Hi,
I noticed a tweet announcing the possibility using your Wikipedia account to edit OpenStreetMap. See the Wikipedia logo at https://www.openstreetmap.org/login . That's really nice!
After a bit of digging I found the registration at https://meta.wikimedia.org/w/index.php?title=Special:OAuthListConsumers/view... and looks like the consumer got one grant: "Applicable grants: User identity verification only with access to real name and email address via Special:OAuth/identify, no ability to read pages or act on a user's behalf."
So when used, the emailaddress of the user is shared with a third party. Is this in line with the privacy policy ( https://wikimediafoundation.org/wiki/Privacy_policy ) ? The user isn't warned beforehand, you realize it after granting the right and you get to some registration process with your emailaddress already pre-filled. Don't we want to warn the user what rights are being granted before approving? The current message is "In order to complete your request, OpenStreetMap needs permission to access information on all projects of this site on your behalf. No changes will be made with your account. "
Maarten
Yes, the dialog should be made clearer and mention the permissions granted before one clicks "Allow". This seems tracked at https://phabricator.wikimedia.org/T91825
That said, I don't see any private information being recorded by OSM once one clicks "Allow": https://www.openstreetmap.org/user/new is opened, where one can see that the form is prefilled with the email address, and the account is created only after confirming again.
The feature was requested at https://github.com/openstreetmap/openstreetmap-website/issues/1146
Nemo
On Wed, Dec 21, 2016 at 3:03 PM, Maarten Dammers maarten@mdammers.nl wrote:
So when used, the emailaddress of the user is shared with a third party. Is this in line with the privacy policy ( https://wikimediafoundation.or g/wiki/Privacy_policy ) ? The user isn't warned beforehand, you realize it after granting the right and you get to some registration process with your emailaddress already pre-filled. Don't we want to warn the user what rights are being granted before approving? The current message is "In order to complete your request, OpenStreetMap needs permission to access information on all projects of this site on your behalf. No changes will be made with your account. "
Brad fixed this in https://gerrit.wikimedia.org/r/#/c/328680/ (already in production).
wikitech-l@lists.wikimedia.org