<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>I will add a link and instructions about revoking the tool from user's authorized applications.<br></div>
<div><br></div>
<div><br></div>
<div>On Fri, 3 Feb 2017, at 11:32 AM, Maximilian Doerr wrote:<br></div>
<blockquote type="cite"><div>My viewpoint is that tokens are considered private information, and it’s during the active browsing session is permitted without disclosure as the end-user is in control of connecting the application or not. However, I consider the storing of these tokens for later use to be storing private data which by the ToS of labs, must be disclosed to the user.<br></div>
<div><div><br></div>
<div><div style="color:rgb(0, 0, 0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;-webkit-text-stroke-width:0px;overflow-wrap:break-word;"><div style="color:rgb(0, 0, 0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;-webkit-text-stroke-width:0px;overflow-wrap:break-word;"><div style="color:rgb(0, 0, 0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;-webkit-text-stroke-width:0px;overflow-wrap:break-word;"><div style="color:rgb(0, 0, 0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;-webkit-text-stroke-width:0px;overflow-wrap:break-word;"><div>Cyberpower678<br></div>
<div>English Wikipedia Account Creation Team<br></div>
<div>English Wikipedia Administrator<br></div>
</div>
<div style="color:rgb(0, 0, 0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;-webkit-text-stroke-width:0px;overflow-wrap:break-word;">Global User Renamer<br></div>
</div>
</div>
</div>
</div>
<div><br></div>
<div><blockquote type="cite"><div>On Feb 2, 2017, at 22:27, Bryan Davis <<a href="mailto:bd808@wikimedia.org">bd808@wikimedia.org</a>> wrote:<br></div>
<div><br></div>
<div><div><div>On Thu, Feb 2, 2017 at 8:00 PM, Maximilian Doerr<br></div>
<div><<a href="mailto:maximilian.doerr@gmail.com">maximilian.doerr@gmail.com</a>> wrote:<br></div>
<blockquote type="cite">As long as the information isn't permanently stored, and the storage location is secure, you can go ahead and do that, BUT such storage must be disclosed to the user in a very visible manner, like a tool ToS, similar to what <a href="https://tools.wmflabs.org/iabot/">https://tools.wmflabs.org/iabot/</a> does for first time use, that discloses what it stores, why it's being stored, and how long it's being stored for, so users can make an informed decision on whether or not to use your tool and if they are comfortable with that condition.<br></blockquote><div><br></div>
<div>Documenting how the tool works and what it stores are very good and<br></div>
<div>reasonable things to do. However I would personally assume that the<br></div>
<div>approval of the OAuth grant in the first place by the end user is<br></div>
<div>consent to use the token. There is no contract, implied or otherwise,<br></div>
<div>in the OAuth prompt that the grant of rights is limited to the scope<br></div>
<div>of a single browser session. OAuth tokens are similar in concept to a<br></div>
<div>valet key [0]. When a grant request is accepted you as the granting<br></div>
<div>user are giving the requesting application the right and ability to<br></div>
<div>perform any of the actions covered by the grant until such a time as<br></div>
<div>the grant is revoked by you using Special:OAuthManageMyGrants [1] or<br></div>
<div>the application itself has its rights revoked globally for some terms<br></div>
<div>of service violation. That being said, tokens should not be stored<br></div>
<div>without a reason and reasonable precautions should be taken to ensure<br></div>
<div>that tokens are not exposed to other users of the application or<br></div>
<div>3rd-parties.<br></div>
<div><br></div>
<div><br></div>
<div>[0]: <a href="https://en.wikipedia.org/wiki/Key_(lock)#Car_keys">https://en.wikipedia.org/wiki/Key_(lock)#Car_keys</a><br></div>
<div>[1]: <a href="https://meta.wikimedia.org/wiki/Special:OAuthManageMyGrants">https://meta.wikimedia.org/wiki/Special:OAuthManageMyGrants</a><br></div>
<div><br></div>
<div>Bryan<br></div>
<div>-- <br></div>
<div>Bryan Davis Wikimedia Foundation <<a href="mailto:bd808@wikimedia.org">bd808@wikimedia.org</a>><br></div>
<div>[[m:User:BDavis_(WMF)]] Sr Software Engineer Boise, ID USA<br></div>
<div>irc: bd808 v:415.839.6885 x6855<br></div>
<div><br></div>
<div>_______________________________________________<br></div>
<div>Labs-l mailing list<br></div>
<div><a href="mailto:Labs-l@lists.wikimedia.org">Labs-l@lists.wikimedia.org</a><br></div>
<div>https://lists.wikimedia.org/mailman/listinfo/labs-l<br></div>
</div>
</div>
</blockquote></div>
</div>
<div><u>_______________________________________________</u><br></div>
<div>Labs-l mailing list<br></div>
<div><a href="mailto:Labs-l@lists.wikimedia.org">Labs-l@lists.wikimedia.org</a><br></div>
<div><a href="https://lists.wikimedia.org/mailman/listinfo/labs-l">https://lists.wikimedia.org/mailman/listinfo/labs-l</a><br></div>
</blockquote><div><br></div>
</body>
</html>