I don't feel that OAuth is a good solution for desktop applications.
If a user doesn't want the application to access their Twitter
account, why'd they download it in the first place? It seems very
redundant.
But the real problem is for mobile devices, especially for devices
that don't have Copy and Paste functions (like the iPhone, up until
recently). Twitter doesn't have a login page for OAuth that really is
made for mobile phones, so the user has to perform extra actions
(zooming, panning, etc.) to be able to login. The PIN method of
verification doesn't work well for phones that don't have Copy and
Paste (like pre-3.0 iPhone, if you plan on supporting that), but then
neither does the Browser option work, because you can't really launch
an app from a URL (with the exception of the iPhone, but Twitter
doesn't allow non-standard URL schemes).
OAuth on mobile devices doesn't work. Let's go back to the iPhone
(which I use as an example because I am a developer for it). You can't
be contaminated with viruses, you can't get malware, and you can't get
spyware. The only way you can get software at all ("legally") is to
get it from Apple, through the App Store, and Apple already does
filtering, and strips out malicious apps. Since the App Store is the
only medium to get apps, you have to want and then go download them.
There is no third-party here putting malicious code on your device,
and stealing your credentials. There is only the users, who wants to
use your app, downloads it, and then is asked if wants to allow this
app to access Twitter. If he doesn't want to let it access Twitter,
why the heck did the user download the app in the first place?
Sure, I chose the iPhone, but from what I understand, other phones
have app stores of their own: Android has their Marketplace,
Blackberry has one, Palm will soon get one if they don't already have
one. People want to use Twitter on these devices, even full clients.
But trying to login to OAuth on that tiny screen, with a PIN that you
may or may not be able to copy and paste (depending on your device
capabilities), is just a big hassle.
For my Twitter client, I've gone ahead and done all the OAuth
authentication behind the scenes. I'll ask them for a username and
password, and log them into OAuh myself without them having to ever
see a web browser. "Wait! You shouldn't do that!" Whatever! I'm
selling this Twitter client on the App Store for two dollars. If a
user doesn't want to let my app access Twitter, why is he wasting two
bucks to download an app he will not use? It does not make sense!
I understand that OAuth is implemented to give the user an extra net
of security, but I'm not sure that the OAuth system is the best one to
use. What would be best is a system that can be used on any platform,
with any device, mobile or desktop. Modifying the login to do
something different for mobile clients, like a different way of
authenticating (such as choosing a picture. Show a picture in the web
browser, send possible images to the client, then have the user choose
the correct picture they saw), would be fantastic! At the very least,
mobile versions of OAuth login and authentication should be implemented.
On another note, how "Open Source friendly" is OAuth? I'm not sure if
people who write open source software want to be giving out their
Consumer Secret key in their source code for spammers to possible get
a hold of, build a bot using that key and secret, and then spam
Twitter using that key, which Twitter might block, thus, completely
disabling your app for all your users. This is terrible for people who
might write open source iPhone clients, as the approval process for
these apps takes 2 weeks: 2 weeks your users can't use your app, and
might switch over to another client.
- Jason
On Aug 16, 2009, at 7:18 AM, Andrew Badera wrote:
>
> On Sun, Aug 16, 2009 at 7:08 AM, Nicole Simon<[email protected]> wrote:
>>
>>
>> On Sat, Aug 15, 2009 at 22:26, Kevin Mesiab <[email protected]>
>> wrote:
>>>
>>> The interaction seems unintuitive and redundant for users who have
>>> already granted our application 'trust' by installing it.
>>
>> I can't understand this notion.
>> Every single day users are sheep enough to do stupid things -
>> they just need to be guided to do so. And then they will follow.
>>
>> Every single day (especially the normal users) install dozens of
>> apps on
>> facebook
>> without even thinking about that box in the middle nor reading it.
>> And 'the
>> experienced
>> ones' who teach the sheeps make sure that "never use your password"
>> gets
>> drilled
>> into their heads.
>>
>> Before there was no alternative. Now there is a better way.From now
>> it is
>> "password?
>> BAD. Using without password and authorize with twitter: good!"
>>
>> Yes, they have granted you the trust of installing it, but could
>> you please
>> set the
>> mindset to the goal? "as part of our x step installation step, this
>> is what
>> is going to happen:
>> - download app
>> - install app
>> - test app
>> - now the fun part: making sure you get the best ou tof this
>> experience and
>> connect it with
>> twitter itself, and this is how it looks. We are using the secure
>> process
>> where you
>> do not need to enter anywhere your password. we never ask for your
>> password,
>> because
>> we are the good guys!
>> - do this
>> - do that
>> and tada! you can start using our app! thanks for trusting us!"
>>
>> Where is the problem?
>> It only is unintuitve when you make it as such. of course the above
>> is too
>> complicated,
>> so the real steps only should be "3 easy steps to go - download,
>> install,
>> connect, use!" or something like it.
>>
>> But as long as you treat it as the ugly way you don't want to use,
>> you will
>> not make
>> it easy on you.
>>
>> Nicole
>>
>
> Agreed. OAuth presents a standardized and centralized process, a
> universal standard which users can become familiar with, rather than
> any given app's arbritrary authorization mechanisms and actual levels
> of trustability.
>
> ∞ Andy Badera
> ∞ This email is: [ ] bloggable [x] ask first [ ] private
> ∞ Google me: http://www.google.com/search?q=(andrew+badera)+OR+(andy+bader
> a)
