3 ms·
Twitter is currently locking down their API and making it harder for developers to access. My bank doesn't even have an API, but developers still gain programma
by strken 8y ago
Twitter is currently locking down their API and making it harder for developers to access. My bank doesn't even have an API, but developers still gain programmatic access to it, only they ask users for their full credentials instead of limited, monitored, and revocable API access. My concern is that Twitter's new restrictions, and restrictions like them, will push apps towards just collecting a user's login credentials.
- xfer 8y agoHow is running a chrome headless any different than running it normally, that's how you login to your account, don't you?
- nailer 8y agoUsers don't want to give third party apps full access.
- strken 8y agoIt's exactly the same thing, which is why it's bad. When I log into e.g. CoolQuiz[0] on quizzes.cambridgeanalytica.com with Facebook using OAuth 2, it requests a limited list of permissions from Facebook, which are shown to a user, and which don't include things like like resetting the user's password or changing the user's email address. It gets back an access token which can only be used for doing those things, and Facebook can track what's done with that access token, in the case that e.g. CoolQuiz uses it to read personal information from all a user's friends and microtarget advertising during a US election. Headless chrome is indistinguishable from a normal user, which means it can do absolutely anything a user can do and can't be tracked. [0] probably doesn't exist, just a hypothetical example
- xfer 8y agoRight, i missed the oauth2 scoping aspect.