A lot of websites these days (including this one) offer Facebook, Twitter, and/or Google login. Usually there's also an option to use old-style username/password credentials. I'm never sure which option to select. I use my real name on Facebook and Twitter. On some sites, I'd rather be anonymous.

Not so much Stack Exchange, but the privileges requested by some other sites seem outrageous. For example, I recently went to sign up for weheartit.com and here's the Twitter "OK" page...


Are they seriously saying they're going to follow people and post tweets using my account without my intervention?

Who would agree to that?

Or do they mean "we'll do those things on a case-by-case basis if you allow it?"

I feel as though there's something I'm not understanding here.

My dilemma is that 3rd party login seems convenient and I could see the advantages of having one consolidated identity across the social landscape, but the privileges they ask for always seem so over the top.

If anyone could explain to me some context or details of how this sort of thing works I'd really appreciate it.

  • 2
    Most of this is soliciting opinions, which makes it off-topic. The other portion "...how this sort of thing works..." isn't really an end user issue, but if you have a more specific question about it, please edit it in and this can be reopened.
    – jonsca
    Jul 25, 2014 at 23:28

2 Answers 2


Are they seriously saying they're going to follow people and post tweets using my account without my intervention?

The scope of the authorization is that should you authorize, they can tweet, follow, and update your profile.

Note that it's they can, not that they will. Twitter's authorization scope allows for read-only, read+write, read+write+send dm

This means that even if all the requesting site wants to do is send a tweet, they must opt for the read+write scope and you get the dialog.

Are they seriously saying they're going to follow people and post tweets using my account without my intervention?

No, what they are saying with the authorization model, they can - not will do the above.


Let's just start with Twitter for the site that you mentioned weheartit.com

If you don't how that login is provided. The site(weheartit.com) had created a twitter application at http://dev.twitter.com and made the app with read , write permissions. (You don't wanna get into the coding part unless you're a programmer).

It is the same with Facebook, Google+ as they register the app with them.

Mostly the apps are provided with Read, Write permission to make sure they can tweet or post in future if they need to (only with your permission). Obviously its some kind of Social Media Marketing such that they'll tweet, or post or share a status from your social account that you used to log in at some point.

You shouldn't worry about them posting frequently, because everytime they (Standard web apps) try to post something to your social profile, they'll (or I say must) have to ask permission from you (some sites not included).

The policies are layed out by the social networking companies (Twitter, Google +, Facebook), and the apps are just making use of it.

Just for example : If you're logging in to weheartit.com with twitter(read, write permission provided), they would want you to tweet to your friends that you've just created an account with them (publicizing).

If you're logged in to weheartit.com with twitter(only read permission), they can't do anything except getting your details that you made visible public on twitter.

I believe you get something from that hard said essay above. ;)

To make things easier and better, I would opt you to choose any social networks (Facebook, Twitter, Google+) login which is most common these days.

Not the answer you're looking for? Browse other questions tagged or ask your own question.