Why does the app need these twitter permissions?

[julianharty]

The twitter link now works (Yay!) however the app seems to be greedy and I - for one - wouldn't trust it with access to my twitter account. Please review what permissions the app needs to have and what users should be able to optionally grant for each of the social network logins.

This application will be able to:
Read Tweets from your timeline.
See who you follow, and follow new people.
Update your profile.
Post Tweets for you.

[julianharty]

[sorry for the duplicate image]

[mgmccarthy]

@julianharty, I was the last one working on the external authorization providers.

Have you looked at what the other login providers require you to share with the application? That might help for us to gauge how "greedy" Twitter is vs. Google for example.

Thanks

[tonysurma]

Good feedback, we will review our ability to minimize that but often there is one thing we need that only comes in a package with many other permissions - similar to other providers as @mgmccarthy as well as an unfortunate pattern on mobile OS's as well (have to get perms to access all files in order to show photos for example).

We for sure are not looking to grab more than we need and it only creates a vector for issues we don't want to have as we purely use it for identity sakes.

Thanks

[julianharty]

@mgmccarthy the permissions being asked for twitter are wide-ranging at the moment and more than for other forms of authentication. @tonysurma @mgmccarthy I've just created a test twitter application (really I've just registered the details on twitter, no line of code needed) and discovered that there are 3 broad permissions. The least is read permission, and the one I've selected for my test app. You should hopefully be able to quickly and easily change the settings for your 'twitter app' to read only, and then check what permissions are displayed when someone who hasn't granted you permission to their twitter* clicks the twitter button in AllReady.

FWIW I found twitter's dev documentation is hard to make sense of. Perhaps it's just me though...

[julianharty]

BTW: there's what seems a clear tutorial at https://code.tutsplus.com/tutorials/how-to-authenticate-users-with-twitter-oauth-20--cms-25713 albeit written in PHP.

[mgmccarthy]

@julianharty, I wrote a blog about what it takes to get read-permission access from Twitter (which is the only way to pull the user's email address in to the registration page when picking Twitter for logon)... and it's involved: https://mgmccarthy.wordpress.com/2016/07/07/asp-net-core-retrieving-a-users-email-and-name-from-the-twitter-external-login-provider/

I'll check out the tutorial written in PHP as we might want to shoot for the least invasive form of Twitter requiring information from the user, which I assume, would result in nothing pre-populated on the registration form when a user picks to authenticate with Twitter.

[mgmccarthy]

@julianharty cc @tonysurma

I set up a new Twitter account tonight and created a new Twitter app. I did NOT go through all the steps listed in my blog (https://mgmccarthy.wordpress.com/2016/07/07/asp-net-core-retrieving-a-users-email-and-name-from-the-twitter-external-login-provider/) yet.

I wanted to see what type of page I would get while running the application locally using the new Twitter account as the Twitter account for the allReady application:

This is the screen I received:

Much different than the screen the @julianharty received, and a lot less invasive. I'm not too sure who's Twitter account is used on the "live" site for hosting the Twitter application, but it sounds like that account might have checked off more information required from the application when authenticating via Twitter.

I'm going to keep investigating as well as take a look at how to fix Issue #1304, which is a bug.

Thanks

[tonysurma]

@julianharty and @mgmccarthy I am going to look at the live config and see what is right/wrong in our live config. Thanks!

[EmilyLuijbregts]

@tonysurma - Just following up on this ticket. Did you manage to look at the liveconfig?