171–180 of 279 posts
Earlier quoted context omitted.
Unless that site is Yelp. Or Pandora. Or... "Always" is meaningless for SAAS that you don't pay for.
Oh yes. Never write in absolutes on HN. I don't know about Yelp but Pandora asks permission. http://www.flickr.com/photos/4braham/5030673157/
I don't use Facebook. Incidentally, I adblocked "facebook.com" the other day, and a lot of sites load much faster now. In three days, the rule has been hit over 1300 times! If I had a Facebook account, this would scare me.
Earlier quoted context omitted.
Will it always do that? Are there any implicit allowances? Will there be in the future? For what's true now, I could look it up. But I'd rather not. For what will be in the future, I have no idea. The simplest thing for me to do is use my Facebook account for Facebook only.
Any information you put on Facebook is susceptible to being used in ways you don't know of or have not authorize for. All information on the internet is like this for that matter. At least currently with Facebook Connect sites FB displays an authorize display laying out the information accessible.
I'm conservative about what I put on FB for this very reason. I consider logging into another site with my FB account part of "what I put on FB."
I am starting a new site and want to avoid authentication. In our system, two users are linked together for the purpose of our service. We do that via unique URLs. Do you think it is safe to match up emails for authentication. i.e. when user 1 wants to get his profile, he has to input his email and his partner's email. If he fails to do that then we do not pull up the profile. Does this make sense and do you think it…
Secure enough for what? The attack is simple: pick a target whose email you know, and then start guessing emails of people you think they might have an account with. This could be as easy as browsing to a website and entering pairs of emails addresses listed on the "About Us" page, or ripping through a person's Facebook friends or Twitter followers. It might be fine for completely non-sensitive data, but for anything…
Earlier quoted context omitted.
what happens if you ad-block google?
Lots and lots and lots of sites fail because they depend on jquery hosted by google.
Earlier quoted context omitted.
The inconvenience of finding/creating a Facebook account to use in joining Quora is, imo, completely worth the value offered by Quora. You have to choose your battles. At a certain point I would rather have access than have my way.
I never bothered to sign up at stackoverflow because of OpenID. Not necessarily because I have some philosophical issue with it, but because I already have a system to maintain this stuff and OpenID is just another hoop to jump through. Adding an optional user/password signup is hardly difficult.
I totally agree with this. I've seen a few things lately that wanted my Facebook login and I just went away instead. OpenAuth (via Google or plain) or private authentication would have been fine, but those weren't options.
The main method of Facebook authentication these days is OAuth (which I assume is what you mean by OpenAuth.)
Earlier quoted context omitted.
I never bothered to sign up at stackoverflow because of OpenID. Not necessarily because I have some philosophical issue with it, but because I already have a system to maintain this stuff and OpenID is just another hoop to jump through. Adding an optional user/password signup is hardly difficult.
The difference with Stack Overflow is that you can, and may people do, use it without an OpenID. Just go ahead and post a question or answer, and you'll be assigned a cookie-based account. And if you put in an email address, you can download a new cookie for that account at any time.