4 ms·

What if you use third party auth, but keep your own account records, including email addresses? Then if you run into any issues with the third-party provider,

• TheAceOfHearts 9y ago
  That could be a viable path for some services. It really depends on the use-case, e.g. the kind of information being stored and how it's used. You could have the user register by providing an email and clicking a verification link, and then optionally allow em to link third-party services. Regular account access is allowed after authenticating through any available method, but administrative actions require going through the email flow. That way you reduce the risk from a compromised or malicious third-party. Of course, this would assume that email is a good identification authority, which isn't always the case.
  • icebraining 9y ago
    You could have the user register by providing an email and clicking a verification link, and then optionally allow em to link third-party services. You don't need that complex workflow; most third-party authentication services allow you to also request the user's email address during the initial process.
    • TheAceOfHearts 9y ago
      That's fine if you're prepared to trust them as a kind of root authority. But it's not always appropriate. By sending an email and having the user visit the activation link you confirm with fairly high certainty that they are in possession of the email being used. I don't think some of these alleged identity providers should have as much power and trust as they have.
      • icebraining 9y ago
        All you're trusting is that they have verified the email themselves. You still get the email address and can then communicate with and authorize the user directly if you wish.
• aiiane 9y ago
  +1. It's a good idea to have some way of contacting your users regardless of what authentication scheme(s) you use.