4 ms·

OP appears to have drawn an arbitrary line in the sand between authorizing an OAuth permissions request and being asked to provide a password, however. Which, u

OP appears to have drawn an arbitrary line in the sand between authorizing an OAuth permissions request and being asked to provide a password, however. Which, unfortunately, indicates the OP's lack of understanding of why OAuth exists---why on Earth would it be better to give Fleep the password that unlocks one's entire Google account instead of just the relatively-narrow authorization to manipulate the user's email account? I can sort of see the argument that email archives are an extra-special category that should require extra-special "Are you sure" confirmation. But I think that the OAuth question panel is intended to be that extra-special "Are you sure" confirmation in the first place. How many "Are you sure"s are necessary to prevent users from shooting themselves in the foot is a bit subjective.

dsmithatx 11y ago
How about just some bold red letters outlining permissions being given away without having to type "more info"? Specifically that you are giving access to all of your email, contacts, and the ability to delete your email.
- fixermark 11y ago
  I mean, why bother? People aren't going to read it anyway, regardless of font or size. ;)
  - dsmithatx 11y ago
    That could be true of most people. I tend not to give permissions out and would read the whole thing. If I was feeling lazy though I can tell you I'd take notice of a red warning but, I can't speak for others.
    - mgreg 11y ago
      I wonder if this is a good reason to NOT use your email provider as your authentication (OAuth) provider?
daveloyall 11y ago
I think OP is saying that Google's oauth2 screen should have asked him to provide a password, to confirm that this should happen. I think I agree with OP. Remember click-jacking? Or cats jumping on keyboards? I wouldn't want my entire gmail history[1] getting delivered to a third party because of one erroneous click. 1. My gmail history actually goes back further than ... what the hell. I imported 1999 era email into gmail years ago and now I can't find it. I am officially sidetracked! [UPDATE]: yeah, my email history goes back to BEFORE gmail launched, because I imported old emails. Early 2003, actually, not 1999... Dunno where those emails went.

dsmithatx 11y ago

How about just some bold red letters outlining permissions being given away without having to type "more info"? Specifically that you are giving access to all of your email, contacts, and the ability to delete your email.

fixermark 11y ago
I mean, why bother? People aren't going to read it anyway, regardless of font or size. ;)
- dsmithatx 11y ago
  That could be true of most people. I tend not to give permissions out and would read the whole thing. If I was feeling lazy though I can tell you I'd take notice of a red warning but, I can't speak for others.
  - mgreg 11y ago
    I wonder if this is a good reason to NOT use your email provider as your authentication (OAuth) provider?

daveloyall 11y ago

I think OP is saying that Google's oauth2 screen should have asked him to provide a password, to confirm that this should happen. I think I agree with OP. Remember click-jacking? Or cats jumping on keyboards? I wouldn't want my entire gmail history[1] getting delivered to a third party because of one erroneous click. 1. My gmail history actually goes back further than ... what the hell. I imported 1999 era email into gmail years ago and now I can't find it. I am officially sidetracked! [UPDATE]: yeah, my email history goes back to BEFORE gmail launched, because I imported old emails. Early 2003, actually, not 1999... Dunno where those emails went.