5 ms·

DropBox seems to have decided that the only way for them to grow is to turn their data sync platform into a collaborative platform. Makes a whole lot of sense t

DropBox seems to have decided that the only way for them to grow is to turn their data sync platform into a collaborative platform. Makes a whole lot of sense to steal contacts from all your users. FYI - never use oauth to log into anything you care about.

pornel 6y ago
Sadly, you can't have a product that does one thing and does it well when you have to show never-ending growth to investors :(
- AnIdiotOnTheNet 6y ago
  Even more sadly that same thing seems to be true of FOSS applications because people think an application you aren't constantly updating and adding features to is "abandoned". Software isn't allowed to just be done anymore.
  - henriquemaia 6y ago
    Well, fortunately, there are exceptions. Case in point being XFCE. It has remained the same for years. However, your point still stands, because exceptions are just that, exceptions.
rad_gruchalski 6y ago
> FYI - never use oauth to log into anything you care about. Interesting remark. I'm not objecting but it's interesting that this goes against what can one read here very often from people who comment on new products, which goes like this: "if you offered oauth sign up, I'd sign up but won't bother with creating an account". Just an observation.
- cblconfederate 6y ago
  do you mean OpenID? I guess oauth is OK for signups if the tokens were expiring. But usually you naively give the credentials to a new startup, only to find out they abuse them months later.
  - dudul 6y ago
    Can you elaborate on that? How can they abuse it? Your oauth provider will show you which permissions the app is requesting when you grant them access. What kind of abuse have you seen?
- malka 6y ago
  I'm the opposite. 'only Google and Facebook Auth ? Can't create account ? Bye.'
  - Tepix 6y ago
    It vastly increases the tracking that FB and Google can do. Bad idea. Also, knowing Google, perhaps they one day decide to discount the oauth login feature?
    - Tepix 6y ago
      not discount, discontinue of course
beastman82 6y ago
Not following. What's wrong with oauth?
- merlinscholz 6y ago
  When Google's AI (=RNG) decides to terminate your account (maybe you typed a few too many comments on YouTube, this has happened to people), you'll lose every service for which you used Google to sign in with. Also, the usual tracking stuff.
  - arendtio 6y ago
    In addition, you are limited to the few providers which are being supported by the platform. So you can't simply create your own authentication provider as it was possible with OpenID.
  - switch007 6y ago
    Don't websites usually create an association between a local user (in their DB) and an oauth2 account, linked by the email address? And then all your data is linked to the local DB user. I guess it's a bigger threat if you don't use your own domain for email. EDIT: I'm talking about sites that also have their own local user db of course, so you could just do a password reset.
Latty 6y ago
Is there an oauth provider that offers what mobiles have started to do with permissions, where "deny" just gives empty data to to the requesting application instead of actually rejecting the claim? It'd be nice to see Google offer something like that.
- ceejayoz 6y ago
  Facebook does this with theirs for access to a user’s Pages. Just an empty array, which isn’t unusual for normal users. Makes it tough for third-party devs to debug a legit “I am not seeing Page X as an option” though.
arendtio 6y ago
I am not so sure if oauth is to blame alone. I mean, it is a technology that lets you control what you want to share. However, engaging in business with a partner who decides to change the rules, is something I see a lot more critical. So maybe the lesson should sound more like - 'Don't use Dropbox for anything you care about' or - 'Don't do business with large corporations for anything you care about' To clarify, I am not saying it to protect oauth (in its current state I am not a particular fan of it), but to show, that the technology doesn't change by itself and that someone decided to change it. So the company who decided to execute this unethical change should take its share of the blame too.
- koheripbal 6y ago
  Isnt the point here that you don't have control? Seems like you need to allow contact access to use google login at all. There is no fine grained control to permissions.
  - robertlagrant 6y ago
    That's not oauth, that's just the granularity the auth provider has decided to expose in its permissions system, and the granularity Dropbox have opted to request.
    - jeromegv 6y ago
      That's oauth in the sense that if you login with your own login/pass, this will never be something they can force on you. I never use oauth, always login/pass, and don't have to care about what permissions they ask me, it's easy, they have absolutely zero access to my gmail/facebook/twitter whatever.
bayindirh 6y ago
> FYI - never use oauth to log into anything you care about. Or, "Then create a password and revoke oauth permissions from the provider"
- mkr-hn 6y ago
  These days all browsers offer to generate and save a syncable password for you and fill in the email, so it's almost as easy to make a normal account as it is to use OAuth. It feels like OAuth/SSO is a tool for a different, less user-friendly era.
tallanvor 6y ago
> FYI - never use oauth to log into anything you care about. I definitely agree with this. While it's true that Google, Microsoft, Facebook, and Apple are probably better at securing accounts than most other companies, there's always the possibility that they can be compromised. Another problem is that if your oauth provider decides to close your account for whatever reason, it may be difficult or impossible to unlink everything from it. Not only do I create real accounts for any service I want to use, I divide them up among multiple separate email accounts, so that if one account is compromised, I limit the associated services that are vulnerable as a result.
- malka 6y ago
  My Spotify is broken since I deleted my Facebook. I can't even change the email in my profile.
  - tored 6y ago
    Contact Spotify support. Had a similar problem where I had a leftover Facebook-Spotify account after delinking that blocked my normal account from changing my email. Spotify support was quick to help me.

pornel 6y ago

Sadly, you can't have a product that does one thing and does it well when you have to show never-ending growth to investors :(

AnIdiotOnTheNet 6y ago
Even more sadly that same thing seems to be true of FOSS applications because people think an application you aren't constantly updating and adding features to is "abandoned". Software isn't allowed to just be done anymore.
- henriquemaia 6y ago
  Well, fortunately, there are exceptions. Case in point being XFCE. It has remained the same for years. However, your point still stands, because exceptions are just that, exceptions.

rad_gruchalski 6y ago

> FYI - never use oauth to log into anything you care about. Interesting remark. I'm not objecting but it's interesting that this goes against what can one read here very often from people who comment on new products, which goes like this: "if you offered oauth sign up, I'd sign up but won't bother with creating an account". Just an observation.

cblconfederate 6y ago
do you mean OpenID? I guess oauth is OK for signups if the tokens were expiring. But usually you naively give the credentials to a new startup, only to find out they abuse them months later.
- dudul 6y ago
  Can you elaborate on that? How can they abuse it? Your oauth provider will show you which permissions the app is requesting when you grant them access. What kind of abuse have you seen?
malka 6y ago
I'm the opposite. 'only Google and Facebook Auth ? Can't create account ? Bye.'
- Tepix 6y ago
  It vastly increases the tracking that FB and Google can do. Bad idea. Also, knowing Google, perhaps they one day decide to discount the oauth login feature?
  - Tepix 6y ago
    not discount, discontinue of course

beastman82 6y ago

Not following. What's wrong with oauth?

merlinscholz 6y ago
When Google's AI (=RNG) decides to terminate your account (maybe you typed a few too many comments on YouTube, this has happened to people), you'll lose every service for which you used Google to sign in with. Also, the usual tracking stuff.
- arendtio 6y ago
  In addition, you are limited to the few providers which are being supported by the platform. So you can't simply create your own authentication provider as it was possible with OpenID.
- switch007 6y ago
  Don't websites usually create an association between a local user (in their DB) and an oauth2 account, linked by the email address? And then all your data is linked to the local DB user. I guess it's a bigger threat if you don't use your own domain for email. EDIT: I'm talking about sites that also have their own local user db of course, so you could just do a password reset.

Latty 6y ago

Is there an oauth provider that offers what mobiles have started to do with permissions, where "deny" just gives empty data to to the requesting application instead of actually rejecting the claim? It'd be nice to see Google offer something like that.

ceejayoz 6y ago
Facebook does this with theirs for access to a user’s Pages. Just an empty array, which isn’t unusual for normal users. Makes it tough for third-party devs to debug a legit “I am not seeing Page X as an option” though.

arendtio 6y ago

I am not so sure if oauth is to blame alone. I mean, it is a technology that lets you control what you want to share. However, engaging in business with a partner who decides to change the rules, is something I see a lot more critical. So maybe the lesson should sound more like - 'Don't use Dropbox for anything you care about' or - 'Don't do business with large corporations for anything you care about' To clarify, I am not saying it to protect oauth (in its current state I am not a particular fan of it), but to show, that the technology doesn't change by itself and that someone decided to change it. So the company who decided to execute this unethical change should take its share of the blame too.

koheripbal 6y ago
Isnt the point here that you don't have control? Seems like you need to allow contact access to use google login at all. There is no fine grained control to permissions.
- robertlagrant 6y ago
  That's not oauth, that's just the granularity the auth provider has decided to expose in its permissions system, and the granularity Dropbox have opted to request.
  - jeromegv 6y ago
    That's oauth in the sense that if you login with your own login/pass, this will never be something they can force on you. I never use oauth, always login/pass, and don't have to care about what permissions they ask me, it's easy, they have absolutely zero access to my gmail/facebook/twitter whatever.

bayindirh 6y ago

> FYI - never use oauth to log into anything you care about. Or, "Then create a password and revoke oauth permissions from the provider"

mkr-hn 6y ago
These days all browsers offer to generate and save a syncable password for you and fill in the email, so it's almost as easy to make a normal account as it is to use OAuth. It feels like OAuth/SSO is a tool for a different, less user-friendly era.

tallanvor 6y ago

> FYI - never use oauth to log into anything you care about. I definitely agree with this. While it's true that Google, Microsoft, Facebook, and Apple are probably better at securing accounts than most other companies, there's always the possibility that they can be compromised. Another problem is that if your oauth provider decides to close your account for whatever reason, it may be difficult or impossible to unlink everything from it. Not only do I create real accounts for any service I want to use, I divide them up among multiple separate email accounts, so that if one account is compromised, I limit the associated services that are vulnerable as a result.

malka 6y ago
My Spotify is broken since I deleted my Facebook. I can't even change the email in my profile.
- tored 6y ago
  Contact Spotify support. Had a similar problem where I had a leftover Facebook-Spotify account after delinking that blocked my normal account from changing my email. Spotify support was quick to help me.