21–30 of 76 posts
This is bad advice for anyone that's not a SaaS company selling to people on non-mobile browsers, like MailChimp is. Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth. (I've been meaning to do a blog post on this topic...)
Here how I read this; "Since social login buttons aren't worth it, it's best to setup a login based on email and manage an email communication with your users instead of social ones. And by the way, Mailchimp may help you with your communication with your customers. Now remove those social buttons and come back to email". Funnily, I agree with the conclusion and I'm using mailchimp extensively.
> Our old login form told users, "Your username or password is incorrect," when they may have the username right, but the password was incorrect. If you have 4 possible usernames and 4 possible passwords, you have 16 possible combinations between them—only one of which is correct. That means in this scenario, the user would have 15 chances to make an error when logging in. But when you know specifically that your use…
> Our old login form told users, "Your username or password is incorrect," when they may have the username right, but the password was incorrect. If you have 4 possible usernames and 4 possible passwords, you have 16 possible combinations between them—only one of which is correct. That means in this scenario, the user would have 15 chances to make an error when logging in. But when you know specifically that your use…
the reason for it is specifically addressed in the article... "But after some further consideration, we decided that it was a false risk, as the username reminder form already tells you if a username exists"
Emails are more personal and might be easier to link back to personal information. Thus, confirming that there is an associated account with a given email is also a privacy leak, because maybe people don't want to reveal that they have an account on a specific website.
I love that comparison.
This is bad advice for anyone that's not a SaaS company selling to people on non-mobile browsers, like MailChimp is. Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth. (I've been meaning to do a blog post on this topic...)
It's also true for SaaS. Many of our signups are from Facebook or Linkedin social login. It's one button for the user vs multiple fields.
This is bad advice for anyone that's not a SaaS company selling to people on non-mobile browsers, like MailChimp is. Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth. (I've been meaning to do a blog post on this topic...)
On a personal level, I use social sharing sign up and login buttons almost 80% of the time in place of regular buttons, and am very OK with doing that from a security perspective personally.
This is bad advice for anyone that's not a SaaS company selling to people on non-mobile browsers, like MailChimp is. Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth. (I've been meaning to do a blog post on this topic...)
The problem however is that people easily forget what they used to login with, and when they try things like a password reset, we can't really reset their passwords if they used social logins. Or they might forget whether they used google or facebook to login...
So the main problem that I personally have with social logins is that they create fragmentation, and a simple login form becomes a memory-exercise for the user.
This is bad advice for anyone that's not a SaaS company selling to people on non-mobile browsers, like MailChimp is. Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth. (I've been meaning to do a blog post on this topic...)
From my experience with a B2C site, we see around 50% use password and 50% use social logins. The problem however is that people easily forget what they used to login with, and when they try things like a password reset, we can't really reset their passwords if they used social logins. Or they might forget whether they used google or facebook to login... So the main problem that I personally have with social logins i…
If a user forgets the method they used to sign up, we'll still return the right user record to your app.
Be careful implementing this, because it can be a security issue if you're not cautious.