Hacker News Reader

How is this a flaw? Go to your Facebook apps settings and you can disable extended permissions for any app there. The apps are expected to work with only some of the permissions, and they have APIs to check which permissions they have enabled. This is intended.

Edit: There's also an option to edit/disable the extended permissions during the authorization. Docs: https://developers.facebook.com/docs/opengraph/authenticatio... (Permissions section)

View on HN

> This is intended

what is intended here? I am user and I cannot opt-out perms in user interface. So I have to use URL trick. Looks not intended

https://www.facebook.com/settings?tab=applications

thanks for the link

"This app can:" section with perms configuration is what I want to see on authorize URL.

During the time between granting the permissions, and removing them, couldn't those permissions be abused? The URL modification solution prevents this problem.

Exactly what I thought. An app will potentially already have your whole social graph by the time you get to change those settings.

The social graph is not secret. Apps don't need to ask any permission to get it. https://blog.facebook.com/blog.php?post=197943902130

Yes, in fact some apps post to your timeline immediately with a message encouraging your friends to add the app.

Reply on news.ycombinator.com