Social Login Buttons Aren’t Worth It • Hacker News Board

Re: Social Login Buttons Aren’t Worth It

#31

Post by Tichy » Tue, Oct 02, 2012, 10:06 PM UTC

eridius wrote: post #15

bunderbunder wrote: post #8

I love being able to log in using an OpenID provider rather than creating an account. Because it's one less !$@%!@$! password to remember. Or it's one less $@&%!@$ hassle adapting my password creation formula to a new site's password requirements. Or it's one less place where my don't-care-use-it-everywhere username/password key is stored, perhaps @$2( ! in the clear. Or perhaps it's just one less time I have to type…

I agree. But unfortunately, OpenID can magnify the problem for some people. For example, my girlfriend has at least 4 different Stack Overflow accounts because she can never remember which OpenID provider she used, so she keeps accidentally creating new ones.

Haven't been able to log in to StackOverflow for weeks.

Re: Social Login Buttons Aren’t Worth It

#32

Post by anigbrowl » Tue, Oct 02, 2012, 10:13 PM UTC

codinghorror wrote: post #4

The way I read this, it's about the CEO overriding the decision based on aesthetic reasons. Personally I'd much rather log in with Google in this case, which means there would need to be three buttons: Twitter, Facebook, and Google. I'm sympathetic to the "nascar-ization" argument, but I also believe your customers are smart enough to process at least as many options as there are in their wallet for providing identit…

I too would rather use Google, but via a browser hook of some sort. I don't like all the social/sharing buttons that festoon most websites these days, and use Ghostery to get rid of them. To some extent it's a dislike of being tracked, but mainly it's just too much crap on my screen.

Re: Social Login Buttons Aren’t Worth It

#33

Post by Zelphyr » Tue, Oct 02, 2012, 10:19 PM UTC

Increasingly there are going to be people like me who don't trust Facebook, Google, Twitter, etc... enough to have an account (or, at least, a real one) with them. So using them for logging in somewhere else isn't helpful.

ONLY being able to use them to log in somewhere else is obviously a reason to never sign up with that "somewhere else" site altogether.

Re: Social Login Buttons Aren’t Worth It

#34

Post by nhebb » Tue, Oct 02, 2012, 10:22 PM UTC

matthewowen wrote: post #27

I think the bigger point has nothing to do with social buttons or login UX. Test your changes independently, and make incremental changes They thought social buttons improved login success. They didn't. An unconnected copy change improved login success. If you test these things independently, you'll get much better insight into what makes a difference.

> Test your changes independently, and make incremental changes

That was my take-away as well. I'm prone to accumulating a list of changes that I'd like to make to my site and then, when change fever strikes, I do them all in unison. When something goes wrong (or right), it's impossible to tell which change had what effect. It's a hard habit to break.

Re: Social Login Buttons Aren’t Worth It

#35

Post by lifeisstillgood » Tue, Oct 02, 2012, 10:28 PM UTC

All the comments below (ha I hope!) are arguing for Mozilla persona

* I want to use email as username

* limit the number of possible ways to login (no NASCAR)

* I want to keep personal and business logins seperate

* don't slap competitor logos all over my pages (CEO quite right there)

this however all begs the question how do I move accounts to a new login?

Few sites (stackoverflow is a shining exception) allow you to associate more than one login with one account. And fewer give different settings by login (admin, power user etc)

we have been lulled by oauth and openid into thinking we have just to authenticate me, rather than authorise a role - and few sites have concepts ofanything other than one role == one set of privileges == one login.

There is a reckoning coming - it is when these sites need to provide fine grained control, as businesses run on them full time, we shall discover why ACLs exist, and what chmod is for. It's going to be painful. But then it's better for mailchimp to take the pain in a couple of years than not be there at all

now go install persona. And allow me to associate more than one login with one account

Re: Social Login Buttons Aren’t Worth It

#36

Post by Nursie » Tue, Oct 02, 2012, 10:29 PM UTC

Zelphyr wrote: post #33

Increasingly there are going to be people like me who don't trust Facebook, Google, Twitter, etc... enough to have an account (or, at least, a real one) with them. So using them for logging in somewhere else isn't helpful. ONLY being able to use them to log in somewhere else is obviously a reason to never sign up with that "somewhere else" site altogether.

And that's not even taking into account that the random dragging in of resources from these places allows them to track which of their users visit which other sites.

Re: Social Login Buttons Aren’t Worth It

#37

Post by jules » Tue, Oct 02, 2012, 10:33 PM UTC

sologoub wrote: post #23

One thing that jumped out at me with the "better" error messages, is that it makes it that much more hackable - if I can hit the service and find valid usernames, I can then try to get into those. If you have a catch-all error message, it's much harder to guess the username/password combo.

You are very likely already exposing that via a timing attack. If you disallow many login attempts in quick succession then it is also a non issue. If you have that in place and somebody is able to guess the password of a random account (it's an account found by randomly trying usernames after all), then it must be an extremely bad password. The benefits far outweigh the minuscule security risk.

Re: Social Login Buttons Aren’t Worth It

#38

Post by yahelc » Tue, Oct 02, 2012, 10:54 PM UTC

stephengillie wrote: post #24

Social login is a shadow issue here - like a sheet over a chair, the little buttons are obscuring a larger issue: Mailchimp found that clarifying login error messages reduced login failures by 66%!! The rest of the story is a coincidental tale about the CEO trying to pull a "Jobs" by thinking he knew what his customers wanted better than they did. The social media buttons only had an effect on 3.4% of their users, a…

Amen. The clarified login error message finding is way more interesting than the vague platitudes on branding and security.

No one will get rid of their social buttons solely on the basis of this post, but hopefully many people will now work on improving their error messages after reading this.

Re: Social Login Buttons Aren’t Worth It

#39

Post by propercoil » Tue, Oct 02, 2012, 10:58 PM UTC

I joined mailchimp ~7 months ago after Jason (thisweekin.com) pleaded viewers to check it out so i signed up for the free trial (2000 subscribers free no credit card).

I'm amazed by everything that they do. Elegant api and ux that "you get" from the get-go. It is a huge problem to solve and i'm now engaging with 1100 subscribers.

Now i want to pay ($30/m) but they don't accept paypal - the service i use to pay for everything since i'm a digital vendor. There are companies in the U.S that don't understand that alot of foreigners do business solely with paypal. There are those who dig it though(Elance, Envato, Odesk)

mailchimp take the leap! eeee

Re: Social Login Buttons Aren’t Worth It

#40

Post by bduerst » Tue, Oct 02, 2012, 11:30 PM UTC

bluetidepro wrote: post #11

mnicole wrote: post #6

Interesting, but MailChimp didn't start with these social media login options, did they? So the low percentage of people using those to sign in probably means that most of those people registered after they were in place? Also, regarding the CEO's email and the confusion of so many options on the homepage, that's merely a design issue. Those buttons don't need to take up so much room or be so bold. They could simply…

> "Interesting, but MailChimp didn't start with these social media login options, did they? So the low percentage of people using those to sign in probably means that most of those people registered after they were in place?" That was my exact first thought after reading. How can they accurately judge the usefulness of the buttons if (for all we know) hardly any of the users created an account that way from the get g…

Yep. There isn't anything very scientific about how he came up with this conclusion.

It would be better to try a study in which you give half the users the social network login, and half the users the regular login, and track their activity.