Start ups, please don't force me to log in with Facebook • Hacker News Board

Re: Start ups, please don't force me to log in with Facebook

#81

Post by nano81 » Mon, Sep 27, 2010, 6:48 PM UTC

Nervetattoo wrote: post #13

It would be interesting to see HN-ers that use facebook auth in their apps share some stats on how big percentage use it? I too believe you should have your own auth system as a base, but maybe someone can provide some numbers proving that it actually is a waste.

On my site (www.dipoll.com) I offer FB connect, Twitter connect, and regular email/password registration. 95% of my users join with Facebook connect.

I may very well do away with Twitter and email registration. Some of those 5% of new users might use Connect, and some might leave. That's fine. What I care about is streamlining the experience for the vast majority of my user base.

"I too believe you should have your own auth system as a base, but maybe someone can provide some numbers proving that it actually is a waste."

This is the way to look at it. Each service should test, analyze their numbers, and make the decision that makes sense for them. Blanket statements like "startups should never only use X for authentication" are just wrong.

Re: Start ups, please don't force me to log in with Facebook

#82

Post by davidedicillo » Mon, Sep 27, 2010, 6:49 PM UTC

I can see the advantages of both the fb login and your own authentication. On getappsdone.com we use our own authentication, but sometimes is really annoying dealing with people who can't figure out their user or password, or maybe they didn't receive the activation email and stuff like that.

On the other hand when I'm offered the change to login with facebook, not always I feel comfortable giving access to all my data.

Re: Start ups, please don't force me to log in with Facebook

#83

Post by abraham » Mon, Sep 27, 2010, 6:49 PM UTC

scott_s wrote: post #76

yock wrote: post #50

Maintaining a separate identity for every site across the web gets more impractical by the second. I think most people would agree that a third-party authentication service is a positive thing, but there seems to be a stigma, earned or not, surrounding Facebook that makes people hesitant to assign that responsibility to them. I think ultimately it's going to come down to a paid, independent service. Startups can't of…

What makes me nervous about singing into a site through Facebook is I don't know what kind of permissions I'm giving to the site regarding my FB account.

Facebook always displays an allow page with what data the site is requesting.

Re: Start ups, please don't force me to log in with Facebook

#84

Post by venturebros » Mon, Sep 27, 2010, 6:50 PM UTC

The reason I got one of those vanity accounts that Facebook hyped up was because I was under the impression they would use that instead of your real name on various websites.

Turns out they did not go that route so I refuse to use FB login.

Re: Start ups, please don't force me to log in with Facebook

#85

Post by meatmanek » Mon, Sep 27, 2010, 6:50 PM UTC

NewHighScore wrote: post #51

far33d wrote: post #37

Earlier quoted context omitted.

Why would you trust a website asking for an email and password more?

Email is better because you are not locked into using some third party website to log in. You can set up an email server of you own if you wanted to.

OpenID works great for this too-- you can create your own OpenID provider.

Re: Start ups, please don't force me to log in with Facebook

#86

Post by varikin » Mon, Sep 27, 2010, 6:55 PM UTC

I recently integrated JanRain into a client's site and I think I will be using it for future personal projects. It handles all the OAuth/OpenID details while providing Facebook/Twitter/OpenID/LinkedIn/Yahoo/Microsoft Live/Google/Wordpress/and more providers.

I would like to give people the Facebook option, but I myself, don't use it unless I have to. Giving a dozen options via JanRain makes that easier.

Re: Start ups, please don't force me to log in with Facebook

#87

Post by markharrison04 » Mon, Sep 27, 2010, 6:56 PM UTC

I agree completely. The whole Facebook login thing is of no use to me since I decided to deactivate my account 12 months or so ago. I am unhappy with Facebook privacy and to be honest, the whole thing of keeping up with Facebook, Twitter, LinkedIn, etc just became too much. Devise an authentic login or lose me as a customer.

Re: Start ups, please don't force me to log in with Facebook

#88

Post by rwhitman » Mon, Sep 27, 2010, 6:57 PM UTC

I just came off of a project where we built the entire auth system on facebook. No other regi options - just facebook.

I will never do that again. If that was to become the standard, facebook shot themselves in the foot with their crappy APIs anyhow (see http://news.ycombinator.com/item?id=1731427 )

And I have a facebook account, and I'm really hesitiant to like or authorize anything for fear of the author (or hacker) using it for malicious purposes or Facebook one day making my actions public etc. I think a lot of folks are too.

FB may have been seen by some folks over the last few months as the magic solution to universal social media authentication but I think its becoming apparent that it is not. And thats a good thing.

Re: Start ups, please don't force me to log in with Facebook

#89

Post by HeyLaughingBoy » Mon, Sep 27, 2010, 6:57 PM UTC

hapless wrote: post #67

yock wrote: post #50

Maintaining a separate identity for every site across the web gets more impractical by the second. I think most people would agree that a third-party authentication service is a positive thing, but there seems to be a stigma, earned or not, surrounding Facebook that makes people hesitant to assign that responsibility to them. I think ultimately it's going to come down to a paid, independent service. Startups can't of…

What's impractical about it ? I'm very comfortable with separate identities per-site. If your site isn't worth a separate identity, why am I interacting with it in the first place?

Furthermore, makes it harder for some of us to use your service at work. My work will let me visit Facebook, but each access is logged and IT does track it. While I can notify IT that it's a valid work use, doing this for every site that causes a similar reaction from the firewall gets tiring after a while.

The harder you make it for us to visit, even if it's a minor inconvenience, the less likely we will.

Re: Start ups, please don't force me to log in with Facebook

#90

Post by mquander » Mon, Sep 27, 2010, 6:58 PM UTC

mike-cardwell wrote: post #80

mquander wrote: post #72

Earlier quoted context omitted.

I'm comfortable with separate identities per site, but it is impractical for most people. You have three general choices: - Maintain a separate login and password for every site. This requires a lot of memorization and is a pain in the ass when you find yourself trying four passwords because you forgot which you used. - Use password management software or a naming system that lets you keep track. This is effective bu…

Choice. Let people choose if they want to use Facebook, or if they want to log in directly. Allowing people to log in directly should be the minimum requirement. Facebook should be an addon authentication system, not the only.

Oh, I think Facebook is much worse. I'm just pointing out that there really is a problem to be solved; separate authentication for every site is not obviously the best possible experience. Choice is a fine answer, if the developers are willing to spend the extra time implementing and maintaining the choices.