31–40 of 101 posts
Overall this problem is worse with things that are more app than web site or that put up an authentication wall before you can see anything interesting.
Even better: Let the application also say why it needs the permission: * Read access We want to analyse your tweets * Read/write Because we want to spam your friends
So, if there's something to be done here, it may be in helping them to recover after they get burned --- perhaps an easy and straightforward UI for revoking OAuth tokens once granted, if the user doesn't like what the app has done with them?
http://www.quora.com/Richard-Henry/Improving-Twitter-OAuth-W...
Richard now works at Twitter.
I have three: GoogleTV, Mobile, Iphone. (I used to have TweetDeck and a couple others, so 6 total.)
Earlier quoted context omitted.
Both OS X and WinAPI do this now. Users (in general) hate it. You make a good point, but it's going to have little impact in the real world. People livin' in that 21st century do it better'n anybody you ever seen do it and they want their Kanye analysis now; they ain't got nothin' to lose! They rollin'! I am deadly serious.
Users dislike it on Windows because requesting elevated privileges became so common that they rationally chose to tune out. Had Windows been designed from the start with UAC, developers would have been less cavalier in requiring administrator abilities, then maybe a UAC request might actually have meant something. Given that so many legacy games request privilege authorization, it's no wonder the users don't take it…
Android and the Android Marketplace appear to contradict that theory.
Honestly, if that's the case, what's the point of OAuth then? Why don't we just go back to handing over usernames & passwords and trusting some 3rd party to not do anything nasty? With everyone constantly complaining about Facebook privacy concerns and hijacked Twitter accounts, how can anyone pretend that conditioning people to allow the maximum set of permissions to a complete stranger is a good thing?
Making Facebook apps, we ran into a tiny fraction of users who disabled some of the permissions that we asked for. It was simpler to just keep popping up the permission window until they accepted or left the app rather than code special cases for the tiny minority that cared about nonstandard permissions settings. This became pretty standard in Facebook apps, although it's a bad experience, because hardly any users a…
I’d be careful before making assumptions like this. Many users may care but still value using an app enough to put up with giving up permissions they’d prefer not to. Other users might not have any idea what the permissions settings do or say. Still other users (for example, me) just avoid facebook apps altogether because they universally ask for distasteful levels of access.
Meh. The problem with this is that every empirical study of actual users is going to demonstrate that they simply don't care. The primary control that OAuth dialogs like these express is "prevent malicious phishing apps from coercing users into inadvertantly opting in", and the dialog we have now is sufficient to that purpose. For the tiny subset of users (I am one of them) to whom this issue matters, you can mitigat…
There's still a culture of too-much-access (we might need it in the future!!) that needs to be addressed here. Perhaps once we're all super used to these interstitials, then it'll become a no-brainer to come back to them and request info. Personally, i think we should go even further; lets request sunset/timeout clauses on access. I'm willing to give the kanye analyzer two weeks access to my twitter account, but afte…
Earlier quoted context omitted.
Would be cool. But really, I don't think people will double-guess themselves when QuizMatic3000 doesn't give reasons for it. (An age-old UX myth: users never read dialog boxes, they just click OK.)
One fearless developer I worked with would switch the meaning of the boxes every now and then to 'train' the users not to ignore the texts based on negative feedback. +------------------------------------------------------+ | | | Are you really sure you don't want to format ? | | | | | | | +------------------------------------------------------+ He'd have made a pretty good BOFH I think.
It's both intuitive and simple. Universally every HIG[1] that exists advocates that. Personally, I'd make the button red as well.
[1] Human Interface Guidelines.
For example, here's relevant section in KDE's HIG: http://techbase.kde.org/Projects/Usability/HIG/Messages#Conf...
EDIT: To clarify I didn't suspected this to be a revelation to anyone. I just wanted to put it here, since it's a very relevant audience and I was just surprised nobody have mentioned it already.