On 12/09/05, Robert E Smith <[EMAIL PROTECTED]> wrote: > > > > How about a more radical suggestion: implement del.icio.us as a distributed > database app, where each user holds his own tag database, and grants > permissions to a central site and to other users through services. > > > > R. > > > > > ------------------------------------------------------- > > Robert E. Smith, PhD > > Intelligent Systems Researcher and Consultant > > http://www.cs.ucl.ac.uk/staff/Rob.Smith > > ------------------------------------------------------- > > > > > ________________________________ > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of pwlin > Sent: 12 September 2005 16:45 > To: Delicious discussion list > Subject: Re: [delicious-discuss] remote app auth > > > > > On 9/12/05, joshua schachter <[EMAIL PROTECTED]> wrote: > > > > i'd like to put together a spec for letting users authorize remote > application access without giving away their actual password. > > here's a very preliminary idea: > > 1) remote webapp links to, say, del.icio.us/auth?return=http:// > place.to.send.auth.key/ > 2) user ends up on a page that tells him 'grant access to http:// > place.to.send.auth.key for write/read/decline' > 3) chooses read or write or whatever and is redirected to http:// > place.to.send.auth.key/?user=xyz&key=abc and this is logged to some > del.icio.us database. (or maybe this should be POST) > 4) api will accept either password or the auth key > > thoughts? > > > > Isn't it just too much of a hassle ? Expiration time for keys, people > changing their mind after authorizing a third party site, key poisoning, > third party sites holding the keys infinitely, etc. etc. > > A very easy way to do this is to let people "white list" the third party > sites they trust in their del.icio.us setting page. (same as we do with > cookies in the browser) > > Then we can just remove that site every time we don't feel it's ok. > > Other way is to force third party sites issue a key to the user, users then > add the key to their "white list" and API requests from designated third > party sites must match the key in user settings. > > In both ways, you can cut hours of coding and nursing the process on your > side. > > -- > pwlin
There has already been a lot of discussion about the flickr athentication process that is documented here: http://flickr.com/services/api/misc.userauth.html It seems to be an interesting approach and I think it can be applied to del.icio.us in the same way as it can be to flickr. Tim Lawrenz _______________________________________________ discuss mailing list [email protected] http://lists.del.icio.us/cgi-bin/mailman/listinfo/discuss
