"What's nice about OAuth is that it allows the end user to control access to information and revoke access as needed." Really? This has NEVER been my experience with OAuth or similar protocols. It's always all or nothing, and I can never: - limit the scope of any given type of permission - find out which data was actually accessed - limit the number of permissions given (it's all or nothing)

I realize this takes much more work than simple protocol, but it's the same as on Android: either an app takes EVERYTHING they ask for, and noone tells you how exactly they used those capabilities (no api log, no nothing), or you can't use the app.

I would much prefer a solution which lets me: - understand full scope of data access (what does it mean that a web-app can "manage my contacts" in Google account? Manage as in... delete? Change their details arbitrarily? What?!) - see full list, by app, what was actually accessed, and when - be able to pick which things I want the app to do, and which I don't - define (with groups, individual item selection or similar) which specific items I want the app to access

If the app breaks because it doesn't support partial access, so be it. But not designing this ability into the UI is basically forcing users to forever become oblivious of how technology works.