4 ms·

Hey Saurik, I'm saying that facebook's documentation of their particular implemenation of oauth is weak, and that this causes devs to proverbially thrown their

by blhack 15y ago

Hey Saurik, I'm saying that facebook's documentation of their particular implemenation of oauth is weak, and that this causes devs to proverbially thrown their hands in the air and say "well screw it! I'll just request offline_access (a long-lived token) and call it good!". That's the frustration, that's the thing I'm "blaming" facebook for. As far as a user's friends coming with their login. Yes, of course, and this is why I'm using facebook authentication. I just wish that facebook made it more obvious to people what they're giving me.

davidcuddeback 15y ago
As someone who develops Facebook apps, I think one of the problems is that there is usually a gap between the reason you need to ask for a permission and what a permission enables you to do. For example, if you want the ability to create albums and post pictures on your users' behalf, you have to request permission to read their albums. This seems to surprise most users: "why do they want access to all my photos?" Answer: the developer probably doesn't care about your photos, but they have a feature that posts pictures. The "offline access" permission is often used to get around rate limits, but users think it means an app is harvesting their deepest secrets. Unfortunately, I can't think of a clear solution to this. Finer-grained permissions will probably look even more nefarious (because the list of permissions being requested will be longer in many cases) and be more confusing to the user.
- TeMPOraL 15y ago
  Maybe some additional text under each permission requested, describing what the app needs it for, e.g.: - "Post to Facebook as me" - we need that to upload your photos created by XYZ. We will not post status updates on your behalf. - "Access my data all the time" - we use that to... etc. I'd personally like to see more developers open about what they're using given permission for. I'm willing to trust them, just if they're a little more transparent.
  - gizzlon 15y ago
    But if you trust their reasons, you already trust them? Why would you believe the reasons given if you don't trust the app developer?
    - TeMPOraL 15y ago
      For me it would make a difference on borderline cases. If I trust the developer, I don't care about permissions; if I don't trust (or don't like), I won't accept. But sometimes I'm not 100% sure - especially when an app asks for lot of permissions and I have no idea why they would even need them. Then, a plausible explanation could convince me to give those permissions.

by blhack 15y ago

davidcuddeback 15y ago

As someone who develops Facebook apps, I think one of the problems is that there is usually a gap between the reason you need to ask for a permission and what a permission enables you to do. For example, if you want the ability to create albums and post pictures on your users' behalf, you have to request permission to read their albums. This seems to surprise most users: "why do they want access to all my photos?" Answer: the developer probably doesn't care about your photos, but they have a feature that posts pictures. The "offline access" permission is often used to get around rate limits, but users think it means an app is harvesting their deepest secrets. Unfortunately, I can't think of a clear solution to this. Finer-grained permissions will probably look even more nefarious (because the list of permissions being requested will be longer in many cases) and be more confusing to the user.

TeMPOraL 15y ago
Maybe some additional text under each permission requested, describing what the app needs it for, e.g.: - "Post to Facebook as me" - we need that to upload your photos created by XYZ. We will not post status updates on your behalf. - "Access my data all the time" - we use that to... etc. I'd personally like to see more developers open about what they're using given permission for. I'm willing to trust them, just if they're a little more transparent.
- gizzlon 15y ago
  But if you trust their reasons, you already trust them? Why would you believe the reasons given if you don't trust the app developer?
  - TeMPOraL 15y ago
    For me it would make a difference on borderline cases. If I trust the developer, I don't care about permissions; if I don't trust (or don't like), I won't accept. But sometimes I'm not 100% sure - especially when an app asks for lot of permissions and I have no idea why they would even need them. Then, a plausible explanation could convince me to give those permissions.