Hacker News Reader

Comment by Kpourdeilami | Hacker News Reader

Didn’t the third party collect data after users gave explicit permission to the third party app to use their data? From my understanding, users didn’t read the short text explaining the information the third party would receive before pressing the “okay” button.

View on HN

Users gave the app permission. The app also harvested the data of their Facebook Friends, who hadn't given permission.

They should take a lesson from the spotify API, friend listening feeds are out of reach for third party apps.

Since facebook apps request these fields so much, they could implement it as an opt-in/out checkbox "Do you want your data to be accessible by 3rd party apps without your consent through your friends?"

This way, if an app request friends access, they would get data only from the ones that allowed it.

It probably would remove a lot of value that can be extracted from their users, but facebook itself would still have all this data to use internally to target ads and they would limit the amount of data that can be exfiltrated to malicious 3rd parties without the consent of users.

Facebook already made this change; however, they changed these things after the data was fetched and stored.

Thanks for the info, I was not aware of that.

Good for them to make this change, bad for them because it was after the data was collected for abuse.

I think the takeaway is that these decisions are irreversible; it's very hard to recall data you've shared, so you need to err on the side of sharing less.

Fortunately, having sane data protection laws gives you things like being able to rescind an agreement like that at any time. Then the party that collects the data has to inform any third parties of the change and all of them have to delete your data.

Reply on news.ycombinator.com