Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was annoyed with sites asking for too many Facebook privileges and made this

github.com

Post reply on HN
Print view View original

31–40 of 146 posts

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#31

Post by latortuga »

loveat528hz wrote: post #16

Does this actually work? I mean, wouldn't the application just go ahead and use those privileges anyway, since it was built into the API? I think this just makes you aware of the privileges it intends to use, and doesn't actually affect what the application can and cannot do. I'd love it if somebody could prove me wrong, though. This would be swell if it worked. :P

Part of the API request sent to Facebook at the time of authorization specifies which permissions you want the user to grant. I have not inspected his code but I think it should be possible to modify those permissions before agreeing to them. The side effect of this is that the webapp you are authorizing may work unexpectedly when it cannot access services/functionality that they originally indicated that they wanted you to agree to.

Short answer: your OAuth token includes permission status so yes, this should work.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#32

Post by bkaid »

sshumaker wrote: post #29

I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.

Developers can do this but for whatever reason they seems to always ask for them all up front.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#35

Post by jarin »

blhack wrote: post #24

Facebook is actually a bit scary even with most of the things you're disabling here disabled. (My point is that this is cool, but it really isn't enough) For instance, I'm using facebook auth on http://lanmarks.com -- I wanted to be able to pull my users' facebook friends so that they could filter the data on my site to only their set of friends (this is one of the appealing parts of facebook auth, imho). I spent a b…

I think friend lists are part of their basic permission set precisely because it's one of the most appealing parts of the Facebook API.

Offline access isn't needed on the majority of sites that ask for it though, it's usually just laziness on the part of the developer (without that permission your server has to request a new token on login every so often).

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#36

Post by transmit101 »

sshumaker wrote: post #29

I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.

There's nothing to stop a Facebook app being built like this. In fact, Facebook recommends this approach.

It's simply that many developers feel that it's easier to get all the permissions in one go, when the user first signs up.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#37

Post by 101010010101 »

DiabloD3 wrote: post #15

I think I did the ultimate opt out: I've never had a Facebook account, and I never will.

This may prove to be one of the smartest decisions you ever made.

All you really need from Facebook are the email addresses of the people who sign up and want to contact you.

It's a bit like the old idea of a "change of email" forwarding service. People change email addresses, but there's nowhere to leave a forwarding address and you lose contact with them. It's also a bit like zabasearch which implemented a way to see if someone is trying to contact you.

Once you have those email addresses, you do not need Facebook. You are in contact, via email, with the people you want to be in contact with. You could set up your own private networks (startup hint). Advertisers are not invited to the party.

Without email, Facebook cannot exist. Zuckerberg's unusually popular password protected website relies on something very old: email addresses.

No email, no Facebook.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#38

Post by cheald »

GiraffeNecktie wrote: post #12

Typical Facebook authorization: Give us permission to post on your wall, check out all your friends, and generally keep tabs on your entire life. Oh yeah, and allow us to verify that you are logged in to your Facebook account. Typical Google authorization: Allow us to verify that you are logged in to your Google account.

This is mostly because Google provides very few useful operations. See also: authorization scopes.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#39

Post by bkaid »

jaymzcd wrote: post #23

I wish there was a way to request permissions for a given time period, it seems it's all or nothing. I'm creating some apps at the minute and just need to checkin the once, I wish I could communicate that to the user but instead facebook insists that they authorize it 'for ever' (well, until they remember and go and remove it). In my opinion that would make take up and "throwaway" usage of apps a bit easier to sell.

Facebook API does have a method where you can revoke the permission automatically (ie when you no longer need it). And also if you don't request offline_access permission, the token is only valid for an hour or two. But yes, Facebook doesn't make this very clear to the user.

Re: I was annoyed with sites asking for too many Facebook privileges and made this

#40

Post by ceol »

rhizome wrote: post #17
gfodor wrote: post #11

This is a cool idea, but of course the warning is that if you are turning off certain permissions, there is a good chance the app you are adding is going to break since it's coded expecting certain behaviors from the API based upon those permissions being granted (even if the data is not going to be used.)

In other words, it's a good test to see if an app is coded incompetently.

To be fair, I don't believe Facebook ever allowed users to opt out of certain permissions (barring their recent beta auth[0]). Certainly you'd want to handle missing permissions gracefully, but I can't blame a dev for making their app non-functional when 99.9% of their users will either accept all permissions or deny the app access.

[0]: https://developers.facebook.com/docs/beta/authentication/ (bottom of page)

Post reply on HN