51–58 of 58 posts
> Users are always identified to you by email address, phone number or both... An account system using phone numbers may have a negative impact to privacy. For some people a phone number is attached to a real name and address. Also it is not uncommon for a person to change their phone number from time to time.
For many people (most?) this is true for an email address as well
Many solid advices here, but I still have doubts about the real-life UX of switching to emailed links instead of using passwords. It's quite popular for some time now, and security wise it makes a lot of sense, but: For one, that means that each time I wish to login (or switch between accounts) I need to fill my email and then go to another tab or to mail app, and wait for the email. It's not that uncommon to take a…
If you're requiring an email/login and 40-70% of users never confirm or bother coming back, perhaps your product isn't something they really want. Personally, I hate being forced to go through the process of creating an account only to quickly discover that I'm never going to use application/website/whatever again.
Earlier quoted context omitted.
I found this related Quora question: https://www.quora.com/Is-there-an-equivalent-of-Facebook-Con... Of those mentioned in the answers, I think QQ would be your best bet. I have never seen anyone use Renren, but everyone seems to have a QQ number. Another of those "everyone has it" apps is WeChat, which also provides OAuth: http://open.wechat.com/cgi-bin/newreadtemplate?t=overseas_op...
You would not use QQ these days, it would be Wechat instead which pretty much everyone online in China has. QQ died around 2013
I agree that WeChat is more popular, though. Those who have both my QQ and WeChat contacts overwhelmingly go though WeChat.
> If the username becomes a form of self-expression on your service, users will want to change it from time to time. IMO separating identity from display-name is an under-used design choice, especially if you think your system needs to scale up to lots and lots of unique accounts. I think Steam is an easy example of a service which does it right: Many people (usually in different social circles) can use the same name…
> I think Steam is an easy example of a service which does it right: Many people (usually in different social circles) can use the same name, you can change your display name easily, other people can see some previously-used names, and you can assign custom names to friends to avoid confusion. On the other hand, they won't let you change your login name, which would hint that they're using it as a unique identifier o…
Come to think of it, that also serves as a counterexample to one of the article's pieces of advice: using an email address as the users login. Steam used to work that way, which is why I have to log in using a string which is an email address I don't use anymore.
Earlier quoted context omitted.
I simply generate non-sensical answers regardless of what the questions are. For example, "What is your favorite place to go on vacation?" was a security question I recently encountered. My answer was something absurd, along the lines of "FourteenZebras".
Ok
Earlier quoted context omitted.
I believe that sign-in-with-X implementations require actually authenticating with X in that context. So in order to sign in with Google to a website, I need to sign into Google itself in the same browser. So in that sense, you are enabling Google to track you in that browser - but no differently than if you just logged into gmail. You could sign back out of Google immediately afterwards. But just the fact that an ap…
It's not that bad. The only thing Google/FB/Twitter gets to know is that a user Y is using app X. Nothing more, and not detailed usage stats, just the basic fact. For that they handle the complete user registration, recovery & auth process for you, with all the work and pain attached to it. Granted if your OAuth provider were really evil, they could log into the users App X account and access whatever data he has ins…
For a hello world app, no big. For a game app, what happens when your employer buys the data, and notices you are playing games on "company" time... Of course lots more privacy failures can be easily imagined here. I picked low privacy failures, but larger failures are very easy to imagine.. Especially when we know that most large governments also have this data, directly siphoned from Google/FB/etc.
> Use email / phone numbers to identify users This isn't always good advice. Not everyone has a unique email address, and not everyone has a phone number. If you're dealing with technology-savvy adults, sure, go ahead. But demanding a unique email address or phone number is actually a high barrier for many people. Case in point, my services is used by families. It's common for them to share an email address, or for t…
Some services (including Gmail, I think) let you link multiple email addresses to an account. That could be useful if you lose access to one of your email accounts.
Earlier quoted context omitted.
I'll have to admit I prefer services that has a "sign up with" particularly google, github or facebook in that order :) It's one less password to manage...
I feel like an old person for hating those things. * I have a password manager because I have to manage 100s of passwords already and most aren't moving to Google anytime soon. * There are a few occasions where I've had to share my credentials with friends or family. It's nice to change the password temporarily and not give them access to my whole Google account. * I don't want to sign into Google on every devices/co…
I wish we had better federated sign-in solutions, but open-id probably won't be it... and U2F while cool won't solve the account recoverability problem.