I'm sick of Google and want to change my openID, so since I can't sign up for the Stack Exchange OpenID, I figured I'd use the Facebook one. Then after signing in, it gives me this message before letting me through (note: imgur wouldn't load this):

imgur broken

So the question is why does Stack Exchange want my friends list? I always turn down Facebooks apps that ask for that, do we really need to suck out that much informaation?

Note: I already know that it's all public in some way, and the rest of the info I've allowed to be public, but there's no reason to grab for Facebook to share that list.

share|improve this question
13  
You're sick of Google and thinking about changing to Facebook? That seems like out of the frying pan and into the fire to me... –  Cody Gray Aug 2 '11 at 6:36
2  
@Cody, yeh, not really any better, my main problems with Google is their non-existent customer support, and not taking input on bugs, which isn't any different on Facebook. I finally just went with the last option, Yahoo. –  Lance Roberts Aug 2 '11 at 15:33
1  
I reached a similar point and went down the OpenID route on my own. Now I get to log into stackexchange (and other OpenID consumers) using a hardware crypto token wherever I am. How awesomely nerdy is that? –  Flexo Aug 27 '11 at 18:01
    
@Flexo very.... –  Cole Johnson Aug 21 '13 at 15:26
add comment

3 Answers

up vote 23 down vote accepted

I have a feeling this is because Facebook's "basic information" permission includes the friends list, among other general things such as name, profile picture, etc. Stack Exchange probably doesn't access your friends list at all, but that's just what is shown in the permission request.

share|improve this answer
    
you don't think the info they send Facebook could exclude it? –  Lance Roberts Aug 2 '11 at 4:57
7  
I took a look at Facebook's "Apps on Facebook" page, and it seems to me if a program wants to "Access [your] basic information", it automatically has access to all the things on that list. –  Kevin Y Aug 2 '11 at 5:03
10  
I now have new level of disrespect for Facebook, thanks for the info. –  Lance Roberts Aug 2 '11 at 5:06
1  
@Lance This also is pretty suspect when you consider if any of your friends sign into third party sites using their facebook account –  davidsleeps Aug 2 '11 at 5:27
add comment

"Access my basic information" is the default permission requested by Facebook apps, since (as you said) it's public info. From the authentication documentation:

By default, the user is asked to authorize the app to access basic information that is available publicly or by default on Facebook. If your app needs more than this basic information to function, you must request specific permissions from the user.

I don't think there's a way to not request that permission; Facebook's examples just show adding additional permissions

share|improve this answer
add comment

Just confirming, Kevin & Michael are correct.

There is no way to not ask for those permissions when authenticating against Facebook. The full permission list is here, of note is the description of the read_friendlists permission.

Provides access to any friend lists the user created. All user's friends are provided as part of basic data, this extended permission grants access to the lists of friends a user has created, and should only be requested if your application utilizes lists of friends.

We do ask for the extra permission email, but only for identification purposes. All emails remain opt-in, even if logging in via Facebook.

We also discard the authentication token after login is complete. You can verify this by checking the last time the Stack Exchange app accessed your information in your Facebook application settings (wherever they've moved that to this week). It will always correspond with when you last clicked the Facebook button on /users/login.

Our app analytics also show the 1 user login -> 1 api call relationship.

enter image description here

share|improve this answer
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .