Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OM: "My web without Facebook Connect"

gigaom.com

Post reply on HN
Print view View original

11–20 of 24 posts

Re: OM: "My web without Facebook Connect"

#11

Post by tosh »

jdp23 wrote: post #2

Whether or not it's fair, most people will blame Facebook in a situations like this. Unless they can get security issues under control, they're in for an increasingly rough time ... one more reason I think they're waaaay overvalued at $70B.

there are many things that facebook can and should improve (like enabling https all the time, not as opt in, and not disabling it when you use apps that don't use ssl/tls). that said I'd love if 10% of the web services I use would take security as serious as fb does.

Re: OM: "My web without Facebook Connect"

#12

Post by simonw »

nickbp wrote: post #9

From the user perspective, I don't use Facebook Connect because I don't think a third party site should be given access to any of my Facebook information, nor should Facebook know what other sites I visit. I'd much rather they all stay ignorant of one another.

Have you heard about Instant Personalisation?

Re: OM: "My web without Facebook Connect"

#13

Post by racbart »

tosh wrote: post #10
Vivtek wrote: post #6

I'm not sure FB is a single point of failure - Twitter signin seems to be nearly as prevalent. In fact, you could probably do something about identity by leveraging these separate identities into one, so that if you lose one (like Om) you wouldn't be separated from your online identity. (Not to mention you could reclaim the failed point based on your other identity components.) That's vague, but seriously - a "single…

I also don't think that facebook connect poses a single point of failure. If it becomes one then it is not the fault of the identity provider but the fault of the relying party, so if he only uses services that only offer auth via fb, or he did not connect his accounts with other identity providers then he should not complain right?

Nothing poses a single point of failure unless one uses it that way.

If you add other identity providers then sure, you're less vulnerable - just like if you replicate your database and set up failover. There are many ways to avoid certain SPOFs but possibility to fix doesn't make a SPOF stop being a SPOF. It's all about how you use them.

If you use FB Connect as the only way to sign into some of your accounts then FB Connect becomes a single point of failure for these accounts, period. That's what happened to Om. There might be only 30% of his accounts affected, but for these 30% accounts, FB Connect was a SPOF.

For me it's easier to use old-fashioned login/email+password signup with a password manager like 1Password than signing up with multiple online identities to every new account (who does that anyway and many websites allow you connect only one identity). Classic email+password has a failover by default in its design - if I forget my password I can reset it by email (I need both to forget password and have broken email at the same time to don't be able to login).

Re: OM: "My web without Facebook Connect"

#14

Post by JonnieCache »

neutronicus wrote: post #7

I won't use any service that require FB Connect.

Yep. For this exact reason. I trust facebook about as much as I trust any other massive, sinister advertising company.

I am already subject to lockin purely because of the social networking aspect - all my friends use it. Why would I want to lock myself in further voluntarily?

And before anyone points out that google is also a massive sinister advertising company, they have shown their commitment to data portability in a way that I presently find satisfactory. FB go to lengths to prevent data portability.

Re: OM: "My web without Facebook Connect"

#15

Post by nickbp »

simonw wrote: post #12
nickbp wrote: post #9

From the user perspective, I don't use Facebook Connect because I don't think a third party site should be given access to any of my Facebook information, nor should Facebook know what other sites I visit. I'd much rather they all stay ignorant of one another.

Have you heard about Instant Personalisation?

I have. It's creepy, and about as useful as any line that begins with "SUP DAWG, I HEARD YOU LIKE..."

Re: OM: "My web without Facebook Connect"

#17

Post by joe_the_user »

Vivtek wrote: post #6

I'm not sure FB is a single point of failure - Twitter signin seems to be nearly as prevalent. In fact, you could probably do something about identity by leveraging these separate identities into one, so that if you lose one (like Om) you wouldn't be separated from your online identity. (Not to mention you could reclaim the failed point based on your other identity components.) That's vague, but seriously - a "single…

FB connect is a single point of failure for if you use for multiple things.

And the simple answer is don't use it for anything...

I think only junkies for the latest and greatest actually do...

Re: OM: "My web without Facebook Connect"

#19

Post by pnathan »

I neither have a Facebook account nor do I use Google search for more than hard-to-query searches.

I don't need Google Mail, and I do blog elsewhere than my (rottingly neglected) Blogspot account.

I appreciate that the author has tied himself to those services, and how problematic that becomes when a centralized service goes down for a user.

That is - partly - why I do not do that, preferring the somewhat rougher road of managing my own usernames and passwords, ensuring that my services are split across multiple providers and are not subject to the whims, failures, and vagaries of a single company.

Re: OM: "My web without Facebook Connect"

#20

Post by PidGin128 »

JonnieCache wrote: post #14
neutronicus wrote: post #7

I won't use any service that require FB Connect.

Yep. For this exact reason. I trust facebook about as much as I trust any other massive, sinister advertising company. I am already subject to lockin purely because of the social networking aspect - all my friends use it. Why would I want to lock myself in further voluntarily? And before anyone points out that google is also a massive sinister advertising company, they have shown their commitment to data portability…

https://www.facebook.com/download

I myself was surprised when I found it.

Post reply on HN