Slashdot Mirror


Gawker Media To Require Commenters' Facebook, Twitter, Or Google Logins

First time accepted submitter wynterwynd writes "In a move that seems to be in line with Gawker Media founder Nick Denton's opinion of his sites' commenters, some Gawker Media sites are now instructing their commenters that they will have to link their Gawker commenter ID with their Facebook, Twitter, or Google accounts in order to log in. Is this really a good idea, considering the security issues Gawker has had in the past? Per the article, for 'security purposes' Gawker is 'putting our account security layer in the hands of some of the best in the business — major sites with more security expertise and resources than anyone else on the web.' To my mind, it's hard to see this as anything but a grab to milk Gawker commenters' social networking accounts for targeted ad revenue — which really shouldn't be a surpirse considering Denton's contempt for most of the Gawker community. Is this a step too far for an online community? Is it a cash grab or a genuine effort to encourage secure and responsible posting?"

231 comments

  1. Okay... by mholve · · Score: 5, Insightful

    Add Gawker to the same list the New York Times is on. That is, "pass."

    1. Re:Okay... by Anonymous Coward · · Score: 1

      If people can't boycott something, they deserve what they get. It's as simple as that.

    2. Re:Okay... by tripleevenfall · · Score: 4, Insightful

      The St. Paul Pioneer Press went this way last year. Unsurprisingly, participation in the comments has dropped to near zero.

      I can see why companies do it - this saves them the trouble of moderation, as people moderate themselves when their real names are used and they conceivably could face real-life consequences for what they post. Is real-life intimidation really the best way to police comments? Certainly not if you want more participation...

      I don't have an issue with it. I think the most important right we have online is the right to remain anonymous. I don't want an employer or anyone else to look at my comments on news or sports and judge my worthiness as an employee by them - which is why I simply choose not to participate when companies choose not to allow anonymity.

    3. Re:Okay... by thetoadwarrior · · Score: 1

      Gawker sites weren't worth anything before. I'm sure Nick is right and his site's have comments without intelligence but if the website has no intelligence then how would you expect to find intelligence in the comments?

    4. Re:Okay... by TheRaven64 · · Score: 5, Funny

      It's difficult to boycott Gawker. It's like boycotting punching yourself in the face. Sure, you can tell everyone loudly you're not going to do it, but on the other hand no one is likely to believe that it's a matter of principle.

      --
      I am TheRaven on Soylent News
    5. Re:Okay... by cayenne8 · · Score: 3, Insightful

      The St. Paul Pioneer Press went this way last year. Unsurprisingly, participation in the comments has dropped to near zero.

      I can see why companies do it - this saves them the trouble of moderation, as people moderate themselves when their real names are used and they conceivably could face real-life consequences for what they post. Is real-life intimidation really the best way to police comments? Certainly not if you want more participation...

      Not to mention...not everyone has a Facebook or Google+ or Twitter or...xyz social network account.

      I find it interesting that these two sites assume everyone that is on their forums have FB, etc accounts....are there other sites out there following this assumption? The assume you have a 3rd party membership established so you can use their forum/services???

      Why would anyone limit themselves based on that type assumption?

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    6. Re:Okay... by siddesu · · Score: 5, Insightful

      I would add this "Gawker" you speak about to my boycott list, but what is it? Is it one of those "websites" that you open with no-script and see a blank page? If so, they've been "boycotting" me for a few years now.

    7. Re:Okay... by Anonymous Coward · · Score: 0

      people moderate themselves when their real names are used and they conceivably could face real-life consequences for what they post

      Yes, because all Facebook and Google accounts are real people :)

    8. Re:Okay... by nolife · · Score: 4, Interesting

      On the flip side, the more sites that reference facebook for their own services and advertising, the more estsablished Facebook gets and the more users that get cemetened in or stuck using it. I find it odd that more and more companies are now advertising "See us at www.facebook.com\ourcompany" instead of their own companies web site.

      --
      Bad boys rape our young girls but Violet gives willingly.
    9. Re:Okay... by Phreakiture · · Score: 1

      Already did, an told them I was doing so.

      --
      www.wavefront-av.com
    10. Re:Okay... by Technician · · Score: 2

      Login with your username and password

      Or

      Log in to Gawker using Facebook, Twitter or Google. If you wish to remain anonymous, we suggest creating a separate Twitter or Google account.

      It is an option. Not a requirement.

      --
      The truth shall set you free!
    11. Re:Okay... by tripleevenfall · · Score: 3, Insightful

      I'm sure that ABC Newspaper loves when you comment on an article, and their name and a link to the site gets posted on your profile, and on everyone you know's timelines. (200 people? 500 people?)

      They can't pay for that kind of personal advertising.

    12. Re:Okay... by sl4shd0rk · · Score: 2

      Add Gawker to the same list the New York Times is on.

      Indeed. It's on a perforated list in the bathroom.

      --
      Join the Slashcott! Feb 10 thru Feb 17!
    13. Re:Okay... by Hotawa+Hawk-eye · · Score: 3, Informative

      It is an option. Not a requirement.

      For the next few weeks, according to their FAQ. Then it becomes a requirement.

    14. Re:Okay... by Anonymous Coward · · Score: 0

      Not so much pass, as I'll read the articles, but I won't participate on their sites.

      Saw an earlier thread this week where long-time members w/ gawker site logins didn't know if they were going to have to create new logins, with said appropriate social media outlets.

    15. Re:Okay... by IntlHarvester · · Score: 2

      The St. Paul Pioneer Press went this way last year. Unsurprisingly, participation in the comments has dropped to near zero.

      From a site perspective, that could be seen a seen as a good thing. The average mainstream reader has little desire to read through 400 comments, most of which could be categorized as 'troll' or 'flamebait'.

      (Maybe I'm just cynical, but many sites added these comment sections just to punch up their "engagement" numbers, not because they actually wanted to engage with their readers. So you get a small subset of people generating page views arguing with each other, with nobody else listening.)

      Anonymous commenting works a little better on Slashdot, but only because it's an older technical audience, and most readers learned on Usenet/BBSs to wear their flameproof undies.

      --
      Business. Numbers. Money. People. Computer World.
    16. Re:Okay... by cain · · Score: 3, Informative

      You don't have to give up anonymity, at least not according to the io9 people (the sci-fi site under the Gawker umbrella). They are encouraging everyone to just create a throw-away twitter account that is only used at io9. Whether this is acceptable to twitter may be another story...

    17. Re:Okay... by number11 · · Score: 1

      I find it interesting that these two sites assume everyone that is on their forums have FB, etc accounts....are there other sites out there following this assumption?

      The political site TPM recently shifted to this policy. They had been allowing OpenID as well, but dropped that because, um, trolls could get accounts there. Shocking, I tell you, who would have thought?

      Of course, you'll still have to select which of your FB, twitter, google personas to use.

    18. Re:Okay... by nolife · · Score: 1

      I understand the benefit to Facebook and the various companies. It just seems like another version of AOL emerging.

      --
      Bad boys rape our young girls but Violet gives willingly.
    19. Re:Okay... by Anonymous Coward · · Score: 0

      Is it one of those "websites" that you open with no-script and see a blank page?

      More or less. I used to read io9 occassionally, first the comments required script and then the content. Can't say I miss it much.

      Facebook is also broken, I'm not interested in an account and I block their static hosts due to that silly "like" button they use to track peoples browsing on 3rd party sites.

      IMHO the ghettos (or sewers) of the internet are not places like 4chan but the sites that cost users their privacy.

    20. Re:Okay... by ebs16 · · Score: 1

      The NYTimes allows anonymous posts. I'm not sure what you're getting at here. If it's about the paywall, you need to understand that Gawker bloggers can sit in in NYC all day to do their jobs. NYTimes has to maintain a giant international staff, field offices, etc. That kind of quality comes at a price that I am more than happy to pay.

    21. Re:Okay... by mjwx · · Score: 1

      It's difficult to boycott Gawker. It's like boycotting punching yourself in the face. Sure, you can tell everyone loudly you're not going to do it, but on the other hand no one is likely to believe that it's a matter of principle.

      How. I dont normally visit Gawker sites any more. I dropped off reading most Gawker sites after that horrific site redesign in Feb 11. Besides, you only need the login if you want to comment, so you can still read it and see content. Comments on most Gawker blogs are even worse then comments on Slashdot.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    22. Re:Okay... by mjwx · · Score: 1

      The St. Paul Pioneer Press went this way last year. Unsurprisingly, participation in the comments has dropped to near zero.

      I can see why companies do it - this saves them the trouble of moderation, as people moderate themselves when their real names are used and they conceivably could face real-life consequences for what they post. Is real-life intimidation really the best way to police comments? Certainly not if you want more participation...

      I realistically cant see how this would work. It's not hard to create fake facebook accounts, say as Senior Alfred Kokonface to use for trolling.

      I think the end result is as you said, comments will drop to zero which realistically will improve most Gawker blogs.

      Signed,
      A Kokonface.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    23. Re:Okay... by Anonymous Coward · · Score: 0

      Gawker doesn't have anything of interest, anyway. Do I really care about celebrities or the latest shitty cellphone or a bunch of sappy shallow articles "by women for women"? No. The only thing stupider than a Gawker commenter is a gawker employee or site. Gawker is the kind of massive "content company" (and content farm) that the internet would be better without. Also, Nick Denton is a cunt.

    24. Re:Okay... by ThatsNotPudding · · Score: 1

      Not to mention...not everyone has a Facebook or Google+ or Twitter or...xyz social network account.

      They mean: those that have them are the only people that count, ad-wise.

    25. Re:Okay... by asdf7890 · · Score: 1

      Aye. That family of sites are also of the sort that store passwords and other credentials in plain text and get hacked, and only repeat information that is repeated in many other places anyway so not visiting them is no hardship at all.

      Last time I checked they didn't have a "delete/close account" feature either, and that was many many months after they promised to implement one after said hack incident that revealed their poor security practice.

    26. Re:Okay... by cavebison · · Score: 1

      This is what advocates of this method seem not to understand. Sure, I don't mind putting my name to a comment, the same way I don't mind being seen walking around in public buying stuff.

      I'm sure people see me sometimes, as I see them, and rarely there is some recollection of having seen that person somewhere else before. Big deal.

      But I sure as shit don't want shop a. knowing I went to shop b. or my employer or ad company or whomever being able to track me.

      That's the difference between parading your real face around town, or using your credit card (which, afaik, only your bank knows the history of) and having a single network monitoring all your online activity whose sole purpose is to monetise that information by providing it to third parties.

      We all take for granted that our daily activities are not monitored and analysed. Yet somehow we're supposed to accept that online, ostensibly because it "makes us more responsible". No, it makes us more "cautious", which is a completely different thing.

  2. goodbye common sense by poetmatt · · Score: 1

    Nothing like gawker having been hacked before to highlight how bad this is, as appropriately noted.

    All this says to me is "don't go to gawker websites or participate in their comment system because it sucks". Is it that hard to figure out when "web 2.0" is a good and/or a bad idea in 2012?

    1. Re:goodbye common sense by icebike · · Score: 4, Informative

      Nothing like gawker having been hacked before to highlight how bad this is, as appropriately noted.

      How is this "bad"?
      Do you understand what is being discussed here? Gawker is not asking for your password for Google/Twitter/Facebook.
      Rather, the ask Google (for example) to authenticate you, and Google answers YES, or NO, and never lets Gawker see your password.

      --
      Sig Battery depleted. Reverting to safe mode.
    2. Re:goodbye common sense by jhoegl · · Score: 0

      so you assume.
      But as for the "article of questions"... I am not doing Slashdots job for them.
      Slashdot, dont you have this new fandangled TV thing where you turn yourselves into journalists?
      THEN GO JOURNAL!!!

    3. Re:goodbye common sense by Desler · · Score: 2

      No, it's not what they assume. It's what actually happens.

    4. Re:goodbye common sense by sourcerror · · Score: 1

      My guess is they use OpenID, which is not as much a security risk as you make it to be. Gawker won't store your username/password (if they're at least semi-competent, which might be questioned ... )

    5. Re:goodbye common sense by SomePgmr · · Score: 2

      Exactly right. Nothing like a shitty summary to get the crowd all up-in-arms, though.

    6. Re:goodbye common sense by poetmatt · · Score: 1

      Yes, your password is not being shared - but the method of authentication between the two is a point of additional security risk. How hard is that to understand?

    7. Re:goodbye common sense by jhoegl · · Score: 1

      The point is that it can be easily spoofed by nefarious people. If the gawker people are acting shady, like the article questions suggest, do you really believe you should trust them?

    8. Re:goodbye common sense by Desler · · Score: 1

      They aren't spoofing anything and they are doing nothing shady. These is just using the authentication services provided by ?google, Facebook, etc. it's not giving them access to your account. That is unfounded FUD. And if they were spoofing things it would be easy to spot since you would notice you aren't being directed t the proper login page. Stop falling for FUD.

    9. Re:goodbye common sense by Desler · · Score: 2

      What is the security risk? All Gawker gets is whether you were authenticated or not. They don't get access to your account or any of the nonsense FUD being spread around.

    10. Re:goodbye common sense by Anonymous Coward · · Score: 0

      Plenty of sites choose to use social sites to authenticate. There is common. I don't understand what slashdot is upset about.

    11. Re:goodbye common sense by Migraineman · · Score: 1

      So, you're logging-in through the Gawker portal, trusting that Gawker won't peek at the user/pass as they hand it off to Facebook or Twitter or whoever for authentication, right? Doesn't sound like an opportunity for a Gawker-in-the-Middle opportunity?

      Further, since they're brokering the connection between you and the comment forum, they'll have access to the authentication credential, which would allow them to snoop your social media resources for as long as the credential is valid - they'd just need to spoof your user session.

    12. Re:goodbye common sense by sexconker · · Score: 1

      What is the security risk? All Gawker gets is whether you were authenticated or not. They don't get access to your account or any of the nonsense FUD being spread around.

      Tons of possible fuck ups can happen.
      Since you're either retarded or willfully obtuse, I'll spell out one XSS scenario for you.

      1) Attacker uploads malicious script to Gawker's site through a flaw in the commenting system.
      2) The script replaces the standard "Login with your Google, Facebook, OpenID, or OtherBullshit account" block with a different one.
      3) Users who log in don't notice any visible difference, and their credentials are sent off to the attacker.
      4) The attacker doesn't want to get caught, so he also passes on the credentials to the legit servers and lets the login process normally.
      5) You're fucked.

    13. Re:goodbye common sense by omnichad · · Score: 4, Informative

      Technically, Facebook's authentication at a minimum gives a lot of personal info to the service. Even the most basic level of Facebook Connect gives them access to a list of your friends, profile information, and so on. So it's a little more than blind authentication.

    14. Re:goodbye common sense by Serious+Callers+Only · · Score: 1

      Yes of course, all these APIs do is let you authenticate and prove that you are hunter2 on Facebook etc to gawker, and then post comments on gawker with that identity.

      Now gawker have no way of getting into your account via this means (unless there is a bug in the API of course, or unless Facebook chooses to let trusted partners access accounts - frankly I wouldn't put it past them given the access they have given Facebook app developers for example in the past). However it does mean you're letting gawker and Facebook (in this example) tie all your Facebook likes, pages etc and all your gawker comments together, and potentially sell that information to a third party (like advertisers), along with possibly your real name, sex, age etc etc if those are available via Facebook. I don't keep up to date with the latest fuck-ups and deliberate exposures/sales of private information by Facebook, but they are legion, so if you trust either gawker or Facebook with your identity, it's fine to sign in this way, but if you trust neither very much and the aggregate even less, then this is just going to stop you commenting if you are at all sane. I would not touch a website which required Facebook or other login rather than its own account system.

      From a developer's perspective, I also think from a website like gawker's point of view it is an abdication of the most important relationship they have - with their readership - if they let a third party take control of that, they are signing up to be screwed over later on, when Facebook suddenly demands money for this sort of sign-on, or demands other favours with the threat they will shut down your site/comments if you don't comply.

      As a reader I know I completely avoid signing in to websites with some central id which I do not control for this reason - what if that company (twitter, Facebook, whoever) is sold or bankrupted, and they start to exploit all your data for gain or sell it on? What then? All those gawker comments and comments on hundreds of other sites linked to your account which you thought were private could suddenly be sold on to a third party in aggregate, all linked together to form a complete picture of you - see the entire history of you for potential consequences. Individual logins make this aggregation far, far more difficult, and also mean you are free to drop one identity and keep another.

    15. Re:goodbye common sense by icebike · · Score: 1

      Since you're either retarded or willfully obtuse, I'll spell out one XSS scenario for you.

      Go read up on OpenID and then come back and apologize for calling people names.
      See also how Google does this.

      1) Gawker puts a sign in with Gmail account button on the page.
      2) You click that and a NEW HTTPS window shows up, sent to you by GOOGLE. (You do understand HTTPS don't you?)
      3) You enter your Gmail address and password.
      4) GOOGLE sends an encrypted token saying Yes/No and possibly your name back to Gawker.
      5) Gawker waits for this token and validates it directly with Google.

      --
      Sig Battery depleted. Reverting to safe mode.
    16. Re:goodbye common sense by Anonymous Coward · · Score: 0

      Exactly right. Nothing like a shitty summary to get the crowd all up-in-arms, though.

      Sounds like something posted on a Gawker website...

    17. Re:goodbye common sense by blueg3 · · Score: 2

      That's not how OAuth works. The party receiving the authentication (Gawker) doesn't at any point get access to the authentication data (your Facebook / Twitter / Google credentials).

      They also don't get access to your Facebook / Twitter / Google session authentication. A consumer of OAuth authentications can't use that authentication token to use any of the authentication provider's services.

    18. Re:goodbye common sense by blueg3 · · Score: 1

      Er, OpenID, not OAuth.

    19. Re:goodbye common sense by Anonymous Coward · · Score: 0

      They have been asking for FB logins for a long time. There is clearly a benefit for them here. Else they wouldn't only be using only social sites. Obviously they arent stealing accounts but they do get an increased chance at someone "sharing" a gawker story. And FB gets info about what you read. There are privacy implications even if they arent staring you in the face. If all Gawker needed was authentication they could use email or openID or something.

    20. Re:goodbye common sense by preaction · · Score: 1

      Gawker never gets the Facebook user/pass, only Facebook does. This is how OAuth, OpenID, and other distributed auth systems work: Gawker asks Facebook "Is this person authed?", Facebook says "No, send them here and we'll take care of this." Gawker then opens a window which redirects you to facebook, and you type in your un/pw. Then Facebook sends you back to Gawker with an authentication token (a big random number). Gawker can now use that authentication token to ask Facebook who you really are, and only that. Facebook will tell you what Gawker is asking to do with that auth token, like "Access my basic information", or "Access my friends list", or "Access my news feed", or "Post to my news feed", etc...

    21. Re:goodbye common sense by SydShamino · · Score: 1

      I think the parent is describing the following scenario:

      1) Hacked Gawker puts a sign in with Gmail account button on the page.
      2) You click that and a NEW HTTPS window shows up, sent to you by GO0GLE, with a certificate and everything.
      3) You enter your Gmail address and password. Behind the scenes, go0gle logs into google, somehow gets around google's geographic logon restrictions, and takes control of your account.
      4) If go0gle chooses to deceive you further, they hand back google's encrypted token and you proceed with your session, blissfully unaware of what just took place.

      HTTPS is only as good as the certificate provided. But even with a good fake certificate for a good fake domain, you need to drive customers to your site. Not many people will click a link to google from www.warez.ru. Hacking Gawker could then open a distribution vector.

      --
      It doesn't hurt to be nice.
    22. Re:goodbye common sense by icebike · · Score: 1

      Except the real Google hands back a token that can only be verified by the real Google.
      The fake token would trip even Gawker's lax security giving you a clue that you have been duped.

      The login buttons aren't on the area available for people to post. (They are not within the posts themselves). As such, you can't sneak in your own hacker code to do what you propose. The posting engine limits just what you can post.

      Look, if it was this easy to break OpenID NOBODY would use it. Yet its gaining acceptance all the time. The GP was blowing smoke.

      --
      Sig Battery depleted. Reverting to safe mode.
    23. Re:goodbye common sense by sexconker · · Score: 1

      Since you're either retarded or willfully obtuse, I'll spell out one XSS scenario for you.

      Go read up on OpenID and then come back and apologize for calling people names.
      See also how Google does this.

      1) Gawker puts a sign in with Gmail account button on the page.
      2) You click that and a NEW HTTPS window shows up, sent to you by GOOGLE. (You do understand HTTPS don't you?)
      3) You enter your Gmail address and password.
      4) GOOGLE sends an encrypted token saying Yes/No and possibly your name back to Gawker.
      5) Gawker waits for this token and validates it directly with Google.

      Once you get hit by XSS the entire page containing that script can be altered, including that NEW HTTPS window, which is now sent to you by SOMEONE WHO IS NOT GOOGLE.

      Thanks for trying, though.

    24. Re:goodbye common sense by Anonymous Coward · · Score: 0

      What would be worse was if you signed into Facebook with OpenID, then they would own everything about you.

      That is why I don't do OpenID, it's just like pushing +1 on every website you go to, but instead of just Google seeing it, anyone that could associate their own logins with your OpenID would have everything!

      Scary stuff!

    25. Re:goodbye common sense by sexconker · · Score: 1

      Except the real Google hands back a token that can only be verified by the real Google.
      The fake token would trip even Gawker's lax security giving you a clue that you have been duped.

      If the Google token can only be verified by "the real Google", then Gawker can't tell a fake one from a legit one either.
      Derp! Regardless, the real token is real once the attacker passed your credentials through the normal login routines. The attacker doesn't care about the token, the attacker cares about your username and password.

      The login buttons aren't on the area available for people to post. (They are not within the posts themselves). As such, you can't sneak in your own hacker code to do what you propose. The posting engine limits just what you can post.

      You're an idiot. Tons of sites have the "login" link on the same exact page you need to post from.
      Look at Kotaku, a Gawker site. Comments are posted right below the main article, and you can type out your comment and hit submit, then get prompted with a login prompt. Each page also has an assload of "share" links, as well as the master "login" link.

      Any page that has user-submitted content on it is potentially vulnerable to XSS attacks. One flaw in the commenting engine and it all goes to shit.
      And of course, there's all the annoying ads on their sites, another potential vector.

      Look, if it was this easy to break OpenID NOBODY would use it. Yet its gaining acceptance all the time. The GP was blowing smoke.

      Look, if it was so easy to steal credit card information, NOBODY would use them.
      People don't give a shit about security, they only want immediate access to fast food and mind-numbing social content. Ad-driven sites must cater to that desire above all else.

    26. Re:goodbye common sense by icebike · · Score: 1

      If the Google token can only be verified by "the real Google", then Gawker can't tell a fake one from a legit one either.
      Derp! Regardless, the real token is real once the attacker passed your credentials through the normal login routines. The attacker doesn't care about the token, the attacker cares about your username and password.

      Gawker hands the token back to google via statically coded portions of their web and google validates it. This is built into the library. If your putative XSS attacker can compromise a system library they you are far more screwed than you think.

      The tokes are use-once tokens. When a website asks Google’s OpenID provider (IDP) for someone’s email address, Google always sign it in a way that cannot be replaced by an attacker. The website won't be able to log you in.

      True, the attacker may already have your Google password, if they are very very good. But this still won't get them much, because google's two factor authentication will stop them in their tracks, and even if the account doesn't use 2FA, google's IP range checking will. (Got caught by this just the other day when I tried to log in to google from a distant hotel. Had to answer the additional security question).

      And you still danced around the question of why something you claim is so vulnerable is becoming the standard. Could it be its far far harder than you glibly claim? Could it be you have never actually done any such programming in the real world? Pretty good at slinging the insults to cover you lack of knowledge. If its so easy go out and DO it some time.

      --
      Sig Battery depleted. Reverting to safe mode.
    27. Re:goodbye common sense by number11 · · Score: 1

      How is this "bad"?
      Do you understand what is being discussed here? Gawker is not asking for your password for Google/Twitter/Facebook.
      Rather, the ask Google (for example) to authenticate you, and Google answers YES, or NO

      Ok, so maybe you can tell us how this thing works.

      How does Google know who I am? (Let's say, I block things like google cookies and google analytics.)

      Inquiring minds want to know. And don't want to share knowledge with google.

    28. Re:goodbye common sense by icebike · · Score: 1

      I'm not repeating it here for the reading impaired. This is explained quite well down-thread.

      Read up on OpenID.

      --
      Sig Battery depleted. Reverting to safe mode.
    29. Re:goodbye common sense by znrt · · Score: 1

      it is an abdication of the most important relationship they have - with their readership - if they let a third party take control of that, they are signing up to be screwed over later on, when Facebook suddenly demands money for this sort of sign-on

      I'm more inclined to suspect the contrary, that fb and g+ are the ones shelling out for having the accounts linked. i'm just speculating but it makes sense given their business model.

    30. Re:goodbye common sense by godel_56 · · Score: 1

      They aren't spoofing anything and they are doing nothing shady. These is just using the authentication services provided by ?google, Facebook, etc. it's not giving them access to your account. That is unfounded FUD. And if they were spoofing things it would be easy to spot since you would notice you aren't being directed t the proper login page. Stop falling for FUD.

      I take it you've never heard of Man-in-the-middle (MITM) attacks?

    31. Re:goodbye common sense by godel_56 · · Score: 1

      Gawker then opens a window that claims to redirect you to facebook, and you type in your un/pw.

      Fixed that for you.

    32. Re:goodbye common sense by Kalriath · · Score: 1

      Plus they'll likely tick the box that asks permission to post to your facebook wall too.

      --
      For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
    33. Re:goodbye common sense by Kalriath · · Score: 1

      No, OAuth is right. That's what Facebook uses. Google can use it or OpenID, but most use OAuth.

      --
      For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
    34. Re:goodbye common sense by omnichad · · Score: 1

      Thankfully, they didn't include that. If they did, I'd be done with Lifehacker for good.

    35. Re:goodbye common sense by Migraineman · · Score: 1

      Yes, this is the real problem. The original question was "what is the security risk?" not "how should this work in theory?"

    36. Re:goodbye common sense by Fnord666 · · Score: 1

      What is the security risk? All Gawker gets is whether you were authenticated or not. They don't get access to your account or any of the nonsense FUD being spread around.

      Well, you could start with this study for example.

      --
      'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
    37. Re:goodbye common sense by blueg3 · · Score: 1

      Ah, ok. I thought OAuth was usually used for access to services (like if you want a website to have access to your Gmail contacts) and OpenID was used for shared sign-in with no service access.

    38. Re:goodbye common sense by preaction · · Score: 1

      How it works explains why there is no increased security risk. At each step it is obvious what website you are on. Gawker opens a window and the URL bar in the new window starts with https://www.facebook.com/, meaning it is a facebook page, and you type in your un/pw if and only if you are not already logged-in to Facebook.

      So the security risk is exactly the same as everywhere else on the Internet. Nothing has changed, except that now there's one less bad password for you to forget.

    39. Re:goodbye common sense by Migraineman · · Score: 1

      So, you're in a position to guarantee that Gawker et al. are going to implement the authentication mechanism to the theoretically-correct ruleset? I don't think I'm going out on a limb when I say "I think not."

      I'm not trying to be pedantic, but people are the weakest link in any security method. I can easily see the following scenario unfold:

      Boss: I'm getting complaints about people being unable to log in.
      ITGuy: They're probably running pop-up blockers.
      Boss: So?
      ITGuy: You need to tell our visitors to allow pop-ups on our sites.
      Boss: I'm not telling thousands of customers that they have to change their system configurations. Do you realize how many customers we lost when we switched over to this god forsaken external authentication mechanism? If we lose any more customers, I'm going to be out of a job. And I can guarantee you that you're out of a job before I am. Just fix it.
      ITGuy: Well, I could embed the login window on the main page using Javascript, then proxy the authentication session through one of our servers. It won't be as secure, but would be transparent to the user.
      Boss: Great. Do it.

      So for a while, this company uses the external authentication as it should be used, and once the customers are comfy with using their Facebook account credentials, they won't blink when the login page changes slightly and embeds the login procedure. Boiled frog meet man-in-the-middle. Do we see yet? The risk isn't, and has never been, in the authentication mechanism. The risk is in the implementation.

    40. Re:goodbye common sense by sexconker · · Score: 1

      If the Google token can only be verified by "the real Google", then Gawker can't tell a fake one from a legit one either.
      Derp! Regardless, the real token is real once the attacker passed your credentials through the normal login routines. The attacker doesn't care about the token, the attacker cares about your username and password.

      Gawker hands the token back to google via statically coded portions of their web and google validates it. This is built into the library. If your putative XSS attacker can compromise a system library they you are far more screwed than you think.

      The tokes are use-once tokens. When a website asks Google’s OpenID provider (IDP) for someone’s email address, Google always sign it in a way that cannot be replaced by an attacker. The website won't be able to log you in.

      True, the attacker may already have your Google password, if they are very very good. But this still won't get them much, because google's two factor authentication will stop them in their tracks, and even if the account doesn't use 2FA, google's IP range checking will. (Got caught by this just the other day when I tried to log in to google from a distant hotel. Had to answer the additional security question).

      And you still danced around the question of why something you claim is so vulnerable is becoming the standard. Could it be its far far harder than you glibly claim? Could it be you have never actually done any such programming in the real world? Pretty good at slinging the insults to cover you lack of knowledge. If its so easy go out and DO it some time.

      Yeah, you're an idiot. The attacker can get around all of the protections in place if they can get their own script to run on the page. And I have no idea why you're thinking about fucking tokens at all. The attacker doesn't want a fucking token, they want a username and password. All they have to do is send it out to their own server via XHR and then let the normal stuff go on as usual.

      Two factor authentication? Who gives a shit? Accounts that have a dongle will be skipped. Accounts that don't have a dongle will be harvested. It's trivial to get around the IP restrictions. You could even just do everything from an IP in a "mobile" block since the check is ignored. And then there's the cascade effect - when attackers have your google username, password, and IP, they'll start hitting other accounts you may have.

      If you think it's so inconsequential, please post your gmail address and password.

  3. Walling the gardens by Nebulo · · Score: 1

    Frost prist!?!

    The days of Anonymous Cowards are seemingly coming to a quick close. This abdication of authentication authority seems in-line with the overall garden walling of various sections of the Internet, operating systems, and devices.

    nebulo

    1. Re:Walling the gardens by nschubach · · Score: 1

      http://wiki.openid.net/w/page/12995226/Run%20your%20own%20identity%20server

      You can be anyone you want if they use OpenID and you have a server setup.

      --
      Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
    2. Re:Walling the gardens by Anonymous Coward · · Score: 0

      Except the web site you want to log into only uses one or a few OpenID providers, such as Facebook and Twitter.

  4. Nobody cares by Anonymous Coward · · Score: 0

    Seriously, nobody cares. He "resents" the community because everybody else is making money off of social media, but nobody likes him or his shitty websites.

    It's the last of the lumbering dinosaurs, the webring. The stupid geek.net or whatever slashdot is, counts too.

    I gave up logging in to slashdot years ago, though I still visit out of habit, more often than not I'm dissapointed.

    Fuck you Trolls!

    Dumb ass will learn

  5. Not so bad compared to some places by Anonymous Coward · · Score: 0

    At least we're not in China or Korea, where the equivalent versions of these sites require you to use their equivalent of our SSNs in order to post a comment. To post a comment!

    I'm a member of one of their sites, and I don't have an account with any of the sites listed. I guess I'm not wanted.

  6. Well that's one less site I will comment on by StuartHankins · · Score: 4, Insightful

    I already don't comment on most sites which require a login (/. is an exception) -- but I can't even imagine wanting to link my personal social media account with a commenting account. What a horrible idea.

    The privacy issues alone are a big deal, but sometimes you want to say something that you can't have directly linked back to yourself (for various reasons). I'm not defending criminal activity or hate speech, but I could think of examples where expressing your view could cause issues because of your religion / country of residence / association with others etc.

    1. Re:Well that's one less site I will comment on by Anonymous Coward · · Score: 0

      /. doesn't require a login, so it really isn't an exception.

    2. Re:Well that's one less site I will comment on by cpu6502 · · Score: 1

      >>> expressing your view could cause issues because of your religion / country of residence / association with others etc.

      Future employment. "Hmmm this guy posts a lot of anti-Bush, anti-Obama, and anti-Romney stuff. My god and he says he voted for that nutjob Ron Paul. Time to trash his resume." ----- Or just plain embarassment. It's bad enough I have posts back to 1988 following me around ~3 decades later, and popping-up when people search my name.

      --
      My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
    3. Re:Well that's one less site I will comment on by XxtraLarGe · · Score: 1

      "Hmmm this guy posts a lot of anti-Bush, anti-Obama, and anti-Romney stuff. My god and he says he voted for that nutjob Ron Paul. Time to trash his resume."

      Looks like I'm screwed!

      --
      Taking guns away from the 99% gives the 1% 100% of the power.
    4. Re:Well that's one less site I will comment on by ZeroSumHappiness · · Score: 1

      And that's why I consider myself lucky that my real name is so common.

    5. Re:Well that's one less site I will comment on by Anonymous Coward · · Score: 1

      Gawker doesn't even usually post anonymous comments. I don't really ever read them because of this. Comments are one of the most important things to me, and their system seems awkward and skewed.

    6. Re:Well that's one less site I will comment on by nine-times · · Score: 4, Insightful

      It has long been held by philosophers and courts that one of the keys to "free speech" is the option of anonymous speech. If you can't give your opinion anonymously, then there's no way you can be sure there will be no retribution.

    7. Re:Well that's one less site I will comment on by AngryDeuce · · Score: 4, Interesting

      Ditto. One benefit of having a name almost as common as "John Smith" is that the signal-to-noise ratio is far too high for anyone to really know what is actually a legitimate hit or one of the other thousands of "John Smiths" in the world. Plus, I happen to share my name with several very famous people, ranging from musicians to professional athletes to actors, so you're going to have to do some serious digging to find a hit that's not related to one of them. Certainly nothing within the first dozen pages on Google (and that's just when I gave up)...

      Funny, when I was a kid I always used to think my name was boring and wanted to change it to something more unique and memorable. Sure am glad I didn't now...

    8. Re:Well that's one less site I will comment on by Anonymous Coward · · Score: 0

      I agree. I don't see a point to compulsory registration. What exactly do you get from asking someone to register and login? If you're worried about spam - add a CAPTCHA in there and let people comment freely. I either don't bother commenting on sites that require registration, or use BMN.

    9. Re:Well that's one less site I will comment on by Anonymous Coward · · Score: 0

      About 25% of the comments on any gawker site are complaining about the commenting system.

      I wouldn't think they could be that incompetent so there must be some legitimate reason (for them) to leave it broken.

    10. Re:Well that's one less site I will comment on by SydShamino · · Score: 1

      My first/last name combo is unique. Last time I went through Google, I had to go through the first dozen pages to find a link that wasn't me (and it was obviously a name aggregation page that randomly included my first and last names among thousands).

      --
      It doesn't hurt to be nice.
    11. Re:Well that's one less site I will comment on by dirk · · Score: 2

      The comments are in no way tied to your account. Basically, instead of them storing your account information, they link your Gawker account to one of the others and then asks them to verify your login credentials. The comments don't show up with your FB, Twitter, or Google handles, they all still show up under your Gawker handle. The only thing that is being passed off if the actual credential check. To me, this makes perfect sense for a site that has had security issues in the past. They no longer handle the security, Google or FB or Twitter does, so there is nothing to be hacked there.

      --

      "Information wants to be expensive" - Stewart Brand, the same guy who said "Information wants to be free"
    12. Re:Well that's one less site I will comment on by Anonymous Coward · · Score: 0

      Slashdot doesn't require any fucking logins, n00b. That's why we can post disgusting true stories like this one:

      It was dark in the Holland, Michigan office nestled deep within Slashdot's Geek Compound. Shifting and moaning, ESR laid sprawled over his filthy desk.

      Dried spittle stuck several Post-It notes to Eric's cheek. His PC, running Linux, silently printed swap error after swap error to the screen, lighting ESR's sickly form. He burped several times as he attempted to recall the night before that had led to this stupor. Holding his head in his hands, he was interrupted by lights and doors slamming. Someone was in the office!

      As Rob "CmdrTaco" Malda walked past ESR, he noticed the several empty bottles of Jagermeister and what appeared to be fecal stains on the floor and walls surrounding the recovering ESRâ"nothing new. He also noticed the some semen bubbling in the cracks of ESR's chafed lips.

      âoeAnother all-night office orgy, Eric?â Rob asked coyly.

      Tilting his head gingerly toward Rob and raising his eyebrows slowly, ESR spoke softly. âoeOh shit. Is that what happened last night? I believe I blacked out at some point, I can't remember anything. Who was here last night?"

      "Well, CowboyNeil got there a little late last night, but he said that by the time he got there that Alan, Emad, Jamie, Michael, and Signal 11 were already pretty drunk," Rob said just a little too loudly for ESR's tender head.

      Closing and opening his eyes gently, ESR muttered to himself about having not invited Signal 11. He also started sniffing the air and licking his lips. "I can smell dried feces on a dick a mile away. Just where were you last night, Robbie? You get a piece of ass last night and decide to ditch my party?"

      "What's it to you? Your breath smells like semen and you don't hear me asking whose it is," Malda shot back.

      ESR smiled and swiveled with a gleam in his eyes. "Ah, but you see, this is my own semen!"

      "And it must taste specfuckingtacular!â Rob shot back.

      Eric interjected before Rob could go on. "Ah yes. You see, I like to add a shot of Jager to it to give it a little kick."

      "No," Rob replied with anger rising in his voice, "You fucking raging alcoholic. Your semen tastes like old motor oil. I think you may have ruptured both of your testicles and now your colon is shooting diarrhea out of your cock-hole."

      "What!? You little fudge-packing piece of shit!" ESR threatened, "Ditch one of my office parties because Hemos calls up and says he's lonely, will you? I bet that's what happened. Well, guess who I'll be recommending we lay off at the next LNUX board meeting? How do you like that, Taco?"

      "Whatever, Eric. You don't scare anyone except your parents," Rob said as he stormed out of ESR's office, his green plaid flannel whipping in the wake behind him. "You would be nothing without Slashdot."

      ESR stammered and shook. Ever since the LNUX stock had plummeted, things were so tense around the office. Relations were falling apart between he and the Slashdot admins. Last night, Michael and Jamie had pounded each other exclusively, ignoring ESR's crooked, erect penis, and Eric had to convince Emad and Alan to restrain CowboyNeil before he could engage in homosexual intercourse with him.

      With a flick of his wrist, ESR popped a dozen extra-strength Bayers down his stinking gullet and washed them down with some Jager from the bottle he had woken up holding. Depressed, aching, and on the verge of vomiting up the entirety of last night's semen binge, ESR cried silently and went back to sleep at this desk, ignoring the pile of work that sullied the landscape of his desktop.

      Clapping twice to darken his office, ESR curled into fetal position as best he could and rested, preparing to do it all over again later that night.

    13. Re:Well that's one less site I will comment on by kruhft · · Score: 1

      Michael Bolton, is that you!??! ;-)

    14. Re:Well that's one less site I will comment on by Anonymous Coward · · Score: 0

      It's bad enough I have posts back to 1988 following me around ~3 decades later

      Those post just show your retardness. No worries, you still post 50 retarded messages a day.

  7. Cash grab by Anonymous Coward · · Score: 0

    Like government, there is nothing a private business does or would do that isn't motivated by money.

  8. Any site doing this needs their head examined... by mlts · · Score: 3, Insightful

    Call me naive, but I have no idea why websites like using other social networks for authentication. Is there something so secure that I can trust Facebook with any and all logins and passwords for not just me, but all my users?

    Yes, FB and Google have two factor authentication as options, but when it comes to making sure my users have basic security, I'd rather pack my own parachute, and have a dedicated appliance store username/password hashes so if someone owns the rest of my boxes, they can't just scoop out passwords that can be used at other sites.

    Maybe this can be a market niche -- a site offering not just OpenID, but a custom API like the old Microsoft Passport allowing people to authenticate from that site, optionally using an app or SecurID key fob.

  9. Gawkers to Fawkers. by LeAzzholeChef · · Score: 0

    LOL...You are now on my boycott list. RETARDS!

  10. I refuse to share my Real Name by cpu6502 · · Score: 5, Insightful

    I refuse to link facebook or twitter or any other account that has my real name. If I can't login under an Email handle/alias then I simply don't post on that website.

    Sorry gawker. You lost my business/ad views.

    --
    My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
    1. Re:I refuse to share my Real Name by Altanar · · Score: 2

      I have a feeling that as time goes on, more and more sites will be losing your business/views.

    2. Re:I refuse to share my Real Name by Anonymous Coward · · Score: 0

      I am okay with using it as a form of authentication, but if it forces me to use my real name or handle in public, then no deal.

      Many sites do it that way, you just use it to authenticate and it doesn't actually use anything from the linked account if you don't want it to.

      But many sites don't do that, and I have issues with that.

    3. Re:I refuse to share my Real Name by AngryDeuce · · Score: 2

      To be fair, they lost my ad views long ago, as has pretty much every other website on the net.

      Hooray for adblock and scriptblocker!

      Yeah, I know, I'm "stealing the web". Let me count how many sleepless nights I've had over that....uh....how do you count to zero, again?

    4. Re:I refuse to share my Real Name by Anonymous Coward · · Score: 0

      Exactly, they're just wasting bandwidth, and my time and money on serving me ads anyway. In the almost 20 years I've been using the web I have bought exactly nothing from an online ad. Let them serve ads to to click-happy Midwest wives who actually buy that kind of crap and stop annoying me with audio, splash screens. flash, expanding hyperlinks and 30 seconds of ad video before every 12 second video I watch (thanks failblog for being the straw that broke the camel's and made me search out abp and adpv -- I've never been happier with the web).

    5. Re:I refuse to share my Real Name by Anonymous Coward · · Score: 0

      If it helps, a growing number of people (myself included) think you're doing the right thing. People always want to stop trends as soon as they spiral out of control, but they fail to see that if they stymied those trends earlier on, they could have avoided catastrophe.

      People cry out "slippery slope" so often that they miss incredibly obvious trends and connections.

    6. Re:I refuse to share my Real Name by Blue+Stone · · Score: 1

      Just create a throwaway anonymous and Gawker-specific Twitter account, as if you were creating an account on Gawker. Don't use that Twitter account for anything other than logging into Gawker.

      Problem solved.

      --
      Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
    7. Re:I refuse to share my Real Name by blueg3 · · Score: 1

      You know that two of those options -- Google and Twitter -- provide pseudonymity.

    8. Re:I refuse to share my Real Name by downhole · · Score: 1

      I care about "stealing the web" about as much as the people in charge of these ad companies care about not getting my computer hacked, not burying a simple site in megabytes of ads, flash animations, pop-ups, pop-overs, pop-unders, and like buttons for various sites that take 10 minutes to load, not leaking my personal data all over the web, etc. As far as I can tell, their level of caring is somewhere between zero, and thinking that I actually like it when they do that. I'll just go ahead and assume that they actually like it when I block their ads and scripts.

      --
      I don't reply to ACs
    9. Re:I refuse to share my Real Name by admdrew · · Score: 1

      Eh, personally, fuck that. If Gawker is too lazy to manage their own authentication system, I'm out.

  11. Issue? What issue? by neokushan · · Score: 4, Informative

    The summary, as you might expect, is a little off.
    What's happening here is that Gawker is switching from its own account system to using the accounts of existing social services (Google, Facebook or twitter). This is not them asking for your account but rather asking you to AUTHORISE gawker's access to your account details. If this is an issue, please go talk to Disqus or even Twitter/Facebook/Google themselves, who also let you "link" accounts from other services, as well as a bunch of other sites. This is the way the web is going and is nothing new.

    --
    +1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
    1. Re:Issue? What issue? by Anonymous Coward · · Score: 0

      This is the first I've heard about it being used for a comment system.

      Gawker's comment section sucks balls anyway so I doubt it will have much of an effect. But imagine if /. tried that. *crickets*

    2. Re:Issue? What issue? by YrWrstNtmr · · Score: 2

      AUTHORISE gawker's access to your account details

      No thanks.

      Twitter/Facebook/Google themselves, who also let you "link" accounts from other services

      Big difference. 'let you' vs 'require'

    3. Re:Issue? What issue? by Desler · · Score: 0

      Then your just ignorant. Comment systems like Discus, for example, have used the same system as well for ages.

    4. Re:Issue? What issue? by v1 · · Score: 1

      time to make another disposable gmail account huh?

      --
      I work for the Department of Redundancy Department.
    5. Re:Issue? What issue? by Desler · · Score: 0

      They are wording it incorrectly. What is done is that you login to your Facebook, Google, etc. account and then those sites pass back to the system whether the user was authenticated or not. You aren't giving Gawker access to your account or account details. The summary is written mostly as FUD.

    6. Re:Issue? What issue? by icebike · · Score: 2

      This!

      Too many people posting here have no clue about how this works.

      But its even more restrictive than that. At least in the case of Google.

      Gawker sends an email address to Google, gets a YES or NO from Google. Google pops up its own https page to gather your password. Gawker sees none of this. And Google tells you exactly what Gawker asks for as far as "Real" name (wink wink).

      And you can control this from your Google Dashboard "Websites authorized to the Account". If that page (Direct link) simply has a listing like the following:

          postings.somesite.com — Sign in using your Google account [ Revoke Access ]

      then all they can get from Google is a Yes or NO.

      Other third party authentication services may not be as transparent as Google and may not allow as fine grained control.

      --
      Sig Battery depleted. Reverting to safe mode.
    7. Re:Issue? What issue? by huge · · Score: 1

      This is not them asking for your account but rather asking you to AUTHORISE gawker's access to your account details.

      The way I read it is that Gawker is using Facebook as authentication service. Once authenticated Gawker is authorizing you to do certain things, like post comments.

      --
      -- Reality checks don't bounce.
    8. Re:Issue? What issue? by Anonymous Coward · · Score: 0

      Disqus lets you create a disqus-only account, which is not linked to anything else.

    9. Re:Issue? What issue? by Desler · · Score: 1

      What exactly in my post was trolling? Since when is providing facts and calling out FUD considered 'trolling'?

    10. Re:Issue? What issue? by dgatwood · · Score: 2

      No, the summary is not FUD. The way those services work is that they use a Facebook app. Although they do not have access to your account, per se, the app is running as an authorized app in your account, which means that it can do anything that any other Facebook app can do.

      Even the base level of permissions is more than I would trust an arbitrary third-party site to have. If I'm posting on an Internet message board, I don't normally want to post with my full name and photo, and I sure as hell don't want that website to have a list of all my friends, even if it is just their IDs.

      I am very selective about what Facebook apps I am willing to authorize. I sure as hell will never authorize an app just to be able to post in some online forum. In effect, this means that by making this decision, they will never get comments by anyone who knows enough about computers to know how Facebook's API works. Basically, they'll be cutting the median tech knowledge level on their message boards in half.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    11. Re:Issue? What issue? by Anonymous Coward · · Score: 0

      Soooo there is now a link between my Google identity and my Gawker identity? If so, no thanks. And no I won't blame Google for "let[ting]" me link an account. I will however blame Gawker for *making* me link an account.

      It is new, by definition of it "going" (note the tense) and it should be resisted.

    12. Re:Issue? What issue? by 93+Escort+Wagon · · Score: 1

      Too many people posting here have no clue about how this works.

      To be fair, the submitter doesn't either - at least assuming he is the one who wrote the title for this submission. And, this being Slashdot, a lot of people here probably didn't read any further than the title before commenting.

      --
      #DeleteChrome
    13. Re:Issue? What issue? by Anonymous Coward · · Score: 0

      No they aren't. What they *are* doing is undertanding the implications of linking their google account to another account, particular a comment system.

    14. Re:Issue? What issue? by omnichad · · Score: 1

      Not with Facebook. Their most basic level of authentication gives Gawker your friends list and profile information as well. Read only, but still gives away a lot.

    15. Re:Issue? What issue? by Anonymous Coward · · Score: 0

      You don't get it. That's by design. Media doesn't want nosy, knowledgeable people commenting on their ridiculously slanted and misleading "news". Nor do they want intelligent people commenting, pointing out outright lies, omissions and other kinds of similar behavior among "the powers that be". This "Pappieren bitte!" trend of late, is nothing but a further attempt at shutting such people up.

      No, they want stupid people commenting, who preferably cheer for the party line or just are too stupid to see what's in front of them, but just feel the need to reassure themselves and everyone else that everything is alright, etc. Because that's what serves their interest. Smart people making comments are a threat, they might teach other readers a thing or two or raise questions the "media" and their owners, who also BTW happen to pretty much "own" the political parties lock, stock and barrel, would prefer weren't.

    16. Re:Issue? What issue? by Anonymous Coward · · Score: 0

      Ahh.... but Gawker has that now with their stupid star system.

  12. Where's the cash grab tie in? by icebike · · Score: 4, Insightful

    Just because you let Google handle the login doesn't mean Gawker gets anything more from you than an email address which you were already obligated to provide in the past. And since Gmail is already great at handling spam, there is precious little opportunity for Gawker to profit from this by selling your email address. Spamming Gmail accounts is already a fools errand.

    At least in Google's case, they glean nothing either, other than the fact that you use Gawker, but any advertising revenue that comes to google via that knowledge goes to Google, and not Gawker. All they provide Gawker is a YES or NO answer when you ask to log in.

    Given the rapidity with which one can create gmail/facebook/twitter accounts it won't assure "secure and responsible" posting either. Its easy enough to have an account that is reserved for such postings, even one per web-site if you want.

    All this does is allow Gawker to off-load all user account stuff to some other entity, making them less of a hacking target, because there will be Nothing Much There to Gain. (Some would say this is an attribute of Gawker Media in general.) Having one less web site holding my passwords in an insecure database is a plus as far as I am concerned.

    --
    Sig Battery depleted. Reverting to safe mode.
    1. Re:Where's the cash grab tie in? by Relayman · · Score: 0

      And how do I verify that I'm actually signing on to Google and not a phish popup? There is no URL and no security icons showing. I'm going to right-click next time and see if I can find ANYTHING that assures me that I'm not being phished.

      --
      If I used a sig over again, would anyone notice?
    2. Re:Where's the cash grab tie in? by Anonymous Coward · · Score: 0

      How dare you bring your silly 'facts' into this discussion. Don't you know thatGawker is evil!? EEEEEEEVIIIIIIIIIIIIIIIIL!!!!!!!!!

    3. Re:Where's the cash grab tie in? by Desler · · Score: 1

      Because you get directed to Google's login page.

    4. Re:Where's the cash grab tie in? by capnchicken · · Score: 2

      It's unbelievable how far I had to scroll down to find this. Handing off your authentication to another more established entity is a growing trend. I don't remember seeing so much vile when OpenID showed up, but apparently its bad if Gawker uses it, and only wants to use it with the most established entities in the industry. IMHO, it speaks of a pretty good risk assessment after having such a huge security breach.

      --
      A libertarian shat on my carpet once. Claimed the free market would sort it out. -Ford Prefect(8777)
    5. Re:Where's the cash grab tie in? by icebike · · Score: 1

      Because you get directed to Google's login page.

      More precisely: A direct to Google SECURE login page. https.

      And you can control what that login will offer on your dashboard: https://accounts.google.com/IssuedAuthSubTokens?hl=en

      --
      Sig Battery depleted. Reverting to safe mode.
  13. Lifehacker by slapout · · Score: 4, Insightful

    I really wish someone would buy Lifehacker. I really like it but not Gawker.

    --
    Coder's Stone: The programming language quick ref for iPad
    1. Re:Lifehacker by GameboyRMH · · Score: 1

      Jalopnik should be liberated as well. The journalistic value has gone downhill from the early days but at least it's entertaining.

      --
      "When information is power, privacy is freedom" - Jah-Wren Ryel
    2. Re:Lifehacker by Anubis+IV · · Score: 3, Insightful

      Someone did buy Lifehacker. Unfortunately, it was Gawker. I liked them a lot better back when Gina was still around and Gawker wasn't their corporate overlord.

    3. Re:Lifehacker by Anonymous Coward · · Score: 0

      Same here. I used to read daily when Gina T. was there. But she left, content got crappier, and the site redesign was a total turnoff. Nowadays, I visit once a quarter maybe.

    4. Re:Lifehacker by alphax45 · · Score: 1

      She is on TWiG every week.

      --
      K Man
    5. Re:Lifehacker by darrylo · · Score: 1

      This. It was great when Gina was around, but I believe the quality can, IMO, "vary wildly". My favorite was last year's article on "Thawing Frozen Food in the Washing Machine". I kid you not.

    6. Re:Lifehacker by leolaporte · · Score: 2

      Sorry to report, Nick Denton _started_ Lifehacker. It was always a Gawker property. Kind of tainted it for me.

      --
      Leo Laporte - Chief TWiT, TWiT.tv
    7. Re:Lifehacker by Anubis+IV · · Score: 1

      I stand corrected. Not sure why I believed otherwise. In checking it out, I can't find anything to support my former belief and plenty that indicates you are correct.

    8. Re:Lifehacker by Anonymous Coward · · Score: 0

      Agreed. I still read it but the post quality has really gone down hill. What is with them cross-posting EVERY SearchReSearch? If I wanted to read SearchReSearch I would subscribe to SearchReSearch's RSS feed. Also most of the current writers seems to be very obnoxious. One post was actually a repost from their own site less than a month ago. Someone called them out on it and they just said it was such a useful tip they thought it should be posted again.

    9. Re:Lifehacker by Anonymous Coward · · Score: 1

      Jalopnik should be liberated as well. The journalistic value has gone downhill from the early days but at least it's entertaining.

      That's already happened; many of Jalopnik's best authors have migrated to The Truth About Cars.

      (Not only is the writing better, but TTAC also liberated auto enthusiasts from Denton's Javashit-and-attention-whoring-dependent commenting system. The harder he tightens his grip, the more talent slips through his fingers...)

    10. Re:Lifehacker by LinuxIsGarbage · · Score: 1

      I agree. Of the Gawker empire it seems to have the least childish commentors, and least ranting/swearing articles.

      I also agree though that the quality of the posts have gone down. With the likes of Gina, there was a lot more original content. Now it seems more about keeping post count up, and there's more and more reposts from other sites. Not only that but reports that are wrong, or weren't tested. There was also a while where they were obsessed with really cheesy DIY's. Cinderblock speakerstands, lamp speaker stands, and endless laptop/iphone stands made out of all sorts of garbage.

      Commentorship really went down. After the site redesign comments on open thread have dropped by half.

      But the other sites are really bad. Gizmodo swears a lot, and Jason, Jesus, and co love to swear, and love to love the iPhone, love to steal iPhones, and love to banhammer people over nothing.

    11. Re:Lifehacker by Anonymous Coward · · Score: 0

      Are you serious? Lifehacker is for your mother; not for a Slashdot reader. It's like calling yourself "Super Pro Car Hacker" and then your articles focus on "how to start your ignition" and "how to fill your tires with air".

  14. Don't have any of those accounts by amiller2571 · · Score: 2

    So what about those like me, who don't have an account on those social sites?

    1. Re:Don't have any of those accounts by Caerdwyn · · Score: 3, Informative

      Then you can't be monetized, and therefore are not of interest to Gawker. From his perspective, you take but contribute nothing in return. Cynical, but Gawker's a business not a charity. They're also criminals, but that's another matter.

      Denton's right about comment sections being basically useless, though. Just look around you. Look at Slashdot's comments. Just a bunch of adolescent OS bigots who don't know shit.

      Yes, I am aware of the irony.

      --
      Everybody gets what the majority deserves.
    2. Re:Don't have any of those accounts by icebike · · Score: 1

      So what about those like me, who don't have an account on those social sites?

      Seriously, how hard is it to set up a Gmail account, even if using a fake name.
      If you got an android device, you already have a google account.

      --
      Sig Battery depleted. Reverting to safe mode.
    3. Re:Don't have any of those accounts by Anonymous Coward · · Score: 0

      If you got an android device, you already have a google account.

      /me checks

      Nope. Didn't you click the Create Later button?

      And it is amusing what messages the phone generates in this corner-case.

      Sync is having difficulties. It will be back soon.

      No sir it will not!

    4. Re:Don't have any of those accounts by Elbart · · Score: 1

      Seriously, how hard is it to set up a Gmail account, even if using a fake name.

      Violation of ToS. Most likely the same for Twitter and Facebook.

    5. Re:Don't have any of those accounts by Anonymous Coward · · Score: 0

      Nope. Not gmail tos.

  15. That's it I'm Gone by Anonymous Coward · · Score: 0

    Gawker has been rapidly declining in quality for the past six months. This move seals it, the three sites which I visit regularly are gone from my favorites bar. There are too many good sites where I can waste time.

  16. Punters by koan · · Score: 2

    I'm on the Internet where I'm going to sign up for Facebook, Twitter, Gawker, ETC, let them all build a marketing profile off me, let them build a record of my email addresses and friends/associations, allow them to build a psych profile, allow them to determine my worth, and finally I'm going to give them all that for free.

    Goldman Sachs referred to their clients as "muppets" I wonder what the above refers to their customer as...

    --
    "If any question why we died, Tell them because our fathers lied."
    1. Re:Punters by chrismcb · · Score: 1

      , and finally I'm going to give them all that for free

      No you aren't. You are getting something in return, therefore you aren't getting it for free.

    2. Re:Punters by Anonymous Coward · · Score: 0

      If you consider vacuous commentary and banal tweets "something" then you are correct sir, never mind that the trade is in their favor and not in yours, I want money fuck the rest.

    3. Re:Punters by thejynxed · · Score: 1

      That's not enough compensation. I should be paid for reading their tripe.

      --
      @Mindless Drivel: 100% of Twitter posts ever Tweeted.
    4. Re:Punters by doston · · Score: 1

      I'm on the Internet where I'm going to sign up for Facebook, Twitter, Gawker, ETC, let them all build a marketing profile off me, let them build a record of my email addresses and friends/associations, allow them to build a psych profile, allow them to determine my worth, and finally I'm going to give them all that for free.

      Goldman Sachs referred to their clients as "muppets" I wonder what the above refers to their customer as...

      Probably refer to them as "Users" as in addicted drug Users. They might emulate Mr Burns and refer to them as "Organ Banks", "Chair Moisteners", or "Fork and Spoon Operators".

  17. So, basically what they are saying is... by Anonymous Coward · · Score: 0

    "We suck at security, so here, login with your Facebook, Google+, Twitter if you wish you comment."

    BRILLIANT IDEA. Brilliant idea indeed.
    Let's just admit failing so hard to the entire internet, then tell them to hand us over other information so that, in the likely case we now get hacked again, you lose even more of your life!
    Huzzahs all around.

    Gawker, you really know how to make a geek happy.

  18. "responsible" posting? by Bieeanda · · Score: 1

    Seriously? Given how many people happily make wall posts that range from the simply offensive to the downright illegal?

  19. Gawker already has 10 tracking services by Animats · · Score: 2

    Gawker already uses tracking from Google, Facebook, Quantcast, Dedicated Networks, Comscore Beacons, Google Analytics, ChartBeat, DoubleClick, Parse.ly, New Relic. (Abine.com has a tool to detect and block such things.)

    Now Gawker wants an anal probe, too?

    1. Re:Gawker already has 10 tracking services by Anonymous Coward · · Score: 0

      Blow things out of proportion much?

  20. Who cares? by johnny+cashed · · Score: 1

    Just use your fake facebook page for your logon. Don't have a fake facebook account? Well that sounds like a personal problem. Poison the data well, make fake accounts. Garbage in, garbage out.

    1. Re:Who cares? by Altanar · · Score: 1
    2. Re:Who cares? by johnny+cashed · · Score: 1

      Feel free to report me them. PS, the facebook johnny cashed isn't me. You need to be sure of your target before you shoot. Good luck tracking down all the Robert Smiths while you're at it.

    3. Re:Who cares? by Anonymous Coward · · Score: 0

      That's wonderful! A fake name nazi!

      While you're at it, how's my grammar.

      I notice you don't use your real name here.

      idiot

    4. Re:Who cares? by brit74 · · Score: 1

      I believe sites that use Facebook-based comment systems have various ways to validate the Facebook account. (I assume this is done by facebook, not the site itself.) But, one test they use seems to be that they count the number of facebook friends you have. If you don't have any Facebook friends, they'll probably assume you're a fake account. This means you need to go and find some fake friends to go with your fake Facebook account. I believe this is also why I occasionally get facebook requests from fake-looking facebook profiles. I think it's spammers trying to increase their facebook-friend count so that they can spam sites.

    5. Re:Who cares? by Anonymous Coward · · Score: 0

      I've had a fake facebook account almost since fb went live, and I've never friended, nor been friends with, anyone.

      So I really don't know wtf you're talking about.

    6. Re:Who cares? by johnny+cashed · · Score: 1

      That is basically my point. I just made a comment last week on a site that required a login with a choice of various ones (twitter, FB, and others). What I did was create a fake facebook account, and posted my comment. Maybe my account will be suspended or deleted in the future, but I already made my comment on the site that required a login. If I can create a fake facebook profile and comment, then what is the point, unless I'm a frequent commenter (which I'm not). I did this not so much because I want to remain anonymous, but because I'm tired of sites that want me to use my FB ID to get into their site or comment.

      Gawker Media can go screw themselves anyway, it isn't like they have high journalistic standards anyway. I might have visited their site a few times, I always feel like I wasted my time in doing so.

      To me this isn't about Gawker, this is about leveraging off of various other social media. I don't want to be someone else's leverage. Unless there is something in it for me.

  21. Re:Any site doing this needs their head examined.. by Eponymous+Coward · · Score: 2

    > I have no idea why websites like using other social networks for authentication

    It's just a way to remove a barrier to entry. Everybody already has a Facebook, Twitter, or Google ID. It's easier (and arguably more secure) to authenticate through one of those services than to ask the user to make and remember yet another set of credentials. There are other reasons as well, but this one is a biggie.

  22. Don't worry by GameboyRMH · · Score: 5, Funny

    Didn't you read TFS?

    Gawker is "putting our account security layer in the hands of some of the best in the business — major sites with more security expertise and resources than anyone else on the web."

    You can rest easy, HBGary is on the case!

    --
    "When information is power, privacy is freedom" - Jah-Wren Ryel
    1. Re:Don't worry by Ihmhi · · Score: 1

      This sounds like the kind of story geeks would tell around a campfire if they ever left the basement.

    2. Re:Don't worry by rot26 · · Score: 1

      Are you saying we can't build campfires in the basement any more?

      --



      To ensure perfect aim, shoot first and call whatever you hit the target
  23. Fuck Nick Denton and Gawker Media by Anonymous Coward · · Score: 0

    I don't need anything they are selling and I never will.

  24. Thansk for the warning by future+assassin · · Score: 3, Insightful

    on telling us your devs are not capable of doing their jobs and letting me know I can't use your site because I don't want to use any of the social sites.

    --
    by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
  25. Re:Any site doing this needs their head examined.. by Anonymous Coward · · Score: 0

    It's just a way to remove a barrier to entry. Everybody already has a Facebook, Twitter, or Google ID. It's easier (and arguably more secure) to authenticate through one of those services than to ask the user to make and remember yet another set of credentials.

    No it isn't, all content frameworks have a module for this, the cost is effectively zero and already exists. The only reason iss to make money from targeted adverts once they (and FB or whoever) sell the data. It provides an addition metric to charge *more* for ads. Which is why most sites don't put their content on youtube, preferring retarded bespoke flash playback. They can't use your viewing details to sell to advertisers.

  26. Re:Any site doing this needs their head examined.. by Anonymous Coward · · Score: 2, Informative

    There are many good reasons. If I were building a new web site from the ground up, I'd probably only allow Google/FB authentication. If I had an existing web site with local authentication, I might switch and I'd definitely prefer Google/FB auth.

    You have to analyze the decision from a business/marketing perspective. Site specific logins are a barrier to using any web site. If it is just one click to login with Google/FB you will get a lot more users, it's as simple as that. And returning users have a big barrier to remember username and secure password, particularly if you put onerous restrictions on password strength.

    Then there are other softer costs. Managing passwords is troublesome, sometimes requires customer service to intervene or lose users. If you get hacked, you'll have a PR nightmare. Security is hard, better to let someone else with a dedicated staff do it.

    And that doesn't even go into the benefits of using social network authentication, like being able to better quality information about those users and get them to draw other users from their network in.

  27. Re:Any site doing this needs their head examined.. by Anonymous Coward · · Score: 0

    Can also be faster, but more than that, this also facilitates targeted ads - a great moneymaker for both Google and Facebook.

    We can probably see that as both a budget cut and cash grab. And Gawker can boot a part of his own security team. And yeah, I don't like this decision.

    After all, I'm very happy being an Anonymous Coward on /.

  28. I wonder... by JustAnotherIdiot · · Score: 1

    ...how fast I would be barred for commenting with a twitter handle "IReallyHateGawker"

    --
    What do I know, I'm just an idiot, right?
  29. Password Reuse: by Hartree · · Score: 1

    After all the warnings from about not using the same password on multiple sites the New Hot Thing(tm) is to use a single logon like facebook or google.

    If that's guessed or compromised, it can be used at many sites.

    How is that any less of a security problem?

    The fuuture: "We at Crudnblood Bank value your security. Please log in to your account with your Facebook or Google login."

    1. Re:Password Reuse: by Anonymous Coward · · Score: 0

      Worse than that. They will make extra profit by selling your transaction history to Facebook who will target ads accordingly.

  30. Re:Any site doing this needs their head examined.. by Kenja · · Score: 1

    They likies the monies.

    --

    "Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
  31. You Get Who You Write For. by Plastic+Pencil · · Score: 2

    Denton: "The idea of capturing the intelligence of the readership — that's a joke."

    Ok, I admit, I find some interesting stuff on occasion on Lifehacker, but that aside, with the insidiously moronic nature of the typical Kotaku article, churned out 3 or 4 times per hour, who else does he expect to comment on such contrived stories as this:

    http://kotaku.com/5567040/star-treks-levar-burton-is-not-pleased-with-e3

    Or just posting random unnamed sources with PS4 specs that sound absurd. No one would get into a protracted, irrational debate about that, based on idle speculation ...
    http://kotaku.com/5896996

    And here's a real think piece from Gawker.com today:

    gawker.com/zooey-deschanel

    Can't believe more rocket scientists and doctors aren't jumping in to elevate the conversation...

    1. Re:You Get Who You Write For. by tlhIngan · · Score: 1

      The problem is twofold - all the good writers left, and the damned site design killed off all the thoughtful commenters and pageviews shrunk.

      Because pageviews shrunk, all the leftover writers (who are paid by the pageview) have to scramble to raise viewership or get stuck with ever-shrinking paycheques.

      So writing goes down, and it's more trolling and flamebaiting to get the eyeballs in. And when you stoop to that level, the only people who comment are trolls and it spirals down from there.

      There are many more forums and commenters that offer wise and insightful comments. I mean, even /. have more thoughtful commenters (if you browse at +1) that what you get at gawker. Some other communities have even better commenters (e.g., Ars Technica), because their writing is generally high quality, unbiased (Gizmodo has officially claimed to be biased a few weeks ago), and informative. LIkewise the comments are same.

      There are too many problems at Gawker. From lousy site design (you can't open more than 10-20 tabs before your browser chews through memory and CPU cycles - doing what in javascript, I don't know), to articles that really are flamebait to the loss of all the original writers. Gawker's dying.

    2. Re:You Get Who You Write For. by Plastic+Pencil · · Score: 1

      I totally agree. I find it ironic (but not unexpected), as owner of the network, Denton is acting like he isn't playing a direct role in all of this. It should go without saying, but if he really cared about the quality of the commenters, he'd take a serious look at what he's putting out there.

      He probably doesn't care though, the move to facebook logins is probably just a money thing.

      I hope your right, and Gawker does die.

  32. Exodus by DEFFENDER · · Score: 1

    And this is why I avoid them like the plague.... Well that and the political smear story they ran a couple years back.

    --
    Careful what you say around me.. I will assume you mean it.
  33. well, fuck Gawker then by DynamoJoe · · Score: 1

    I've got other places to be.

    --
    bah.
  34. You are not registered. Attend to this discrepancy by Animats · · Score: 1
  35. Re:Any site doing this needs their head examined.. by Anonymous Coward · · Score: 0

    Facebook has a much better history of security competence than Gawker does. Gawker just doesn't want to deal with the headache anymore, not after what happened a few months ago.

  36. Re:Any site doing this needs their head examined.. by icebike · · Score: 1

    Exactly.

    Gawker gets nothing more than your email address (which they already used to require). They ask google if you are who you say, and google logs you in. Gawker never gets your google password, and stores nothing on their own servers (they don't even have to store your gmail address, because your browser will do that for you). At most, Gawker gets a YES or NO, and maybe the name you signed up to Gmail with.

    This makes any site more secure, because you have nothing there for hackers to steal.

    --
    Sig Battery depleted. Reverting to safe mode.
  37. Can you say Faux Facebook Account ten times fast? by Anonymous Coward · · Score: 0

    > milk ... commenters' social networking accounts for targeted ad revenue?

    Let me know how that works out. I use a dummy Facebook account to comment on Gawker sites. (And I've got dummy Google+ accounts too.) You want to target ads at a FB account I hardly ever look at. Knock yourself out.

    So I'm probably in the 0.01% and he'll make money on the other 99.99%. Meh.

  38. Solved the problem by Anonymous Coward · · Score: 0

    So um...just create a fake Gmail or Facebook account?

  39. It does give them more information by pavon · · Score: 2

    Just because you let Google handle the login doesn't mean Gawker gets anything more from you than an email address which you were already obligated to provide in the past.

    The only situation where that is true is where you previously provided them an email that was already associated with a social networking account (like GMail is). You could avoid providing Gawker with information about your social networking account by using an unrelated email account. No you know longer have that option. You must authenticate using some method which tells Gawker the account you use for social networking. And this is useful information to them. Gawker advertizes on Facebook, this indirectly gives them access to demographics information about the accounts they are advertizing to, which they can now link with Gawker accounts.

    All this does is allow Gawker to off-load all user account stuff to some other entity, making them less of a hacking target,

    Except research is showing that outsourcing this task is more difficult than people think. Sites that do so are more likely to make a mistake that results in a data breech than those who use their own in-house authentication. Any sort of cross-site integration is tricky from a security point of view, and this is no exception. They haven't made things more secure, they have just introduced another point of failure.

    1. Re:It does give them more information by icebike · · Score: 1

      Try this example.

      Log out of Google if you are logged in.

      Go to CNET.COM

      Click Login (upper right), then the little "Sign in with Google icon.
      Notice you get a HTTPS (Secure) page from Google. Google is the only one that sees your LoginId or your Password.
      It sends a token to Cnet. Maybe sends your Gmail name (real or fake).

      CNET gets nothing more. You control access to this via your Google Dashboard: https://accounts.google.com/b/0/IssuedAuthSubTokens?hl=en

      If you were already signed in to Google when you went to Cnet, clicking Cnet's sign in with google button already knows about you, and may not ask for a password (unless your sign in was many minutes ago).

      So you never actually give Cnet anything. At most they might get an OpenID login and it might contain a name and email, but then they had previously been collecting that (and having it stolen) anyway.

      This is how Gawker will work when they get it established. And no, its not that hard any more, and the problems mentioned in the article you linked were fixed. OpenID4Java has been patched with the fix in version 0.9.6.662 (19th April, 2011)

      Note that I don't consider a gmail account a "social networking" account. Some people have dozens of them.

      Your statement :

      Gawker advertizes on Facebook, this indirectly gives them access to demographics information about the accounts they are advertizing to, which they can now link with Gawker accounts

      is very worrisome (if true), and its part of the reason I refuse to ever open a facebook account. Google does not provide this kind of information, with any degree of specificity. All Gawker would get from Google is your email address and name. They get access to NOTHING more, directly or indirectly.

      --
      Sig Battery depleted. Reverting to safe mode.
    2. Re:It does give them more information by Anonymous Coward · · Score: 0

      People keep repeating what you just posted.

      Fun times:

      OpenID has a long-standing bug where your logged in stuff is kept in your browser history.

      For instance:

      1. Log into site A) using your OpenID, and then site B) which you are using, in this case, one of the various Gawker sites.

      2. Log out of both sites.

      3. Go to your browser history

      4. Copy and paste the url from that last closed Gawker site.

      5. Stare in disbelief as the site loads fully authenticated.

      Granted, it will only work for a limited time per site, because the OpenID code forces you to provide a decay timer (but once you pop that page back open, guess what gets reset), but if a piece of malware is specifically crafted to harvest and take advantage of what it finds in your browsing history (numerous sites on the internet already read and record your history), you could find your account exploited.

      It is not out of the realm of the impossible. Also, this was already mentioned on StackOverflow sometime back in 2011, and still hasn't been fixed.

  40. Not happening with,me by rickb928 · · Score: 1

    1. I don't even link my Pinterest boards with my Facebook account.

    2. I've never visited gawker until just now, to see if it could possibly be worth the trouble. Answer is no.

    --
    deleting the extra space after periods so i can stay relevant, yeah.
  41. Tracking data outside of Facebook by Anonymous Coward · · Score: 0

    If you're account is associated with Facebook, Twitter, what not. What is stopping Facebook from crawling these websites and tracking down every single comment made on every single article and associating it with your account and part of your information?

  42. Nah...I'm not giving shit to Gawker Media by PopeRatzo · · Score: 1

    I now require Gawker Media to link their lips to my ass.

    There...I've just changed my TOS agreement to reflect this change in policy. Their continuing to exist represents their assent to this binding legal contract (and by the way, they also agree to give up any right to legal recourse beyond binding arbitration before a panel made up of me).

    I can't tell you how much richer my life has become since I've decided to jettison any commercial entity who I believe is hostile to my best interests. I'm saving thousands of dollars in money and hours of time by simply categorizing any corporation that wants to treat me like a commodity as officially dead to me. Putting all these commercial entities on a permanent pay-no-mind list is incredibly liberating and exhilarating.

    There are still enough companies that have a business model where they provide a product or service for a reasonable price which I choose to purchase that my new policy of erasing entire categories of corporations from my life has not meant any deprivation to me at all.

    I once used Ghostery and Ad-block and such in judicious manner, choosing only to block corporations whose infractions were egregious. Now, I just block everything and only let through the corporations that I want to support - those that do not require a direct hook-up to my private life because...because fuck you. Surprisingly, I do not miss the "richer end-user experience" that those direct hook-ups provide. Now, I don't care at all that my little decision doesn't mean squat to these corporations, or whether anyone else decides to do as I have done. I don't care because I'm doing it entirely for my own benefit, not to change their behavior or to convince anyone else. Just for me.

    --
    You are welcome on my lawn.
    1. Re:Nah...I'm not giving shit to Gawker Media by SydShamino · · Score: 1

      Do you put your TOS in your HTTP GET requests?

      --
      It doesn't hurt to be nice.
  43. Re:Any site doing this needs their head examined.. by icebike · · Score: 2

    Call me naive, but I have no idea why websites like using other social networks for authentication. Is there something so secure that I can trust Facebook with any and all logins and passwords for not just me, but all my users?

    I won't call you naive, just misinformed.

    1) Gawker will not know your Google/FB password.
    2) You won't have a Gawker password any more.
    3) Gawker asks google to authenticate joerandomuser@gmail.com
    4) Google pops up a SECURE web page and gathers your gmail password
    5) Google sends Gawker a YES or a NO, and possibly your name.

    That's it. You have one less password, and you get logged in with what ever gmail account you enter. That gmail account need never be stored on Gawker's server, (unless you ask for notifications of replies or something). Gawker never has any passwords at all.

    This makes Gawker less of a hacking target.
    It frees Gawker of having to maintain any login system of their own.
    It reduces cost.
    You still maintain fine grained control of which sites can use this facility (at least with Google via your dashboard).

    See https://developers.google.com/accounts/docs/OpenID?hl=pl-PL for an explanation of how it works.

    The upshot: You want this. You didn't know how it works, so you rightly mistrusted it. But Its better.

    --
    Sig Battery depleted. Reverting to safe mode.
  44. What's the big deal ? by Anonymous Coward · · Score: 0

    So Gawker finds out that all of their commenters are "evidently" people who are new to the internet since they all have Facebook/Google/Twitter accounts that were just created in the last day or two.

  45. Use Tor! Screw them all! by Anonymous Coward · · Score: 0

    The Tor Browser Bundle is easy as pie to download, install, and execute. Avoid sites requiring registration unless you can do so using fake accounts in Tor with fake info. Try TORMAIL.net or SAFE-MAIL.net for some good free e-mail services which work well under Tor.

    Read this as a primer or refresher before you begin:

    Tor Operations Security
    - http://cryptome.org/0005/tor-opsec.htm

    Please disregard references to Scroogle, which is dead, at least for now.

  46. Re:Any site doing this needs their head examined.. by tqk · · Score: 1

    Everybody already has a Facebook, Twitter, or Google ID.

    Check your assumptions (or did you mean, "everybody that matters ..."?). I disagree. If you don't know why, you haven't been trying very hard.

    --
    "Tongue tied and twisted, just an Earth bound misfit ..." -- Pink Floyd.
  47. Re:Any site doing this needs their head examined.. by Anonymous Coward · · Score: 0

    No it isn't, all content frameworks have a module for this

    Barrier to entry for the user; not the developer.

  48. Re:Any site doing this needs their head examined.. by mutube · · Score: 1

    No it isn't, all content frameworks have a module for this, the cost is effectively zero and already exists.

    This isn't about barrier to entry for developers but for users. Creating an account on a new website means going through a singup form (+/- captcha), getting an email, clicking a link in the email, and then remembering the details for future use. All before knowing if what you're signing up for is really worth it. In comparison signup via social networks require (at most) two clicks and no commitment. You can see what information the receiving site is going to get and Y/N appropriately.

    I can attest the effectiveness of this. On a group of sites I've been working on the signup rate is considerably higher via social login (Google, Facebook, Twitter, etc.) than regular login options.

    The only information we get through from the services is email and avatar so I can't see the opportunities for targetted advertising (at least from our end). What do you mean?

  49. Re:Any site doing this needs their head examined.. by omnichad · · Score: 1

    Facebook Connect gives them access to your friends list and profile information. Definitely more than just your email and YES/NO.

  50. No big loss by Anonymous Coward · · Score: 0

    I suppose that since I don't have a Facebook, Twitter or Google account I won't be commenting there. Then again I got banned from commenting for speaking my mind about Gawker's biased reporting so. No big loss.

  51. Re:Any site doing this needs their head examined.. by Anonymous Coward · · Score: 5, Insightful

    The upshot: You want this. You didn't know how it works, so you rightly mistrusted it. But Its better.

    No, I don't want this.

    It's none of Google's business what I do on Nick Denton's sites. And it's none of Nick Denton's business what my G+/Y!/FB profile was.

    If I had any use for Gawker Media, all it means is that I'd have to set up yet another browser profile and associate that with whatever disposable email address I'd originally created for use with his sites.

    Anyone who gives a damn about security or privacy issues knows the value of compartmentalization, and ought to be rightfully resentful of any attempt to bridge unrelated accounts.

  52. look at it another way by citylivin · · Score: 1

    "Just look around you. Look at Slashdot's comments. Just a bunch of adolescent OS bigots who don't know shit. "

    In soviet russia, adolescent os biggots don't know shit about YOU!

    (and here gawker is trying to change that!)

    --
    As a potential lottery winner, I totally support tax cuts for the wealthy
  53. And nothing of value was lost by denmarkw00t · · Score: 1

    I mean, seriously, Gawker's comment system is a wreck - as are the comment sections of most sites - and this doesn't really bother me. I think it could even be a Good Thing in some regards, as you're likely to find bigoted idiots posting something offensive in the comments for a new Mario Party game on Kotaku - it's ridiculous the things some people say on Gawker sites, enough so that I tend to avoid their sites in general these days (comments + terrible new layout = no thanks).

  54. This would be irritating... by jcr · · Score: 1

    ...if I ever had occasion to view, much less comment on any gawker media site. Those clowns have been on my shit list ever since that stunt they pulled that got them banned from the CES a couple of years back.

    -jcr

    --
    The only title of honor that a tyrant can grant is "Enemy of the State."
  55. Re:Any site doing this needs their head examined.. by icebike · · Score: 1

    Exactly why I would never sign up with Facebook.

    People who do, don't care about that.

    --
    Sig Battery depleted. Reverting to safe mode.
  56. Re:I refuse to enable javascript by b4dc0d3r · · Score: 1

    I'm not sure if you've made the connection - with NoScript, all of those properties display a blank page.

    Enabling scripts brings up the content, and a bunch of stories on the right side where the "posted" time continually counts in *seconds*.

    I am very sensitive to movement, and every second as I read those stories my attention is grabbed by those ever changing numbers. If it's something I really want to read, I enable scripts, refresh, and then revoke temporary scripts immediately.

    I'm not stealing the web from them at all - I click, get an empty page, and close the tab/window. This could not be any more of a non-issue to me. I gave up commenting on only seeing a white page long ago, I figure it's worth one more post just for old times' sake.

    Gawker, io9, LifeHacker, Gizmodo... I assume all of the Gawker properties do the same thing.

  57. Which of those allow more than one ID per person? by davidwr · · Score: 1

    If Facebook, Google, or Twitter allow the creation of multiple accounts per person, problem solved.

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
  58. Symptom of a Greater Threat by Bob9113 · · Score: 1

    Is this a step too far for an online community? Is it a cash grab or a genuine effort to encourage secure and responsible posting?

    It is a symptom of a greater threat. This is a symptom of centralization of social communication. It creates an ecosystem in which defector organizations necessarily emerge and distort communication. Whether any one of the primary centralization actors is actively evil or misguided, the system will necessarily co-evolve entities which exploit the systemic flaw of centralized social communication.

    There are benefits to centralization in terms of economies of scale and specialization of labor and capital, but social communication is too vital to the free mind to allow it to be distorted for such trivial benefits. We can decentralize these systems through projects like Diaspora and WebFinger. We (Slashdotters) are the ones who have the ability to make decentralization possible for the masses -- and those who benefit from centralization are not going to do it for us. I am working on it in my own way, and it is rewarding. Consider lending a hand, if you aren't already.

  59. Re:Any site doing this needs their head examined.. by JohnFen · · Score: 2

    Everybody already has a Facebook, Twitter, or Google ID.

    Not everybody. This infinitely increases the barrier of entry for people like me, who do not have FB or Twitter and is unwilling to use my google ID for anything at all outside of making my phone work.

    In this case, there's no loss. The Gawker family of sites are abysmal anyway.

  60. Re:Any site doing this needs their head examined.. by johnny+cashed · · Score: 1

    This. Mod this guy up. Compartmentalization was the concept I was trying to remember in another comment. I don't want FB/Google/Y! or the other guys watching my every move. It is about some privacy.

  61. Re:Any site doing this needs their head examined.. by JohnFen · · Score: 1

    Creating an account on a new website means going through a singup form

    You know what's even better? Not requiring creating an account at all.

    All before knowing if what you're signing up for is really worth it.

    I would never create an account at a site unless I had a very compelling reason to do so. Certainly not sight-unseen. It doesn't matter if "creating an account" consists of linking to a social network account or doing it the old-fashioned way.

    The only information we get through from the services is email and avatar so I can't see the opportunities for targetted advertising (at least from our end). What do you mean?

    Your end isn't the problem. It's the social site's end that's the problem. If I want to use your site even despite requiring an account somewhere, why in the world would I want to bring a third party into it and allow them to know every time I log into your site? That's just between you and me.

  62. Gawker - what are you gawking at? by Lynchenstein · · Score: 2

    I have increasing contempt for the Gawker content as well - especially Gizmodo, but to a lesser extent Jalopnik. The articles seem to be steadily getting more childish and unprofessional, often with sensationalist headlines and highly opinionated content which tends to draw a raucous comment section. Which, naturally, leads to more page views. Dare to point this out using the same language used in the post and you're banned. That's childish behavior as well. I admit that some of their properties are of higher quality, but the general Gawker enterprise has a whiff of the National Enquirer. It's far less about good blogging, and far more about goofy "look at me" tactics now.

  63. Re:Which of those allow more than one ID per perso by JohnFen · · Score: 1

    Well, Google's official suggestion of how to avoid their cross-service information sharing is to have multiple accounts (one for search, one for gmail, etc.). So it sound like they're fine with it.

  64. Re:Any site doing this needs their head examined.. by mutube · · Score: 1

    You know what's even better? Not requiring creating an account at all.

    Absolutely. But then you're faced with the problem of dealing with large quantities of spam. Captchas etc. can block most stuff but if people can find a way to post something to site they'll happily pay people to do that for them. You can use spam filters (Akismet etc.) and however many other. But then you find yourself spending a lot more time on beating spam than providing things for your users.

    I wish there was some nice built-in standard in browsers to support log in without handing over personal details. BrowserID looked like it might do it - if coupled with a throwaway email - but now they've rebranded that to Mozilla Persona there is zero chance of it becoming cross-browser.

    Your end isn't the problem. It's the social site's end that's the problem. If I want to use your site even despite requiring an account somewhere, why in the world would I want to bring a third party into it and allow them to know every time I log into your site? That's just between you and me.

    I completely agree myself. I would never log into a site with an account from another site for exactly that reason - the thing most people would. It's the old security vs. convenience decision.

  65. What is it? by honestmonkey · · Score: 1

    What is Gawker, anyway? I guess I don't know and don't care. And that's the difference between ignorance and apathy.

    --
    Everything you know is wrong, Just forget the words and sing along.
  66. Re:Any site doing this needs their head examined.. by ramk13 · · Score: 1

    You don't want them to know what sites you log into, but you are fine sharing everything else they collect?? Site logins are trivial compared to everything else they keep. Off the top of my head:

    Search History
    Email contacts
    Actual content of emails (!!!!)
    Friends lists
    Click-out tracking

    GP's comment about bridging unrelated accounts is still valid, though. I can see how people would trust Google/FB, but not Gawker.

  67. Why are we here? by Serious+Callers+Only · · Score: 1

    You know what's even better? Not requiring creating an account at all.

    Read this site at -1 (go on, I dare you, and leave it at that setting), and you'll quickly understand why accounts are a requirement for civil discourse. You can't have moderation or attribution of comments in any meaningful sense without accounts.

    I would never create an account at a site unless I had a very compelling reason to do so.

    I see - please do tell us what very compelling reason caused you to join Slashdot?

    1. Re:Why are we here? by JohnFen · · Score: 1

      Read this site at -1 (go on, I dare you, and leave it at that setting), and you'll quickly understand why accounts are a requirement for civil discourse. You can't have moderation or attribution of comments in any meaningful sense without accounts.

      I frequent a handful of sites that manage it quite well, so it's absolutely possible. I also know of a number of sites that require registration but have comment sections that are as much a cesspool as any.

      Registration, as near as I can tell, doesn't really impact comment quality that much.

      I would never create an account at a site unless I had a very compelling reason to do so.

      I see - please do tell us what very compelling reason caused you to join Slashdot?

      Continuity, essentially. I want all my various comments to be associated with each other.

  68. Re:Any site doing this needs their head examined.. by PeanutButterBreath · · Score: 1

    Your mistake is the assumption that these sites want to maximize comments, and should thus remove barriers. In fact, these sites don't want to deal with the reams of gawdafullness that fill up most comment sections.

    In this regard, turning to social network authentication schemes has two benefits:

    1. Fewer people will bother commenting.
    2. People that comment will have some fear that their behavior will be associated with something they care about protection, i.e. their "real" on-line identity, if not their actual identity, and will thus resist (at least a little bit more) the temptation to be total asshats.

    IOW, broken by design.

  69. Throw-away accounts by LuniticusTheSane · · Score: 1

    Because making a throw away twitter account is so hard ...

  70. Science has an answer! by PeanutButterBreath · · Score: 1

    One benefit of having a name almost as common as "John Smith" is that the signal-to-noise ratio is far too high for anyone to really know what is actually a legitimate hit or one of the other thousands of "John Smiths" in the world. Plus, I happen to share my name with several very famous people, ranging from musicians to professional athletes to actors, so you're going to have to do some serious digging to find a hit that's not related to one of them.

    The obvious solution is to combine all of the information on the various "John Smiths" and judge each by the resulting composite.

    Don't tell me you trust the data mining racket to never come up with that one!

  71. Re:Any site doing this needs their head examined.. by johnny+cashed · · Score: 1

    No, I'd rather "them" not collect anything. I know the trade with gmail, I understand that. I'm trying to keep a handle on what "they" collect on me. It is possible that I'm not tech-savvy enough to block everything, but I'm willing to try my best to obfuscate my personal online habits and browsing. Which "them" are you referring to? I never said I was "fine" with any of this. And before anyone jumps on me, this is news for nerds, not just news for programmers and internet experts.

  72. It is high time to switch to the only service whic by Anonymous Coward · · Score: 0

    h actually respects your privacy: PlainBoards.com.

  73. Re:Any site doing this needs their head examined.. by Mabhatter · · Score: 1

    It also puts some of the users "skin" in the game. If you get banned, then you have to get a new Facebook login too to get back on the site. Those sites don't take kindly to making many fake accounts.

  74. Re:Any site doing this needs their head examined.. by Anonymous Coward · · Score: 0

    it is an easy way to curb incidental bb spamming

  75. OpenID by LordLucless · · Score: 1

    So, basically, this story is that Gawker is switching to OpenID for their authentication system - just twisted around into flamebait.

    Stay classy, slashdot

    --
    Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
  76. Let me get this straight. by __aaltlg1547 · · Score: 1

    They're saying Facebook, Google and Twitter are paragons of data security???

  77. Fake accounts by TraumaFox · · Score: 1

    I don't know if it has been pointed out or if all Gawker sites are doing it, but at least Kotaku is now actively encouraging users to create "fake" accounts on these services, violating their respective ToS agreements.

  78. Re:Any site doing this needs their head examined.. by admdrew · · Score: 1

    No, I very much do *not* want this. I also know exactly how it works (I've played around with fb connect and google authentication for my own web apps). You're confusing peoples' fear of a lack of privacy with a perceived lack of security. Thankfully, I can vote with my feet and never visit gawker media sites.

  79. One more reason... by Anonymous Coward · · Score: 0

    ... why I never comment on web site articles.

    Doh!

  80. What is the Issue? by kyrio · · Score: 1

    Are people now completely unable to think for themselves? It's not like Gawker Media has anything to offer anyone - anything that's necessary in life. In the end, the people that use their sites are dumb enough to agree to anything, which is why this is going to work for Gawker Media, and no amount of "is this a step to far??!??!??!" is going to make any difference.

  81. Re:Any site doing this needs their head examined.. by Eponymous+Coward · · Score: 1

    It comes down to a simple business decision. Adding login via FB (or Twitter or Google or...) gets the site more users than if they make them create an account. Login exclusively through one of these sites also saves them in development and operational costs and lowers the amount of spamming and trolling. It means they lose some users (like yourself), but from the site's point of view, it's a net gain (at least for a Gawker-type sites, it would be different for someplace like Slashdot).

  82. Synchronicity by AnnaZed · · Score: 1

    Interesting when one of their own headlines today is about a hack into someone's facebook account: http://gawker.com/5897485/white-supremacist-hacks-trayvon-martins-email-account-leaks-messages-online