I am sure this has changed since 2012...
Social Login Buttons Aren't Worth It (2012)
41–50 of 76 posts
Re: Social Login Buttons Aren't Worth It (2012)
#42This is bad advice for anyone that's not a SaaS company selling to people on non-mobile browsers, like MailChimp is. Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth. (I've been meaning to do a blog post on this topic...)
From my experience with a B2C site, we see around 50% use password and 50% use social logins. The problem however is that people easily forget what they used to login with, and when they try things like a password reset, we can't really reset their passwords if they used social logins. Or they might forget whether they used google or facebook to login... So the main problem that I personally have with social logins i…
Frankly I would like to have only one login with Gmail which requires triple authentication (password + image or something else + phone or dongle or heartbeat or something), then for everything else just email me a link to log in.
Re: Social Login Buttons Aren't Worth It (2012)
#43It's old but the point about losing your login, say if Facebook deleted your acount, should not be an issue. If you sign up using Facebook, Facebook gives the requestor your email address. All they have to to is reset their password by email and login using the username and passsword.
Spotify destroyed my account, along with my 4 remaining months of Premium, when I asked to be un-linked from Facebook. YMMV.
Re: Social Login Buttons Aren't Worth It (2012)
#44I encountered the "which method did I use to register to this site" problem years ago and I have a simple solution (as a user) to this:
When there are multiple one-click login options, I register with Facebook first, if that's not available or doesn't work, I use Google, then Twitter.
So I don't have to remember which service did I used, just stick to my simple rule and login with Facebook first.
Re: Social Login Buttons Aren't Worth It (2012)
#45To be honest, in this order I hate the login issues:
a) When you can't use an email in the username field.
b) When sites don't tell you which one between username and password is wrong (I don't care what security experts say, I would rather receive more spam, than be constantly frustrated by not knowing which one was wrong in every website I browse once in a blue moon).
c) When the username/password has imposed constraints like (must have lower, upper, number, special character, and the blood of a virgin).
d) When the site doesn't hint you about the username/password constraints that were imposed when you registered.
e) When I don't know which one of my N possible passwords I used (this one is my own fault, and this is the only issue I expect to have).
Re: Social Login Buttons Aren't Worth It (2012)
#46i personally like having the oauth option. saves me from remembering what username i used with the site, and I dont have to type a username and password since i never sign out.
i set up a pinterest style pig sharing website for fun, and i really enjoyed it when i added the fb login option
Re: Social Login Buttons Aren't Worth It (2012)
#47To be honest, in this order I hate the login issues: a) When you can't use an email in the username field. b) When sites don't tell you which one between username and password is wrong (I don't care what security experts say, I would rather receive more spam, than be constantly frustrated by not knowing which one was wrong in every website I browse once in a blue moon). c) When the username/password has imposed const…
I'd add:
- when copy/paste is disabled via javascript
- when javascript is required for the form to work
Re: Social Login Buttons Aren't Worth It (2012)
#48Here how I read this; "Since social login buttons aren't worth it, it's best to setup a login based on email and manage an email communication with your users instead of social ones. And by the way, Mailchimp may help you with your communication with your customers. Now remove those social buttons and come back to email". Funnily, I agree with the conclusion and I'm using mailchimp extensively.
One key thing I think is to have the email as a username. I know this is generally done anyway these days but as someone who helps maintain a system where users have "usernames" separate to email addresses, there is a high support cost to this. I overhear a lot of support enquiries with "No, enter your username, not your email address! We've emailed you your username".
I think simpler is better and think using email instead of usernames should be what you go for first. However, I do think usernames are useful for public facing profiles in order to keep email addresses private. Another benefit is that usernames are usually shorter to type than email addresses (which is really noticeable on mobile...I should set up a shortcut for mine).
Most sites I've seen accept email or username in the login field. I'm pretty sure that was the default behavior for Django last time I looked into it (years ago).
Re: Social Login Buttons Aren't Worth It (2012)
#49Earlier quoted context omitted.
For usernames it might be true but many sites use emails instead of usernames (and rightfully so, it's already complicated for people to remember passwords without forcing them to also remember an unique username). Emails are more personal and might be easier to link back to personal information. Thus, confirming that there is an associated account with a given email is also a privacy leak, because maybe people don't…
But don't you leak the same information during registration? What happens when a user tries to sign up with an already existing email address? Don't you return an error saying that email has already been used?
This actually argues in favor of only using social logins, which would not leak any clues about other users of the site.
Re: Social Login Buttons Aren't Worth It (2012)
#50On why telling users if it is the username or password that is incorrect they say... But after some further consideration, we decided that it was a false risk, as the username reminder form already tells you if a username exists, and is not a significant security risk for the bajilions of sites that have them. Oh, damn i didn't realize bajilions of sites do this and yet are so secure. Next time, a better response i h…
Yea, it was pretty terrible how they got hacked after this article.