Facebook Removes Firewall from Applications

NewsCloud writes "Last week, Facebook quietly removed sign-in restrictions that previously hid third party applications from the public Web. In other words, Facebook now allows its third party applications to be viewable on the Web by anonymous visitors and indexable by search engines. Web developers can now build an application using Facebook's platform usable by anyone on the Internet — not just Facebook members (e.g. the Lending Library). In doing so, developers can leverage Facebook's login and registration as well its other platform services, which are becoming increasingly substantial. Facebook may be trying to gain advantage as a universal authentication gateway for public Web applications. If successful, it could further hamper efforts to establish OpenID. This will also help the company break out of its earlier AOL-like walled-garden strategy."

Security implications.

[palegray.net]

To hell with the analogy to AOL's "walled garden", I envision some more akin to a burning garden if a major security incident were to occur after widespread adoption of this platform for single-signon functionality. This is the same reason I have always been opposed to Microsoft's ambitions for using their Passport system for wide authentication; my objections had very little to do with my political opinion of Microsoft (which isn't terribly high, but that's beside the point). Diversity in any system is good for competition, and limits the damage any one exploit can cause.

Security of applications

[Rinisari]

Does this strategy protect the Facebook users' data from being seen by non-Facebook users at the Facebook API level? By this, I mean that Joe Internet User cannot see my data on the Facebook application, and that Facebook is held liable for this, not the application developer? If this cannot be guaranteed, it looks like I might be removing most of my applications, no matter how useful they may be. I trust Facebook a whole lot more than I trust individual people.

Re:Security of applications

[mozumder]

Applications see people (and their data) that approve the applications.

So, if a person approves an application, then that application can go ahead and broadcast to the world that person's data.

how many of you...

[mathfeel]

like me, started using facebook because it's a walled-garden with well segregated networks? I mean, I don't want to pervert457 or randomperson223 to be able to view my profile, or try to flood my inbox (or wall, I suppose). Maybe I am mis-informed, but that's how I perceive MySpace from a lot of media reports including here on /.. Now-a-day, facebook seems to become exceeding bloated with random apps. I just want to check what's up with my friend and his profile takes eons to load (partly his fault of course). I also start to notice that my "notification" are filled with (non-deleteable) items for ads (just saw a Blockbuster one).

Oh yeah, and this is hilarious...youtube video [youtube.com]

Re:how many of you...

[maxume]

I didn't start using either of them(mostly because I'm too old to have started during school and haven't had other reason). It's getting to be pretty clear that published means just that, regardless of any promises that are made. This is an irritating lesson to learn, but it provides an easy to use guideline.

What is everyone talking about???

[DeionXxX]

This announcement is for APPLICATIONS. No one is going to see YOUR PROFILE! This allows people without facebook login's to see APPLICATIONS, not read your profile. If they want to use those APPLICATIONS, they will have to sign up. Even if they had a facebook profile, they still couldn't see your profile.

Ohh and another thing. Potential employers can't see your profile unless they submit a "friend request" and you accept them. So there's no issue with anyone searching google and finding your profile.

Re:Facebook...

[quintessentialk]

On the other hand, the sort of personal disclosure we see on facebook may grow into a cultural, society-wide phenomenon. Presumably most people are concerned about information disclosure because of consequences of that disclosure. If there are few consequences, how many people will care? Sure, the HR director who hired me probably looked for my facebook page. But I came across his facebook page entirely by accident, and his is way more revealing of his personal life than mine is. Once the college students of today rise to power, I think personal internet disclosure will be more socially acceptable.

OpenID doesn't need facebook to fail

[coryking]

OpenID is an overly complex protocol that requires a bazillion interdependencies to work right. Worse, it doesn't actually solve the pain. It doesn't solve the trust problem! People want an authentication protocol that has trust. Random URL's are not trust!

Yeah, I hear you saying "Cory, OpenID isn't about trust". Well than whoopty fucking doo, go away and stop wasting my time. If I cannot have trust, what the hell is the point of OpenID?

And seriously? URL's as your unique login? What the fucking hell is that all about? 1) URLs are ugly. 2) Mom & Dad dont understand them 3) URLS!?!?

And a bonus seriously. Having the whole mess ride on top of HTTP as a friggen space age XML-RPC-SOAP-REST thing? Pick something more mature? Why not at least try to sink it down into the HTTP protocol itself? Maybe even invent a new protocol. But layering it on top of an XML RPC protocol on top of HTTP on top of TCP/IP? Are you insane?

How will this whole damn thing integrate into SMTP or IMAP - will postfix need to learn OpenID and open itself to all kinds of web base security risks? How will I use this to log into SecondLife or World of Warcraft? Do they now have to write a gog damn web stack to authenticate against OpenID? How can it integrate into LDAP or active directory?

And NONE OF THIS IS EVEN SOMETHING YOU CAN TRUST! It is all worthless!!!

OpenID does not need facebook for it to fail. OpenID will fail because it is complex, hard to explain, doesn't play with other protocols, difficult to implement, and it is misunderstood by managers, developers, sysadmins, and security experts.

a-holes

[ImTheDarkcyde]

Im going to go ahead and be a troll here, so you might just want to skip this comment-

Fuck anything that throws "open" in front of the name. Fuck openID. Do you want a goddamn pat on the back because you are "open?" On top of that people of slashdot are adamantly against Real ID, which is the same thing to my uneducated eyes, except for in the real world, but hey isn't giving your single password away nowadays the same thing as handing over your social security number, bank accounts, search history, et cetera?

Comment removed

[account_deleted]

Comment removed based on user account deletion