The protocol documentation describes the getfriends and friendof modes, which would be exactly what I'd need... except that these modes both require a password---the user's password.
I'm pretty sure that I shouldn't need to know Bob's password to see Bob's friends list. How do I get around this? A quick example would be most appreciated.