facebook (as Amazon and hundreds of others are now doing).

joe_the_user• 16 years ago

As I recall, Facebook still won't let the app/script that I run myself save the email addresses of my friends that they choose to share with me (I can manually save each shared email-address of each friend of my hundred friends but the terms of service prohibit any bulk downloading of this information).

So the assumption is that I, as a user, am naturally more willing to share my contact information with anonymous application X than I am with my friends.

Naturally, this is indeed a transparent effort at lock-in.

celticjames• 16 years ago

You know who else shares my phone number and address? The phone book!

Flenser• 16 years ago

You know who else shares my phone number and address? The phone book!

but the phone book doesn't call up the websites you visit to tell them that it's you that's visiting them. It's not about the specific information being available; it's about the context it's available in and what other information it could be connected to.

jarek2• 16 years ago

And you can opt out of being in a phone book while continuing to use your phone.

Not to mention phone books have been sliding down a steep slope of irrelevancy for the past 10 or 15 years as cell phones increased in popularity.

itsnotvalid• 16 years ago

So from now on, we need to remove two more items from our profile.

Well, as long as we are not allowed to partially denie permission requests (which of course would make certain apps not able to share our information to other third parties)

samic• 16 years ago

there is always a problem with facebook! I can't trust them ever!

rwwmike4• 16 years ago

Here's the follow-up story...

http://www.readwriteweb.com/archives/facebook_identity_the_c...

shankx• 16 years ago

When somebody knocks at your door, peep through the peephole first. It might be some stalker who got your address from an app.

pasbesoin• 16 years ago

I commented on this already in another thread that I saw first. My apology for bending the rules, just this once, by posting the same comment a second time in this active thread to make the point:

I'm sure my relative would appreciate her abusive ex getting his hands on her phone number. (And given past problems with third parties, I have to think this information -- speaking generally if not specifically -- is going to leak.)

You use the cell phone number as part of password recovery / identity verification (as I understand it). And then you do this?

Facebook Now Shares Phone Number & Address With Third-Party Apps

Related Stories