This is "double click SETUP.exe" all over again.
People don't read any message boxes' contents, they only see the "Ok" button and click it. It's amazing, but unfortunately true.
OAuth Will Murder Your Children
91–100 of 101 posts
Re: OAuth Will Murder Your Children
#92Earlier quoted context omitted.
Both OS X and WinAPI do this now. Users (in general) hate it. You make a good point, but it's going to have little impact in the real world. People livin' in that 21st century do it better'n anybody you ever seen do it and they want their Kanye analysis now; they ain't got nothin' to lose! They rollin'! I am deadly serious.
Users have been well trained that all install dialogs are just barriers to task success. They don't read anything on them. Next next next next Finish. I guarantee you I'd get 80% conversion to "Format C:/ and pillage your Googles" if it were the last step of the BCC instller.
Many experts agree with you. Facebook disagrees for this specific instance. They advise developers not to ask for more permissions than they need, because the more permissions you ask for, the fewer signups you'll get. That suggests that a non-trivial number of users are reading something on these particular dialog boxes.
Non-trivial is a large number for Facebook. They nerfed their "Friend Lists" feature because only 5% of their userbase, i.e. 25 million people, were using it.
Re: OAuth Will Murder Your Children
#93Good point, bad example: your "KanyeAnalysis app" really does not need write access, so no need for checkboxes. It simply should not request write access, ever. Period.
Re: OAuth Will Murder Your Children
#94I agree, limiting third parties access to your data is why OAuth exists in the first place. Although everything in this article is about Twitter's implementation of OAuth and not OAuth in general. The title is misleading.
Re: OAuth Will Murder Your Children
#95Even better: Let the application also say why it needs the permission: * Read access We want to analyse your tweets * Read/write Because we want to spam your friends
I agree. My sister (a Normal Person) asked me why her new Android phone does this, and now she thinks she should have got an iPhone.
Re: OAuth Will Murder Your Children
#96Earlier quoted context omitted.
Users have been well trained that all install dialogs are just barriers to task success. They don't read anything on them. Next next next next Finish. I guarantee you I'd get 80% conversion to "Format C:/ and pillage your Googles" if it were the last step of the BCC instller.
Many experts agree with you. Facebook disagrees for this specific instance. They advise developers not to ask for more permissions than they need, because the more permissions you ask for, the fewer signups you'll get. That suggests that a non-trivial number of users are reading something on these particular dialog boxes. Non-trivial is a large number for Facebook. They nerfed their "Friend Lists" feature because onl…
It doesn't suggest that to me. It suggests to me that they would prefer you not ask for too many permissions because they've learned from Farmville that overbearing apps get bad PR for Facebook, and the fact that some number (perhaps quite trivial) of people will be turned off by it is a convenient disincentive.
Re: OAuth Will Murder Your Children
#97We had a similar problem at Yahoo! with BBAuth and OAuth. Developers started out initially building an application that needed access to (for instance) Yahoo! Mail. Unfortunately, there's no way in the Yahoo! Developer Network to "upsize" an application ID or consumer key after it has been created. You can't go back and say, "You know what? My application could be 2x as awesome if I added Yahoo! Address Book support." As a result, developers requested the kitchen sink: Yahoo! Mail, Address Book, Calendar, Flickr, Profile, MyBlogLog, Delicious, Fantasy Sports, Messenger, Updates and so on. In addition, each of those services has different permissions ranging from Read-Only to Read/Write (see https://developer.apps.yahoo.com/dashboard/createKey.html).
Google did a better job of this with their OAuth flow, allowing a "scope" to be passed in the authorization request so applications can dynamically select what they want access to (http://code.google.com/apis/gdata/docs/auth/oauth.html#Scope). This means applications don't have to ask for the world up front when registering. Unfortunately it doesn't fix the "OAuth will murder your children" problem.
Ultimately it's a user experience problem. As the article points out, add too many checkboxes and it becomes too complex. The average user doesn't pay attention (like reading a EULA) and in several cases they're not going to understand the scopes presented to them anyway. Read/Write is pretty clear to most of us, not so clear to my mother.
As an amusing aside, I went to log into Hacker News using their Clickpass integration to sign in using my Yahoo! account. Clickpass does the OAuth song and dance and requests read/write access to my Address Book. "http://www.clickpass.com is asking you and Yahoo! for the ability to automatically sign-in as you to your Yahoo! account through a service or application that is provided by http://www.clickpass.com, and to read and store to your data in Yahoo! Address Book." Evidently OAuth will not only murder your children, it will wipe them from your Address Book, too.
Re: OAuth Will Murder Your Children
#98Even better: Let the application also say why it needs the permission: * Read access We want to analyse your tweets * Read/write Because we want to spam your friends
Q: Why would an application developer want to make limiting promises? A: Because more users will trust the application and be willing to authorize it. I think this is the only correct answer. Sadly, without mechanisms in place to limit the scope of the authorization, the market is aiming for a scenario where ordinary people simply don't trust web applications. Even visiting new sites on the web for them will carry a…
We proposed a reputation mechanism for mash-ups/apps that can be plugged on OAuth. The service provider (e.g: Twitter or Facebook) records every access to the user account and sends a report after a week. Users rate the application which reputation is maintained by the service provider. Average ratings and comments are displayed when a new user is asked to grant an authorization.
Link to the paper: http://www.dundal.com/R2M-CCNC2010.pdf
Re: OAuth Will Murder Your Children
#99Earlier quoted context omitted.
An untrusted application is handled in running it as a dedicated user, like 'httpd' or 'nobody'.
Can nobody access "user joe"'s SMS and Email? A. If it can, then it can send my personal info to outside world. I don't care if it can't gain root access to my phone. My phone's root account is not important, my personal information inside that phone is. B. If it cannot. Then most of my application is useless because it can't access any information at all. Why don't I add it to "trusted" zone? Because I don't trust i…
Please educate yourself about Unix Security Contexts.
Re: OAuth Will Murder Your Children
#100I agree. A simple solution in the meantime maybe to allow users to revoke certain access levels to specific services in an admin panel.