Hacker News Reader

Comment by branden | Hacker News Reader

Nope, not giving you my Netflix password at least until I know exactly how this works and whether it's worth the risk. A demo, a video, a description, something.

View on HN

I thought Netflix supported something resembling Oauth....

http://developer.netflix.com/docs/Security

They do support OAuth now apparently.

Which should set off some serious scam bells here should it not? Why would they need your login credentials in the first place?

Hi enjo, we are using OAuth to access Netflix data. The reason we need your login credentials is because we first need to get your permission to access your Netflix Instant Queue data. The process of linking your Netflix account with Qpicker is only done once and you can always remove this permission from your Netflix account under "Manage applications".

Nope. That's not how OAuth works. If you are getting the users password, you did it wrong. Let Netflix handle the authentication and access control.

Hi marcc, actually it is done correctly and that is how OAuth works. In order to get the user access token the user has to first login to authenticate they are the rightful owner of the account and then grant access to the application. In our case, we could have sent the user to Netflix to login or we could have asked for the credentials on Qpicker and sent the details to Netflix who handles the authentication/access control.

http://josephsmarr.com/2008/10/01/using-netflixs-new-api-a-s...

No, you redirect to Netflix as part of the authorize phase. The user may then login to Netflix after which they will be given the option to authorize your app. If they do, you will receive token credentials enabling you to access the user's Netflix data. The whole point of OAuth is that you don't need the user's login credentials.

Reply on news.ycombinator.com