If I connect my Facebook to my Spotify so that I can log in with one account and maybe share music with friends, I don't expect Spotify to have access to my private messages.
Obviously context is important, but I'm not seeing the double standard.
What’s more, users explicitly opted in, giving Spotify permission to do so. [1] No reasonable person would use Spotify to send and receive messages after explicitly granting the client permissions and then claim “but I don’t expect Spotify to have access to my private messages”
[1] - https://stackoverflow.com/questions/17561784/django-social-a...
Of course as a technician with knowledge of how OAuth and web APIs work, the implication that it really needs access to all messages seems a lot more reasonable - but I don't think this view is necessarily valid in a larger context.
Implementing more fine-grained permissions is absolutely possible. See e.g. Telegram: Even though Telegram bots appear as mostly ordinary users, they by default cannot access the messages of the channels they joined - they can only access commands that users were explicitly sending to them. You need a special permission to have a bot actually be able to access a channel like a human user would.
Or is your claim that you gave only permission for profile and friends but the Spotify client had messaging permission as well?
I disagree. I have perused various trials for Spotify and other services over the years and never once had to resort to using a Federated ID/login.
Which they have been shown to about a dozen times over this month.
1) if you use their Messenger app plugin
2) if you had connected to Messenger through Spotify's desktop app. I believe this feature has been deprecated for a few years now, though.
Even if you sign up for Spotify using your Facebook account or connect your Facebook account to Spotify that does not give them access to your Messenger messages. It is my understanding that it required the user to opt into specifically connecting Messenger for that circumstance to occur.
If I download a calculator, it has no business reading location, call logs, messages, contacts, full filesystem. That would make me outraged, even if I did technically click through permissions.
FB never did anything but being at the right place at the right time and were pretty nefarious from the very start. If any innovation can be claimed to have come out of FB, it's new ways of large scale psychological manipulation.
I suspect it's the memory of those early Google years that make some more lenient towards Google, although at this point, they really shouldn't be.
Facebook has had to pull off their own feats of engineering. It is a fact whether you like their product or not.
I work for FB. I am leaving for my own personal reasons. It is not a perfect company. Your comment, however, is wrong and I am calling it out as such.
Because as things appear, FB was a myspace for grown-ups at a time when there was a need for such a service, that is, the right time and the right place, and technology-wise there was nothing extraordinary about the service itself.
> It is a fact whether you like their product or not.
I like their product just fine. I just wish more of them held their privacy in higher regard.
Maybe there's a daily cycle of various worldviews prevailing in the comments―I guess here's a toy project for data scientists.
It's interesting to see the difference in attitude on HN towards Google and Facebook. Many readers on HN shared the media's outcry when it was "revealed" that Netflix and Spotify were given read/write access to users' messages if they had authorized those Messenger plugins/platforms. I'm not attacking your position--I wholeheartedly agree with it--it just seems like there's a double standard on HN when it comes to certain tech companies.