4 ms·

While I think this is ridiculous. My general take is you gave consent with the login page, it's not the API providers fault they misused it. You should have bee

by throwaway2016a 8y ago

While I think this is ridiculous. My general take is you gave consent with the login page, it's not the API providers fault they misused it. You should have been more careful about who you trust. But with that said, I often considered it to be a good idea to allow users to see what data is accessed by apps. I'm working on an app that as a service to the customer allows them to see exactly which records each authorized app accesses. And also flags access that includes fields that are considered personal via GDPR. It's a way to be able to account for which users you gave access to a specific customer's data to. I kind of like the feature and all it involves is a logging operation that gets imported into the database with an app ID, date and document ID and true/false if any of the field's were sensitive. Though I suppose if our use case had a lot of read heavy clients it could be a problem to manage all the data.

brazzledazzle 8y ago
It would be fantastic if they kept an audit log and showed you just what an app pulled down via the API. They actually might (or at least the means to do so) since they provide a pretty good level of auditing for their paying apps/drive customers.
pacala 8y ago
What if there were a permission to "read and withdraw from your bank account"? If 1% of the users are cleaned after absent mindedly agreeing to 10+ permissions on a random app, would that not be the API provider fault?
- AstralStorm 8y ago
  It could be a runtime permission, you have to ask for it every time unless user explicitly changes that setting. Secure Element should be handled with exactly such a permission.
- throwaway2016a 8y ago
  NO!! No more so than if I gave the app my password directly. If you give someone the keys to your apartment and they rob you it is the thief's fault and your fault for trusting them. Not the landlord for making a copy of your key when you requested it. As a user I want API access to my data. As do a lot of people. I am going to be pissed if people like you cause everyone to stop offering APIs because they think people are two irresponsible to be trusted with access to their own data. APIs provide us data freedom. They are a good thing. The villain here is pretty clear to me is the company that is abusing your trust by withdrawing your money not the company providing the API. It is educating people that is broken not that APIs. I don't know when we got to be so trusting that we "absentmindedly" give 10 companies access to our data by clicking straight through a permission dialog that clearly says what I am doing. But absentmindedness is not a good reason to put padding on everything and force everyone to wear kneepads.
  - pacala 8y ago
    This is not about API vs. not API. It's about hiding critical APIs among benign APIs and training users to click "Accept" on a regular basis. This is a dark pattern if there ever was one, perhaps the darkest of all. It's about the company formerly led by Eric "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place" Schmidt. It's about an ecosystem that requires you to hand out a copy of the key to your apartment to strangers in exchange of minor services on a regular basis, and makes it really easy to do so. I haven't used Android in a while, but here's a quick search that fits my Android experience of yesteryear. Almost every app I installed asked for this overreaching kind of permissions. Transcript with a little easter egg. Glympse needs access to * Identity * Calendar * Contacts * Location * SMS * Phone * Photos/Media/Files * First Born * Wi-fi connection information ACCEPT http://openattitude.com/wp-content/uploads/2015/06/m-permissions-02-glympse.png http://openattitude.com/wp-content/uploads/2015/06/m-permiss... https://www.howardforums.com/showthread.php/1865181-A-Massive-Disappointment-App-Permissions-on-Android-M https://www.howardforums.com/showthread.php/1865181-A-Massiv...

brazzledazzle 8y ago

It would be fantastic if they kept an audit log and showed you just what an app pulled down via the API. They actually might (or at least the means to do so) since they provide a pretty good level of auditing for their paying apps/drive customers.

pacala 8y ago

What if there were a permission to "read and withdraw from your bank account"? If 1% of the users are cleaned after absent mindedly agreeing to 10+ permissions on a random app, would that not be the API provider fault?

AstralStorm 8y ago
It could be a runtime permission, you have to ask for it every time unless user explicitly changes that setting. Secure Element should be handled with exactly such a permission.
throwaway2016a 8y ago
NO!! No more so than if I gave the app my password directly. If you give someone the keys to your apartment and they rob you it is the thief's fault and your fault for trusting them. Not the landlord for making a copy of your key when you requested it. As a user I want API access to my data. As do a lot of people. I am going to be pissed if people like you cause everyone to stop offering APIs because they think people are two irresponsible to be trusted with access to their own data. APIs provide us data freedom. They are a good thing. The villain here is pretty clear to me is the company that is abusing your trust by withdrawing your money not the company providing the API. It is educating people that is broken not that APIs. I don't know when we got to be so trusting that we "absentmindedly" give 10 companies access to our data by clicking straight through a permission dialog that clearly says what I am doing. But absentmindedness is not a good reason to put padding on everything and force everyone to wear kneepads.
- pacala 8y ago
  This is not about API vs. not API. It's about hiding critical APIs among benign APIs and training users to click "Accept" on a regular basis. This is a dark pattern if there ever was one, perhaps the darkest of all. It's about the company formerly led by Eric "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place" Schmidt. It's about an ecosystem that requires you to hand out a copy of the key to your apartment to strangers in exchange of minor services on a regular basis, and makes it really easy to do so. I haven't used Android in a while, but here's a quick search that fits my Android experience of yesteryear. Almost every app I installed asked for this overreaching kind of permissions. Transcript with a little easter egg. Glympse needs access to * Identity * Calendar * Contacts * Location * SMS * Phone * Photos/Media/Files * First Born * Wi-fi connection information ACCEPT http://openattitude.com/wp-content/uploads/2015/06/m-permissions-02-glympse.png http://openattitude.com/wp-content/uploads/2015/06/m-permiss... https://www.howardforums.com/showthread.php/1865181-A-Massive-Disappointment-App-Permissions-on-Android-M https://www.howardforums.com/showthread.php/1865181-A-Massiv...