I notices that the twitter single sign on requires both read and write access from end users. When user clicks on register with twitter, twitter tells the end user that

This application will be able to:

Read Tweets from your timeline.
See who you follow, and follow new people.
Update your profile.
Post Tweets for you.

Since YAF does not do any of the four option above, why not remove write option and make it as read option only (in twitter settings).

We only need to read user details to register (or login) users on the forum. We would not be adding anything to their twitter profile or posting any messages on their behalf.

I personally do not generally use applications which requires all four options listed above. It may lead to many users not using twitter as login option.

Related bug in FB SSO:

When you click on "register with facebook", it takes you to facebook page and gives option "Okay" or cancel".

If I click on cancel, it again redirects me back to same two options "okay" and "cancel".

Clicking cancel second time redirects to FB error page:

I'm stuck in an app that keeps asking to access my info or post on my behalf, and I can't dismiss the message.

If an app asks to access your info or post on your behalf and won't allow you to decline or click Cancel, it isn't following our policies.

Please report the app if it continues to ask for your info. We appreciate your patience, and thanks for helping us enforce our policies.

A bug in Google SSO:

When you click on "register with google", it redirect you to page with "accept" or "cancel" button. When you click on cancel button, it gives this error message:

Error: invalid_request
http://www.example.com/forum/auth.aspx?auth=google&error=access_denied 

Learn more

Request Details
https://www.googleapis.com/auth/userinfo.email 
response_type=code
redirect_uri=http://www.example.com/forum/auth.aspx?auth=google&error=access_denied
client_id=181937474123.apps.googleusercontent.com

Feel free to move these two posts or entire thread to bugs forum.

My event log has many errors for Facebook SSO and so far no one seems to have been able to use FB SSO to register.

We only need to read user details to register (or login) users on the forum. We would not be adding anything to their twitter profile or posting any messages on their behalf.

Actually yaf do tweets but NOT automatically. The user can tweet a topic or a single message

When you click on "register with google", it redirect you to page with "accept" or "cancel" button. When you click on cancel button, it gives this error message:

Fixed

Related bug in FB SSO:

When you click on "register with facebook", it takes you to facebook page and gives option "Okay" or cancel".

If I click on cancel, it again redirects me back to same two options "okay" and "cancel".

Clicking cancel second time redirects to FB error page:

Fixed

My event log has many errors for Facebook SSO and so far no one seems to have been able to use FB SSO to register.

fixed, this issue is not related to SSO itself.

Actually yaf do tweets but NOT automatically. The user can tweet a topic or a single message

Thank you tha_watcha. If that is the only scenario, why dont we either (a) default back to old ways in which the tweet button in YAF 1.9.6 worked (open pop up window and twitter will ask them if they want to tweet) or (b) Use the simple tweet button which is now used probably in millions of websites (with same functionality).

I am concerned that if forum is hacked (weak password, asp.net bug, iis bug, etc), the hacker can have access to lots of members personal details (by adding a new page on website and pulling personal tweets, etc).

As you may have heard, about 30,000 vbulletin sites were hacked few weeks ago. The hacker was able to create admin account using the install folder.

Hence it would be very helpful to limit the data we ask from users (a) that we do not really need and (b) provide exact same functionality with just a simple tweet button.

Many people would not use any forum which asks so many twitter permissions just for registration/login.

I am concerned that if forum is hacked (weak password, asp.net bug, iis bug, etc), the hacker can have access to lots of members personal details (by adding a new page on website and pulling personal tweets, etc).

That wouldn't be a problem, because i had that concern to i decided that the access token that are needed for the application to tweet are not saved in the database only temporarily in the session state.

The actual reason why yaf needs write access is, when private messages are disabled in yaf it send the user after registration a dm message to let the user know, that they need to enter the correct email address in the user profile.

The actual reason why yaf needs write access is, when private messages are disabled in yaf it send the user after registration a dm message to let the user know, that they need to enter the correct email address in the user profile.

I think twitter verifies email address when user registers at twitter. So if we use this verified address from twitter during registration, why do ask them to enter the correct email address again? I am just curious. 🙂

The actual reason why yaf needs write access is, when private messages are disabled in yaf it send the user after registration a dm message to let the user know, that they need to enter the correct email address in the user profile.

I think twitter verifies email address when user registers at twitter. So if we use this verified address from twitter during registration, why do ask them to enter the correct email address again? I am just curious. 🙂

Because twitter doesn't share the email address with oAuth, when a user registers on the forum via twitter. Currently yaf uses the dummy address username@twitter.com.

To make things like email notifications work the correct email address is required.