One reason I particularly avoid logging in with Facebook or Twitter is the large proportion of sites that will abuse the authority to post whatever you post on your FB/Twitter profile as well. Sorry, if I'm just signing in to comment on a Twitter-shared picture or a news article, that does NOT mean I want it posted on my message stream! I've learned the hard way to always use Google/Yahoo OpenID auth instead.
Start ups, please don't force me to log in with Facebook
221–230 of 279 posts
Re: Start ups, please don't force me to log in with Facebook
#222It seems like the reason websites are starting to do this is that facebook authentication gives the developer more information than just an email/credentials. The developer can access all of the basic data in the user's profile and also grab their friend list. This means that later down the line they can automatically connect friends together inside the developer's own service without having to ask their users for th…
Well said. Seems like most people replying are speaking as users who guard their privacy everywhere. Most consumer products are aimed at people that are looking for the bacon immediately. Facebook gives developers a lot of useful information fast so they can get on to deliver the content or service the user thinks they are getting.
When the plumbing works, it's a lot easier to enjoy the architecture where developers and designers deliver real services.
Re: Start ups, please don't force me to log in with Facebook
#223We have two separate clients that spend big $$$ on AdSense driving new customer acquisition that used single fb connect for login. After the API issue last week both saw their 8+ LP scores dive down to 1! Lost commerce for both over the past few days equals multiple tens of thousands, still not seeing the scores recover.
LP?
Landing Page quality score.
Re: Start ups, please don't force me to log in with Facebook
#224Earlier quoted context omitted.
You explicitly grant access for each new set of permissions - accessing a friends list (and thus their publicly available information) is one of those sets. If the site changes their policy, they have to go back to the user and request permission.
This is false - accessing the friends list only requires "basic" permissions.
The friends list can be accessed without asking for permissions via the graph API and an API key if your user id is known.
Re: Start ups, please don't force me to log in with Facebook
#225We have two separate clients that spend big $$$ on AdSense driving new customer acquisition that used single fb connect for login. After the API issue last week both saw their 8+ LP scores dive down to 1! Lost commerce for both over the past few days equals multiple tens of thousands, still not seeing the scores recover.
LP?
Landing Page
Re: Start ups, please don't force me to log in with Facebook
#226Earlier quoted context omitted.
I'm comfortable with separate identities per site, but it is impractical for most people. You have three general choices: - Maintain a separate login and password for every site. This requires a lot of memorization and is a pain in the ass when you find yourself trying four passwords because you forgot which you used. - Use password management software or a naming system that lets you keep track. This is effective bu…
I think this is an issue that needs to be dealt with in schools, because it's going to be VERY important by the time current kids grow up, and most of them don't know what they're doing. Here's what I do. I have two branches of passwords: one unsecure and easy to dictionary attack, another that was randomly generated and I got into muscle memory when I was a boy. Each secure site gets its own slightly different versi…
I use pretty much the exact same system that you do and have done so for many years as well. Recently though, I'm starting to think I might try out the password management software route. I've haven't yet had a problem with any of my accounts being brute forced and I guess there's something to be said for "if it 'aint broke...", but reviewing the passwords I use, even the more secure ones, I have this nagging feeling that they are more similar to each other than they should be. If a resourceful and determined attacker was to somehow figure out one of my secure passwords, then that would be a good ways towards figuring out all of my secure passwords and I don't like that possibility, however remote it may actually be.
Re: Start ups, please don't force me to log in with Facebook
#227It's interesting that there is a constant, fairly large hatred for Facebook connect.
What do you guys who are entirely not into FBC think about the last RFS?
Re: Start ups, please don't force me to log in with Facebook
#228I don't use Facebook. Incidentally, I adblocked "facebook.com" the other day, and a lot of sites load much faster now. In three days, the rule has been hit over 1300 times! If I had a Facebook account, this would scare me.
I use Facebook, so blocking it won't work for me. But I don't want other sites to be able to "cross-domain" Facebook, since that gives Facebook more information that I'd like. A way to block only "cross-domain" type Facebook access would be nice. Or perhaps a per-tab private browsing mode.
I use a separate browser to access facebook, on those few occasions I need to. No other sites need to now about that.
Re: Start ups, please don't force me to log in with Facebook
#229We have two separate clients that spend big $$$ on AdSense driving new customer acquisition that used single fb connect for login. After the API issue last week both saw their 8+ LP scores dive down to 1! Lost commerce for both over the past few days equals multiple tens of thousands, still not seeing the scores recover.
I hate to be pedantic (publicly, at least), but I believe you meant to say that your clients spend big on AdWords, not AdSense, or have the two become somewhat interchangeable (honest question)?
Re: Start ups, please don't force me to log in with Facebook
#230Earlier quoted context omitted.
I won't implement OpenID for any site where I have a say. It needs to die so that something good can step into its place. If you have a site that requires OpenID, I won't use it for the same reason I won't use your site that requires Facebook. If you're going to implement it, make sure you also implement a standard user/pass registration or you'll lose a lot potential users (as in most of them).
Define "something good." You haven't given any reasons on why it sucks.
Something that lets me use my email address as my ID.
I can remember my email address. I can't even remember which openID provider I used to sign up for StackOverflow, let alone how they expect me to form the URL that I use for my login.
So once a month, when my cookie expires, I get to perform a forgot-password-like action, where I dig through my email to find my username, then try several combinations of it and claimid.net (or was it .org) until it lets me in. But I'm not in. I still have to type in my username and password and, click OK, then click OK on a second screen.
That's on the order of 10 more steps than it takes me to type in my email address and password. I remember my email. And I can type it in 400 milliseconds.
The thing that replaces OpenID needs to understand that.