jsha / blocktogether

Share your blocks and subscribe to others'
GNU General Public License v3.0
330 stars 68 forks source link

Don't require so many permissions (or explain why you do in FAQ) #262

Open kiprobinson opened 6 years ago

kiprobinson commented 6 years ago

When adding Block Together, it is asking for the following permissions:

  • Read Tweets from your timeline.
  • See who you follow, and follow new people.
  • Update your profile.
  • Post Tweets for you.

This seems like a lot. I discovered the app from a Twitter thread (https://twitter.com/shannoncoulter/status/1028632688586936320), which included this which kind of set off alarm bells in my head:

You can ignore the copy that says the app will be able to post to your timeline. It will not. That’s boilerplate copy that appears for all external Twitter apps. I’ve tested the tool it doesn’t do anything unexpected/unwanted.

Training users to ignore important warnings is the kind of thing that enabled to Cambridge Analytica. If there's some reason why you need all these permissions, you should at least state in the FAQ why this is.

oops So I just checked the FAQ one more time before posting this, and I see now that you are actually explaining why you need "Post Tweets for you" permission. But it's not in a place that seems obvious to me (even though it's at the top). Maybe put it under its own h3 named "Required Permissions"?