3

I have run into this situation before but I will speak specifically about a current project, since it is a good example.

I am building a desktop application that uses the Stack Exchange API, and authenticates using the implicit OAuth flow currently recommended for desktop applications.

The exclusively web-based nature of this authentication flow means that rather than, say, opening a login dialog in the user's favorite trusted browser with a clear URL in the address bar, desktop applications must open the SE authentication page in an embedded browser control. This would be similar to, say, an application displaying its own, probably-shoddier-looking-than-your-favorite-browser, window with a Google authentication page on it, for example. It does not scream "trust me!"

My question is: What things can I do to increase user trust? The ideal situation would be nobody raising an eyebrow, or heading to the internet to find out if the application is safe or not, etc.

The only thing I can think of is making the source code available, although this still requires the user to take a leap of faith and assume the source I have distributed is truly the source for the application they are running. It also only primarily helps users who are programmers and who are also willing to take a look to verify, although I suppose it helps non-programmers too in that it potentially projects an image of honesty even if they don't understand the source.

What else can I do to gain a user's trust in a situation like this?

2

One tactic is to do it Apple's way. Tell them. If they are wondering, it has a friendly way of telling, but it's out of the way when not needed.example

Example Popup

This login box uses OAuth 2, the most secure way to login. The only data we collect it your email address. This website is hosted with HTTPS, a secure protocol that requires a certificate.

In other words, your account is safe to login with. :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.