Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth Will Murder Your Children

zachholman.com

Post reply on HN
Print view View original

61–70 of 101 posts

Re: OAuth Will Murder Your Children

#61

Post by generalk »

marshray wrote: post #27
generalk wrote: post #20

Earlier quoted context omitted.

Most users will never analyze the "This application requests the following permissions..." screens; see: anyone that owns an Android phone.

I am not most users. Strangely, neither are most of the people I know. But we're the ones everybody looks to when they need to buy a computer, know if the web is safe, or clean up the mess when it turns out not to be. Quit it with the "most users" reasoning, unless your goal in life is to part fools from their money.

Quit it with the "most users" reasoning, unless your goal in life is to part fools from their money.

I don't follow your reasoning, but still:

Listing granular permissions is like throwing up a confirmation dialog before a destructive action: better than nothing, but more often than not gets ignored.

Yes, after that, your friends call wondering why all their data was deleted or why some app is updating their facebook wall. And you tell them to pay attention next time, and they swear they will.

And they don't.

I don't have a better solution, but that doesn't mean that this is the right one.

Re: OAuth Will Murder Your Children

#62

Post by shasta »

marshray wrote: post #50
joelhaasnoot wrote: post #43

Earlier quoted context omitted.

The problem is lots of calls in the Android API have side-effects or can be used for a variety of reasons. Anytime you have ads for instance, you need internet access. If the app can be moved to the SD card, you need write access to that, and so on and so forth. They're little things but require opening up lots of possibilities.

Yeah I don't really know about Android. The article was really more about web apps. But granular access controls are nearly impossible to implement in practice. Unix had it right all along: a set of limited users, and root. You're doing well if you can even defend that security boundary, anything in-between tends to be root-equivalent on general purpose systems.

That's ridiculous. The Unix security model doesn't even address untrusted applications, unless you think auto-downloading and running Unix executables would work out well. The situation with web security is terrible and there aren't any "good old days" we can revert back to -- every mainstream OS has done it wrong. Good security is difficult and influences many parts of a system, but if it were a priority for any of the big players, it would have already happened.

Re: OAuth Will Murder Your Children

#63

Post by samstokes »

I agree with the OP's conclusion - permissions need to be finer-grained and authorisation prompts more informative. But with OAuth as it stands, those things are under the control of the API provider, and app developers have limited control.

If my app has a button to follow someone on Twitter, my app needs Twitter write permission, which also lets me tweet as you and read your DMs. All I want to do is follow someone, but Twitter doesn't offer finer-grained authorisation, so I have no choice but to pop up the dialog box asking for full write access.

Twitter's an extreme example, but not the only one. The Facebook API also has some unintuitive permissioning requirements (for example, you need more permissions to "like" a post than you do to comment on it). Unless the permission model makes sense to users, apps have a hard time communicating to users why they need the permissions they're requesting. Judofyr's suggestion above would help a lot with this problem, but it's still not something that can be blamed entirely on lazy app developers.

Re: OAuth Will Murder Your Children

#64

Post by AndrewO »

rmc wrote: post #45
AndrewO wrote: post #36

I see a couple of responses saying users don't care about this and they'd never read a dialog box. Honestly, if that's the case, what's the point of OAuth then? Why don't we just go back to handing over usernames & passwords and trusting some 3rd party to not do anything nasty? With everyone constantly complaining about Facebook privacy concerns and hijacked Twitter accounts, how can anyone pretend that conditioning…

OAuth has some advantages over storing passwords, firstly you're not giving your password away. Password reuse is very common, if you give one site your Facebook password, they probably have your email password. It also easier to revoke access to just on app, previously you had to change your password and then update all the other apps

I admit there was some slight hyperbole there. Let's say it's one better than giving out your password because it cuts down on the password reuses issue and you can revoke.

If that's all that OAuth will ever get us, then it's a failure: either because the goals of the spec were infeasible or because developers weren't able to use it to its fullest (I lean toward the later).

OAuth is not about solving password reuse. It's about granting other clients rights to specific resources on your behalf. It's about telling a 3rd party app they can tweet once, and not read my direct messages; they can read my Gmail contacts, but not send; and so on...

I for one believe in the need for this. But the original poster is right: as long as developers request blanket permissions, I'm not going to use their apps. I may be in a small category, but I'll ask again: is this the kind of behavior we want to condition into users?

Re: OAuth Will Murder Your Children

#65

Post by pretz »

orangecat wrote: post #19
bryanlarsen wrote: post #4

Android needs this too, perhaps even more than OAuth does.

My first thought as well. It annoys me when apps add optional "sharing" features that require access to my contact list, and there's no way to allow the app to run without those permissions. And the Internet and SD card permissions are too coarse-grained; developers should be able to list specific directories and hosts that the app can access.

Trust me, as an app developer it annoys me too that there's no easy way for me to allow users to opt-out of contacts access. Making a second app is just too complicated.

Re: OAuth Will Murder Your Children

#66

Post by StavrosK »

mikedouglas wrote: post #30
tptacek wrote: post #14

Earlier quoted context omitted.

Both OS X and WinAPI do this now. Users (in general) hate it. You make a good point, but it's going to have little impact in the real world. People livin' in that 21st century do it better'n anybody you ever seen do it and they want their Kanye analysis now; they ain't got nothin' to lose! They rollin'! I am deadly serious.

Users dislike it on Windows because requesting elevated privileges became so common that they rationally chose to tune out. Had Windows been designed from the start with UAC, developers would have been less cavalier in requiring administrator abilities, then maybe a UAC request might actually have meant something. Given that so many legacy games request privilege authorization, it's no wonder the users don't take it…

Your point about Android is half correct, yes I like seeing what the app needs to access, but I don't see why. Why does your calculator app need access to the internet? I know the author can just offer some bullshit excuse, but it's better than nothing...

Re: OAuth Will Murder Your Children

#67

Post by brown9-2 »

generalk wrote: post #61
marshray wrote: post #27

Earlier quoted context omitted.

I am not most users. Strangely, neither are most of the people I know. But we're the ones everybody looks to when they need to buy a computer, know if the web is safe, or clean up the mess when it turns out not to be. Quit it with the "most users" reasoning, unless your goal in life is to part fools from their money.

Quit it with the "most users" reasoning, unless your goal in life is to part fools from their money. I don't follow your reasoning, but still: Listing granular permissions is like throwing up a confirmation dialog before a destructive action: better than nothing, but more often than not gets ignored. Yes, after that, your friends call wondering why all their data was deleted or why some app is updating their facebook…

It doesn't matter if "most users" don't care about this level of information as long as they still click "allow", but it does make difference to the minority that do care. So what's the harm?

If they don't care about the information then it's presence doesn't hurt them.

Re: OAuth Will Murder Your Children

#68

Post by lurker17 »

shasta wrote: post #62
marshray wrote: post #50

Earlier quoted context omitted.

Yeah I don't really know about Android. The article was really more about web apps. But granular access controls are nearly impossible to implement in practice. Unix had it right all along: a set of limited users, and root. You're doing well if you can even defend that security boundary, anything in-between tends to be root-equivalent on general purpose systems.

That's ridiculous. The Unix security model doesn't even address untrusted applications, unless you think auto-downloading and running Unix executables would work out well. The situation with web security is terrible and there aren't any "good old days" we can revert back to -- every mainstream OS has done it wrong. Good security is difficult and influences many parts of a system, but if it were a priority for any of…

An untrusted application is handled in running it as a dedicated user, like 'httpd' or 'nobody'.

Re: OAuth Will Murder Your Children

#70

Post by archangel_one »

StavrosK wrote: post #66
mikedouglas wrote: post #30

Earlier quoted context omitted.

Users dislike it on Windows because requesting elevated privileges became so common that they rationally chose to tune out. Had Windows been designed from the start with UAC, developers would have been less cavalier in requiring administrator abilities, then maybe a UAC request might actually have meant something. Given that so many legacy games request privilege authorization, it's no wonder the users don't take it…

Your point about Android is half correct, yes I like seeing what the app needs to access, but I don't see why . Why does your calculator app need access to the internet? I know the author can just offer some bullshit excuse, but it's better than nothing...

I would very much like the checkboxes in Android too, although obviously they'd place a greater burden on developers. For example, I tried installing the official XBMC remote app a while back; it requested all sorts of crazy permissions ("read SMS" etc) which they were intending to use for debatably useful features but I ended up not installing it because of the privacy concerns. In the end I installed a third-party remote app which didn't ring as many alarm bells on installation, but I'd have been happier to stick with the 'official' one if I could selectively disable some of the permissions they wanted.

I can certainly see why that isn't an option; it'd make things much harder for developers if they suddenly have to test against different sets of security permissions. But it's on my wishlist.

Post reply on HN