That's amoral bullshit and we must demand better. It should be expected that that connecting accounts means sharing little more than the subset of data required for the integration. Companies that violation this expectation must face consequences.

GDPR takes a step in this direction, prohibiting retention of PII for longer than necessary for business purposes.

> That's amoral bullshit and we must demand better.

Why is this amoral bullshit? It seems like a lot of the outrage around this topic is born out of a 'feeling' that you have an instrinsic right to online privacy. But, I don't see this right clearly defined in the constitution, so where does it come from? Are you sure it exists?

> It should be expected that that connecting accounts means sharing little more than the subset of data required for the integration.

I think it's unrealistic to expect FB to expend resources to determine what subset of data is 'required' for every app in its ecosystem. When inspecting the utility/privacy frontier, the current model of requiring users to grant permission to an app makes the most sense to me. The problem in this case is that the permissions modal may not have been clear enough.

These rights have routinely been taken from people with or without their consent throughout history.

EDIT: What I mean to say is having it spelled out can only help, and if we cannot make an argument based on existing legal constructs we might need to spell it out.

When it's not defined by law, it's up for debate. And, my main point is that in such a scenario, I don't think calls for moral condemnation are in order.

In outrage scandals like this, we're so quick to condemn the actor and demand punishment. I think the more constructive action is to condemn the action (not the actor) and demand regulation (not punishment). Condemning the actor may quench our thirst for justice, but I think it's often net harmful.

I get that calling for punishment is a good disincentive for future immoral, unregulated activity, but the punishment has to fit the bill. FB lost, what, $30B of value over this 'scandal'. Is that not a big enough fine?

Isn't that like when a rich/famous person evades punishment for a crime that the average person would get a long jail sentence for, because from loss of income etc they'd already got 'a big enough fine'? i.e. effectively only the non-rich are punished for crimes.

Requiring permissions is a good step, but an auditable history would be a huge gain for users world-wide.

In other words, I would like to make an api call or visit a facebook page and see what data was requested by and sent to every third party with which I have shared data. I could then use that data to see if I'm comfortable sharing that information. Automation could also be undertaken by facebook to weed out obviously malicious actors.

Because

> But, I don't see this right clearly defined in the constitution, so where does it come from? Are you sure it exists?

It comes from morality. Some people think it's immoral to defraud people, whether that is money or their private information.

Some people don't want to live in immoral societies and want the government to enforce some level of moral behaviour amongst it's subjects.

> I think it's unrealistic to expect FB to expend resources to determine what subset of data is 'required' for every app in its ecosystem.

How? They have billions in profits and are in the process of hiring thousands of people to help get their news curation/reporting systems upto scratch. Why can't they setup a process where people have to justify to facebook what they would use the data for?

I could easily argue it would have been in their financial interest as it's quite possible we wouldn't be here talking about facebook if they had taken this approach.

But no, im supposed to believe it's unrealistic to have such simple process.

I don't understand why netflix gets to see all your DM's when all you want the connection to do is send a message to a person you choose. The connection doesn't need to give netflix literally any data besides maybe the fact that a message was sent. why do they need to know who it was too, and any other messages surrounding it?

I am about to change my mind on the GDPR. If Spotify and Netflix are legally obligated to not store any data they do not need, then Facebook can actually make an additional argument that it is ok to give them wider access; after all, the law will ensure they have to handle it properly.

That seems like a huge perverse incentive. Companies will start constructing systems so that more data is "required" so they can legally collect and share more of it. Then convincing them to collect less would require not just convincing them not to collect the data but convincing them to undergo the expense of redesigning all their systems to not "require" it anymore.

This is exactly what companies do. They decide what data they want, and then set out to find a way that each of those data elements is necessary.

It's absolutely nothing like your Thunderbird analogy because Thunderbird exists to present you email but Spotify has absolutely nothing to do with messaging.

Facebook should have given Spotify the bare minimum they needed to make me an account and play me music. Anything else is gross incompetence at best.

And how did you think they were monetizing in the first place? When I read all the outrage here, it’s almost like I’m reading comments from an alternate universe where nobody knew Facebook’s business model. On top of that, I find it even more amusing that lawmakers are up in arms over this, when they were the ones who passed the Patriot Act in the first place, destroying the Bill of Rights and desecrating the Constitution.

I might also expect Facebook to ask the services for some money to get their faces seen on the platform.

Is that hopelessly naive?

I think this is a common belief in Silicon Valley. It is not elsewhere. This, in a crux, is why decision-making power is being—and needs to be—removed from the former.

I agree that few are behaving in a downright evil manner. (At least according to their own compasses.) But there has been moral drift around when permission needs to be asked, how it needs to be asked, and the degree to which business leaders have a duty to safeguarding their customers’ interests. The same thing happened in the trust-busting era; it’s interesting to see it happen again.

1) Runs on my own machine, not on somebody else's servers.

2) Is FLOSS so it's actually possible to verify what it's doing.

I think there's a fair debate to be had about what data should be shared when users volunteer to "connect" accounts, but this Thunderbird analogy is horrendously off base.

But everyone doesn't, and lawmakers are, on a good day, when doing their jobs, more concerned with reality than idealism.

Or at least, they "should" be :)

This is an argument you have to make, but you're just asserting it. If I get pulled over for speeding, I have to show my driver's license, which I also used to open my bank account, which I use to pay my phone bill, which I use to call my mother on her phone, which she pays for out of her bank account, which she used her driver's license to open, which she had to show to get past the security desk at a building downtown to go to a job interview with a business that rents a space there.

Are you saying that I should expect that interviewer to have access to my driving record? If not, to what degree should it be "fairly clear" to me that there is information shared, and why?

OK, now pretend that I used facebook login to periodically read articles about selling fishing gear, at the website for a membership trade organization for fishing gear merchants that I belong to. I set it up (with two clicks) because I was sick of typing my membership number in on the rare occasion I visit the site. It's like 12 digits, and it's like not I keep my membership card in my wallet; I only need it for conventions...

No that's not at all equivalent. If Hotmail were my only email provider, me and hotmail are the only ones who have access to my inbox regardless of what email client or clients I choose to use. That's not "connecting accounts." Thunderbird is not a company. What an absurd statement to make.

>"If should be fairly clear to anyone that if you connect accounts you are exposing data between the accounts."

Except that we don't actually know if FB only gave access to people who had accounts with both FB and the specific third party. Nor do we know who the third parties exposed that data to. FB has very problematic relationship with truth and transparency in general. Nothing should be "fairly clear to anyone" about FB.

>"The debate about the granularity of permissions is neither here nor there ..."

Saying something is "neither here nor there" is a meaningless platitude.

FB is sneaky and does not have the culture of valuing users' privacy. It is going to catch up with them eventually.

I don't think there is a "right" answer here that solves all of the problems.

For example, should FB be required to explain to my technically illiterate Aunt how images and text are used to train feature classifiers, which inform the social graph?

its actually just gotten incrementally worse..