I was up way too late on Monday poking at a side project (a dumb little app that lets you rate your friends' Instagram captions, don't ask) and had to wire up Facebook Login again, which usually means bracing myself for that giant wall of permissions Facebook shoves at people before they've even decided if they trust your app. Except this time it wasn't a wall. It was a short list, with toggles, and I could actually see what I was asking for and take pieces off if I didn't need them.
Turns out that's not an accident on my end, it's Facebook's doing. They ran F8 last week (April 30th and May 1st, over at Fort Mason in San Francisco) and one of the bigger changes they announced was a total rework of how the Login permissions screen works. Instead of the old all-or-nothing dialog where an app could ask for your email, your friends list, your photos, your relationship status and your firstborn child in one shot and you either agreed to the whole pile or walked away, users can now go through line by line and uncheck the stuff they don't want to hand over. New apps also start out only getting your name and profile picture by default. Everything past that has to be asked for specifically and approved by Facebook's review team before it goes live.
Honestly? Good. This is one of those rare cases where I think the platform holder actually listened to how obnoxious their own product had become. I cannot count the number of times I've bailed on signing up for some app because the permission screen wanted access to basically my entire digital life just so I could see a leaderboard for a trivia game. And on the other side, as someone who builds stuff, I never wanted half that data anyway, I just took what was offered because that's how the dialog worked. Now I can ask for exactly what I need and nothing else, which is better for me and less creepy for whoever's clicking "allow."
They also announced something called Anonymous Login, which is a weirder one to wrap your head around. The idea is you can use your Facebook credentials to sign into an app without the app ever getting your name or any profile info at all, until you decide you want to "reveal" yourself to it later. So it's Facebook as a pure identity and authentication layer, no data handoff required. I'm curious how many developers actually build for this rather than just defaulting to the full login, because most apps want your name for basically day one (how else do you show "Welcome back, whoever you are" on the home screen). But as a concept it's a decent nod to the fact that not everyone wants their real identity attached to every random app they try out once and delete a week later.
Zuckerberg also spent a chunk of his keynote basically apologizing for how much Facebook's platform strategy has whipsawed developers over the last few years. He specifically brought up Home, the Facebook-launcher-for-Android thing they pushed hard in 2013 that basically nobody wanted and that quietly stopped getting updates, and said going forward they're committing to two years of API stability so people building on the platform aren't left holding the bag every time Facebook changes its mind about something. I'll believe that promise when I see it survive a full two years without some "sunset" email showing up in my inbox, but I appreciate that they said it out loud in front of a room full of the people who got burned last time.
None of this is a huge, life-altering announcement, I know. It's not a new phone or a chip or whatever. But if you've ever built anything that touches Facebook Login, or even just been a regular person clicking "allow" on some app at 1am without reading what it's actually asking for, this is the kind of change that quietly makes things a little less gross. I'll take it. Now if they'd just do something about apps that still post to your timeline without asking twice, I'd be thrilled.