[tjogin]

Seriously, what kind of consequences are you afraid of when logging in with your Facebook account?

Have you looked at the Facebook API? I've produced a website where you can either create a "normal" account by supplying your email address, or you can use Facebook Connect.

What I know about our users with "normal" accounts: their name and their email address.

What I know about our users with Facebook connect accounts: their name. No email and no means by which to contact them. And if I wanted to do anything else, like post on their wall, I'd have to ask them explicit permission first.

[andrewcooke]

personally, i avoid places that require a facebook login because i want to avoid lock-in. this isn't such a great example, because i doubt i would care about long term access to random strangers, but in general i want to be able to have access to sites without having to keep using facebook. this is just a simple issue of access control - there's little advantage to me, and a big advantage to facebook, if they control my access to important services.

second, i am starting to be concerned about the ease with which private data on me can be pooled in one place. i have a consistent public persona on the internet (i am usually the no 1 hit on searching for my name, for example), and i am fine with that. however, in the past that has not included private conversations with other people. google (gmail) and facebook are changing that, and starting to exploit access to data i have previously considered private. so i am worrying about how to reduce the likelihood that this private data can be abused. one way is to reduce the amount of data out there (so i have stopped using gmail). another is to keep data isolated, which leads to me not wanting to use facebook logins ubiquitously (note that isolation works for private data, even as public data becomes more unified, as it cannot be pooled by a third party). i am not saying that there is any current danger in you providing data to facebook, but i think there is a clear risk that things could progress in that direction (for example, in the future they might provide libraries/services that help with whatever your site does; that may lead to them managing data, and that data will be associated with a single identity).

[before anyone points out that email is not private, the distinction i am making here is a practical and graded one. no single email is private, but the entire corpus is unlikely to be public knowledge]

[eam]

I believe he's referring to privacy concerns.

[tjogin]

Right, and I'm wondering which ones.

My view of the Facebook API is that it isn't exactly a gold mine of personal information. I'm wondering what part of it is it that freaks people out.

[saytheobvious]

You are sorely mistaken. With the Facebook API, you're granted CIA level information on any person that allows you (most). I should know, I've been using the api for games and other apps since its inception. As for privacy, I'm convinced people can afford to give some up, in exchange for more civility, if that's what they want. If not, they can continue to enjoy the Smörgåsbord over at CR.

[tjogin]

I'd love to just take your word for it, but for the sake of the discussion, would you please expand a bit on what "CIA level" information you can retrieve using the Facebook API?

To begin with, what can you find out about a person after they've logged in with Facebook Connect, without explicitly asking for additional permissions?

[saytheobvious]

To start with: http://wiki.developers.facebook.com/index.php/User_(FQL)

If that isn't everything you need, you could use that information as foreign keys to other databases in other places, to easily fill in the blanks, if you wished to dampen the shade of your hat. As far as "CIA level", I'll admit that was sensationalist just for the sake of writing, but it is damn scary nonetheless.

[tjogin]

Right. But, if you are sensitive to privacy issues (which seems sound), you're not likely to have an exhaustively filled out Facebook profile either way.

So, if you have a sparingly filled out Facebook profile, what is the risk involved using Facebook Connect?

That API list kind of looks like a CIA-like dossier of information, I agree, but that's worth nothing if the values are mostly: "", drivel, some inside joke, or whatever.