Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Start ups, please don't force me to log in with Facebook

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 279 posts

Re: Start ups, please don't force me to log in with Facebook

#191

Post by Hexstream »

michaelbuckbee wrote: post #136
synnik wrote: post #75

Earlier quoted context omitted.

Automated password resets are a solved problem. Either email a new pw or reset link to a known address, or authenticate with "secret questions". Both have their problems, but no small company should waste support time when established techniques are available.

The items you mentioned mitigate but do not "solve" the problem. We often have users forget what email address they used when they first signed up (work, personal, their kids email because they aren't a "computer person", etc). Probably not so coincidentally, these same users are the ones that struggle the most with basic computer tasks like opening a URL from an email, etc.

You can just let users initiate a request with their login name, no?

Re: Start ups, please don't force me to log in with Facebook

#192

Post by wvenable »

daychilde wrote: post #169
wvenable wrote: post #109

Earlier quoted context omitted.

I'm not comfortable using any sort of 3rd party service. I also don't like that I have any kind of connected identity across multiple sites. This sort of authentication system should be built into the browser, entirely under my control, and every site should be given a separate identity token.

Sounds good, but what happens when you reinstall your OS, or change your OS or browser? Not saying it's not possible - not trying to shoot this down at all - just I think it's a major issue.

One could use a cloud service like Xmarks which already syncs bookmarks and browser passwords. Just because it's built into the browser doesn't mean that you can store the information in the cloud and sync it between browsers.

The difference is that you control the connection and your information directly. With OpenID or Facebook the connection is directly between those entities and site you are visiting. With a browser-based system, the connection is always between the site and you or the cloud and you.

Re: Start ups, please don't force me to log in with Facebook

#193

Post by guelo »

CWuestefeld wrote: post #170
rwhitman wrote: post #88

I just came off of a project where we built the entire auth system on facebook. No other regi options - just facebook. I will never do that again. If that was to become the standard, facebook shot themselves in the foot with their crappy APIs anyhow (see http://news.ycombinator.com/item?id=1731427 ) And I have a facebook account, and I'm really hesitiant to like or authorize anything for fear of the author (or hacker…

I'm really hesitiant to like or authorize anything for fear of the author (or hacker) using it for malicious purposes I'm not quite as fearful for myself. However, if your application requests access to my friends list, you've just struck out with me. Even if I'm inclined to trust you, I don't believe that I have the right to make that decision for my friends. I won't expose them to you, so you can't have my business…

How do you know if the app requests access to your friends? Even if FB warns you about this behavior (I dont think it does) how can you trust that they won't change their policy in the future without alerting you?

Re: Start ups, please don't force me to log in with Facebook

#196

Post by Locke1689 »

mikeklaas wrote: post #155
kenjackson wrote: post #105

Earlier quoted context omitted.

Why do you think Facebook security is security by professionals? I fully expect that Microsoft and Google have a stronger set of security experts working on their various authentication and encryption methods.

Because they are paid in the charge of the largest online authentication system in the world? That's not to say that they are the strongest professionals in the world, of course.

They actually have pretty broken security practices from what I've heard. Their security review before pushing live features is definitely as not as strong as Microsoft (I can't really say for Google, I don't know what their security review is like). Check out the Facebook Chat for an example.

Re: Start ups, please don't force me to log in with Facebook

#197

Post by joeyh »

xiongchiamiov wrote: post #144
StavrosK wrote: post #133

Earlier quoted context omitted.

The only thing I wish for nowadays is for the public to gain a better understanding of OpenID so we can start using it on every site. It's the best thing to ever come out.

It became significantly easier when Google (and Yahoo!, and MySpace) became OpenID providers. If you do something like StackOverflow does (click the Google icon to login with Google), then it's pretty low-effort to use.

And there is a free version of the login widget StackOverflow uses. (Not quite the same code base, but more or less identical.) At http://code.google.com/p/openid-selector/

When I deployed a version of that on my sites, I got lots more causual users posting comments, etc. Most of them just click on google.

Re: Start ups, please don't force me to log in with Facebook

#198

Post by jarek »

generalk wrote: post #184
jdavid wrote: post #147

Earlier quoted context omitted.

What Problem do you have with OpenIDv2a + OAuth?

So I start a SaaS business and put "Please login with your OpenIDv2a+OAuth compatible login below." prominently on my front page. And then I have no users because nobody knows what that means.

You should probably put "Please login with your Facebook or Gmail account below" on your front page instead.

Modify the services named based on expected clients. Choose one or more from the following: AOL, BBC, Facebook, Google, IBM, MySpace, Orange, PayPal, VeriSign, LiveJournal, Yandex, Ustream and Yahoo!. *

On the sign-up page, put in smaller text "You can sign up/log in with any compatible OpenID service" for the technically savvy users, if you expect any at all.

Don't straw man.

* list copied from Wikipedia.

Re: Start ups, please don't force me to log in with Facebook

#199

Post by Croaky »

If your app only provides Facebook for authentication, do some Jakob Nielsen-style usability testing and you might be surprised how common this complaint is. That's been my experience on the most recent app I've worked on.

Startups love Facebook authentication more than users do.

Re: Start ups, please don't force me to log in with Facebook

#200

Post by joeyh »

Aetius wrote: post #12

I'm sorry, but its just not worth expending the extra effort to get you signed up to my service. I can get millions of people before it even starts becoming an issue.

You know, early adopters tend to think about technology, and make choices such as not using facebook. You're likely setting yourself up for negative publicty from some person with a blog and a large following. Is it really worth risking that to shove onto users your choice of being technologically locked in to someone else's company?
Post reply on HN