544 karma · joined December 8, 2009
I was pretty happy with this result since we could write a simple page like https://developers.facebook.com/docs/authentication/server-s... which conformed to the spec (http://tools.ietf.org/html/draft-ietf-oauth-v2-12#section-4....) and was an easy to implement explanation of authenticating a user.
But the OAuth 2.0 spec we were working off of is now eighteen months old and as Eran said the vast majority of those contributors have drifted away from the effort over this past year :-\
I manage one of our tools engineering teams focused on making it easy for employees to quickly find the right information and keeping it up to date. But there are a number of different tools engineering teams focused on things from tools engineers use daily to how we can better support users.
Email is on my profile.
https://www.facebook.com/careers/department.php?dept=enginee...
1) Before any action is shared back from the site to Facebook, the user has agreed to authorize that site (application) and add it to their timeline. Part of that dialog shows what's going to happen (https://developers.facebook.com/docs/beta/authentication/).
2) There are plenty of other examples around the web where submitting a HTTP GET request results in an action. For example, clicking an up arrow on Hacker News submits a GET request which increases the karma score on another author. What becomes more important is how you protect against XSRF and crawlers not accidentally changing state within your app.
It isn't that my bank would change the role of the IRS, but I'd login to the IRS using a strong identity issued by my bank versus this silly PIN I use today.
This project is aimed at making it possible for people to interact with government agencies using identities they already have. Some interactions require very little security and knowledge of who a person is (leaving a comment here for example) while others (paying your taxes) require quite a bit.