Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What percentage of your users are using social login?

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 172 posts

Re: Ask HN: What percentage of your users are using social login?

#141

Post by SlowRobotAhead »

sp332 wrote: post #49
SlowRobotAhead wrote: post #28

Side topic I hadn’t considered... If you don’t use 2FA on your google or Facebook account, how are delighted authentications any better than password reuse? They actually seem worse / less secure.

You get to set permissions on a per-app basis, so that's a lot less access than going them your password. And if they abuse the access you give them, you can deauth just that app instead of changing the password and breaking all the apps. Edit: I think you were asking about the other direction. It's still not as bad, because if you are sharing passwords and any service was breached, all you services would be exposed.…

Gotcha on the edit, and yea that was the direction.

But if you lost the gmail/Facebook login you also loss all of the sites you used. Classic single sign on issue.

Re: Ask HN: What percentage of your users are using social login?

#142

Post by incompatible »

Moru wrote: post #139
incompatible wrote: post #125

Earlier quoted context omitted.

Is it really so hard for scammers / spammers to create fake Google / Facebook accounts? What is so hard about creating any number of "non fake emails"? I assume a non-fake email (address) is just one that can accept incoming messages.

Google requires a phone number nowadays. And you can't use the same phonenumber more than X times. (Not sure what X is but I hit it last week so had to go on the second phone)

I didn't know that. But if Facebook still allows sign-ups with an email address only, it gives a way in.

Re: Ask HN: What percentage of your users are using social login?

#143

Post by biohax2015 »

devgutt wrote: post #120
jfaucett wrote: post #111

Earlier quoted context omitted.

> 'jfaucett probably is fine sacrificing losing this small minority. precisely. In my experience, this small minority can actually be subdivided broadly into two groups: those with very high data privacy concerns and scammers/spammers. It turns out that in my experience, the high level data privacy concern people have been the vastly smaller of the two groups, so at the end of the day you are sacrificing a tiny fract…

Although I don't disagree, I suspect you are driving away a very interesting group of technically literate, even being small.

I can guarantee you no VC or CEO cares about that in 99.99% of cases.

Re: Ask HN: What percentage of your users are using social login?

#144

Post by Finnucane »

incompatible wrote: post #125
jfaucett wrote: post #76

All my side projects and any projects I control use exclusively social login. Here's why. 1. Its way easier on me. I don't have to worry about password resets or users hacking an account in the site. OAuth and be done. 2. I don't have to deal with any outgoing or incoming emails and complaints dealing with login. 3. I don't have to worry about scammers, since google/facebook pretty much require phone, a non fake emai…

Is it really so hard for scammers / spammers to create fake Google / Facebook accounts? What is so hard about creating any number of "non fake emails"? I assume a non-fake email (address) is just one that can accept incoming messages.

I have an empty Facebook account with a pseudonym--the name of a fictional character, so it's actually obvious--and gmail address I don't use for anything. I set this up specifically to use with sites that use 'social' login. I've had it for a few years now, and as far as I can tell FB does not care.

Re: Ask HN: What percentage of your users are using social login?

#145

Post by thurt »

hamstercat wrote: post #73
adtac wrote: post #38

Curious: has anyone integrated Github login? What percentage of your users use Github?

I'm also curious about it. I think it makes great sense for services that target developers as their main audience, but I don't see it used a lot in the wild.

example: codewars.com has a prominent "GitHub Login" button that precedes email login

Re: Ask HN: What percentage of your users are using social login?

#146

Post by throwaway47853 »

Moru wrote: post #139
incompatible wrote: post #125

Earlier quoted context omitted.

Is it really so hard for scammers / spammers to create fake Google / Facebook accounts? What is so hard about creating any number of "non fake emails"? I assume a non-fake email (address) is just one that can accept incoming messages.

Google requires a phone number nowadays. And you can't use the same phonenumber more than X times. (Not sure what X is but I hit it last week so had to go on the second phone)

No it doesn't (at least on the desktop version of the site). You can leave the phone number field blank on the 'Create your Google Account' form. For 2 factor authentication you do need it.

Re: Ask HN: What percentage of your users are using social login?

#147

Post by Joakal »

pen2l wrote: post #105
f2n wrote: post #92

Earlier quoted context omitted.

I am unlikely to use your site if it requires me to use a Google or Facebook login. Those companies already have too much power to fuck my life up, I have no interest in giving them any more.

While I'm sympathetic to your viewpoint and to a large degree share it, you are among a vanishingly small minority to not use a site or service just because of social login. 'jfaucett probably is fine sacrificing losing this small minority.

Is it actually a small minority?

How do you test this? I'm not sure how to test this though as there are flow-on effects on preventing registrations ie less word-of-mouth.

Re: Ask HN: What percentage of your users are using social login?

#148

Post by digiwise »

bjelkeman-again wrote: post #130
dbielik wrote: post #119

Earlier quoted context omitted.

Why not create a Facebook or Google account just for these websites? Or is it the cross domain tracking that is worrying since everyone's sites are tagged?

It becomes a mess to track where you are logged into what. And cross domain tracking.

2 accounts can take care of this. You can have one account for life related things and another one specific for Logins.

I personally don't care. As I have nothing to hide and I trust most of the businesses providing federated logins.

Also, makes life a lot easier. Not only as a developer, but as a user.

Re: Ask HN: What percentage of your users are using social login?

#150

Post by hellofunk »

nkkollaw wrote: post #107
hellofunk wrote: post #95

Earlier quoted context omitted.

Think about it from the perspective of the site owner. Much safer to offer access this way, and easier, than having to manage and store and secure passwords. Much safer for users.

I'm not convinced. For the site owner, they can even more easily pick social login. As for safety, it's just as hard for a hacker to guess my email password then my website password, what is the difference? Not to mention that if my phone is around you might be able to see the URL from the lock screen, and if God forbid my phone (or even laptop, but it never happens) is unlocked my email client is accessible at all t…

But if someone can access your email, they can already reset your password anyway. So email is the Golden Gate to your services in general, regardless of whether you use this approach. And the URLs that are sent out would not just be simple things that you could look at and remember and then go type them into some other computer.

It comes down to ultimate safety for users and development time for vendors. I personally feel much safer knowing that some startup is not having to provide security on their own and store and manage my password and control all the things that my email provider does anyway. Because if that startup is hacked, there's much less likelihood of hackers walking away with credentials they can use later to access my account.

Social sign on offers similar reliability and development benefits. The difference is that in my experience a lot of people are quite hesitant to use a social service like facebook to sign onto a site that otherwise contains important personal data. But I do typically work with customers who are older, so they're less likely to understand these kinds of practices. A very common misconception that I've heard many many times is people who think that because you login with a Gmail or a Facebook OAuth, that means you're giving those companies access to your account on our app. Seems silly, but a very common misconception.

Post reply on HN