I was annoyed with sites asking for too many Facebook privileges and made this

Re:I was annoyed with sites asking for too many Facebook pri... by saurik on Monday November 28, 2011 @10:14PM (#3288845)

Facebook is not trying to be a "general authentication provider": they are trying to be a "social application enabler". If you have no interest in making a social application, which to Facebook means you fundamentally at bare minimum are going to need their friends list (or they, and I, would question what you even mean by "social"), then you should not use Facebook's authentication mechanism.

Really, it comes down to this statement you made: "this is one of the appealing parts of facebook auth, imho" <- Facebook agrees, and it is Facebook's vision that that is the reason you are using their login provider. If you weren't intending to do that, in their model you are doing something actively confusing and wrong, not something that requires fewer permissions. ;P

"This is with the most basic authentication mechanism that facebook offers." <- so yes, it is. This is their offering: a login mechanism that isn't just a login mechanism, but in fact a way to build social applications where you can filter content based on users friends, show users how their friends interact with your content, and generally provide an experience based around "the social graph". If you really just want a login provider, you should go talk to Yahoo! or Microsoft, who were both interested in this raw service on various occasions (with lackluster results ;P).

It also is not Facebook's fault if "most apps ask for" a permission you do not want to grant. In fact, it is the fault of the other users on the service who don't care about granting that permission: instead of complaining to Facebook, you should complain to the developers, and honestly instead of complaining to the developers, you should spend your time educating the public on "least priviledge".

To instead claim that is Facebook's fault is an exactly analogous argument to claiming that all computing platforms should be closed, as it is then also Google's fault if a lot of developers ask for permission to run native code on their Android devices, instead of just using Java (which is at least memory safe): better to just avoid the whole mess and remove the functionality, right?

[ Parent | on HN ]

Re:I was annoyed with sites asking for too many Facebook pri... by blhack on Monday November 28, 2011 @10:36PM (#3288910)

Hey Saurik,

I'm saying that facebook's documentation of their particular implemenation of oauth is weak, and that this causes devs to proverbially thrown their hands in the air and say "well screw it! I'll just request offline_access (a long-lived token) and call it good!".

That's the frustration, that's the thing I'm "blaming" facebook for.

As far as a user's friends coming with their login. Yes, of course, and this is why I'm using facebook authentication. I just wish that facebook made it more obvious to people what they're giving me.

[ Parent | on HN ]

Re:I was annoyed with sites asking for too many Facebook pri... by davidcuddeback on Monday November 28, 2011 @11:14PM (#3289021)

As someone who develops Facebook apps, I think one of the problems is that there is usually a gap between the reason you need to ask for a permission and what a permission enables you to do. For example, if you want the ability to create albums and post pictures on your users' behalf, you have to request permission to read their albums. This seems to surprise most users: "why do they want access to all my photos?" Answer: the developer probably doesn't care about your photos, but they have a feature that posts pictures. The "offline access" permission is often used to get around rate limits, but users think it means an app is harvesting their deepest secrets. Unfortunately, I can't think of a clear solution to this. Finer-grained permissions will probably look even more nefarious (because the list of permissions being requested will be longer in many cases) and be more confusing to the user.

[ Parent | on HN ]

Re:I was annoyed with sites asking for too many Facebook pri... by TeMPOraL on Tuesday November 29, 2011 @01:41AM (#3289379)

Maybe some additional text under each permission requested, describing what the app needs it for, e.g.:

- "Post to Facebook as me" - we need that to upload your photos created by XYZ. We will not post status updates on your behalf.

- "Access my data all the time" - we use that to...

etc.

I'd personally like to see more developers open about what they're using given permission for. I'm willing to trust them, just if they're a little more transparent.

[ Parent | on HN ]

Re:I was annoyed with sites asking for too many Facebook pri... by gizzlon on Tuesday November 29, 2011 @03:25AM (#3289602)

But if you trust their reasons, you already trust them?

Why would you believe the reasons given if you don't trust the app developer?

[ Parent | on HN ]

Re:I was annoyed with sites asking for too many Facebook pri... by TeMPOraL on Tuesday November 29, 2011 @04:15AM (#3289684)

For me it would make a difference on borderline cases. If I trust the developer, I don't care about permissions; if I don't trust (or don't like), I won't accept. But sometimes I'm not 100% sure - especially when an app asks for lot of permissions and I have no idea why they would even need them. Then, a plausible explanation could convince me to give those permissions.

[ Parent | on HN ]