Unfollowed Me worm spreads on Twitter - stop allowing 3rd party apps | Hacker News Reader

Unfollowed Me worm spreads on Twitter - stop allowing 3rd party apps

nakedsecurity.sophos.com

11 pointszgorgonola8 comments

What I find really iritating with Twitter and Facebook logins is that the rights an app asks for (e.g. post tweets, read DMs) is an all-or-nothing proposition.

It should be more configurable at the point of login so that you can refuse to grant something that a 3rd part app is asking (e.g. often I don't want 3rd party apps sending tweets as me), and let the app figure out if thats ok.

Agreed. It would also be nice if the 3rd party apps were required to provide short explanations for each of the permissions they were requesting.

I almost never provide access to any 3rd party Twitter app that wants permission to "read and update" my stream, because I don't know if they have any legitimate reasons to want to update it (aside from automatic self-promotion tweets that look like they're coming from me).

Geeks like us would understand that, but regular users (especially for Facebook) would be utterly confused. Any better ideas?

They'd be confused until they learned. Facebook was probably confusing for my mom until she figured it out. People are more adaptable than you think, when the information is presented in a clear way.

To put it another, harsher way - adapt or die, we need a better class of netizens who aren't completely baffled by non-binary decisions.

In addition to what pavel_lishin said, this is just a UI problem. A skilled developer working with a skilled UX designer could make a comprehensive security system that anyone can use, possibly by allowing casual users to accept some kind of default, and anyone who cares enough to drill down into detailed permissions.

Taking the Facebook permissions window as an example, I can't see why having a checkbox next to each permission would be complicated. Give developers the opportunity to grey those checkboxes out (i.e. this app relies fundamentally on this permission, you can't run without it) and get them to check for the presence of the remainder- and you're done.

The other day I signed up for Disqus. They offered the option to link your account to Twitter. However, they only supported asking for "read and update" permission, so that they can tweet your comments. I have no interest in doing so, so I dropped them an email asking for the option of connecting to Twitter with read permission only, not update permission. They responded back that I could just use Disqus's preferences to say I don't want comments tweeted, completely missing the point.

I wonder how many non-geek users who read this article will simply disallow all third-party apps, even legitimate ones.

Reply on news.ycombinator.com