61–70 of 279 posts
Earlier quoted context omitted.
You are aware that there are more people not on facebook than people on facebook, right?
I am. What you're probably not aware of is who my market is (hint: 90% of them have facebook accounts).
Is the perception that we will be nefariously ingesting your private data? Or that FB auth is just a trend? Or just a mistaken assumption that all users actually have a Facebook account?
All of the above. And also because, I just don't want to have to use FB to login to a totally unrelated site. The use case is, I use FB sparingly because I don't have time to get sucked into that pit. I friend people I meet irl, and 'Like' sites that are relevant to my profession (personal branding & networking). But I don't use it for any other purpose. So if your site isn't relevant to my profession, I don't want t…
I've not seen any websites that require a Facebook account to log in, but my immediate reaction on seeing one would be to assume the person who implemented it doesn't know what they're doing and can't be trusted with my data.
Why would you trust a website asking for an email and password more?
When I see a dodgy username and password form, what I parse is "I can't wait for them to email me back my password in plaintext, and then store it without a one-way hash."
Earlier quoted context omitted.
I would much rather have an easy way to tell if someone is a "real" person, and Facebook gives me that. How does Facebook give you that, exactly?
Several ways, none of which is individually full-proof, but taken together they are a very good indicator: - Does the user have a profile photo, or is it the default user icon? - How many friends does the user have? (Generally 0, 1, or 2 is highly suspicious) - Does the user have a real name? [Edit: we have a blacklist of fake names.]
Here is a very quick experiment I made:
- Get the name of one of your contact and the surname of another one and subscribe with that.
- Take the picture of a random girl on the internet that looks real, put a copy and paste famous quote in the description like "it will not rain forever".
- Subscribe to a couple of groups or pages with the word "sex" in them.
Bang, hundred of friends in a couple of days, and the profile now seems legit.
Still harder than generating fake profiles automatically, but I think that with a little bit of effort this can be automated too. There are also companies that will give you some hundred of friends for a fee.
Maintaining a separate identity for every site across the web gets more impractical by the second. I think most people would agree that a third-party authentication service is a positive thing, but there seems to be a stigma, earned or not, surrounding Facebook that makes people hesitant to assign that responsibility to them. I think ultimately it's going to come down to a paid, independent service. Startups can't of…
If your site isn't worth a separate identity, why am I interacting with it in the first place?
This is by far my largest complaint with Quora.
Agreed. I've lost track of how many times I've gone to a Quora answer, thought 'I must take a closer look at Quora', gone to the root domain, realised you need a Facebook login, then just navigated away. I even have a Facebook account somewhere - just don't like logging into another site like this for some reason.
I have a site that requires Facebook to login. For this site, user fraud is a big concern. I would much rather have an easy way to tell if someone is a "real" person, and Facebook gives me that. If my market size goes from 1.5B to 500M because of this decision, that's fine. In our case, it's a calculated choice, like the dozens of calculated choices a startup makes every day.
I have two fake Facebook accounts that I use to sign in to services. I even have a good rep on Quora using a completely fake name. Forcing Facebook because you think it will give you real people and verified accounts is wrong.
Authentication isn't -- and shouldn't be -- a one-size-fits-all problem. For us, Facebook has worked extremely well. (We originally supported Twitter and OpenID but dropped them when it turned out that 100% of our fraud incidents had authenticated with one of those two.)
That said, I'd love to know if our FB heuristics would "catch" you or not. Email me your fake FBUIDs and I'll publicly post their score. We can all learn something! portman.wills[at]gmail.com
To be clear: even if it costs half your conversion rate, it may be valuable, at least until you grow in size to the point where having some support staff on hand is a non-issue, to force people to use a "well known" login provider. The users who insist on per-site accounts very well may just not make enough revenue to hire the support staff required to maintain them.
(Also, I think the privacy issues are seriously underrated: users often seem to insist that you should be willing to trust From: headers on email messages and that looking someone up by real name should be a common/valid way of finding people... I'd much rather Facebook, Google, Yahoo!, whomever, has to think about those issues rather than me.)
Edit: (typed on my iPhone, already fixed a typo)