Facebook held F8 yesterday over at Fort Mason and the headline feature, at least the one everybody in my Twitter feed latched onto, is something they're calling Anonymous Login. The pitch is simple enough: you can now sign into a third-party app using your Facebook account without handing that app your name, your photo, your friend list, any of it. You get a little randomized identifier so the app can remember you came back, and that's basically the whole transaction.
I want to like this more than I do.
Don't get me wrong, the old system was genuinely bad. You'd go to install some flashlight app or a trivia game and it'd throw up that permissions screen demanding access to your entire friend list, your email, your birthday, sometimes even your relationship status, and there was no way to say "actually just let me log in, I don't want you posting on my behalf." It was all-or-nothing. Say no and you couldn't use the app at all. I've clicked "allow" on things I had zero intention of ever letting near my timeline just because I wanted to see if some app was worth using for five minutes. Everybody has.
So the fact that Zuckerberg stood up there and said permissions requests would now be incremental (an app can ask for your email later, when it actually needs it, instead of front-loading every possible request) is a real improvement. Nobody's going to argue with that. And giving developers a rule where they can't quietly change what data they're pulling from you without Facebook re-reviewing the app is good too, assuming they actually enforce it, which is doing a lot of work in that sentence.
But here's my complaint, and it's not really about the feature itself, it's about the framing. Anonymous Login is being talked about like it's a privacy win for users. I think it's mostly a growth play for Facebook. Right now there's a real category of apps and sites that don't use Facebook Login at all because their users don't want to hand over that much personal info just to try a to-do list app. Anonymous Login removes that objection. More apps adopt Facebook as their identity layer, Facebook's login button ends up everywhere, and Facebook quietly becomes the thing standing between you and basically every app on your phone. That's not a criticism exactly, it's just business, but I don't think "anonymous" should be the word doing the marketing here. You're still authenticating through Facebook's servers. Facebook still knows every app you've anonymously logged into, even if the app itself doesn't know who you are. The anonymity is one-directional and I haven't seen anybody point that out plainly yet.
Small tangent, but this is also the same week I finally finished resetting every password I own after Heartbleed, which if you've forgotten already (understandable, it's been a busy month) was the OpenSSL bug that had half the internet telling you to change your passwords back in April. I went through my LastPass vault entry by entry and it took two evenings. Somewhere around entry 40 I started just picking new passwords without really looking at which sites actually needed it, which is exactly the kind of security fatigue that makes something like "just log in with Facebook, one button, done" so appealing in the first place. I get why users want it. I still don't fully trust handing one company that much of the keys.
None of this means I think F8 was a nothing announcement. The FbStart program for startups, the extended App Links stuff for deep linking between apps, the ad network expansion, there was a lot in that keynote and most of the developer-facing stuff sounded genuinely useful if you build apps for a living. I don't build apps for a living, so I'm judging this purely as a person who has clicked "Log in with Facebook" a hundred times without reading a single word of the permissions box.
I'll actually try Anonymous Login the next time an app offers it, mostly out of curiosity about what the identifier they hand you looks like, and whether it's tied to your real account behind the scenes in some way they haven't fully spelled out yet. My guess is yes. I'll report back if I find anything interesting.