This is just Spotify not finding a user with username=[your email address] and looking for that user on Facebook.
I did a test by creating an account with the email benjamintesterton@mailinator.com (not linked to a Facebook account) and username benjamintesterton. When I tried logging in with the email, it failed, but with just the username worked.
If logging in with the email did work, it would mean that Spotify authenticated you with their server and then abused your credential re-use to hack your Facebook account. However, this appears not to be the case.
They should just check email=[input] OR username=[input], but that may be backwards-incompatible and break the functionality of people who use their Facebook credentials to login.
Not just finding a user on Facebook with an email address, because they also log into the Facebook account and add their app to it. (Hence the re-activation email as well.) Very shady.
I really doubt this is Spotify's fault. Facebook has quite the trigger-finger when it comes to reactivation -- clicking a like button with the right cookies will do it, IIRC.
That is correct. It says quite clearly "Facebook Email or Spotify Username". It's the user's mistake for using their Facebook account instead of the account they just created.
I don't think it's fair to blame the user for that. This is a standard-looking login form that users will have seen hundreds or thousands of times before. You don't reinterpret the words on a login form every time you see a new one; you type in the stuff to log you in without really thinking about it.
Regardless of Spotify's intentions here, they're benefitting from users' trust in normal login processes to get Facebook account access. Lots of designs exploit users' automatic behaviors like that; see Dark Patterns [1].
Yes, true, but I thought it would be a lot more damning if they also authenticated via Spotify email, because that would mean that they accessed the Facebook account while already having authenticated the user via Spotify credentials.
Comments
This is just Spotify not finding a user with username=[your email address] and looking for that user on Facebook.
I did a test by creating an account with the email benjamintesterton@mailinator.com (not linked to a Facebook account) and username benjamintesterton. When I tried logging in with the email, it failed, but with just the username worked.
If logging in with the email did work, it would mean that Spotify authenticated you with their server and then abused your credential re-use to hack your Facebook account. However, this appears not to be the case.
They should just check email=[input] OR username=[input], but that may be backwards-incompatible and break the functionality of people who use their Facebook credentials to login.
Not just finding a user on Facebook with an email address, because they also log into the Facebook account and add their app to it. (Hence the re-activation email as well.) Very shady.
I really doubt this is Spotify's fault. Facebook has quite the trigger-finger when it comes to reactivation -- clicking a like button with the right cookies will do it, IIRC.
How would the app be installed?
That is correct. It says quite clearly "Facebook Email or Spotify Username". It's the user's mistake for using their Facebook account instead of the account they just created.
I don't think it's fair to blame the user for that. This is a standard-looking login form that users will have seen hundreds or thousands of times before. You don't reinterpret the words on a login form every time you see a new one; you type in the stuff to log you in without really thinking about it.
Regardless of Spotify's intentions here, they're benefitting from users' trust in normal login processes to get Facebook account access. Lots of designs exploit users' automatic behaviors like that; see Dark Patterns [1].
[1]: http://darkpatterns.org/
Yes, true, but I thought it would be a lot more damning if they also authenticated via Spotify email, because that would mean that they accessed the Facebook account while already having authenticated the user via Spotify credentials.