PSN automatically "roots" your Facebook, no permission granted.
I have been meaning to link up my modern warfare 3 account with facebook (new feature) so I could see which of my facebook friends play. Today I finally did it and paid very close attention to the permission I was granting to the game. Call of duty asks for permission to access all your basic info, view your photos, and post to your wall. A bit hefty, but I wanted to see who else was playing modern warfare 3 so I agreed. I was logged in, and when I went to my friends list i was informed it found no results so was pretty much pointless. Immediately I checked my account settings on facebook thinking I would just remove access and forget about the whole thing. I was not so shocked to find that call of duty had allowed itself more access than it asked for. I WAS however shocked that there was another app allowed in the last 24 hours called 'Playstation Network' and it had a pagelong list of access permissions all of which were completely open and I had never been asked to allow that. (I'm pretty sure it just opened up every permission setting possible on facebook) Seriously, check it out yourself if you have the game on ps3. I would take a screenshot but I was so disturbed the first reaction was to of course revoke all access. Obviously any information they could access would have been crawled and indexed in sony's servers in those few minutes, but it was all I could do of course. Has anyone else been disturbed by this? It is particularly ironic that sony not so long ago lost all psn users' personal and financial data to crackers, and now they want to underhandedly grab more of it from our facebook accounts. Please help me bring some attention to this.
34 comments
[ 3.6 ms ] story [ 90.5 ms ] threadMy Samsung feature phone also gets full permissions when it logs in.
I don't understand why Facebook can't do one of these two things.
Yeah, that's not convenient, but you didn't get a computer without a working browser for convenience in using Facebook...
EDIT: To clarify, Facebook has made a special deal with HTC (or Sony in the case of this post) to allow these non-standard browser oAuth flows.
QFT. You would think that they'd show a little more sensitivity around privacy issues after their recent security fiasco, instead of looking for more ways to steal information that they might very well end up losing.
I doubt Sony has the ability to do anything it wants with your account (It can't change your password, it can't revoke permissions of another app) so they haven't gained "root access" to your account.
I also doubt that Sony is hacking or getting this access through illicit means. Sony doesn't "root" your account through some sort of exploit, Facebook has most likely given them that access. (As a few others have mentioned)
You're right that this is disturbing. Poking holes into the security model in other to make the user experience more convenient is something companies do depressingly often. Here's an example that surprised me recently, if you activate your android phone by signing into a google account it ignores two-factor authentication and only asks for your password.
[edit, removed a patronizing paragraph]
Are you sure about this? Perhaps you have the "Remember this computer for 30 days" cookie around?
My phone always asks for two-factor auth. In fact, I had to wipe my phone and re-auth, so I used one of the throw-away codes. When I re-init'd Google Auth app (which annoyingly requires disabling and reenabling two-factor auth, AND invalidates one time use keys), it immediately reprompted me to complete an oAuth cycle with the two-factor code for the core Google account on my phone.
ICS/Galaxy Nexus/etc
Also, just to clear up what happened, I was asked to allow separate permissions for modern warfare 3 (much less lenient ones) and when i did that, psn also hopped on board and opened up everything (which I clearly did not authorize). I don't think that facebook has anything to do with this except for the fact that it is possible. I would hope that this sort of use of their service makes them unhappy.
I would take personally any app that asked me to allow certain rights and then piggybacked on every single possible right without notification. Some people don't care, I think it is an issue to bring to everyones attention. I'm glad you got amusement, hopefully some others got more.
Facebook gives users the illusion of control and will only extend that illusion when someone makes a loud fuss (or a lawsuit).
When Zuckerberg states that Facebook has a hacking culture, I think he meant social engineering.
I do remember seeing an apology and promise from Sony about the incident in the form of a press release. Though my reading of it was "we are sorry they got caught and embarrassed us" and "we promise not to do exactly the same thing in the near future" (which left them open to doing something just as bad right away and open to doing the same thing now, years later, without breaking their word).
If Sony reaps brand benefits from naming a "partially owned company" "Sony xxx", then Sony should also suffer when one part of the whole does something damaging to the brand.
Can't have it both ways.
Your clued up person may know the difference, but the average person is not that clued up.
While Sony certainly stood to reap the brand benefits, they also reaped almost all of the negative publicity.
That sounds like someone failed in their due diligence role, rather than any reason I should pity Sony.
Mainly, though, this corporation, which began with Sony and ended with Sony, fit very well with the Sony culture of abusing consumer trust for additional profit.
I know this is a conspiracy theory. The sony fanboys ripped me apart when I complained on twitter about it. 'Obviously' it was just coincidence. I'm thinking at the very least it has to do with that legit version of yellow dog linux i had on it at one point which they forced me to remove with a more recent update if i wanted to keep my psn access. I have a feeling i would have been better off just giving them the boot then and there.. ohh well, SMH
EDIT: just so everyone knows the details it was after the big crack of psn, it was down for months and every day i turned on my ps3, checked if i could get on and turn it off. I complained on twitter at some point and when the network finally came back up I installed the update. It completed 'successfully' and asked me to allow it to restart my ps3, I said yes, it turned off, yellow light comes on and the tears begin to fall.