<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Salvo,<div class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On 02 Sep 2015, at 10:25, Salvo Tomaselli <<a href="mailto:tiposchi@tiscali.it" class="">tiposchi@tiscali.it</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">I can't think of an obvious easy way to do it. The way gwenview does it</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">is to open the browser window and then the user needs to copy and</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">paste the URL into the application.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">It is a bit bad, but I would be more reassured that it is indeed facebook.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""></div></blockquote></div><br class=""></div><div class="">as so often, one has to find a compromise between security and user convenience.</div><div class=""><br class=""></div><div class="">There are two concerns I can see one might have: </div><div class=""><br class=""></div><div class="">1) The subsurface binary is evil and tries to steal your FB credentials. That is why you want to do the authentication in your favourite browser as that you trust more than subsurface. In that case we probably cannot do much since after authentication you explicitly at least give subsurface a token to post content on your behalf. By the copy&paste procedure you only make sure we don’t download your list of friends etc. But I would recommend that if you tend not to trust subsurface you probably don’t want to connect it to Facebook anyhow.</div><div class=""><br class=""></div><div class="">2) Subsurface is playing nicely but somebody else sits on your network connection and pretends to be Facebook and fishes of your password. For this concern, I can tell you that subsurface uses https authentication and refuses to work if the server does not present a valid certificate for <a href="http://Facebook.com" class="">Facebook.com</a>. I just tried that (by giving <a href="http://www.facebook.com" class="">www.facebook.com</a> the IP address of my server in /etc/hosts). We could, to assure you that subsurface is convinced to really talk to the real Facebook, display an icon of a closed lock. But of course, that is only snake oil.</div><div class=""><br class=""></div><div class="">Am I missing something?</div><div class=""><br class=""></div><div class="">Best</div><div class="">Robert</div></body></html>