OAuth apps have their own rules for handling private data, which are different from the WMF privacy rules. Users should be using such apps at their own risk, but to be able to evaluate such risk, there should be some way to evaluate the app's privacy policy & data retention rules.
We should add a new field (oarc_privacy_policy_url or similar) to the consumer table, ask the owner for a privacy policy URL when registering the app, and display that URL in the authorization form.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T90925 General authentication improvements for MediaWiki | |||
| Open | None | T86869 Support a nice sso experience with MediaWiki's OAuth | |||
| Resolved | • dpatrick | T68493 Special:OAuth doesn't provide a grant to access to private info of users | |||
| Open | None | T75062 OAuth permission screen needs redesign for better usability and comprehension | |||
| Open | None | T64686 Replace link to WMF privacy policy with link to app's privacy policy on OAuth authorize dialog | |||
| Open | None | T98843 Store a link to app's privacy policy in OAuth consumer registration form | |||
| Open | None | T64687 Add warning for user on /authorize about privacy policy |
The link is to [[Project:Privacy policy]] on the local wiki by default. Can this task be resolved?
The task is about managing per-app privacy policies. I tried to clarify the task description.