I was annoyed with sites asking for too many Facebook privileges and made this

It's simply that many developers feel that it's easier to get all the permissions in one go, when the user first signs up.

https://market.android.com/details?id=com.lbe.security.lite

I agree; I much prefer whitelisting as I go (which is why I still use Firefox + NoScript + RequestPolicy).

Facebook's utility is in sharing personal information.

As a Facebook Connect developer, I too hate the all-or-nothing approach, but there's no easy way to avoid it until this new flow becomes standard.

http://ignoredbydinosaurs.com/2011/09/permissions-abuse-or-f...

First, I actually do have this warning in the README.

Second, if the app breaks when it doesn't have enough permissions, that's really just the laziness of the app developer. Handle the error gracefully if you really need the permission, and prompt for it again, explaining what you need it for.

Perhaps before it becomes a point'n'click install there might need to be more explanation about what might break, but anyone capable of installing it in its current form _ought_ to be capable of working out it's various means of breakage...

Breaking the app is the point of doing this. It's often not clear that, say, a FB app will post, as the user, to their own stream. I think most people don't want this, and want the app to break if it tries. You're thinking of "safety" from the perspective of perserving application behavior, not perserving user data and identity.

One point is: The UI is somehow broken (no styling, and "application settings", "update" and the checkboxes each are on their own line). Second point: When removing the ticks from the checkboxes and click on update, I'm redirected to: "https://www.facebook.com/dialog/undefined/dialog/permissions...

so "dialog/undefined" needs to be stripped.

(Maybe add the issues functionality to your repos.. :))

- Michael

Offline access isn't needed on the majority of sites that ask for it though, it's usually just laziness on the part of the developer (without that permission your server has to request a new token on login every so often).

I immediately changed my DOB on facebook and vowed to avoid authenticating with apps.

I generally avoid putting in real information on facebook but the amount of stuff they give away is frightening. It's a heaven for social engineering and spear phishing.

That's literally what this plugin does. It's actually kind of hard to do it without a plugin though; way harder than it should be:

For some reason, Chrome doesn't let you edit the URL for this kind of popup and so you have to copy it and paste it into a new window. Then, when you "allow" it, the javascript that would trigger the original page to reload doesn't work, since the page didn't popup your new window.

You can refresh the original window now, and depending on how the app is programmed, it may or may not have you logged in. If not, you can click the facebook connect button again, and this time hit "Deny". If the programmer was lazy, they won't notice that you Denied, and since you've already granted some permissions, you might get logged in.

Anyway, the plugin works better. I wrote it because I used to do this stuff.

The advertisers are the Johns (paying customers). The platform owners are the pimps. The users are the whores. Once you understand that, things become crystal clear. The more whores a platform owner has, the more they can charge the Johns to fuck the data. Pimps fight over whores and try to keep them from leaving. They fight over territory too.

What you want? White males between 24 and 28 in the 12345 zip code who like sports cars and are college graduates. We've got 18,000 of them. How much cash you got?

It's big business. Smart money is on the G pimp. They own more street corners.

Really, it comes down to this statement you made: "this is one of the appealing parts of facebook auth, imho" <- Facebook agrees, and it is Facebook's vision that that is the reason you are using their login provider. If you weren't intending to do that, in their model you are doing something actively confusing and wrong, not something that requires fewer permissions. ;P

"This is with the most basic authentication mechanism that facebook offers." <- so yes, it is. This is their offering: a login mechanism that isn't just a login mechanism, but in fact a way to build social applications where you can filter content based on users friends, show users how their friends interact with your content, and generally provide an experience based around "the social graph". If you really just want a login provider, you should go talk to Yahoo! or Microsoft, who were both interested in this raw service on various occasions (with lackluster results ;P).

It also is not Facebook's fault if "most apps ask for" a permission you do not want to grant. In fact, it is the fault of the other users on the service who don't care about granting that permission: instead of complaining to Facebook, you should complain to the developers, and honestly instead of complaining to the developers, you should spend your time educating the public on "least priviledge".

To instead claim that is Facebook's fault is an exactly analogous argument to claiming that all computing platforms should be closed, as it is then also Google's fault if a lot of developers ask for permission to run native code on their Android devices, instead of just using Java (which is at least memory safe): better to just avoid the whole mess and remove the functionality, right?

rather than let me write a page about it, just click the link

My guess is that chadselph's technique rarely gives worse results and is a damn sight more convenient to use.

Basically, when you generate a connect button, you list the which permissions you want to ask for and you get redirected to a page that asks for those permissions. My extension just changes the URL of the popup window so Facebook will be asking for different permissions.

Before yesterday, I've always just done this manually, but I was surprised to learn that people didn't know this trick. So, last night at 10pm I decided to just sit down and finally write it as an extension.

Short answer: your OAuth token includes permission status so yes, this should work.

Sadly, I believe you misunderstand Facebook's business case.

https://developers.facebook.com/docs/beta/authentication/

All you really need from Facebook are the email addresses of the people who sign up and want to contact you.

It's a bit like the old idea of a "change of email" forwarding service. People change email addresses, but there's nowhere to leave a forwarding address and you lose contact with them. It's also a bit like zabasearch which implemented a way to see if someone is trying to contact you.

Once you have those email addresses, you do not need Facebook. You are in contact, via email, with the people you want to be in contact with. You could set up your own private networks (startup hint). Advertisers are not invited to the party.

Without email, Facebook cannot exist. Zuckerberg's unusually popular password protected website relies on something very old: email addresses.

No email, no Facebook.

I just wish the next big thing would pop up so we can stop worrying about what stupid privacy blunder Facebook will commit next.

If they don't pay attention to those, clearly more obvious sketchy things, you really expect them to make sense of opting in and out of an already confusing app permission step?