3 ms·
The title here is misleading to me... it sounds like the kerfuffle is about Power.com not using the proper APIs and instead choosing to capture login credential
by cgranade 18y ago
The title here is misleading to me... it sounds like the kerfuffle is about Power.com not using the proper APIs and instead choosing to capture login credentials. That's a real breach of security, and given that Facebook implements an alternate authentication method, seems completely unnecessary. Maybe I'm missing something; is there anything you can do with direct logins that you cannot with Facebook Connect and full permissions?
- snprbob86 18y ago"is there anything you can do with direct logins that you cannot with Facebook Connect and full permissions" Yes, and that is exactly the problem. Facebook's APIs enforce very strict access controls on the data available to external or embedded applications. If you have my user name and password, you effectively have full permissions. Secure by design means no access by default. Sometimes, there are things not yet or not fully exposed to the APIs under the API's definition of full permissions. Other times, the granularity of access controls doesn't exactly match what your application needs. The user name and password lets you avoid playing by the rules and has the potential to greatly undermine user confidence in the security of their data.