Facebook does this too, and while it’s absolutely absurd to a technology enthusiast such as yourself, you’d be surprised how many veteran (but casual) internet users are willing to give out their email account information to a “trusted” website. I think the website creates an image of the company running it that prevents the users from realizing that all that was created by people just like themselves, albeit more knowledgeable about technology.
That said, about the “email address book sharing” you want, CSV files should be standardized for this use. Facebook, Yelp and other sites like them should allow for the uploading of CSV files with a list of contacts. Additionally, there should be a standard by which you can give your email address and an “address book password”, which allows the website to retrieve your email address book without having complete access to your account.
Forget Yelp, IMHO Facebook is the big brother in this respect. Absolutely shocking.
Perhaps, web2.5 sites should implement something like a payment gateway system, wherein I am redirected to the source sites page, do my authentication theere and a one-time authorization of what info I want to share.
If we can do it for payment, it should happen.
That way we can have a track of what info we shared, much less, there’s no need to share out passwords
Wouldn’t it be cool if, instead of your email credentials, Yelp (or any site like it) could use your Facebook/MySpace/MySocialNetworkingSiteOfChoice credentials to find your friends? I know for a fact I don’t keep my financial info stored on my Facebook profile, and I message more friends through social networking sites than I do through email anyway.
Agreed, and Twitter tried the same thing. Only an utterly retarded individual would even consider doing such a thing. What we need is a standard format for address book exporting (using XML or JSON). Then we can upload that to Yelp, or whatever, if we decide we want to. It’s a really simple concept.
the better solution is to have a textarea where the user simply adds their contacts (aka “friends”) via a comma separated list.
the user then has the option to include a message. yes that means people need to know all their “friends” email addresses but if you put those two options in a user testing scenario I bet the textarea vs the plaxo/yelp type import solution would have a much higher success ratio.
“As a software developer, you should never ask a user for their email credentials.”
Software developers typically don’t have much of a say as to what they are developing - that’s decided by the client.
So my question is… what legitimate steps could a software developer take if they find this practice absolutely repugnant (as I do), yet still have instructions requiring them to implement it from higher up?
From what I can see, the developer basically does what he’s told or quits / is fired. Quitting may not be financially expedient in your current circumstances, and getting fired won’t be good at all.
I’d just like some ideas on what WE, as software developers, can do to combat this evil, insidious practice.
With tech support asking for passwords I have a simple solution. I give them the first 10 or so characters. If they can see my password on their screen it’s all good, but if they need it to log in to my account… we have to escalate to someone who has authority to vary the terms and conditions. Specifically to add the bit “not disclose… except to tech support staff”. Usually once they see that they become more reasonable. Possibly because in Australia we don’t grant local monopolies anywhere near as often as the US does, so tech support people are aware that I can just cancel the account.
As far as spambook and similar sites wanting my gmail details… I have a gmail account specially for them. Ditto crapspace, youtube etc etc. Some sites just plain will not let you even see content without disclosing that sort of nonsense (spambook and crapspace not least amongst them).
I know i shouldn’t, but i can’t help to find this extremely comical! “Asking for the e-mail password is like asking for the keys to my home”! I couldn’t agree more. And besides, there is always 4. How do i know that their site has not been compromised and, despite they not being storing my password, it is being sent unawarely to somewhere else?
These mail services need to support OAuth to provide authorization tokens.
I’m actually working on a client site now, and they need CSV document import for contacts, and I want to upsell import features - however it will use the new API’s, and only be in AFTER the user has signed up and goes into their contacts page.
What some people seemed to have not noticed is that both Hotmail, Gmail and most other desktop clients allow you to export your contact list to a file. Now I don’t know about most social sites, but Facebook allows you to upload a file from many different applications in order to search for contacts. The problem? It’s not their primary option. Also, for most webmail applications the options to import/export contacts are not obvious, you have to want to find them in order to find them.
At the root of the problem is that the least secure option is provided as the default option. While it would be easy enough for a developer to change this, this would provide a greater learning for the end user and most people don’t want use things that are hard to use.
Not suggesting this is a solution to the overall problem, but I’m hearing a lot of “OMG, they’re going to store my password on an unsecured database somewhere and it will be hacked by the Russian mob and my identity will be stolen” sorts of fears. Technically, a way around this that I’m sure is commonly used is to store an encrypted version of the password in a cookie, and store only the key in a database. I think the odds of someone gaining access to both the database and your computer’s hard drive are fairly low. Perhaps I am not paranoid enough, but personally, if a legitimate site explained to me that they were not actually storing my email and password anywhere on their servers, I would consider providing the information.
And what do you want to bet that these schemes were thought of by some little sociopath a**hole with a freshly minted MBA and a strong tendency to magical thinking?
