13

I'm sick of Google and want to change my openID, so since I can't sign up for the Stack Exchange OpenID, I figured I'd use the Facebook one. Then after signing in, it gives me this message before letting me through (note: imgur wouldn't load this):

imgur broken http://img641.imageshack.us/img641/5981/facebookxl.png

So the question is why does Stack Exchange want my friends list? I always turn down Facebooks apps that ask for that, do we really need to suck out that much informaation?

Note: I already know that it's all public in some way, and the rest of the info I've allowed to be public, but there's no reason to grab for Facebook to share that list.

Improve this question
5
  • 13
    You're sick of Google and thinking about changing to Facebook? That seems like out of the frying pan and into the fire to me...
    – Cody Gray
    Commented Aug 2, 2011 at 6:36
  • 2
    @Cody, yeh, not really any better, my main problems with Google is their non-existent customer support, and not taking input on bugs, which isn't any different on Facebook. I finally just went with the last option, Yahoo.
    – Lance Roberts
    Commented Aug 2, 2011 at 15:33
  • 1
    I reached a similar point and went down the OpenID route on my own. Now I get to log into stackexchange (and other OpenID consumers) using a hardware crypto token wherever I am. How awesomely nerdy is that?
    – Flexo - Save the data dump
    Commented Aug 27, 2011 at 18:01
  • @Flexo very....
    – Cole Tobin
    Commented Aug 21, 2013 at 15:26
  • @CodyGray: more like out of the frying pan and into the volcano.
    – WGroleau
    Commented May 18, 2015 at 10:51

3 Answers 3

Reset to default
23

I have a feeling this is because Facebook's "basic information" permission includes the friends list, among other general things such as name, profile picture, etc. Stack Exchange probably doesn't access your friends list at all, but that's just what is shown in the permission request.

Improve this answer
4
  • you don't think the info they send Facebook could exclude it?
    – Lance Roberts
    Commented Aug 2, 2011 at 4:57
  • 7
    I took a look at Facebook's "Apps on Facebook" page, and it seems to me if a program wants to "Access [your] basic information", it automatically has access to all the things on that list.
    – Kevin Yap
    Commented Aug 2, 2011 at 5:03
  • 10
    I now have new level of disrespect for Facebook, thanks for the info.
    – Lance Roberts
    Commented Aug 2, 2011 at 5:06
  • 1
    @Lance This also is pretty suspect when you consider if any of your friends sign into third party sites using their facebook account
    – davidsleeps
    Commented Aug 2, 2011 at 5:27
13

Just confirming, Kevin & Michael are correct.

There is no way to not ask for those permissions when authenticating against Facebook. The full permission list is here, of note is the description of the read_friendlists permission.

Provides access to any friend lists the user created. All user's friends are provided as part of basic data, this extended permission grants access to the lists of friends a user has created, and should only be requested if your application utilizes lists of friends.

We do ask for the extra permission email, but only for identification purposes. All emails remain opt-in, even if logging in via Facebook.

We also discard the authentication token after login is complete. You can verify this by checking the last time the Stack Exchange app accessed your information in your Facebook application settings (wherever they've moved that to this week). It will always correspond with when you last clicked the Facebook button on /users/login.

Our app analytics also show the 1 user login -> 1 api call relationship.

enter image description here

Improve this answer
1
  • Thank you for your transparency!
    – dreamflasher
    Commented Jan 10, 2015 at 10:03
10

"Access my basic information" is the default permission requested by Facebook apps, since (as you said) it's public info. From the authentication documentation:

By default, the user is asked to authorize the app to access basic information that is available publicly or by default on Facebook. If your app needs more than this basic information to function, you must request specific permissions from the user.

I don't think there's a way to not request that permission; Facebook's examples just show adding additional permissions

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .