Couldn't have found a more linkbait title if I tried.
OAuth Will Murder Your Children
51–60 of 101 posts
Re: OAuth Will Murder Your Children
#52Making Facebook apps, we ran into a tiny fraction of users who disabled some of the permissions that we asked for. It was simpler to just keep popping up the permission window until they accepted or left the app rather than code special cases for the tiny minority that cared about nonstandard permissions settings. This became pretty standard in Facebook apps, although it's a bad experience, because hardly any users a…
> hardly any users actually care I’d be careful before making assumptions like this. Many users may care but still value using an app enough to put up with giving up permissions they’d prefer not to. Other users might not have any idea what the permissions settings do or say. Still other users (for example, me) just avoid facebook apps altogether because they universally ask for distasteful levels of access.
Schemes that avoid users like you may be good business, similar to the way that fine-grained low pricing invites pathological users.
Re: OAuth Will Murder Your Children
#53Earlier quoted context omitted.
There's still a culture of too-much-access (we might need it in the future!!) that needs to be addressed here. Perhaps once we're all super used to these interstitials, then it'll become a no-brainer to come back to them and request info. Personally, i think we should go even further; lets request sunset/timeout clauses on access. I'm willing to give the kanye analyzer two weeks access to my twitter account, but afte…
Absolutely right. LinkedIn is doing this. access for one day, one week, ... when granting permissions.
Here's screenshot of how it looks: http://developer.linkedin.com/servlet/JiveServlet/downloadIm...
However the reason LinkedIn does it is probably because the nature of information accessed is very fragile.
Similar, but slightly different solution, I'd suggest, would be to track by provider if application is actively used and perhaps revoke token after some period of time (or at least present user with that data on their profile settings page).
Re: OAuth Will Murder Your Children
#54OAuth is powerful and awesome because even when people hand over full control they can revoke that access at any time they want.
Previous to OAuth people would hand over their credentials to third party apps. That's what sucking looks like.
Re: OAuth Will Murder Your Children
#55Couldn't have found a more linkbait title if I tried.
Yeah, but it works because a.) Zach follows through with the metaphor throughout the article and b.) it isn't slimy self promotion.
Re: OAuth Will Murder Your Children
#56I don't think developers get that users simply don't care about this kind of stuff.
There's a reason Steve Krug titled his book on good UI design 'Don't make me think'. We should be trying to make things simpler (from the User's POV) not more complex.
Re: OAuth Will Murder Your Children
#57OAuth is powerful and awesome because even when people hand over full control they can revoke that access at any time they want. Previous to OAuth people would hand over their credentials to third party apps. That's what sucking looks like.
Before, all you needed to do to revoke access to all those crazy 3rd parties you gave your password to was: change your password.
Now, you need to figure out where to go to revoke permissions, figure out what 3rd party app you no longer want, and figure out exactly what permission (in Facebook's case, but not Twitter's). It's confusing even for technical people because it's nonstandard and different on every OAuth provider's site.
Re: OAuth Will Murder Your Children
#58I'm building a startup and I want to make things easier for my users.
Should I let them "sign up" with OAuth?
I read somewhere that doing that I don't "own" the users. What does that mean?
All I want is for folks to find their friends automatically, and not to force people to remember another password.
Re: OAuth Will Murder Your Children
#59OAuth is powerful and awesome because even when people hand over full control they can revoke that access at any time they want. Previous to OAuth people would hand over their credentials to third party apps. That's what sucking looks like.
Before, all you needed to do to revoke access to all those crazy 3rd parties you gave your password to was: change your password. Now, you need to figure out where to go to revoke permissions, figure out what 3rd party app you no longer want, and figure out exactly what permission (in Facebook's case, but not Twitter's). It's confusing even for technical people because it's nonstandard and different on every OAuth pr…
1) Unless the app was evil and changed your password for you.
2) Or unless you wanted to let some apps keep access to your account, but not others.
3) And if you can easily deal with remembering new passwords (most users can't).