Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Start ups, please don't force me to log in with Facebook

news.ycombinator.com

Post reply on HN
Print view View original

261–270 of 279 posts

Re: Start ups, please don't force me to log in with Facebook

#261

Post by saurik »

synnik wrote: post #75
saurik wrote: post #70

"I forgot my username/password" is an immense burden on a small company. You end up having to make horrible tradeoffs between privacy and convenience (how do you really verify that this user is really this person?) and end up with a serious support issue for a product that might otherwise not generate much support email at all. To be clear: even if it costs half your conversion rate, it may be valuable, at least unti…

Automated password resets are a solved problem. Either email a new pw or reset link to a known address, or authenticate with "secret questions". Both have their problems, but no small company should waste support time when established techniques are available.

This assumes that the user remembers his username (very unlikely: their favorite username was likely taken on this site; my mother actually had a binder where she had written down every username she had been forced to use on every website she had ever gotten an account with) and that he has a static e-mail address (end users don't: they use temporary e-mail addresses assigned to them by their ISP/school/work) or at least remembers the answers they left to those challenge questions (which people often just type random gibberish at because they consider the answers private/personal).

When you get users e-mailing you, incredibly angry, insisting that you help them because they are spending $X at your website and they can't even log in, you realize you can't pretend that these fully automated solutions work for normal people.

Hell, if you want to know real pain: normal users don't even have a single Gmail account, so my #1 support issue is actually users who log into my site with the wrong single-sign-on account and then get angry that none of their stuff is there anymore.

Re: Start ups, please don't force me to log in with Facebook

#262

Post by saurik »

nano81 wrote: post #81
Nervetattoo wrote: post #13

It would be interesting to see HN-ers that use facebook auth in their apps share some stats on how big percentage use it? I too believe you should have your own auth system as a base, but maybe someone can provide some numbers proving that it actually is a waste.

On my site (www.dipoll.com) I offer FB connect, Twitter connect, and regular email/password registration. 95% of my users join with Facebook connect. I may very well do away with Twitter and email registration. Some of those 5% of new users might use Connect, and some might leave. That's fine. What I care about is streamlining the experience for the vast majority of my user base. "I too believe you should have your o…

So, this isn't a useful number for the OP (as it doesn't compare against a direct email/password registration), but people may still find it interesting:

My application (an alternatie to the iPhone App Store) supports Facebook Connect and Google Login (using OpenID). As I'm selling products, I can do a direct revenue breakdown on the two services, which shows a 2:1 advantage for Google accounts.

(If anyone is interested, the 2:1 Google advantage holds even if I control for "in the United States"; about 50% of my sales are in the US, so I have a great statistical sample, and the login breakdown for the rest of the world is nearly identical.)

Re: Start ups, please don't force me to log in with Facebook

#263

Post by saurik »

easyfrag wrote: post #29
akozak wrote: post #6

Is the perception that we will be nefariously ingesting your private data? Or that FB auth is just a trend? Or just a mistaken assumption that all users actually have a Facebook account?

Personally for me as a user it's because I don't trust Facebook. I also think it is a bad idea to outsource your authentication mechanism to a single private entity. What happens if your user deletes their account? What if Facebook thinks your site exhibits suspicious behavior and decides to not send along its users' authentication? Probably won't happen but if it does it could be a world of hurt, much like PayPal.

For the record, normal users /do/ delete their accounts. Users also often have unpredictable priorities, as they are complex people in their own right ;P. Example: they may use transient e-mail addresses (assigned to them by their ISP/school/work) and then get "locked out" of their Facebook account because they forgot their password and can't fix it due to a new e-mail address. Rather than going to the trouble to fix the situation, they may instead simply create a new account, and take this as an opportunity to have a "clean slate". Meanwhile, they may consider your website, which they might even be paying for, to be critical to their lives, and now they can't log in anymore.

Re: Start ups, please don't force me to log in with Facebook

#264

Post by dzlobin »

raganwald wrote: post #73
cliffchang wrote: post #41

Earlier quoted context omitted.

I think you may misunderstand what signing in with Facebook does. 1) It could, potentially, provide some value to you as a user. Quora gets to suggest people to follow for you based on your Facebook friends, so your experience on there is seeded with relevant information. 2) Nothing you do on the site you signed in with is published to your Facebook profile, without your explicit consent on a dialog box.

Nothing you do on the site you signed in with is published to your Facebook profile, without your explicit consent on a dialog box The trouble with this statement is that some users (myself included) don't believe (a) this is true even when they say it's true, or (b) that if it's true today it will still be true tomorrow. Such paranoid users are worried that FB will make a privacy policy change that turns the privacy…

I don't mean to personally call you out but this mindset is entirely flawed for this argument. If you're so worried about keeping your private things private, don't put anything you're not completely fine with being public on facebook. According to your logic they don't owe you any real promise of privacy, right?

Re: Start ups, please don't force me to log in with Facebook

#266

Post by timmy_k »

I completely agree.

Options, options, options. The internet is all about options. This stems from the fact that people would prefer to "Have it their way"... still waiting on BK to deliver that.

When people online don't have options they feel alienated. It's the expectation at this point.

Re: Start ups, please don't force me to log in with Facebook

#268

Post by jarek »

bugsy wrote: post #215
jarek wrote: post #198

Earlier quoted context omitted.

You should probably put "Please login with your Facebook or Gmail account below" on your front page instead. Modify the services named based on expected clients. Choose one or more from the following: AOL, BBC, Facebook, Google, IBM, MySpace, Orange, PayPal, VeriSign, LiveJournal, Yandex, Ustream and Yahoo!. * On the sign-up page, put in smaller text "You can sign up/log in with any compatible OpenID service" for the…

A problem with asking someone for their gmail password to sign into malwarenet.org is that it seems very suspicious. Why does malwarenet.org want my password? I bet I can guess - they want to steal my email, find my bank account numbers and identity fraud me. Oh, it doesn't work that way, right right, but how can any one without exceptional technical skills know that for sure? Lots of site spoofing out there. Hell, o…

1) Unless I am misunderstanding the standard, malwarenet.org never asks for your OpenID password -- your OpenID provider does.

2) Why does malwarenet.org want your Facebook password / to connect with your Facebook account?

Re: Start ups, please don't force me to log in with Facebook

#269

Post by jarek »

zumda wrote: post #248
jarek wrote: post #198

Earlier quoted context omitted.

You should probably put "Please login with your Facebook or Gmail account below" on your front page instead. Modify the services named based on expected clients. Choose one or more from the following: AOL, BBC, Facebook, Google, IBM, MySpace, Orange, PayPal, VeriSign, LiveJournal, Yandex, Ustream and Yahoo!. * On the sign-up page, put in smaller text "You can sign up/log in with any compatible OpenID service" for the…

"Modify the services named based on expected clients. Choose one or more from the following: AOL, BBC, Facebook, Google, IBM, MySpace, Orange, PayPal, VeriSign, LiveJournal, Yandex, Ustream and Yahoo!. " That's the problem! Most people will look at this and don't know what to do. People hate choice , you generally have to lead them. On the other hand, that you even have to provide such a big list is a flaw in the Ope…

Perhaps I didn't phrase my comment clearly? I meant that the website creator can pick one or two of the above to feature on the sign-up page. Examples: Aiming at techy 20-somethings? Google's your bet. Professionals? Advertise Linkedin. Users from Russia? Yandex and Livejournal.

Advertise one or two of the most likely sign-in credentials (so people who hate choice have it easy), and then put a small note that others are accepted too (so people who know what's going on aren't locked out).

Re: Start ups, please don't force me to log in with Facebook

#270

Post by dzlobin »

manveru wrote: post #267
dzlobin wrote: post #227

It's interesting that there is a constant, fairly large hatred for Facebook connect. What do you guys who are entirely not into FBC think about the last RFS?

Do I have to be into FBC to know what a RFS is?

Facebook Connect, Request for startups: http://ycombinator.com/rfs.html
Post reply on HN