6 ms·

That's exactly what I was thinking. Using OAuth logins from Google, Facebook, etc. saves a lot of pain.

by Osiris 9y ago

pavel_lishin 9y ago
It offloads that pain to the user. What if I no longer wish to have a Facebook account? What if I lose access to it?
- ams6110 9y ago
  Or what if I don't have one? Now I need to sign up for some social media platform that I don't want, just to use your service?
zawerf 9y ago
I had a lot of trouble implementing social logins the other day so it's not completely painless either. For example if you have multiple social logins, what do you do if the user forgets which account(e.g., google or facebook) they used? You could just let them login with any as long as the email matches. But then what if you have a social login type that doesn't require verified email? For example let's say you add an imgur login but the user doesn't have an already have an account there. Then an attacker can just create the imgur account with that unverified email and then use that to log into the same email on your site. There's also a bunch of edge cases with handling users who use different emails for different social accounts so you can't assume one-to-one correspondence between email address and users anymore. And there's a bunch of other issues with how to initialize a good default display name from these different social profiles. And also the issue with how to handle if they unlink all their social login methods. And how/who to send reset password. And so on and so forth. In the end this was all too hard and I gave up and only allowed logging in with google and google only. Which kind of sucks.
ronnier 9y ago
https://stackoverflow.com/users/login https://stackoverflow.com/users/login I don't remember if I used Google, Facebook, or SO's own auth when I created my SO account. Some sites have upwards of 5 to 10 different ways to login and I find it very confusing.

That's exactly what I was thinking. Using OAuth logins from Google, Facebook, etc. saves a lot of pain.

by Osiris 9y ago

That's exactly what I was thinking. Using OAuth logins from Google, Facebook, etc. saves a lot of pain.

pavel_lishin 9y ago

It offloads that pain to the user. What if I no longer wish to have a Facebook account? What if I lose access to it?

ams6110 9y ago
Or what if I don't have one? Now I need to sign up for some social media platform that I don't want, just to use your service?

zawerf 9y ago

I had a lot of trouble implementing social logins the other day so it's not completely painless either. For example if you have multiple social logins, what do you do if the user forgets which account(e.g., google or facebook) they used? You could just let them login with any as long as the email matches. But then what if you have a social login type that doesn't require verified email? For example let's say you add an imgur login but the user doesn't have an already have an account there. Then an attacker can just create the imgur account with that unverified email and then use that to log into the same email on your site. There's also a bunch of edge cases with handling users who use different emails for different social accounts so you can't assume one-to-one correspondence between email address and users anymore. And there's a bunch of other issues with how to initialize a good default display name from these different social profiles. And also the issue with how to handle if they unlink all their social login methods. And how/who to send reset password. And so on and so forth. In the end this was all too hard and I gave up and only allowed logging in with google and google only. Which kind of sucks.

ronnier 9y ago

https://stackoverflow.com/users/login https://stackoverflow.com/users/login I don't remember if I used Google, Facebook, or SO's own auth when I created my SO account. Some sites have upwards of 5 to 10 different ways to login and I find it very confusing.