Why Facebook Connect Shouldn't Be Your Only Sign-in Option

Post by icebraining » Fri, Feb 03, 2012, 7:54 PM UTC

djtriptych wrote: post #32

keturn wrote: post #13

Earlier quoted context omitted.

Unless your product is something that builds on Twitter's platform, I wouldn't recommend it. It means your users don't have a choice about how they're authenticated to your site, and A) Failwhale, anyone? B) Twitter doesn't provide serious options for protecting their users' login credentials. It's the same username/password combo which is easily phished & replayable. Sadly, I've pretty much given up on the hope that…

From a dev's point of view I really feel that OpenID/OAuth is absolutely not worth the headache. I'd rather just go the hacker news model. Choose a strong password and if you forget it, we send a new one to your email address. Works fine, offloads a lot of security issues to email providers (who tend to be good at it), easy to code.

Post by marshray » Fri, Feb 03, 2012, 8:13 PM UTC

RandallBrown wrote: post #42

The reason people pick Facebook only is because they think that losing users that don't use Facebook is better than having to implement your own account system. Authorization and account management is really easy to screw up. If you leave it to Facebook, you'll save a lot of time. The only question is whether or not it's worth it.

Post by sopooneo » Fri, Feb 03, 2012, 8:30 PM UTC

marshray wrote: post #43

RandallBrown wrote: post #42

The reason people pick Facebook only is because they think that losing users that don't use Facebook is better than having to implement your own account system. Authorization and account management is really easy to screw up. If you leave it to Facebook, you'll save a lot of time. The only question is whether or not it's worth it.

Surely there's a way to avoid implementing your own account system that doesn't drag in the massive unrelated architecture of a Facebook, Google, or Twitter. You don't even need SSO like OpenID. Is there a company that just sells a no-frills user enrollment and login service and also provides strict isolation between sites? (I.e., they resist the temptation to leverage their aggregate user base.)

Post by lean » Fri, Feb 03, 2012, 8:36 PM UTC

alttag wrote: post #9

Aqua_Geek wrote: post #3

There's a good chance that if FB is the only sign-in option, I will immediately close the window and never use your service. It's pretty much an insta-bounce for me for the exact reasons cited in the article.

Me too, because I don't have a FB account. I actively avoid one. I'm being excluded from marketing campaigns, contests, and give-aways because I don't trust FB with my privacy.

Post by emp_ » Fri, Feb 03, 2012, 8:42 PM UTC