{"action":"created","issue":{"url":"https://api.github.com/repos/reddit/reddit/issues/1352","labels_url":"https://api.github.com/repos/reddit/reddit/issues/1352/labels{/name}","comments_url":"https://api.github.com/repos/reddit/reddit/issues/1352/comments","events_url":"https://api.github.com/repos/reddit/reddit/issues/1352/events","html_url":"https://github.com/reddit/reddit/issues/1352","id":91902806,"number":1352,"title":"Why can't implicitly authenticated users be permanent/provided a refresh token?","user":{"login":"a9io","id":2660634,"avatar_url":"https://avatars.githubusercontent.com/u/2660634?v=3","gravatar_id":"","url":"https://api.github.com/users/a9io","html_url":"https://github.com/a9io","followers_url":"https://api.github.com/users/a9io/followers","following_url":"https://api.github.com/users/a9io/following{/other_user}","gists_url":"https://api.github.com/users/a9io/gists{/gist_id}","starred_url":"https://api.github.com/users/a9io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/a9io/subscriptions","organizations_url":"https://api.github.com/users/a9io/orgs","repos_url":"https://api.github.com/users/a9io/repos","events_url":"https://api.github.com/users/a9io/events{/privacy}","received_events_url":"https://api.github.com/users/a9io/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-06-29T20:32:24Z","updated_at":"2015-07-01T19:30:05Z","closed_at":null,"body":"I don't understand why implicit authentication has such little trust compared to explicit.\r\n\r\nPlenty of mobile apps/clients use cookie authentication at the moment (set to be deprecated) and they're a client-only application. But what happens when they switch to Oauth?\r\n\r\nThe time a user spends on the apps is certainly more than an hour (multiple times daily) and it would be a nightmare to have to make the user sign in again after their token expires.\r\n\r\nOf course there is *explicit* authentication, but that is only for servers. What if a client is just a client which is used by the user for the long-term? Storing private keys on an app someone downloads is extremely frowned upon.\r\n\r\nThere is no refresh token for implicitly authenticated users who desire this kind of behavior. And there are a *lot* of those users."},"comment":{"url":"https://api.github.com/repos/reddit/reddit/issues/comments/117801405","html_url":"https://github.com/reddit/reddit/issues/1352#issuecomment-117801405","issue_url":"https://api.github.com/repos/reddit/reddit/issues/1352","id":117801405,"user":{"login":"rtheunissen","id":809191,"avatar_url":"https://avatars.githubusercontent.com/u/809191?v=3","gravatar_id":"","url":"https://api.github.com/users/rtheunissen","html_url":"https://github.com/rtheunissen","followers_url":"https://api.github.com/users/rtheunissen/followers","following_url":"https://api.github.com/users/rtheunissen/following{/other_user}","gists_url":"https://api.github.com/users/rtheunissen/gists{/gist_id}","starred_url":"https://api.github.com/users/rtheunissen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rtheunissen/subscriptions","organizations_url":"https://api.github.com/users/rtheunissen/orgs","repos_url":"https://api.github.com/users/rtheunissen/repos","events_url":"https://api.github.com/users/rtheunissen/events{/privacy}","received_events_url":"https://api.github.com/users/rtheunissen/received_events","type":"User","site_admin":false},"created_at":"2015-07-01T19:30:05Z","updated_at":"2015-07-01T19:30:05Z","body":":+1: "}}