Social Login Buttons Aren’t Worth It • Hacker News Board

Re: Social Login Buttons Aren’t Worth It

#51

Post by propercoil » Wed, Oct 03, 2012, 1:01 AM UTC

ericcoleman wrote: post #49

propercoil wrote: post #39

I joined mailchimp ~7 months ago after Jason (thisweekin.com) pleaded viewers to check it out so i signed up for the free trial (2000 subscribers free no credit card). I'm amazed by everything that they do. Elegant api and ux that "you get" from the get-go. It is a huge problem to solve and i'm now engaging with 1100 subscribers. Now i want to pay ($30/m) but they don't accept paypal - the service i use to pay for ev…

Couldn't you just get a debit card for your paypal account then? https://cms.paypal.com/cgi-bin/marketingweb?cmd=_render-cont...

"Sorry, you're not eligible for the PayPal Debit MasterCard®. This may be because you live outside the United States"

Re: Social Login Buttons Aren’t Worth It

#52

Post by djt » Wed, Oct 03, 2012, 1:03 AM UTC

robomartin wrote: post #50

There's another element of this that, to this day, I don't fully understand: Companies subverting their brands and actually promoting facebook. What do I mean by this? The other day we were watching TV and a Charmin ad comes in. At the end of the ad they actually say "go to facebook.com/charmin" What? They have a perfectly good and highly recognizable brand. And, they happen to have a great URL: charmin.com. Why send…

People are spending a lot of money on Facebook promo these days.

I have a lot of people that tell me the number of likes on their business pages boosts their credibility etc.

Re: Social Login Buttons Aren’t Worth It

#53

Post by tolmasky » Wed, Oct 03, 2012, 1:37 AM UTC

ProblemFactory wrote: post #45

tolmasky wrote: post #43

I think telling people that just their password was wrong was a bad move. The author argues that this is not a security risk because the "username reminder form already tells you if a username exists". However, this simply displays a further security issue. I don't have the link handy, but there was just a (really good) article the other day here on Hacker News about why you should not reveal whether the email addres…

Yes, both of these UI features would reveal the fact that this username or email already exists. But isn't it impossible not to reveal it on the signup page anyway? You want users to have unique usernames (or emails acting as usernames), therefore the signup form has to tell them if it has been already taken. My suggestion would be to tell users if the username or email is unknown right away - and perhaps add a captc…

You can use the same strategy there too: in the signup page, it can just say "a confirmation email has been sent to your email". In the event that the email is already known, the email will say "someone else has tried to sign up with your email -- if this was you click here to change your password". This way, the attacker will never know if the email genuinely resulted in a new account or not.

Re: Social Login Buttons Aren’t Worth It

#54

Post by hakaaak » Wed, Oct 03, 2012, 1:38 AM UTC

robomartin wrote: post #50

There's another element of this that, to this day, I don't fully understand: Companies subverting their brands and actually promoting facebook. What do I mean by this? The other day we were watching TV and a Charmin ad comes in. At the end of the ad they actually say "go to facebook.com/charmin" What? They have a perfectly good and highly recognizable brand. And, they happen to have a great URL: charmin.com. Why send…

I'm not a fan of social login buttons, but I've visited a lot more brand pages on FB than I have product individual sites, usually because those FB pages are running a promotion where you "like" them and then fill in a form to get some product for free. Sometimes I'll unlike them afterwards, but sometimes I leave my "like" as-is. However, neither FB nor branded product sites have really influenced my purchasing decisions. What does? A product that I research via the web, consumer reports, or Amazon ratings and determine is good, a product that is on sale or is more attractive or just "looks" better (or maybe even has a higher price), and for services and applications, I do the same- look at reviews and determine if there is a free product or service that I feel comfortable using instead.

Marketing and ads are a HUGE con game, as people mostly ignore them.

Re: Social Login Buttons Aren’t Worth It

#55

Post by iamdave » Wed, Oct 03, 2012, 1:44 AM UTC

robomartin wrote: post #50

There's another element of this that, to this day, I don't fully understand: Companies subverting their brands and actually promoting facebook. What do I mean by this? The other day we were watching TV and a Charmin ad comes in. At the end of the ad they actually say "go to facebook.com/charmin" What? They have a perfectly good and highly recognizable brand. And, they happen to have a great URL: charmin.com. Why send…

OK, the other question might be: Who is visiting a Facebook page for toilet paper.

Question of a generation. I've had this same question in my head for a while; yes-social media can give you a very unique perspective into your customer base by way of what they like, who they're influenced by, et al.

But should you? "Who is visiting a Facebook page for toilet paper" might right off the cuff seem like a short, witty dismissive remark about a brand of toilet paper to some, but with the right pair of eyes you're able to see the deeper question: Just because social media is there, does that necessitate moving your brand to it?

I agree with everything you just said robomartin.

Re: Social Login Buttons Aren’t Worth It

#56

Post by [deleted] » Wed, Oct 03, 2012, 1:46 AM UTC

sologoub wrote: post #23

One thing that jumped out at me with the "better" error messages, is that it makes it that much more hackable - if I can hit the service and find valid usernames, I can then try to get into those. If you have a catch-all error message, it's much harder to guess the username/password combo.

[deleted]

Re: Social Login Buttons Aren’t Worth It

#57

Post by WiseWeasel » Wed, Oct 03, 2012, 1:47 AM UTC

BryanB55 wrote: post #18

We've always found that by replacing "username" with "email address" makes logging in a lot easier. Most users already know their email address. By using a username thats one more thing they have to remember.

Sites that allow you to post public comments require a user name, so you're not forced to show your email address to everyone, while still allowing you to identify other users making comments. The best answer in these cases is to have both, and allow users to log in with either.

Re: Social Login Buttons Aren’t Worth It

#58

Post by taylonr » Wed, Oct 03, 2012, 2:00 AM UTC

I see this as two problems. 1. Too many options. They even mentioned it "Did I log in with Facebook or Google or Twitter or what."

2. Having both social & native logon.

You could actually solve both by either 1. Only using native logon. or 2. Picking one (maybe 2) social logins.

I went with #2. Granted it was on a small test site, but the trade off of managing customer logins sucks. I'd rather have google get busted for getting hacked than for my little SQL DB getting attacked.

The way I look at it, I have time to write code and secure it to the best of my ability. However, Google and other social logins have whole teams that can manage security and keep up to date with the latest technology etc.

So there is more to social logins than the actual act of logging in. And some of the problems listed aren't really with social logins, but rather with a particular implementation.

Re: Social Login Buttons Aren’t Worth It

#59

Post by vampirical » Wed, Oct 03, 2012, 2:09 AM UTC

> But after some further consideration, we decided that it was a false risk, as the username reminder form already tells you if a username exists [...]

Alright so this security hole already existed in their system elsewhere. After raising the issue that this type of message leaks data, which is a completely valid concern, they dropped it because they were already leaking that data elsewhere? It isn't like email based account reset/reminder forms have to leak the existence of an email within the system, a fact they just gloss right over.

For a system that stores quite a lot of very sensitive data it is surprising to see them knowingly keep such a hole open. I understand the desire to smooth out the user experience but this honestly seems more driven by the desire to not field customer support requests for what feels like a "stupid issue".

I'm not currently a MailChimp customer but I used to be and before reading this I would have chosen to use them again if the need was there. Please don't compromise the security of customers for convenience.

Re: Social Login Buttons Aren’t Worth It

#60

Post by bwooce » Wed, Oct 03, 2012, 2:13 AM UTC

RandallBrown wrote: post #19

BryanB55 wrote: post #18

We've always found that by replacing "username" with "email address" makes logging in a lot easier. Most users already know their email address. By using a username thats one more thing they have to remember.

Using an email address instead of a username is SO HUGE of a usability win. I can't stand when companies don't do this. My email address is going to be unique. I don't have to pick one of the few standard usernames I use and hope that it's available. I know my email address will be. Have you ever been to a site that says username, but really wants an email address? It's absolutely infuriating.

I struggle with this. I acknowledge all your points, but it doesn't cover the usecases of: 1. Changing ISP and getting a new email address. This is really common. 2. Having multiple addresses (work/home, etc). Also see #1

This breaks password resets and creates a "I want to change my credentials" flow that doesn't exist with usernames. It is especially complicated as emails to the old address won't work/are not accessible.

Most companies want to keep track customers over their lifetime and not have them create a new account when they change ISP/job.

If you want to see an example of this not working at all well, see Apple IDs. The pain surrounding them, purchases, @me.com, @mac.com, changing countries and the attached purchases is inspirational in its depth and breadth.