Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth Will Murder Your Children

zachholman.com

Post reply on HN
Print view View original

81–90 of 101 posts

Re: OAuth Will Murder Your Children

#81

Post by drm237 »

Twitter is half of the problem here. Once you request read access and a user approves it, there is no way under the same application then go back and get write access. Ideally every app would start with read and then only upgrade to write when needed but Twitter won't allow it. There are multiple bugs in their api issue tracker and they don't seem to care. The only way to get around it is to have two applications, a read and a read-write which actually is more difficult and why bother working around Twitters short comings when most users don't care?

I know this wasn't only about Twitter, but this is an issue I've had myself and it's incredibly annoying.

Re: OAuth Will Murder Your Children

#82

Post by liuhenry »

Facebook has made a lot of progress in app privileges. Under http://www.facebook.com/settings/?tab=applications, there is a categorical line-item veto - you can revoke access to certain things, such as wall posting, access posts in news feed, access my data at any time, check-ins, etc. It also specifically shows what information was accessed by an app, and when (Last Accessed: Basic Info, Likes, and Current City on January 25th).

LinkedIn has time-out on permissions. You can set a specific time setting or allow access until revoked.

There's no reason that Twitter can't do the same. The subset of users who care about specific privileges can go and revoke them, and the app can re-request permissions if needed.

Re: OAuth Will Murder Your Children

#83

Post by btilly »

StavrosK wrote: post #66
mikedouglas wrote: post #30

Earlier quoted context omitted.

Users dislike it on Windows because requesting elevated privileges became so common that they rationally chose to tune out. Had Windows been designed from the start with UAC, developers would have been less cavalier in requiring administrator abilities, then maybe a UAC request might actually have meant something. Given that so many legacy games request privilege authorization, it's no wonder the users don't take it…

Your point about Android is half correct, yes I like seeing what the app needs to access, but I don't see why . Why does your calculator app need access to the internet? I know the author can just offer some bullshit excuse, but it's better than nothing...

They need access to the internet so they can dynamically fetch the ads they are going to show you which is where they get their money from.

This has the advantage of generally being true, and being unobjectionable enough that most people will grant access.

Re: OAuth Will Murder Your Children

#84

Post by StavrosK »

btilly wrote: post #83
StavrosK wrote: post #66

Earlier quoted context omitted.

Your point about Android is half correct, yes I like seeing what the app needs to access, but I don't see why . Why does your calculator app need access to the internet? I know the author can just offer some bullshit excuse, but it's better than nothing...

They need access to the internet so they can dynamically fetch the ads they are going to show you which is where they get their money from. This has the advantage of generally being true, and being unobjectionable enough that most people will grant access.

That was an example, though.

Re: OAuth Will Murder Your Children

#85

Post by patio11 »

tptacek wrote: post #14
judofyr wrote: post #6

Even better: Let the application also say why it needs the permission: * Read access We want to analyse your tweets * Read/write Because we want to spam your friends

Both OS X and WinAPI do this now. Users (in general) hate it. You make a good point, but it's going to have little impact in the real world. People livin' in that 21st century do it better'n anybody you ever seen do it and they want their Kanye analysis now; they ain't got nothin' to lose! They rollin'! I am deadly serious.

Users have been well trained that all install dialogs are just barriers to task success. They don't read anything on them. Next next next next Finish.

I guarantee you I'd get 80% conversion to "Format C:/ and pillage your Googles" if it were the last step of the BCC instller.

Re: OAuth Will Murder Your Children

#86

Post by bugsy »

I agree with the criticism. This OpenID stuff was promoted as single sign in. That is not what it is at all! You are forced to give write permission to every app out there before being allowed to sign in to their site to do trivial things, and then they start spamming your feed and harvesting your data. When you try to turn it off there is no off switch that can be found. It's insane.

It's the same level of intrusion as if you wrote a letter to the editor of the local paper and by sending your opinion on local parking fees, the newspaper is given access to your private mail, is allowed to set up cameras inside your house, and asserts that you agreed the newspaper's publisher can have sex with your daughter.

What the hell does any of that have to do with submitting an editorial letter?

What it has to do is this system ALLOWS them to invade your privacy, so they REQUIRE you to give up your privacy and allow them to invade it in order to do things like post comments or vote in polls that have nothing at all to do with any of what they demand they must have.

It's an abusive system that violates consumers.

Re: OAuth Will Murder Your Children

#87

Post by ZoFreX »

archangel_one wrote: post #70
StavrosK wrote: post #66

Earlier quoted context omitted.

Your point about Android is half correct, yes I like seeing what the app needs to access, but I don't see why . Why does your calculator app need access to the internet? I know the author can just offer some bullshit excuse, but it's better than nothing...

I would very much like the checkboxes in Android too, although obviously they'd place a greater burden on developers. For example, I tried installing the official XBMC remote app a while back; it requested all sorts of crazy permissions ("read SMS" etc) which they were intending to use for debatably useful features but I ended up not installing it because of the privacy concerns. In the end I installed a third-party…

XBMC remote needs that because it has a "show your texts on the TV" feature which you really, really shouldn't turn on. Trust me.

It's a shame that you can't pick and choose, as a user, because they can't remove that permission without breaking that feature for everyone [who?] that uses it. It's open-source though, so the good news is you could remove that permission and feature yourself if you really want it (you should: it's pretty nifty).

Re: OAuth Will Murder Your Children

#88

Post by stevefarnworth »

So because some apps abuse the system, we all have to suffer writing lots of extra code?

In one of my apps, I request read/write access and then allow the user to select whether they want to tweet on an interaction basis, not on a connection basis. It would provide an extra pain point if the user did want to the application to tweet to have to go back to Twitter.com to change their settings (and if the setting can be changed via the API, then that defeats the purpose altogether).

It's not ideal when any app can spam, but it's better than having a user choose their access levels before they've even used the application (where the OAuth request dialogue tends to sit).

Re: OAuth Will Murder Your Children

#89

Post by jacquesm »

compay wrote: post #80
jacquesm wrote: post #17

Earlier quoted context omitted.

One fearless developer I worked with would switch the meaning of the boxes every now and then to 'train' the users not to ignore the texts based on negative feedback. +------------------------------------------------------+ | | | Are you really sure you don't want to format ? | | | | | | | +------------------------------------------------------+ He'd have made a pretty good BOFH I think.

> He'd have made a pretty good BOFH Or punching bag.

Hence the 'fearless'.
Post reply on HN