Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was annoyed with sites asking for too many Facebook privileges and made this

github.com

Post reply on HN
Print view View original

41–50 of 146 posts

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#41

Post by chalst »

gfodor wrote: post #11

This is a cool idea, but of course the warning is that if you are turning off certain permissions, there is a good chance the app you are adding is going to break since it's coded expecting certain behaviors from the API based upon those permissions being granted (even if the data is not going to be used.)

I often grant these applications all the permissions they want and then revoke them from within Facebook. Some complain or fall over, most don't.

My guess is that chadselph's technique rarely gives worse results and is a damn sight more convenient to use.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#42

Post by cheald »

Well, it's a good idea, but it needs a big, fat "hey, this might/will probably break stuff in the app you're authorizing" button. Apps usually request that stuff for some reason, and the vast majority of users don't have enough understanding of the systems to know which permissions are safe to revoke.

Best case, things silently break and the user doesn't care. Worse case, things break and the user blames the developer and malign the application. You know how important the star ratings are in the mobile markets? You know how much effort developers put into managing the user experience, knowing that their app's success lives or dies based on their ability to keep from offending the luddites among their userbase?

This is great for power users who understand and accept the risks inherent in doing something like this, but it's an awful idea for just about anyone except developers who understand what those permissions are actually used for.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#43

Post by bkaid »

idoh wrote: post #27

I'm working on a facebook app right now. In A/B testing the permissions, it doesn't matter how many things we ask for, the results are about the same. So might as well ask for anything we think will be useful.

I've seen a study that shows this isn't true, especially when prompting for offline_acces. Wish I could find the link. Also, Facebook's app analytics shows you the break down of how often permissions are rejected and from what I've seen with high usage, the permissions prompted did matter. I would disagree that you should just ask for ones you might not need, especially since you can always prompt the user later for more if needed.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#44

Post by jarin »

rhizome wrote: post #17
gfodor wrote: post #11

This is a cool idea, but of course the warning is that if you are turning off certain permissions, there is a good chance the app you are adding is going to break since it's coded expecting certain behaviors from the API based upon those permissions being granted (even if the data is not going to be used.)

In other words, it's a good test to see if an app is coded incompetently.

I guess it would depend on how "production" the app is, but I don't know if I would automatically call not handling that edge case incompetence.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#45

Post by ThomPete »

Maybe I am the only one on HN and I can't believe I am defending FB but I don't get this.

I understand and can appreciate what is being done. I just don't understand why anyone would want to use a service that they are not comfortable giving out data to.

FaceBook for better or worse is making money by knowing a lot of things about you. In return you have a place to hang out and share a lot of things.

Is that such a bad deal?

Personally by default I just assume that everything I post/share/say is going to be used.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#46

Post by chadrs »

cheald wrote: post #42

Well, it's a good idea, but it needs a big, fat "hey, this might/will probably break stuff in the app you're authorizing" button. Apps usually request that stuff for some reason, and the vast majority of users don't have enough understanding of the systems to know which permissions are safe to revoke. Best case, things silently break and the user doesn't care. Worse case, things break and the user blames the develope…

I have to disagree.

First, I actually do have this warning in the README.

Second, if the app breaks when it doesn't have enough permissions, that's really just the laziness of the app developer. Handle the error gracefully if you really need the permission, and prompt for it again, explaining what you need it for.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#47

Post by wacheena »

transmit101 wrote: post #36
sshumaker wrote: post #29

I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.

There's nothing to stop a Facebook app being built like this. In fact, Facebook recommends this approach. It's simply that many developers feel that it's easier to get all the permissions in one go, when the user first signs up.

Android, unfortunately does not have this functionality. All permissions have to be requested up front, whether or not they are needed for all users.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#48

Post by bigiain »

cheald wrote: post #42

Well, it's a good idea, but it needs a big, fat "hey, this might/will probably break stuff in the app you're authorizing" button. Apps usually request that stuff for some reason, and the vast majority of users don't have enough understanding of the systems to know which permissions are safe to revoke. Best case, things silently break and the user doesn't care. Worse case, things break and the user blames the develope…

I'm not entirely sure that's a valid objection for something who's installation instructions include "clone this git repo, then open chrome in developer mode".

Perhaps before it becomes a point'n'click install there might need to be more explanation about what might break, but anyone capable of installing it in its current form _ought_ to be capable of working out it's various means of breakage...

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#49

Post by vdm »

sshumaker wrote: post #29

I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.

This could be like early Windows firewalls all over again; popping up windows every time you try to do something, until you just disable it.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#50

Post by jinushaun »

sshumaker wrote: post #29

I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.

Like EULAs, everyone just hits agree and move on. No one reads them. Apple did it right in iOS: ask for permission when you actually need it.
Post reply on HN