41–49 of 49 posts
Earlier quoted context omitted.
Danke!
Is it possible for your app (or any) to offer to revoke it's own access after it's finished?
FYI with firefox + adblock + ghostery I see only the static landing page with broken "about" link.
Holy shit, you're definitely going to have to explain that graphic at the end. I looked at it for over a minute and I've absolutely no idea what it's supposed to represent or even what kind of chart it is or what the axes are.
Yes, I'm sure a lot of work went into that graph, but it makes absolutely no sense to me whatsoever.
Earlier quoted context omitted.
> the data only gets sent back and forth between your browser and fb That's... actually a very interesting way to put it. There should be a way to make a Facebook application that could guarantee it can't leak information to any other server.
It can't be done. I could get the data from FB with javascript, and If I'm using it, I can sent it to my server with another request, so there is no way to block that.
One solution would be for Facebook to host the app, and to run its content in a sandbox (using something like Google's Caja?).
Another approach would be a system permission at the browser level, where a page could explicitly request to restrict what it is allowed to do.
Then you could have an approach where the app asks Facebook for this and that permissions, but accepts to be sandboxed to only have access to Facebook's domains. The request goes to FB as it does now. FB calls the return URL, but it opens it in tab with specially sandboxed permissions.
Everyone wins: the app makes it clear there's no information leak possible and the user is feeling safer.
I'm not saying any of this is trivial to implement. But it would make sense from a user perspective.
FYI with firefox + adblock + ghostery I see only the static landing page with broken "about" link.
FYI with firefox + adblock + ghostery I see only the static landing page with broken "about" link.
Perhaps try disabling some addons? I'm guessing its ghostery.
Like "you seem to be blocking Facebook with XYZ..." or a similar message. Realize it's just a prototype -- can understand if you don't want to take the trouble.
Cool idea in any case.
Earlier quoted context omitted.
Is it possible for your app (or any) to offer to revoke it's own access after it's finished?
its a nice idea, i'd like that also but don't know of such fb-functionality. in my case i have no use for the permissions. maybe permissions with an expiry date would be great.
Revoking Login
You can also let people completely de-authorize an app, or revoke login, by making a call to this Graph API endpoint:
DELETE /{user-id}/permissions
This request must be made with a valid user access token or an app access token for the current app. If the request is successful, your app receives a response of true. If the call is successful, any user access token for the person will be invalidated and they will have to log in again. Because you're de-authorizing your app, they will also have to grant access to your app as if they were logging in for the first time.
Earlier quoted context omitted.
its a nice idea, i'd like that also but don't know of such fb-functionality. in my case i have no use for the permissions. maybe permissions with an expiry date would be great.
Revoking Login You can also let people completely de-authorize an app, or revoke login, by making a call to this Graph API endpoint: DELETE /{user-id}/permissions This request must be made with a valid user access token or an app access token for the current app. If the request is successful, your app receives a response of true. If the call is successful, any user access token for the person will be invalidated and…