Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social Login Buttons Aren't Worth It (2012)

blog.mailchimp.com

Post reply on HN
Print view View original

51–60 of 76 posts

Re: Social Login Buttons Aren't Worth It (2012)

#51

Post by ams6110 »

So on the positive side, social logins are easier for users, don't require a choice between vague error message or leaking user information, and are probably more secure (likely that Google, Facebook and Twitter have stronger security teams than your company).

On the negative side, social logins contaminate your site with someone else's brand, and take away some of your control (what do you do if Facebook decides to ban the user).

As always, look at your users and their usage and try to make the decision that is best for your site. There is no absolute right or wrong here.

Re: Social Login Buttons Aren't Worth It (2012)

#52

Post by pureyang »

woah wrote: post #50
cyphunk wrote: post #35

On why telling users if it is the username or password that is incorrect they say... But after some further consideration, we decided that it was a false risk, as the username reminder form already tells you if a username exists, and is not a significant security risk for the bajilions of sites that have them. Oh, damn i didn't realize bajilions of sites do this and yet are so secure. Next time, a better response i h…

Yea, it was pretty terrible how they got hacked after this article.

source?

Re: Social Login Buttons Aren't Worth It (2012)

#54

Post by finkin1 »

gingerlime wrote: post #29
nostromo wrote: post #6

This is bad advice for anyone that's not a SaaS company selling to people on non-mobile browsers, like MailChimp is. Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth. (I've been meaning to do a blog post on this topic...)

From my experience with a B2C site, we see around 50% use password and 50% use social logins. The problem however is that people easily forget what they used to login with, and when they try things like a password reset, we can't really reset their passwords if they used social logins. Or they might forget whether they used google or facebook to login... So the main problem that I personally have with social logins i…

If users sign up through a social site, their account is still identified by email. So as long as their email addresses are the same between sites, it doesn't matter which social service they use, so they won't have to remember. Twitter doesn't provide an email address, however, so that could be a problem.

Re: Social Login Buttons Aren't Worth It (2012)

#55

Post by rjvir »

finkin1 wrote: post #54
gingerlime wrote: post #29

Earlier quoted context omitted.

From my experience with a B2C site, we see around 50% use password and 50% use social logins. The problem however is that people easily forget what they used to login with, and when they try things like a password reset, we can't really reset their passwords if they used social logins. Or they might forget whether they used google or facebook to login... So the main problem that I personally have with social logins i…

If users sign up through a social site, their account is still identified by email. So as long as their email addresses are the same between sites, it doesn't matter which social service they use, so they won't have to remember. Twitter doesn't provide an email address, however, so that could be a problem.

Not only that, Facebook's default privacy settings are set up in a way which most users' proper email address is not exposed to sites using social login.

Re: Social Login Buttons Aren't Worth It (2012)

#56

Post by ollysb »

gingerlime wrote: post #29
nostromo wrote: post #6

This is bad advice for anyone that's not a SaaS company selling to people on non-mobile browsers, like MailChimp is. Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth. (I've been meaning to do a blog post on this topic...)

From my experience with a B2C site, we see around 50% use password and 50% use social logins. The problem however is that people easily forget what they used to login with, and when they try things like a password reset, we can't really reset their passwords if they used social logins. Or they might forget whether they used google or facebook to login... So the main problem that I personally have with social logins i…

Google logins are the absolute worst, now you have to remember which of your accounts you logged in with (like many others here I have 5 active accounts - I really wish they could give me a single identity that would work with all of them).

Re: Social Login Buttons Aren't Worth It (2012)

#57

Post by thesumofall »

adventured wrote: post #37
thesumofall wrote: post #13

With the risk of repeating myself: https://passwordless.net I think we often overdo the simple things such as authentication.

I've looked at implementing an email auth system. My hold back is concern about delivery guarantees, particularly around speed. For example if I use Mailgun, a reputable service with good infrastructure and a very high rate of delivery. That still doesn't prevent random b.s. around emails not being delivered immediately due to any number of issues. If the user is left waiting for even more than a matter of seconds, t…

Good point. My thoughts: - Email is not the only option to deliver tokens. You could also go for SMS, or both - For most registrations such emails are anyway commonplace. Combined with long sessions (where possible), I think the risks of delayed emails are low (compared to guys getting frustrated with the password) - I'm so far happy with Mandrill. But as you say: random b.s. can happen

Re: Social Login Buttons Aren't Worth It (2012)

#58

Post by ams6110 »

ollysb wrote: post #56
gingerlime wrote: post #29

Earlier quoted context omitted.

From my experience with a B2C site, we see around 50% use password and 50% use social logins. The problem however is that people easily forget what they used to login with, and when they try things like a password reset, we can't really reset their passwords if they used social logins. Or they might forget whether they used google or facebook to login... So the main problem that I personally have with social logins i…

Google logins are the absolute worst, now you have to remember which of your accounts you logged in with (like many others here I have 5 active accounts - I really wish they could give me a single identity that would work with all of them).

If you want a single identity why do you have five active accounts?

I have multiple google accounts because I want separate google identities.

Re: Social Login Buttons Aren't Worth It (2012)

#59

Post by ams6110 »

thesumofall wrote: post #57
adventured wrote: post #37

Earlier quoted context omitted.

I've looked at implementing an email auth system. My hold back is concern about delivery guarantees, particularly around speed. For example if I use Mailgun, a reputable service with good infrastructure and a very high rate of delivery. That still doesn't prevent random b.s. around emails not being delivered immediately due to any number of issues. If the user is left waiting for even more than a matter of seconds, t…

Good point. My thoughts: - Email is not the only option to deliver tokens. You could also go for SMS, or both - For most registrations such emails are anyway commonplace. Combined with long sessions (where possible), I think the risks of delayed emails are low (compared to guys getting frustrated with the password) - I'm so far happy with Mandrill. But as you say: random b.s. can happen

Random b.s. happens with SMS messages too. I've waited minutes for tokens from my bank's login system on more than one occasion.

Also it's not always the case that a user has access to email when he's trying to log in to your app.

Re: Social Login Buttons Aren't Worth It (2012)

#60

Post by vacri »

eterm wrote: post #22
diminish wrote: post #20

Here how I read this; "Since social login buttons aren't worth it, it's best to setup a login based on email and manage an email communication with your users instead of social ones. And by the way, Mailchimp may help you with your communication with your customers. Now remove those social buttons and come back to email". Funnily, I agree with the conclusion and I'm using mailchimp extensively.

One key thing I think is to have the email as a username. I know this is generally done anyway these days but as someone who helps maintain a system where users have "usernames" separate to email addresses, there is a high support cost to this. I overhear a lot of support enquiries with "No, enter your username, not your email address! We've emailed you your username".

I agree with your sentiment personally (email is guaranteed unique, for a start), but as the sysadmin of a company with a sixteen-letter-long domain... it does cause some problems, especially on mobile. Trying to type in a long domain on mobile compounds the problem of also having a long username, which is forced on you by most corporate email address formats, if you have a long name in meatspace.
Post reply on HN