Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Start ups, please don't force me to log in with Facebook

news.ycombinator.com

Post reply on HN
Print view View original

271–279 of 279 posts

Re: Start ups, please don't force me to log in with Facebook

#271

Post by Encosia »

japherwocky wrote: post #251
lwhi wrote: post #162

Earlier quoted context omitted.

Interesting, that makes their altruistic (CDN) hosting seem slightly more strategic.

I wish people would explain their downvotes more (I just bumped you from 0). Is it too short? Or not insightful enough? Or.. do you disagree with his opinion?

My guess would be it's because the comment was factually incorrect.

From an ad-blocking perspective, the Google AJAX Libraries CDN and the rest of Google's properties are in no way related. The Google API, Libraries CDN, and supporting documentation is the only thing on the googleapis.com domain.

Re: Start ups, please don't force me to log in with Facebook

#273

Post by jonny_noog »

TheSOB88 wrote: post #252
jonny_noog wrote: post #226

Earlier quoted context omitted.

I use pretty much the exact same system that you do and have done so for many years as well. Recently though, I'm starting to think I might try out the password management software route. I've haven't yet had a problem with any of my accounts being brute forced and I guess there's something to be said for "if it 'aint broke...", but reviewing the passwords I use, even the more secure ones, I have this nagging feeling…

As long as each of your secure sites has encrypted the password in their database, which they damn well should be doing, an attacker wouldn't be able to benefit from any similarities because they wouldn't know what your password actually is. Right?

That would be right assuming passwords were always encrypted - and we know that unfortunately even some of the biggest sites have been bitten by not encrypting passwords in their database[1] - but that's not actually the case I was thinking of when I said "brute forced".

Here's one possible scenario: let's say that I happened to be a member of a website that unfortunately allows an attacker to hit their login form as many times as they like and as fast as they like with various username/password combinations, and by brute forcing this login page in this way, they manage to determine what my username/password actually is. Now the attacker does know my username/password for one website I belong to and - if they're smart and determined - it may occur to them that now they know one of my usernames/passwords they might use these details as a starting point in trying to brute force other accounts that I may have on other websites.

I used to run these kinds of brute force attacks against websites back in the day when I had nothing better to do and before I had to work for a living. Often I was quite successful, but I wasn't targeting specific users and even back then I could tell that websites were getting more savvy in terms of detecting and defeating such attacks. So no doubt it would be harder to pull this kind of thing off now and it would probably depend a lot on which website(s) you targeted. But surely it wouldn't be impossible.

[1] http://blog.moertel.com/articles/2006/12/15/never-store-pass...

Re: Start ups, please don't force me to log in with Facebook

#274

Post by loewenskind »

sbierwagen wrote: post #255
loewenskind wrote: post #253

Personally I don't like any of these global logon initiatives. I don't use Stackoverflow because I never found a way to login without using OpenID. Since I don't like a bunch of random web sites being able to connect me so easily, to use Stackoverflow I would have to go to one of those openID sites and make a fake account or set up my own OpenID provider. Both of these options are extremely inconvenient. I'm used to…

Perhaps you should try something before you dismiss it. Sites you log into using OpenID never see your password. (For that matter, any competent OpenID provider will never store your password in cleartext, so they won't know it either.) The only thing the site knows is your OpenID url, and when you sign in using that, it redirects you there, to enter your password. Live example. I use myopenid.com to provide OpenID s…

Ok, so browser phishing protection should prevent a hostile site from being able to fake this work flow then, right?

In that case I guess I can live with it. I'll just have to go to the effort of setting up my own openID provider since I still don't want different sites tying my ID together so I'll have to set something up on my side.

This is all a lot more effort than it was before and I don't see any benefit at all to how I use the internet. But thanks for giving a detailed explanation of how it works. At least my security concerns are lessened (still, compromising one site and logging passwords will compromise every site you use this service with).

Re: Start ups, please don't force me to log in with Facebook

#275

Post by raganwald »

dzlobin wrote: post #264
raganwald wrote: post #73

Earlier quoted context omitted.

Nothing you do on the site you signed in with is published to your Facebook profile, without your explicit consent on a dialog box The trouble with this statement is that some users (myself included) don't believe (a) this is true even when they say it's true, or (b) that if it's true today it will still be true tomorrow. Such paranoid users are worried that FB will make a privacy policy change that turns the privacy…

I don't mean to personally call you out but this mindset is entirely flawed for this argument. If you're so worried about keeping your private things private, don't put anything you're not completely fine with being public on facebook. According to your logic they don't owe you any real promise of privacy, right?

I don't know what they owe me, but I do know what I do and do not trust them to do. And on that basis I decide what I will and will not share with them.

Which brings us full-circle back tot the point of the post:

When a third-party application uses FB as its authentication mechanism, it gives the appearance of asking its users to trust FB with everything they do on that application.

So yeah, I don't put anything on FB that I can't handle becoming public some day. That doesn't mean I want it to be public, but I wouldn't knowingly put something private on there.

And that extends to third-party apps using FB for anything at all. I can't ever imagine using a linked-in kind of application that uses FB authentication. I'm not going to put certain business contacts and my business relationship with them where FB might be able to scrape the data.

I'm not dating, but if I did I wouldn't use a service that used FB for authentication. Or a personal money management application.

And my message to third party apps using FB for authentication is to take this into account. I won't say "don't," you know your market, maybe they don't care. But at least have your eyes open to people who might think twice if whatever you're managing for them might be sensitive.

Re: Start ups, please don't force me to log in with Facebook

#276

Post by abraham »

loewenskind wrote: post #246
recoiledsnake wrote: post #118

Earlier quoted context omitted.

Exactly. This is the reason that I am far more comfortable using my Google or Yahoo OpenID than a Facebook login.

Why? Because these companies are less likely to sell your data to third parties? You know Google has pretty well always read your gmail right?

> You know Google has pretty well always read your gmail right?

That is a loaded question that does not cover how and why google uses your emails.

Re: Start ups, please don't force me to log in with Facebook

#277

Post by loewenskind »

abraham wrote: post #276
loewenskind wrote: post #246

Earlier quoted context omitted.

Why? Because these companies are less likely to sell your data to third parties? You know Google has pretty well always read your gmail right?

> You know Google has pretty well always read your gmail right? That is a loaded question that does not cover how and why google uses your emails.

What are you talking about? It doesn't matter why they're doing it today. It matters that they're doing it. Even if you're naive enough to buy into "don't do evil", surely you realize that it wont always be that way.

Re: Start ups, please don't force me to log in with Facebook

#278

Post by jdavid »

generalk wrote: post #184
jdavid wrote: post #147

Earlier quoted context omitted.

What Problem do you have with OpenIDv2a + OAuth?

So I start a SaaS business and put "Please login with your OpenIDv2a+OAuth compatible login below." prominently on my front page. And then I have no users because nobody knows what that means.

OpenID is a delegated identity service. It's like a credit card, drivers license or social security card. And on that front everyone knows how to use one. It's been companies like Facebook, Microsoft that have been fucking this up and trying to own it, and to create some bullshit "one web identity" service.

I have been trying to seek out jobs to improve the UX of OpenID, and at MySpace I did the 1st popup login flow.

After MySpace imploded, I even tried for a short time to start an identity company called redrover, but then i had an offer to build an identity service for unity ( which was never internally supported ).

I am very passionate about making web identity work, and allowing people to have multiple web persona.

I have more idea's but i don't have a platform to innovate on.

Maybe now that I am working part time at UCSF on 'Profiles' with Harvard I have a shot again to fix OpenID, OpenSocial, and OAuth.

here is some work that Aza did to improve social bookmarking, http://www.azarask.in/blog/post/socialhistoryjs/

if you think about it a bit, you could use css inflection to determine or refine a list of potential OpenIDs that the user might use to log in.

maybe we finally make browsers smarter, or even better yet maybe with any login form on a web page
then supporting sites could.... tell the browser to cache that those openid urls like you do for username password pairs.

it also might be possible to link your openid to user profile in a browser, so that when you see the openid login form the browser can know what your profile is and delegate that identity transaction for you, like it handles cookies.

Post reply on HN