4 ms·

What about security? Why should we as users trust a non-Gmail service with our Google Accounts username and password? We, as hackers, should not foster such bad

What about security? Why should we as users trust a non-Gmail service with our Google Accounts username and password? We, as hackers, should not foster such bad security behaviours.

breck 18y ago
Nearly every social networking site and new web 2.0 site has this feature. Passwords are not stored. I rarely feel comfortable using these features because many sites try hard to trick you into inviting everyone in your address book(BluBet as a recent example). That's precisely why this widget would be useful--having a trusted company provide this functionality for many small sites would be preferable to trusting many small sites with these credentials.
axod 18y ago
I agree. I think the whole idea is absolutely horrible. It'd be better to have webmail clients have a "Email my contact list to this address" functionality.
- breck 18y ago
  I don't understand your concerns. Facebook, LinkedIn, Twitter, Loopt, Flickr, practically every single site with any type of social component implements this idea. What's the problem?
  - pierrefar 18y ago
    Ubiquitous implementation does not mean it's a good idea.
  - axod 18y ago
    It encourages people to give sites login details to other sites. That is a really bad idea, especially when it's only to import your contacts. Would you give someone the keys to your house so they could rifle through your letters, address book, computer etc to find your contacts? A far better solution would be a push from the user - email the website a list of contacts for example.
    - breck 18y ago
      A far better solution would be a push from the user - email the website a list of contacts for example. I disagree. The implementations I have seen are very easy to use and effective. This solves a huge problem of having to build a friends list from scratch every time I join a new site. Emailing a list of contacts would be a feature no one would ever use. The security concerns are warranted. I wouldn't give out my credentials to just anyone, only to reputable sites. If a site were to abuse a user's trust by using the email login info for unathorized purposes, a user who was actively and willingly trying to help the site by inviting their friends, I think the consequences should be and would be severe. As long as one uses common sense in deciding whether to give out their login info, I think this is a really good idea. Ideally, a trusted third party--or the email providers themselves--would handle this type of contacts exchange through some type of JavaScript tool.
      - axod 18y ago
        By "email the website a list of contacts" I mean have webmail clients implement a button [Email my contacts] so the user only has to login to their webmail, click the button, enter an email address for the site.
drm237 18y ago
Until recently, google didn't provide an api to access contact information, so collecting the username and password information was required to make it work. I haven't seen any sites make use of google's new contact access api though.
- spazmaster 18y ago
  Soocial has a working service (still private beta though) that uses Google Contact API. They use OAuth authentication too, which means that you can grant access via GMail, so you never have to give out your password to a third party (Soocial in this case). http://www.soocial.com http://www.soocial.com This widget is a terrible idea (you don't give the PIN code of your ATM card to your waitress do you?), but might be a great idea when implemented using OAuth.
  - breck 18y ago
    Thanks! Look forward to the launch.

What about security? Why should we as users trust a non-Gmail service with our Google Accounts username and password? We, as hackers, should not foster such bad security behaviours.

breck 18y ago

Nearly every social networking site and new web 2.0 site has this feature. Passwords are not stored. I rarely feel comfortable using these features because many sites try hard to trick you into inviting everyone in your address book(BluBet as a recent example). That's precisely why this widget would be useful--having a trusted company provide this functionality for many small sites would be preferable to trusting many small sites with these credentials.

axod 18y ago

I agree. I think the whole idea is absolutely horrible. It'd be better to have webmail clients have a "Email my contact list to this address" functionality.

breck 18y ago
I don't understand your concerns. Facebook, LinkedIn, Twitter, Loopt, Flickr, practically every single site with any type of social component implements this idea. What's the problem?
- pierrefar 18y ago
  Ubiquitous implementation does not mean it's a good idea.
- axod 18y ago
  It encourages people to give sites login details to other sites. That is a really bad idea, especially when it's only to import your contacts. Would you give someone the keys to your house so they could rifle through your letters, address book, computer etc to find your contacts? A far better solution would be a push from the user - email the website a list of contacts for example.
  - breck 18y ago
    A far better solution would be a push from the user - email the website a list of contacts for example. I disagree. The implementations I have seen are very easy to use and effective. This solves a huge problem of having to build a friends list from scratch every time I join a new site. Emailing a list of contacts would be a feature no one would ever use. The security concerns are warranted. I wouldn't give out my credentials to just anyone, only to reputable sites. If a site were to abuse a user's trust by using the email login info for unathorized purposes, a user who was actively and willingly trying to help the site by inviting their friends, I think the consequences should be and would be severe. As long as one uses common sense in deciding whether to give out their login info, I think this is a really good idea. Ideally, a trusted third party--or the email providers themselves--would handle this type of contacts exchange through some type of JavaScript tool.
    - axod 18y ago
      By "email the website a list of contacts" I mean have webmail clients implement a button [Email my contacts] so the user only has to login to their webmail, click the button, enter an email address for the site.

drm237 18y ago

Until recently, google didn't provide an api to access contact information, so collecting the username and password information was required to make it work. I haven't seen any sites make use of google's new contact access api though.

spazmaster 18y ago
Soocial has a working service (still private beta though) that uses Google Contact API. They use OAuth authentication too, which means that you can grant access via GMail, so you never have to give out your password to a third party (Soocial in this case). http://www.soocial.com http://www.soocial.com This widget is a terrible idea (you don't give the PIN code of your ATM card to your waitress do you?), but might be a great idea when implemented using OAuth.
- breck 18y ago
  Thanks! Look forward to the launch.