Pool Math........The App

you all are lucky to beta test. Cant wait to get to purchase and use it from what i am hearing you all say about it
 
It doesn't ask for any data, there are a few posts earlier in this thread that have lots of details about all of that. And you can create a brand new Gmail address with all fake data only used for PoolMath if you really want to keep it separate.
 
That's very unfortunate. I'm conscious of managing my privacy, and won't use any services that ask for data that they simply don't need to have.

Why don't you go back and read through some of the threads on this issues, especially Posts #190 and #220. This from Post #190 -

2. There's a bit of discussion about the social login. These days, most users will have one of the 4 options provided. One of the main reasons we didn't elect to do a user name and password is simply because it's actually less secure to do that. It would mean we would have to store your username and a one way hash of your password on our servers.

Considering how many people use the same password for multiple services, there's an added liability on us if we store your passwords that I'd rather avoid. I won't get into details about how OAUTH2 works exactly, but basically now if your social 'token' gets exposed from our servers (which are hosted securely in Azure by the way), the worst someone could do with it is see your name and email address. We don't collect any personal information other than storing your email address locally on your device so that we can display it in the top left corner of the slide out menu in the app. That's it.

As you can see, it's actually LESS SECURE to have TFP handling a username/password hash. By using the Social login method, the only thing that could possibly get "hacked" is the password hash token that the social media company would provide. That would enable a hacker to figure out....your name and e-mail address....so even if they obtained the token info, it could not be used anywhere else.

If TFP stored a username and password for you, and you ever used that password somewhere else, and the app or site got hacked such that they could decrypt usernames and passwords, then that is a MUCH bigger exposure.

It's certainly up to you, but the app will be using social media logins for the time being until such a time in a future update as when it might get linked to your TFP credentials.
 
And you can create a brand new Gmail address with all fake data only used for PoolMath if you really want to keep it separate.

Unfortunately, that's not how Big Data works. Multiple accounts are combined into individual user profiles. It's unfortunate.

I've just chosen to limit my exposure to being spied on. I'm not fanatic about it, but I do try to limit it. We aren't the customers of these companies--we're the raw materials for the products they produce. Participating in that is partially voluntary. We used to be a society that both valued and respected privacy, but privacy doesn't generate economic activity in the way that comprehensive consumer profiles do.
 
Thanks for the references to the previous posts. They were informative.

As you can see, it's actually LESS SECURE to have TFP handling a username/password hash. By using the Social login method, the only thing that could possibly get "hacked" is the password hash token that the social media company would provide. That would enable a hacker to figure out....your name and e-mail address....so even if they obtained the token info, it could not be used anywhere else.

Security isn't my concern.

It's certainly up to you, but the app will be using social media logins for the time being until such a time in a future update as when it might get linked to your TFP credentials.

I'm unclear as to why it's asking for access to read my Tweets and see who follows me, when logging in with Twitter. Twitter was the only one of the four that told me what it planned to do with the access before it was granted.

I understand and appreciate the desire to sync data between devices. Supporting both iOS and Android is likely what's led to using a less conventional sync service, correct? I know more about iOS than Android, and many iOS apps use iCloud services to sync data between devices. I believe Apple has an API built to simplify this.

Other cross-platform apps I use have used services like Dropbox as their sync system, which I'm much more comfortable with from a privacy perspective. Yes, I know it's had some security concerns.

I'm not hear to argue or change anyone's opinion. I'm simply expressing why I won't be using the app. It's an unfortunate design decision, in my opinion.
 

Enjoying this content?

Support TFP with a donation.

Give Support
Thanks for the references to the previous posts. They were informative.



Security isn't my concern.



I'm unclear as to why it's asking for access to read my Tweets and see who follows me, when logging in with Twitter. Twitter was the only one of the four that told me what it planned to do with the access before it was granted.

I understand and appreciate the desire to sync data between devices. Supporting both iOS and Android is likely what's led to using a less conventional sync service, correct? I know more about iOS than Android, and many iOS apps use iCloud services to sync data between devices. I believe Apple has an API built to simplify this.

Other cross-platform apps I use have used services like Dropbox as their sync system, which I'm much more comfortable with from a privacy perspective. Yes, I know it's had some security concerns.

I'm not hear to argue or change anyone's opinion. I'm simply expressing why I won't be using the app. It's an unfortunate design decision, in my opinion.

I understand and respect your privacy concerns, and others who share them. At this point we're focusing on shipping a product that brings the most value to the largest audience possible. This means things like an alternative authentication type are not top priority (though it's certainly on our radar and something we eventually want to incorporate).

As for the question specifically about twitter, I've already chosen their least permissive authentication scope, which happens to include the ability to read your tweets, home timeline, and basic profile, but not your direct messages (as per their documentation found here Application Permission Model Twitter Developers ). Twitter only offers a few options, so this is the smallest scope I can provide when logging in via twitter. What I can tell you is we are not storing anything other than your twitter ID.

Although creating a separate social account just to use for this app is a bit tedious, it's always an option.

I think you may also be confusing the idea that somehow your synchronized data is available to any of the social platforms you login with, which is simply not the case. We create a unique account identifier on our own servers which is based off of your account identifier that you login with (so not even the same identifier), and all stored data is associated with that id. Facebook, Google, Twitter, etc are in no way able to see any of your data that we store.

We did opt not to use iCloud as a sync provider based on your correct assumption: We wanted this to work across platforms (Android and iOS now, Windows eventually), so another option was chosen.

If this still isn't private enough for you, then apologies and sorry you are not able to use the app for now. Hopefully you'll give it a try when we're able to get to implementing an alternative authentication mechanism.

I wanted to clear this up as I don't think it's fair to raise the level of paranoia round data privacy without knowing all the facts. I'd be more than happy to discuss in more detail how the data is stored and why and how it can't be shared/accessed/mined by Facebook/Google/etc, if you have more questions around it.

Cheers
 
Thanks. I'm not attempting to raise any levels of paranoia, I'm simply stating what is important to me. I'm not concerned about these companies accessing pool data--I'm concerned about them knowing more about me. And yes, they get another data point each time I use them as an authentication service. That's one of the reasons they offer an authentication service, after all.
 
Thanks. I'm not attempting to raise any levels of paranoia, I'm simply stating what is important to me. I'm not concerned about these companies accessing pool data--I'm concerned about them knowing more about me. And yes, they get another data point each time I use them as an authentication service. That's one of the reasons they offer an authentication service, after all.

We really do thank you for your openness concerning this item. When we made this decision it was one that we went back and forth with for some time. In the end we simply felt for the sake of time/security that Social Sign On was the way to go. With that we knew we'd be having this discussion. We hope we've answered some questions about how it works and how safe it is for you. I know we're not going to bring everybody over to our side of the tracks, but that's OK. We're already working on some other options and we sincerely hope you try the App out once we get those up and running. For now however adding additional options is going to become an issue logged to get setup at a later date. Right now we're pushing hard to get a finial App pushed to Apple for review/approval before Memorial Day weekend hits. As you can imagine this is a major deadline for us. We're hoping users understand we won't get every request done in time for our initial launch. We must continue to put our focus on getting the foundation setup before our deadline. We've heard alot of positive feedback about the App so far and we're glad people are enjoying it. Best part is......this is just the start. :D TFP is working on building this App for the long run. We're not looking for something that you'll delete in 6 months. We hope to take the workings of PoolMath plus the teachings of TFPC and merge them together to create a new tool for pool owners out there to maintain their pools. Bear with us and keep the feedback coming......it's starting to all come together!
 
2 1/2 issues I found
1...when putting in the FC if you type a number, 2 for example, then type . and then 0, it won't let you put another number, not sure you NEED another number, but it's a querk (typing any other number allows a 3rd number.

2....in the log view, where it lists all the logs and results, there's no CC listed ( and yes I agree, CC should be right under FC).

3... cosmetic...in the same log view, between salt and CSI, the placeholder is visible, tap/hold you can't miss it.

Otherwise....LOVE!!!
 
Don't have the pool opened for the season yet but just installed the IOS version of the app and have been playing around with it. I thought that I had found a bug but in reality what I found was that I fat fingered the entry for pH (entering 75 rather than 7.5). Made for an interesting quantity of acid to add.

Should there be some sort of sanity check made of the entries that cause an alert/highlights entry, etc. that something is (way) out of range to save us from ourselves?
 
So far so good. I don't like that I have to authenticate to an external service to use it. There is no reason for it.

Other than that I'd like to track external temperature rather than just pool temp, with a cover on and off option. Then I could easily see the temperature fluctuations. Also being able to pick a weather station from wunderground, or madis.
 
Why don't you go back and read through some of the threads on this issues, especially Posts #190 and #220. This from Post #190 -



As you can see, it's actually LESS SECURE to have TFP handling a username/password hash. By using the Social login method, the only thing that could possibly get "hacked" is the password hash token that the social media company would provide. That would enable a hacker to figure out....your name and e-mail address....so even if they obtained the token info, it could not be used anywhere else.

If TFP stored a username and password for you, and you ever used that password somewhere else, and the app or site got hacked such that they could decrypt usernames and passwords, then that is a MUCH bigger exposure.

It's certainly up to you, but the app will be using social media logins for the time being until such a time in a future update as when it might get linked to your TFP credentials.

Why is a login needed? You are already authenticated to your phone. Why is another login to use the app needed at all? Be it tfp or another authenticator.
 
So far so good. I don't like that I have to authenticate to an external service to use it. There is no reason for it.

If you go back through the thread a bit (posts #190-220 or so), you will see posts by the app developer as to why external authentication was chosen. It's actually more safe to do it that way and it alleviates a huge burden from TFP and the app developer - namely, username/password account reset requests and account issues. That might seem like it's not a big deal but, for a small web-forum administered by a single admin in the mid-west, that task could easily eat up all of his available time.

Like it or not, external authentication methods (as well as secondary identification methods that use SMS text messaging to transmit a challenge code) are where the technology is these days and it makes little sense to try to stand apart from that...
 
Why is a login needed? You are already authenticated to your phone. Why is another login to use the app needed at all? Be it tfp or another authenticator.

Login and authentication (as well as encryption) are needed because the App uses a remote server to store user data that way the app can work across devices and even across OS's.
 
Thank you for letting me beta test this. I just moved to a new house with the first pool I've ever owned, and everything was out of whack. Had to drain half the water, and now I'm slamming it. The app is so much help to me. So handy to have it and my numbers in Walmart, and get to adjust chlorine percentage and jug size to see how much to buy and get the best price.
 

Enjoying this content?

Support TFP with a donation.

Give Support
Thread Status
Hello , This thread has been inactive for over 60 days. New postings here are unlikely to be seen or responded to by other members. For better visibility, consider Starting A New Thread.