[Labs-l] Labs privacy policy questions

[Platonides]

On 15/03/16 21:29, Zhou Zhou wrote:
> If you have specific suggestions in clarifications you would
> like to see, please send them my way. We will also look into
> incorporating into the next draft of the Labs TOU your point about
> real-world consequences for misuse of data.
>
> With respect to Wikimetrics, we also plan on modifying its privacy
> policy to address your concerns and clarify on how the data is being
> used instead of relying on the standard interstitial.
>
> Let me know if you have any questions.
>
> Thanks,
>
> Zhou

A problem I find with OAuth is that often you don't know at all what it 
is going to do.

So, taking wikimetrics as an example, it says:
«In order to complete your request, Wikimetrics Website needs permission 
to access information on meta.wikimedia.org on your behalf. No changes 
will be made with your account.»

Which information does it access? Your account name? Your watchlist? The 
checkuser log (supposing you were a CU)?

In this case there's a little more explanation at the wikimetrics page, 
where it says "we will only access your email address and name to verify 
your identity". Yet, there's no explanation at all on why does it needs 
the email address (nor is it obvious for the tool goal).

The tool does not explain at all what it needs/uses. And of course, if 
you cancel, you are simple told «"Wikimetrics Website" will not work 
unless you allow it access.». No dancing pigs for you.

It claims "Wikimetrics welcomes all" but it requires you to log in and 
share "some data". From the description of the tool, I see no reason for 
not allowing anon usage of it (perhaps with a few restrictions, it's 
expected that if you want it to save your reports, it needs to identify 
you somehow).
Right now, this is a walled tool.


(I am mentioning wikimetrics as it is the one brought up, this is also 
applicable to many (most?) other tools that use wmf OAuth)


REgards