If you follow this sort of thing, you already know about IFTTT. It’s a new web service that enables non-programmers to compose other web services. The acronym expands to If This Then That, and here are some ways you can use the metaphor:

If I am tagged in a Facebook photo, then save the photo to Evernote

If the library sends email saying my book on hold is ready, send me a text message

My colleague Scott Hanselman says this is bloody brilliant and I agree. It’s the next step in a journey that began for me back in 1999 when I mashed up Alta Vista’s search engine with Yahoo! directories to measure the mindshare of sites by category. More recently Yahoo! Pipes made service mashing easier for non-programmers. Now IFTTT enables everyone to play. Wonderful!

So why am I less enthusiastic about IFTT than I thought I would be? There are two related reasons. First, here’s what IFTTT says when you ask it to activate its Twitter channel on your behalf:

This application will be able to:

  • Read Tweets from your timeline.
  • See who you follow, and follow new people.
  • Update your profile.
  • Post Tweets for you.
  • Access your direct messages.

Excellent! This is an example of OAuth, a protocol that enables you to delegate powers to IFTTT without giving up credentials. Most of the services you can use with IFTTT support OAuth, and that represents another huge step forward for the web.

What if I only want to give IFTTT the power to tweet on my behalf, though, and not give up access to my private direct messages? More generally, how can I think about the tradeoffs involved in delegating all versus some versus no powers to IFTTT, across a range of services I might authorize it to use on my behalf?

This leads to the second and broader concern. If I’m not paying for the product, I am the product. As is true for many free services on the web today, I have no contractual relationship with IFTTT. I pay for the service it provides by surrendering access to my data. OAuth helps me negotiate how much access, but if I give up none then IFTTT is powerless.

Why, though, can’t I pay for the product instead of being the product? I want IFTTT to work for me, I want to pay for the service, and in return I want it to promise never to keep or use any of the data it exchanges on my behalf. I realize this may not be a popular option anytime soon. But it’s time to start the conversation. Services don’t only want to be free, they also want to be valuable. That’s rarely a choice nowadays. It needs to become one.