Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Absolutely right. LinkedIn is doing this. access for one day, one week, ... when granting permissions.


Here's screenshot of how it looks: http://developer.linkedin.com/servlet/JiveServlet/downloadIm...

However the reason LinkedIn does it is probably because the nature of information accessed is very fragile.

Similar, but slightly different solution, I'd suggest, would be to track by provider if application is actively used and perhaps revoke token after some period of time (or at least present user with that data on their profile settings page).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: