Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was annoyed with sites asking for too many Facebook privileges and made this

github.com

Post reply on HN
Print view View original

121–130 of 146 posts

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#121

Post by TeMPOraL »

sshumaker wrote: post #29

I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.

It worked like that with J2ME on old phones and I HATED it. Some apps asked me for permission to use the camera every time I took the first (since last restart) photo with it. It's annoying and breaks the flow in whatever you're doing at the moment. I much prefer being asked once, and approving for good.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#122

Post by dtsingletary »

phillmv wrote: post #61
blhack wrote: post #24

Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…

I signed up for airbnb using my facebook account and I noticed that they give away your DOB. I immediately changed my DOB on facebook and vowed to avoid authenticating with apps. I generally avoid putting in real information on facebook but the amount of stuff they give away is frightening. It's a heaven for social engineering and spear phishing.

Frankly, I'd wonder why you want to be a customer of AirBNB, then. Not because they're asking for this, but because it seems like a pretty valid piece of information for a company that banks on authenticity and trust between its buyers and sellers. I understand this for less reputable apps and companies, but if you're willing to circumvent the information they've requested through an authenticator (and data provider) of choice, and your reaction is to poison that data, then a) Why are you authing with Facebook? (You answered that, I guess: you won't do it now) b) Do you distrust the site you're using to find someone to share some housing with?

Would any solution for authentically sharing data be acceptable?

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#123

Post by chadrs »

gcanyon wrote: post #116

Doesn't work for me -- I have it installed in Chrome 15.x on OS X. Using Facebook authentication, I get a dialog with the checkboxes at the top to disable some requests. I can uncheck some items, but then when I click apply nothing seems to happen.

Yeah, I pulled in some style changes without testing them and they accidentally broke the onclick handler for the button. I fixed it here: https://github.com/chadselph/OOptOut-Chrome-Extension/commit...

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#124

Post by ambition »

msumpter wrote: post #5

Awesome extension! I just wish Facebook would include this as a standard option on the auth page. It would be great to just uncheck the things I don't want it to do on my behalf. Instead I was allowing the app and then editing it's permissions immediately afterward. Great job!

In the new Auth Dialog, extended permissions have this behaviour built in.

https://developers.facebook.com/docs/beta/authentication/

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#125

Post by blhack »

zobzu wrote: post #120
blhack wrote: post #24

Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…

you should take a look at browserid (browserid.org) its much better than FB auth. its much better than any other auth service in fact. because browserid doesn't want to make a profit out of the user, so its focused on useability, privacy and security. rather than let me write a page about it, just click the link

I have my own auth system that I use in all of my other projects. Why on earth would I send users to, and trust, a third party?

That seems like an extra headache. It makes sense for me to do it with facebook because it's really easy for users, and because there are benefits for the users when they do it (and for me).

(These benefits are: they don't have to rebuild their social network, again)

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#126

Post by mweibel »

psawaya wrote: post #25

This is a fantastic idea. I have a really simple Firefox port running. You can see the code and download it (.xpi) here: https://github.com/psawaya/OOptOut-Extension-Firefox/tree/ma... I only tested it out on one website, so let me know how well it works (or doesn't) for you. I'd like to keep working on this and tighten up the interface. I think a lot of people will find this useful!

Thanks mate. I tried it on vimeo.com (as author suggests) and it doesn't seem to work.

One point is: The UI is somehow broken (no styling, and "application settings", "update" and the checkboxes each are on their own line). Second point: When removing the ticks from the checkboxes and click on update, I'm redirected to: "https://www.facebook.com/dialog/undefined/dialog/permissions...

so "dialog/undefined" needs to be stripped.

(Maybe add the issues functionality to your repos.. :))

- Michael

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#127

Post by gizzlon »

TeMPOraL wrote: post #119
davidcuddeback wrote: post #113

Earlier quoted context omitted.

As someone who develops Facebook apps, I think one of the problems is that there is usually a gap between the reason you need to ask for a permission and what a permission enables you to do. For example, if you want the ability to create albums and post pictures on your users' behalf, you have to request permission to read their albums. This seems to surprise most users: "why do they want access to all my photos?" An…

Maybe some additional text under each permission requested, describing what the app needs it for, e.g.: - "Post to Facebook as me" - we need that to upload your photos created by XYZ. We will not post status updates on your behalf. - "Access my data all the time" - we use that to... etc. I'd personally like to see more developers open about what they're using given permission for. I'm willing to trust them, just if t…

But if you trust their reasons, you already trust them?

Why would you believe the reasons given if you don't trust the app developer?

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#128

Post by TeMPOraL »

gizzlon wrote: post #127
TeMPOraL wrote: post #119

Earlier quoted context omitted.

Maybe some additional text under each permission requested, describing what the app needs it for, e.g.: - "Post to Facebook as me" - we need that to upload your photos created by XYZ. We will not post status updates on your behalf. - "Access my data all the time" - we use that to... etc. I'd personally like to see more developers open about what they're using given permission for. I'm willing to trust them, just if t…

But if you trust their reasons, you already trust them? Why would you believe the reasons given if you don't trust the app developer?

For me it would make a difference on borderline cases. If I trust the developer, I don't care about permissions; if I don't trust (or don't like), I won't accept. But sometimes I'm not 100% sure - especially when an app asks for lot of permissions and I have no idea why they would even need them. Then, a plausible explanation could convince me to give those permissions.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#129

Post by lmm »

sshumaker wrote: post #29

I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.

Java in Konqueror used to work like this. It would ask permission separately for every single file an applet tried to access outside the sandbox. That got old pretty fast.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#130

Post by paraschopra »

dlevine wrote: post #69

Chrome should integrate this into the Browser. That way, Google could "protect" you against "privacy violations" by Facebook. It could show a little warning at the top of the screen, and allow you to edit the permissions (kind of like what the app does now, but as an official-looking browser message). Oh, and Google should also do this with the Android App Store...

Won't it be anti-competitive? Facebook would probably sue Google if they specifically integrate such functionality into Chrome. (If they do it for all sites generally including G plus, then it would be fantastic)
Post reply on HN