Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Start ups, please don't force me to log in with Facebook

news.ycombinator.com

Post reply on HN
Print view View original

201–210 of 279 posts

Re: Start ups, please don't force me to log in with Facebook

#201

Post by joeyh »

tomjen3 wrote: post #121
akozak wrote: post #6

Is the perception that we will be nefariously ingesting your private data? Or that FB auth is just a trend? Or just a mistaken assumption that all users actually have a Facebook account?

To me it just seems retarded to assume that everybody have a facebook account - especially when OpenId was invented to solve this exact problem. And guess what, a facebook account is also an open id.

Facebook uses openid to eg, allow users to sign in with a google openid when signing up for facebook. But as far as I know, Facebook is not an openid endpoint, you can't auth against a facebook account using openid.

Happily, google is an openid endpoint, and basically everyone has a google account for gmail or something.

Re: Start ups, please don't force me to log in with Facebook

#202

Post by julianz »

yock wrote: post #97
hapless wrote: post #67

Earlier quoted context omitted.

What's impractical about it ? I'm very comfortable with separate identities per-site. If your site isn't worth a separate identity, why am I interacting with it in the first place?

Well, for one thing, this becomes a bigger and bigger problem: http://www.xkcd.com/792/ Yes, it's a ridiculous example, but the vast majority of end users keep the same username and password for all of their online services. Obtain one U/P pair and you could conceivably access their identity anywhere. A centralized, specialized authentication provider could maintain multiple levels of authentication depending on what…

That XKCD made me go back through a whole lot of my "low security" sites and change the password away from the same old thing I'd used for ages. Still funny though :)

Re: Start ups, please don't force me to log in with Facebook

#203

Post by michaelbuckbee »

Hexstream wrote: post #191
michaelbuckbee wrote: post #136

Earlier quoted context omitted.

The items you mentioned mitigate but do not "solve" the problem. We often have users forget what email address they used when they first signed up (work, personal, their kids email because they aren't a "computer person", etc). Probably not so coincidentally, these same users are the ones that struggle the most with basic computer tasks like opening a URL from an email, etc.

You can just let users initiate a request with their login name, no?

Unfortunately that is even tougher for users to remember as there is even less context.

Re: Start ups, please don't force me to log in with Facebook

#204

Post by julianz »

Aetius wrote: post #19
jat850 wrote: post #16

Earlier quoted context omitted.

I feel that's a flawed attitude. It's like reverse entitlement. Were I a startup founder, I would make it my goal to ensure that EVERY. single. potential customer can use my site, within my capabilities. (edit: I don't know why you're getting downvoted; you stated your philosophy as part of the discussion, which I don't think is a good reason to get downvoted.)

It is my goal. But not right now.

Sure, but look at the clusterfuck above where people are arguing about something called Quora -- they can't even agree on how you log into the site, because some people only saw it when you had to use Facebook.

Users will only give you one chance, if they see a reason not to come back then they won't come back, regardless of later changes you make.

Re: Start ups, please don't force me to log in with Facebook

#205

Post by cyen »

guelo wrote: post #193
CWuestefeld wrote: post #170

Earlier quoted context omitted.

I'm really hesitiant to like or authorize anything for fear of the author (or hacker) using it for malicious purposes I'm not quite as fearful for myself. However, if your application requests access to my friends list, you've just struck out with me. Even if I'm inclined to trust you, I don't believe that I have the right to make that decision for my friends. I won't expose them to you, so you can't have my business…

How do you know if the app requests access to your friends? Even if FB warns you about this behavior (I dont think it does) how can you trust that they won't change their policy in the future without alerting you?

You explicitly grant access for each new set of permissions - accessing a friends list (and thus their publicly available information) is one of those sets. If the site changes their policy, they have to go back to the user and request permission.

Re: Start ups, please don't force me to log in with Facebook

#206

Post by FernandoEscher »

Well, it's easier for user to register a page in an usual manner, why? Well, because they have been doing this all the time. In a startup I'm working on, we forced user to use a Google Account to login, then I ran a usability test on my mom, her first questions were: what's a Google Account? Where is the registration form?

Don't force people to user any third party login, instead, make them have a choice to sync their openid or facebook accounts to have extra features like facebook notifications, GCalendar and GDocs sync, etc.

Registering to an app must be easy, fast and intuitive. The use of third party authentication service must be unobtrusive, and should not limit your application, just improve it.

Re: Start ups, please don't force me to log in with Facebook

#207

Post by Sephr »

I don't want to give you any control to my facebook account via OAuth, but I'll gladly sign in with my facebook OpenID (if they provided OpenID, which they don't). The same goes for Twitter.

This is a dangerous trend that encourages trading control over your Twitter/facebook/etc. accounts for easy registration on possibly-malicious websites. OAuth is not meant for this, and OpenID should really be being used instead.

Re: Start ups, please don't force me to log in with Facebook

#208

Post by bugsy »

This has been bothering me for a while as well. I don't do facebook due to the privacy problems there and general contempt for customer.

Many sites have complex authentication and identity management systems for adding a simple comment. I don't contribute to these sites or return to them, no bookmarking. Too much of a hassle. Studies done by topix and others have shown that authentication does not increase the quality of posts. It's not even clear why comments need to be authenticated anyway. If the visitor is not purchasing something, there is no need to ascertain their true identity.

Look at both the hacker news and reddit systems for a reasonable example of doing it right. Choose a name and password and you are done. For reddit an email address is optional. Both of these sites are examples of places where there is intelligent interesting discourse. The same can not be said for sites with complex authentication systems.

Re: Start ups, please don't force me to log in with Facebook

#209

Post by tholex »

guelo wrote: post #193
CWuestefeld wrote: post #170

Earlier quoted context omitted.

I'm really hesitiant to like or authorize anything for fear of the author (or hacker) using it for malicious purposes I'm not quite as fearful for myself. However, if your application requests access to my friends list, you've just struck out with me. Even if I'm inclined to trust you, I don't believe that I have the right to make that decision for my friends. I won't expose them to you, so you can't have my business…

How do you know if the app requests access to your friends? Even if FB warns you about this behavior (I dont think it does) how can you trust that they won't change their policy in the future without alerting you?

Accessing your friends is not an extended permission as mentioned in another comment, any app you give permissions to can access your friends and get their ID's and Names.

Re: Start ups, please don't force me to log in with Facebook

#210

Post by mkramlich »

hapless wrote: post #67
yock wrote: post #50

Maintaining a separate identity for every site across the web gets more impractical by the second. I think most people would agree that a third-party authentication service is a positive thing, but there seems to be a stigma, earned or not, surrounding Facebook that makes people hesitant to assign that responsibility to them. I think ultimately it's going to come down to a paid, independent service. Startups can't of…

What's impractical about it ? I'm very comfortable with separate identities per-site. If your site isn't worth a separate identity, why am I interacting with it in the first place?

whether having separate identities is a net win or a net lose depends on N. Having to maintain say 3 separate identities (N=3) on the web (roughly: one for public social, one for private/secret, one for money/utilities) is a much lower burden than having to maintain say 30 or 300 separate unconnected identities, each with their own username/password/profile/messaging/eventstreams/community-connections.
Post reply on HN