Why do HN commenters have so much Facebook Connect angst?

https://news.ycombinator.com/item?id=3043201

by bretpiatt • 15 years ago

24 23 15 years ago

news.ycombinator.com

Every article that mentions a company tying their authentication to Facebook Connect unleashes a horde of people saying "I'm going to cancel my account", or "this is the worst idea for their business ever" ..

Why is having a central authentication system a bad idea? How many times have we seen articles where companies are storing information (password included) in plain text or a weak cipher? How much developer time is wasted rebuilding authentication systems? How much user productivity is lost trying to remember passwords if they use different ones (or lost managing things through a tool like 1password)? How many security breaches are caused because people use the same password across many sites?

Facebook Connect is a good thing. I understand that the data mining and privacy concerns. These concerns aren't real, not because Facebook isn't collecting information but because everyone is collecting information so any privacy you have left is an illusion of privacy, not actual privacy.

sp332• 15 years ago

You've got a good point about the false sense of security. But the main problem is that Faceobook makes it too easy to make information public and too hard to manage my view into that information. If I could see and edit the info Facebook makes available to other people, I would be much more comfortable.

Also, I feel like Facebook isn't just storing my info, but is actively trying to get me to add more info. I feel like I'm being milked for personal information.

danmaz742• 15 years ago

Try to see this from a developer's perspective. If Facebook becomes the de facto standard for internet authentication and the de facto standard platform for every service, developers' freedom will be much diminished. And there are many developers (and entrepreneurs) here.

bretpiatt3• 15 years ago

Do you have some examples of how companies have differentiated on authentication that led to their success? For each of those how many have failed due to lost time trying to build an authentication system or due to a breach caused by building one with a flaw in it?

hack_edu• 15 years ago

What about some examples where requiring authentication led to measurable market success at all?

danmaz742• 15 years ago

Authentication might seem a trivial matter, but it isn't. If you use facebook connect, your users are actually facebook's users. Facebook knows how many times they used your service, when, and so on. And, most importantly of all, you are locked in into facebook's service.

What if one day FB starts to push more and more FB connect applications to become FB apps? How much leverage would they have?

As a counter example, I use google analytics on my websites. This means that google knows everything about my stats. But if I stop trusting them, for any reason, it would take just 5 minutes to change. This doesn't give any leverage on me. Contrast this to using FB connect - or the google equivalent, for that matter.

That's what makes many independent developers scared of this kind of news... that being assimilated by FB could one day become inevitable.

throwaway32• 15 years ago

"These concerns aren't real, not because Facebook isn't collecting information but because everyone is collecting information"

So Facebook isn't acting counter to your interests because everyone is acting counter to your interests?

lemming• 15 years ago

This is mostly a concern for me because I choose not to use Facebook, so I won't be using any business relying on Facebook Connect. Most of my reasons for not using Facebook (aggressive data collection and being pretty open about milking it for their own ends) are even more worrying when applied to an auth system.

johnthedebs2• 15 years ago

These concerns aren't real...any privacy you have left is an illusion of privacy, not actual privacy.

This is Wrong. Our privacy is only actually gone when we consciously decide to give it away, or throw our hands up and say "oh well, there's nothing we can do".

Facebook Connect isn't bad in and of itself, and neither is central authentication. But a lot of people understandably don't trust Facebook to manage their identity for them and would prefer to manage it themselves.

It's still perfectly possible to maintain reasonable privacy on the web, and any site or product that doesn't at least give me the option of doing so isn't a site or product I'm interested in using.

bretpiatt3• 15 years ago

What do you consider reasonable privacy? This doesn't just apply to the web.

Do you use a credit card to pay for things or do you always use cash? Your purchasing behavior is being collected and tracked. Do you have a loan for anything? Your income, address, and your ability to pay on time is tracked. If you always pay cash and avoid having loans or anything you need to manage your credit history for, you are part of a small paranoid minority.

On the web.. do you log on from an Internet access account that is yours or are you always using public wi-fi? If you log on from your own account your ISP is tracking where you visit. Do you use Google or Bing for search or DDG? Your behavior is being tracked there already. If you never search with Google or Bing you're part of a small paranoid minority.

Even if you choose to not participate in information sharing with any of the products you use it is being gathered anyways by the semi-static data you share just by being online. This includes if you browse with cookies turned off -- if they're on forget about it, any privacy you have is a complete illusion.

Do you carry a cellphone? Do you run around with GPS turned on? Your carrier is already collecting this information. If you avoid this behavior you're part of a small paranoid minority.

Privacy is an illusion. This isn't a bad thing. It is good as it allows services to tailor their interactions with you to improve your experience. Time to welcome the benefits of sharing .. what do you have to hide?

seabee2• 15 years ago

"What do you have to hide" is the most naive and/or disingenuous rebuttal ever seen in a privacy discussion.

"What do you have to fear" is a more honest one. As it turns out, there are plenty of malicious actors you have to fear. Private investigators or fraudsters blagging private records. Identity theft. Embarrassing details coming out you'd rather your family didn't see.

But since you have nothing to hide, why not tell me your contact details, your bank details? If you refuse then I think we have established that some things should be kept under control rather than wantonly shared.

zheng• 15 years ago

My credit card company can not legally sell my purchasing history to the highest bidder.[1]

Google can not tracking my searching if I am connected via a public proxy (very common, in fact)

Most people don't have smartphones, and most don't leave the GPS on.

I'm willing to guess that taking the union of all of your "small paranoid minorities" gives a pretty large minority, in fact.

---

[1] http://www.federalreserve.gov/bankinforeg/regpcg.htm

johnthedebs2• 15 years ago

As seabee said, "'What do you have to hide' is the most naive and/or disingenuous rebuttal ever seen in a privacy discussion."

But to respond to your first point, I consider reasonable privacy to mean, very simply, that I understand the consequences of whatever action I take (because they are made up front and clear) and that I have choices in controlling the flow of my personal information (because options are available).

Whether I choose to be in the "small paranoid minority" is my own decision and I should have the freedom to make it.

abyssknight• 15 years ago

I'll just leave this here. Just replace the name Google with Facebook.

http://www.securitytube.net/video/1084

hsmyers• 15 years ago

No particular angst, but I do recognize a personal dichotomy. Like many others I react to Facebook changes with initial distrust and sometimes anger but---then I remember that there is nothing there that I did not put there or that my small circle of friends put there. So I back up and re-think my reaction and mostly conclude that it is mostly not 'what', but 'how' that bothers me. No one would ever accuse Facebook (or its leader) of being tactful but then so what? That in of itself is nothing to get wrapped around the axle about. It still bothers me just not the way that it seems to bother others...

gyardley• 15 years ago

It's because that certain subset of HN commenters are exactly the wrong audience for Facebook Connect. They value privacy over convenience, while Facebook Connect values convenience over privacy.

Not every product is for everybody.

The angst is probably magnified a bit by the awareness that they're the minority view. When dominant values are different from your own, it makes you uncomfy.

geoffw8• 15 years ago

put very well indeed

pragmatic• 15 years ago

This has to be a trolling attempt.

"...any privacy you have is a complete illusion" "what do you have to hide?"

Please people, don't feed the trolls.

rufo• 15 years ago

For me, the problem is that Facebook constantly wants me to overshare, and I feel like I constantly need to pull back. It's never just "authenticate with Facebook", it's "Authenticate with Facebook, give the app 30 different ways to violate my privacy, then make a bee-line for the App Settings panel to turn off all the permissions I'd rather not use".

cmoscoso• 15 years ago

I just dont trust them anymore. FWIW, I'm ok with using Twitter as a central authentication system.

Terretta• 15 years ago

Why is having a central authentication system a bad idea?

Because you give central control to a central authority.

How many security breaches are caused because people use the same password across many sites?

Note that a single login to all sites is the same problem as a single password to all the sites. If the password is compromised, all the sites are compromised.

Facebook Connect is a good thing.

That conclusion doesn't follow from your remarks.

You choose to focus on two objections that are both false objections: that we have a choice between only a central auth system or many weak auth systems, and that we've lost all privacy anyway.

I believe the cost of central control over all online activity is higher than the cost of developers learning and implementing strong personally controlled authentication and the cost of educating users what history shows us about ceding too much privacy and autonomy.

I worry that Facebook Connect is an actively "bad" thing. I think a good thing would be for OS X Keychain or 1Password style tools to be built into browsers or operating systems to give master key + random auth key functionality to every user with users controlling their own online credentials.

It bears repeating:

Why is having a central authentication system a bad idea?

Because you give central control to a central authority.

Why do HN commenters have so much Facebook Connect angst?

Related Stories