2 ms·
I think there are a lot of users who feel the other way around, they can't trust "some random website" with their facebook / G+ identity. They would rather just
by jay_kyburz 12y ago
I think there are a lot of users who feel the other way around, they can't trust "some random website" with their facebook / G+ identity. They would rather just make a throw away account with some easy to remember password.
- dyoo1979 12y agoI would agree that this is a major flaw, if the "scope" were unrestricted. But most of these systems support a capability-style model where you can say: "I give you permission to let me log in as myself, for this particular web site. But you have no other authority to do anything else as me." For example, "email" scope: https://developers.google.com/+/api/oauth#email https://developers.google.com/+/api/oauth#email, or the Permissions in Facebook login: https://developers.facebook.com/docs/facebook-login/permissions/v2.2 https://developers.facebook.com/docs/facebook-login/permissi... Another reason why I don't feel happy about forcing people to make passwords for random web sites: most people are really bad at understanding risky computer behavior. Do you have a parent or relative who uses the same password for everything? I do. Despite my best efforts to warn them, they are not convinced that this is a dangerous thing to do. I don't think they're alone in this. Education is not enough.