It would be interesting to have a follow up mechanism to indicate how many requested permissions were actually required by apps. I suspect it would end up around the 50% mark.
I was annoyed with sites asking for too many Facebook privileges and made this
111–120 of 146 posts
Re: I was annoyed with sites asking for too many Facebook privileges and made this
#112Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…
Facebook is not trying to be a "general authentication provider": they are trying to be a "social application enabler". If you have no interest in making a social application, which to Facebook means you fundamentally at bare minimum are going to need their friends list (or they, and I, would question what you even mean by "social"), then you should not use Facebook's authentication mechanism. Really, it comes down t…
Hey Saurik,
I'm saying that facebook's documentation of their particular implemenation of oauth is weak, and that this causes devs to proverbially thrown their hands in the air and say "well screw it! I'll just request offline_access (a long-lived token) and call it good!".
That's the frustration, that's the thing I'm "blaming" facebook for.
As far as a user's friends coming with their login. Yes, of course, and this is why I'm using facebook authentication. I just wish that facebook made it more obvious to people what they're giving me.
Re: I was annoyed with sites asking for too many Facebook privileges and made this
#113Earlier quoted context omitted.
Facebook is not trying to be a "general authentication provider": they are trying to be a "social application enabler". If you have no interest in making a social application, which to Facebook means you fundamentally at bare minimum are going to need their friends list (or they, and I, would question what you even mean by "social"), then you should not use Facebook's authentication mechanism. Really, it comes down t…
Hey Saurik, I'm saying that facebook's documentation of their particular implemenation of oauth is weak, and that this causes devs to proverbially thrown their hands in the air and say "well screw it! I'll just request offline_access (a long-lived token) and call it good!". That's the frustration, that's the thing I'm "blaming" facebook for. As far as a user's friends coming with their login. Yes, of course, and this…
As someone who develops Facebook apps, I think one of the problems is that there is usually a gap between the reason you need to ask for a permission and what a permission enables you to do. For example, if you want the ability to create albums and post pictures on your users' behalf, you have to request permission to read their albums. This seems to surprise most users: "why do they want access to all my photos?" Answer: the developer probably doesn't care about your photos, but they have a feature that posts pictures. The "offline access" permission is often used to get around rate limits, but users think it means an app is harvesting their deepest secrets. Unfortunately, I can't think of a clear solution to this. Finer-grained permissions will probably look even more nefarious (because the list of permissions being requested will be longer in many cases) and be more confusing to the user.
Re: I was annoyed with sites asking for too many Facebook privileges and made this
#114Earlier quoted context omitted.
Like EULAs, everyone just hits agree and move on. No one reads them. Apple did it right in iOS: ask for permission when you actually need it.
I've got a 67-page iTunes EULA I've had to agree to about 20 times that says differently. This is, unfortunately, an almost universal failing.
That's not the parent's point: the point is that iOS — correctly — asks for permission when required, not in advance. The idea is that asking in advance is similar to a click-through EULA, not that Apple doesn't use one.
Re: I was annoyed with sites asking for too many Facebook privileges and made this
#115Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…
I signed up for airbnb using my facebook account and I noticed that they give away your DOB. I immediately changed my DOB on facebook and vowed to avoid authenticating with apps. I generally avoid putting in real information on facebook but the amount of stuff they give away is frightening. It's a heaven for social engineering and spear phishing.
My "fakebook" personal data is mostly false, including birthday and age (wtf, combined, that's one of the keys used for auth verification at banks!)
It doesn't help when I got 30 incorrect "happy birthday" wishes, but that was when I decided I should just hide all my (fake) data from friends too... real friends know who I am, anyway.
Re: I was annoyed with sites asking for too many Facebook privileges and made this
#116Doesn't work for me -- I have it installed in Chrome 15.x on OS X. Using Facebook authentication, I get a dialog with the checkboxes at the top to disable some requests. I can uncheck some items, but then when I click apply nothing seems to happen.
Re: I was annoyed with sites asking for too many Facebook privileges and made this
#117Just create an empty Facebook account and use it to authenticate, problem solved.
Yes, it's against Facebook's TOS, which makes me feel even better whenever I authenticate with it.
Re: I was annoyed with sites asking for too many Facebook privileges and made this
#118I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.
This could be like early Windows firewalls all over again; popping up windows every time you try to do something, until you just disable it.
Nah, that BlackIce Defender nagwall stuff usually settled into a relatively quiet equilibrium.
Re: I was annoyed with sites asking for too many Facebook privileges and made this
#119Earlier quoted context omitted.
Hey Saurik, I'm saying that facebook's documentation of their particular implemenation of oauth is weak, and that this causes devs to proverbially thrown their hands in the air and say "well screw it! I'll just request offline_access (a long-lived token) and call it good!". That's the frustration, that's the thing I'm "blaming" facebook for. As far as a user's friends coming with their login. Yes, of course, and this…
As someone who develops Facebook apps, I think one of the problems is that there is usually a gap between the reason you need to ask for a permission and what a permission enables you to do. For example, if you want the ability to create albums and post pictures on your users' behalf, you have to request permission to read their albums. This seems to surprise most users: "why do they want access to all my photos?" An…
Maybe some additional text under each permission requested, describing what the app needs it for, e.g.:
- "Post to Facebook as me" - we need that to upload your photos created by XYZ. We will not post status updates on your behalf.
- "Access my data all the time" - we use that to...
etc.
I'd personally like to see more developers open about what they're using given permission for. I'm willing to trust them, just if they're a little more transparent.
Re: I was annoyed with sites asking for too many Facebook privileges and made this
#120Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…
you should take a look at browserid (browserid.org)
its much better than FB auth. its much better than any other auth service in fact.
because browserid doesn't want to make a profit out of the user, so its focused on useability, privacy and security.
rather than let me write a page about it, just click the link