155 comments

[ 2.2 ms ] story [ 17.3 ms ] thread
(comment deleted)
An unexpected downside of oAuth rears its ugly head.
I mean the loss of trust in the provider is an obvious downside of centralized authentication right?

The “unexpected” part is the loss of trust in Facebook as a provider.

I would argue trusting Facebook with anything was obviously going to end in tears but I admit I’m not a normal user.

Agree, the problem in regards to spotify is that for a while spotify required facebook for new accounts.

The disconnect that led to that decision is absolutely mind blowing. To make it even more surreal lots of people, even on HN, defended it.

Yeah I just didn’t use Spotify until I could sign up with email. It kind of surprised me they were able to gain as much traction as they did with what I viewed as a user-hostile action right at signup.
Spotify activity in the early days was super prominent in the Facebook activity feed and that weird mini feed they used to have. So I think they probably got more new customers from that angle as they might have lost from the login limitation.
You can always provide a way for the user to convert oAuth accounts into your own system. No idea why Spotify hasn't done already, this problem has existed on Spotify for many years now.
You can always ask Support and they'll happily migrate your data to a new account.
Yup, they did this for me back in 2015, and it was a really good customer support experience. I'd actually created a second account & asked them to close my original Facebook-linked one, but they offered to move across all my playlist data etc over to the new account so I didn't have to start over. And they checked in with me to make sure the data all looked good before deleting the other account. I was really happy with how they handled it.
While it isn't really straightforward, Spotify support will transfer all your songs, playlists, followers and if I recall correctly also your followed artists to a new account. Another possibility is for them to delete your old Facebook-linked account so you can create it again after which they'll also transfer all your old data. It isn't an ideal solution but at least you won't have to worry about losing your collection.
I created my Facebook account with my parent's email address back in the day (when I turned 13). Today it has been completely unlinked, but Spotify is still connected with that old email account. There's no way to actually change that.
I would like to know why some people stopped using Facebook claiming that the main reason is "the recent databreach". If you don't want to use Facebook for how they handle your data in the first place, it seems perfectly fine to me. But, the data breach exploiting 3 vulnerabilities seems to be bad luck, I don't really think they're not committed to security in that sense. I'd like to know opinions from others.
IMAO Facebook IS a data breach where people voluntarily comply to, not just some vulnerabilities. Login with Facebook is a pretty stupid thing to do anyway, happily giving away even more data.. Cannot think of 1 valid reason to do that except for being too lazy to generate a new password.
That's the whole point of OpenID. One account with one credentials, multiple profiles on multiple sites. Lazyness is good. Much better than creating n acoounts on multiple sites using the same passwords, getting the weakest site to be compromised silently and hackers streaming back to your other accounts from that one. I'd rather trust fb.com 2fa security team over joeschmoe.com's one.
With the benefit of hindsight, that OpenID allows the ID authority to engage in tracking is a significant design flaw.
I've used facebook/google logins for some small projects in the past. In theory it should be easy. The user doesn't need to remember their username let alone a password, or even if they made an account already. They can just click to log in.

There were two main issues. The first is that people don't trust facebook or google even if they already were signed into their services. They didn't want to give them any more information.

The second was that it was a huge pain to maintain and test. Facebook and google changed how the services worked semi-regularly and it was not trivial to find their documentation on how to update everything (and during that time nobody could log into your service).

It should have been easy, but it wasn't and it was not worth it.

I actually refused to use Spotify for years because they required Facebook login. I gave in eventually as Rdio lost to Spotify in the market. Like many, though, I am deeply concerned about Facebook's policy direction and leadership. I did disconnect my Spotify account from my Facebook account the hard way (with customer support) a few months ago.

In general I am enthusiastic about federated signin, but I don't want to do business with Facebook.

What do you mean that Spotify requires Facebook login, I don't have a fb account and are using it just fine.

E: Missed the past tense. I just checked, you can sign up with your email address.

It used to. In fact Spotify shared the same auth database with Facebook (not oAuth, the literal same password - change it in FB, it changed in Spotify and vice versa)
Started doing FB only login in Sep 2011, but if you already had an email login you could keep it. Lasted for about a year then it was dropped.
Couldn't you just make a new, empty facebook account just for spotify login with no real personal info on it?
The recent data breach made many people realize that you're always just 1 instance of bad luck away from having a bunch of aggregated personal data stolen. It's pretty reasonable to decide you're better off removing yourself as a target than hoping Facebook will never again experience bad luck.
It's not reasonable at all. You're 1 instance of bad luck away from death. But that's hardly a reason to not leave home.
It's hardly a reason to leave home, but it's definitely a reason to, for example, not go skydiving.

You obviously can't remove all risk, but you sure can reduce it.

That might not be the best example, though. You are more likely to die driving to the airport than you are to die while skydiving. That is an activity which is similar to riding a roller coaster: it seems much more dangerous than it actually is.
> You are more likely to die driving to the airport than you are to die while skydiving.

Can you back that up? I thought this was true too but did a quick check anyway and I found skydiving death rates are 8 in a million but driving death rates are 7.1 per billion kilometers. Driving to the airport is probably more dangerous than your average drive, but it still looks like the car trip is less likely to kill you.

Presumably you get value from leaving home, and these people realized they weren’t getting value from Facebook.

Personally I have still friends I cannot switch to other platforms so I am stuck checking my Facebook messages once a month, but that is the only reason I still have an account, and I have unliked everything else from the service.

The likelihood of death isn't enough to keep me from from leaving my house, but it is enough to keep me from driving without buckling my seatbelt. Everyone has to do their own cost-benefit calculations, and the benefits of Facebook will not always outweigh the costs of having their personal data leaked.
> The recent data breach made many people realize that you're always just 1 instance of bad luck away from having a bunch of aggregated personal data stolen.

There is no such thing as data stolen but from the files on your hard drive. As soon as you upload something to the Internet you publish it and have no guarantee but hope people you don't want to see it won't notice it.

Data breaches make the news because the data wasn't supposed to be published. Just because a third party has my data on a computer doesn't mean it's public. Under your logic I've published all my banking data, whether I've used online banking or not.
All I've meant is that nobody should ever feel surprised when the data they've uploaded leaks. Now the people have realized it can leak, what amazes me is that they supposedly didn't realize it in advance. Just don't upload your naked pictures anywhere if you are going to feel seriously upset for longer than a couple of seconds once everybody sees them. That's just "a rule of a thumb". I absolutely don't mean companies like Facebook should not bother to protect users' data, I mean users should never actually take this protection seriously. The Facebook problem did not affect me because everything I've ever uploaded/written there is what I would not mind showing/saying on a TV.
> The Facebook problem did not affect me because everything I've ever uploaded/written there is what I would not mind showing/saying on a TV.

Does that include everyone who you've friended and everything they've put on Facebook, plus all the data they've inferred about you and your friends through tracking and other third-party sources?

If a company holds some information internally, and an unauthorised third party surreptitiously obtains that information, wouldn't you call that stealing?
Every direct mail list provider on the planet has just as much info on you as FB, and they have garbage security. This is an overblown risk comparably.

Source: Have bought DM lists of millions of people with full addresses, estimated salaries, employers, etc.

How bad do you think a risk needs to be to justify not using a service you probably don't enjoy anymore anyway?
To me the data breaches was just the final straw. Naively perhaps I never believed that they would be so careless with my data as it turned out. Then on top they can’t even keep it out of the hands of people who don’t have a contract with Facebook.

I think that it could be the GDPR that is now forcing Facebook to be more open about breaches, and previously they may have been keeping them secret.

I already unlinked my Spotfiy account from Facebook with this way: https://robblewis.me/convert-spotify-facebook-to-email-login...

No account migration of contacting support is needed. Just use your registered email account to reset (or in this case actually set) your account password and afterwards you can log in via your email+pw. Then in the Spotify preferences the button to disconnect Facebook becomes available.

Wow, thank you! I'll give this a shot tonight. I've been wanting to disconnect it for a while now as well.
When it says "disconnect Spotify in Facebook" does that mean deleting the Spotify app? Doing so warns me that it could potentially delete my account, which worried me enough not to go through with it.
Yeah, that's what it means (to delete the app from your Facebook).

I also got that warning but I ignored it and clicked through anyways. Confirmed that my Spotify account is still working via email/password login.

Awesome, thanks for the confirmation! You're much braver than me :)
Wow, just confirmed this works. I can now log in to Spotify via email/password. Thanks for this!

The only caveat is you will need to re-sign in to every device where you are currently signed in via FB.

That is expected behaviour though after unlinking :)

Cool that this works!

I was able to successfully unlink my Spotify from Facebook using this method without deleting my account or losing anything. Thank you for this.
Nice - this trick also works for Strava (for which I originally signed up using Google)!
I actually liked having Strava post to facebook, but now I get an error every time I try to tell it to post a run I just completed to facebook. I might have to go into facebook's app settings and remove Strava and add it back, or to disconnect it inside Strava and reconnect it.
This is a recent change on Facebook's behalf - apps are no longer permitted to post automatically on your behalf [1]. I can understand why they've done it (searching for that reference involved going through 3 pages of "how do I stop app X from posting on Facebook") - but for those who actually wanted that feature, it will be missed.

1. http://uk.businessinsider.com/facebook-no-longer-lets-apps-a...

Same here. Can confirm this method works like a charm.
This also helped with reverting to username from real name after unlinking.
thank you, I've just done it. Another one bites the dust.
I can confirm that this worked for me. Thanks a lot!
Damn. I wish I saw this 3 months ago when I had to delete my Spotify so I could delete my account.
Thanks for this! My husband has been trying to join our family account for like years (I didn't even know he wasn't part of it and that we were overpaying my $10 a month until 6-8 months ago), and couldn't b/c he signed up with a Facebook account (back in 2011, when Spotify required that for new US users who weren't like me and already had accounts because of ...reasons) and support's official suggestion was to open a new account and migrate playlists, which just sucks.

Hopefully this works!

Amazing! I've been looking for this for so long and even considered copying over all my playlists and manually doing this but this is a life saver.
I had my Facebook account linked to my Spotify account. I didn't create an account using Facebook, but linked them later on.

Even when I had a Facebook account linked, I could still login to Spotify using a username (a bunch of numbers) that I was able to dig out from the settings at some point.

I recently deleted my Facebook account, and everything went quite well. The app said my playlists was created by user "null" (they fixed this after a while and now displays the numbers which makes my username), but other than that there's been no changes. So, just deleting your Facebook account and let Spotify deal with it seems to work, but it require you to know the username (and password. I don't know how I got that, maybe it was the same password as the one I used before linking my Facebook account).

It’s literally the only reason I still have a Facebook account. Couple that with Alexa picking out the worst version possible of the song I requested (“Master of Puppets - live by not Metallica on Spotify”) but seems to get it right with prime music; I’m about to drop it.
I also created my Spotify account with Facebook. When I wanted to unlink them I just sent an email to support and they did it pretty quickly with no issues. I haven't used FB and Spotify for years now, so things might have changed, but OP should try and do the same.
A quick email to support helped me do this a couple of years back. Don’t know if it should be any more trouble nowadays
Literally created another account last night and transferred all my playlists. Was actually straightforward on the desktop (drag and drop playlists from old to new account. Lost all of my history, but w/e.

Removing/blocking followers would also be appreciated.

I don't have Facebook, and I desperately want to get rid of the panel on the right telling me to login. So annoying. Apart from that really enjoy Spotify.
Assuming you’re referring to the ‘See what your friends are playing’ panel; on macOS it’s View Menu -> Uncheck ‘Friend Activity’. The right hand panel should then close.
On windows, but I will give it a try, thanks for the tip

Edit: You are a champion, that worked!

I was able to unlink FB my account with help from customer support. I had to provide details about my payment. They then basically deleted my account and created a new one and copied the playlists. There were some issues with Discover Weekly and Daily Mix playlists, but they resolved after a couple of weeks. I guess the process could be smoother and more automated, but I am glad now don't use FB login anywhere.
(comment deleted)
I created my first Spotify account in 2011 I'm pretty sure the ONLY way to authenticate was Facebook. There's no way I would have used Facebook rather than email. Years later I realized how absurd this was, found out you can't unlink them, and just made a new account. Spent a couple of days transferring my playlists.
I've had a Spotify account for just as long and never had it linked with Facebook, purely because I didn't have Facebook at the time. I just log in with id and password.
For about a year you were unable to create a new spotify account without a facebook account.

Accounts created before that were unaffected.

FB login only started in sep 2011, and lasted for about a year before it was dropped.
Spotify gave up on caring about their users a few years ago, I think. I uninstalled after the app forced the "DJ fade in / fade out" between every track -- including between movements of Beethoven's symphonies. (No, the toggle to turn that off never worked for me. No, they never replied to my attempts to let them know how awful it was.)

(No, I'll never go back to their service.)

Gapless playback without crossfades was a must-have feature for me and was one of the reasons I migrated to Spotify. It continues to work for me on both Mac OS and iOS.
Never could get it to work on Samsung, Apple 7, or Pixel.
Trying to click through to this piece from HN on Facebook tells me this link is malicious. Sour grapes on FB’s part?
Not at all. It's my personal blog, has very low traffic, it's only a basic HTML+CSS page, probably hits a few spam rules here and there.
This is what fake FB accounts are for.
Also, it would be nice if Spotify could bring back the ability to follow friends without requiring Facebook.
You can still do it. I follow 10 or so friends, and I've never linked facebook. The mechanism for adding friends is needlessly obtuse though. You need to add spotify:user:<username> in the search box to find them, then you can follow.

My biggest gripe is they removed the ability to send songs to friends.

Yeah, nothing listed here has worked for me. The issue is I had two accounts with the same email address one with Facebook one w/o. Not sure how it happened but if I try to reset the password of my account with my email address I immediately receive a "welcome back to facebook" email.

So, they are keeping the OID information somewhere. I've asked, begged, pleaded, and demanded for them to fix this and I've gotten absolutely nowhere. It is infuriating.

Have you tried changing your facebook email address?
I’d like to be able to do this on Instagram with my inactive Facebook account
I never use oauth unless I can avoid it. I’ve got LastPass and that makes creating a custom login per site trivial, so I have no need to hand more data to some oauth provider.
The most frustrating Spotify problem for me is the link between mobile / desktop play queues. I've moaned about it many, many times on the forums and there's a giant thread of people moaning about the same thing, but it's been years without resolve.

Basically, if I don't force-close the Spotify app on my Android before I get my laptop open on the same wifi, the phone will overwrite any play queue on my desktop. I exclusively use Spotify on my phone in the gym. I'll choose one album at a time and play it through while I work out. My laptop is for work - I'll maybe spend 15 minutes every few days queueing 10 or so new albums I want to try. Utterly maddening when you forget to close the app, go to Spotify and you're blasted with gym music and you've lost your carefully curated play queue.

Why not make a playlist? Seems more durable
I hate this too! For me, tho, the worst part is that they're not even consistent. I never know if the computer will pick up whatever I'm playing in the phone: sometimes it does, sometimes it doesn't. I don't want to check if my phone is connected to the same wifi for it to work.

Back when I used Rdio, the behavior was to keep all devices/tabs synced. It was consistent. It worked. When I wanted to keep diferent sessions I used playlists. I could work around it.

But with Spotify it's a mess. It doesn't sync correctly when I want, but only when I don't want.

Could you disable Spotify Connect? I don't actually have this problem myself. The playlists always remain separate until I explicitly select the other device via Spotify Connect.
Just make a playlist. AFAIK desktop and mobile apps both have the ability to one-click add albums to saved songs or playlists.

I love the combined cue, especially when hosting parties. Let guests cue songs from laptop and then adjust the order according to whom I like more (:

I select an album and play it straight in the gym - as in type in the artist, choose the album, double click and play. No playlist needed.

I suppose I could continue to create / delete playlists on the desktop, but it seems like I shouldn't have to. I'll go through the new releases on Friday / Tuesday, queue all the ones I want to try and listen to them one after the other. If I like them, I'll save them to a playlist or add the album to my library. If it doesn't grab me, I won't bother. Regardless, even if I'd queued a playlist, the mobile is still going to overwrite my queue. I just want an option to disassociated the two devices.

You just identified a wish-list-item I have for music apps: Location aware playlists:

The device would be aware where it is located - or moving via either gps, accelerometer or wifi ssid visibility or even an ibeacon.

The device will then know that it should play from selected sets/playlists that I have tagged appropriate for that location.

I would like this in a video library management app as well.

Basically, the content most likely to be relevant to my current location or activity should float to the top of the playlist or click-field.

All content should obviously be available, but preference to play a cetain list over another based on location or activity without overt action from me.

Kind of like an "ok google - I am now running so play my running lists" and "ok google - I just arrived at my office so either STFU or play my worklist"

"Looks like you just got on bart list"

How much battery life are you willing to pay for that?
Google Music does that already. But I know, Google isn't fashionable on HN. In fact, there will be another revolt - Google is creepy!