16 ms·
Ask HN: What percentage of your users are using social login?
In first quarter of 2018, what percentage of you users have been using social login (Facebook/google/etc) for you projects? I've never liked the idea of using social login as a customer, but I don't want to alienate users as a dev.
- fwgwgwgch 9y agoNot a fan so not defending but I wouldn't classify Google as social login.
- monocasa 9y agoEmail was the original social network (still left).
- stanleydrew 9y agoNah, the PSTN was the original social network. And they even developed the first cloud app: voicemail.
- monocasa 9y agoEmail's older than voice mail.
- stanleydrew 9y agoFair enough, though I wouldn't call it a "cloud" application until webmail became prominent in the late 90s.
- monocasa 9y agoWhy? You'd log in to servers that were more or less permanently on and connected to public internet in order to access email for the length of it's existence.
- gscott 9y agoSorry, smoke signals were the first social network. Plus you couldn't even opt out of them.
- fwgwgwgch 9y agoThey weren't even push in a way. You had to manually pull the messages. So I don't think there's a question of opt out. :)
- joefourier 9y agoBy that definition, the telegraph was the original social network, preceding emails by over a hundred years. The definition of social networking is debatable, but I don't think one that encompasses every communication medium is useful.
- monocasa 9y agoI would say that communications media that addresses based on an individual's identity, and has infrastructure for public and pseudo public group communication counts. Email + listserv counts, IMO, whereas your example of telegraphs would not. You could probably implement a social network on top of TELEX if your we're feeling ascetic though.
- caseysoftware 9y agoA more proper term might be "delegated authentication" but it's a mouthful so people don't use it unless they mean arbitrary Identity Providers. * Biased as I work on the OpenID Connect and OAuth at Okta where we are an Identity Provider and support many of the social login options.
- jccalhoun 9y agobut Google+!!!!
- fwgwgwgch 9y agoLol
- ajeet_dhaliwal 9y agoThis will probably depend on what market the project is in. Tesults does not have a social login option but it is a business/dev app and not consumer so it would be strange to allow a social login, you’re supposed to add your colleagues/team from work using your work emails.
- unilynx 9y agoIt's still useful in a B2B context - the 'google' login button also works for G Suite (google apps) accounts.
- arsalanb 9y agoI'm currently working on a project which has only social login (but allows you to choose between facebook and google) and this was a very deliberate move. For any given person on this planet, there is a higher chance that they use facebook or gmail over any other "service", so no need to offer support for 10 different social logins. Also, this is more about imposing a qualitative filter on the users who sign up. If the earliest users you have don't like you enough to give you their social login details (assuming, of course, you don't do something silly that poses a security threat) then do they really like you enough? I like to think of my earliest users as "apostles" (I even call them that. Not to their face, but yeah) and they should have a bit of faith in the service. If they don't, then they are not really apostles after all.
- Razengan 9y agoI will never use your product or service, if it only allows "social login." If it's an app that requires ANY sign-up to begin using it, I will uninstall it, unless I feel it offers a tremendous value to me.
- acheron 9y agoSame. And I hold grudges. Lyft and Spotify used to require Facebook logins, and even though they have since removed the requirement, I still feel negatively towards them for it and don’t use them to this day.
- KaoruAoiShiho 9y agoThat's it exactly, he only wants people that finds his service of tremendous value. I think it makes sense as a way to deter casual sign ups.
- wepple 9y ago“If the earliest users you have don't like you enough to give you their social login details ” Perhaps I’m an anomaly, but if there is no regular email sign-up, I’m not using your product, period. There’s enough information floating around about me in databases all over the world, I don’t need them to be further connected and linked. To see the situation with FB/CA and then demand your users use their login is insulting to me.
- motdiem 9y agoMy current project doesn’t implement social logins yet. On my previous one, on a B2C niche site, i’d say maybe 30% used social logins. One thing you want to consider is allow users to login in multiple fashions - like if you recognize an email that is already a social login, offer them a way to create a site password too. In my case, maybe 80% of support requests we got were people forgetting they signed up with a social login and then wondering why their passwords weren’t working.
- kaycebasques 9y agoFor my little side project I’m using email only. Tangentially related, I quite like Medium’s workflow where you don’t need to enter passwords anymore. You just enter your address, they send a login email, you click the link in your email, and it redirects you to Medium, logged in.
- Xeoncross 9y agoInteresting, I always assumed this would be too much hassle for users since after the first login, the browser (mobile or desktop) would remember the password. Certainly seems like an optimum solution to typing a password on first login though (assuming the email is prompt).
- davnicwil 9y agoCouple of points, first of all the thing the browser can still remember is the auth token in a non-expiring cookie. As the majority of users will rarely if ever clear cookies or change browsers, this nullifies the password remembering feature. Secondly, particularly on mobile, tapping through to email and hitting a link is probably faster and more convenient for most users than simply entering a password on the keyboard. It's just a shame it's such a pain to write automated tests that go through the email login procedure compared to username/password ;-)
- oddlyaromatic 9y agoI used a fundraising tool recently with this kind of passwordless workflow. It's a tool that you only use once a year for about 30 days, and your authenticated session can last about that long. Which means you do the process once on each computer you use, and then you never have to remember the password the next year. It's great.
- deleted 9y ago[deleted]
- jehlakj 9y agoI like it too. No need for confirmation as you’re already accessing your email to login. It’s far more secure as the average user will most likely use the same password as the email to sign up with.
- Jack000 9y ago32% username password 57% google rest facebook/twitter out of 7291 users, via auth0 (for my project brandmark.io)
- mycentstoo 9y agoYour app is awesome!
- enzolovesbacon 9y agoJust found out about your site. It's great! Will be using it for my next projects for sure.
- yowlingcat 9y agoYour project's awesome! Definite step up from a couple other tools that attempt to do the same thing. Came up with a couple good concepts for an idea I've been tooling around with for a while!
- seveibar 9y agoI'm a cofounder at CollegeAI.com. Our users can sign up via Facebook, Google or Email. Here are our stats: Google: 58% Email: 23% Facebook: 19% Most of our users are around 18yo.
- e12e 9y agoDo you have stats on how many sign up with Gmail (or Google mail account) - but as "email"?
- seveibar 9y ago59% use a gmail when they sign up with email. Many of the users on our platform will use their school emails, so this might not be representative of another sites.
- paulsutter 9y agoGoogle is preferred because the one thing you know for sure is that nobody uses google+ so there’s no risk of unintended social leakage (have done surveys)
- learnstats2 9y agoI was curious and visited your site, thanks :) I noticed that Facebook is listed as the first option with a graphic button, whereas e-mail is listed last with a text-only link. Despite this, e-mail has attracted more users than Facebook. It’s broadly a similar story for other posts here with stats listed. In my view, this mostly negates the claims above that people who prefer to login with e-mail can be reasonably ignored.
- buildbuildbuild 9y agoAn interesting question but I caution you not to follow blindly in the path of what has worked for other products. The conversion rate of social logins with _your customers_ is the ultimate metric to look at. They are trivial to implement, do some A/B testing with your product and follow the metrics. A CRM product, for example, might see almost zero social signups compared to email. But an app for photo editing might see 90%. Know and serve your own customers before following others' metrics. And good luck :)
- wkrause 9y agoI'm the creator of Langliter, which launched a little over a month ago. 40% email 30% Google 30% Facebook Google might be a little under represented due to a bug (was fixed within a couple days) that prevented some Android users from using it to create an account.
- tootie 9y agoWhen you say email, you mean email as username plus a password? Or you mean like TOTP via email?
- wkrause 9y agoGood point, I mean user name and password, with an initial verification email. If you use the email option, you can't get into the app without first clicking a verification link in an email. That caused a few headaches after launch when my transactional mail service didn't have a great delivery rate. Still the right thing to do from a security perspective. I do have a big "preview" option on the login page for anyone looking to kick the tires before committing to creating an account, which hopefully compensates for some of the added friction in the verification process.
- beagle3 9y agoWhat are you using to get a good delivery on transactional main?
- wkrause 9y agoNothing high tech. Started out monitoring failed deliveries and sent out verification requests manually to get over the first week or two. I noticed it was failing consistently on Microsoft domains, so contacted the provider and they reassigned an IP which improved things. Other than that, I have a really high open rate, but I'm not going to pretend I know much about the intricacies of building a domain's reputation. I'm using Mailgun btw. Can't really compare it to other services personally, but their support has been great especially given that my service isn't large enough yet to need more than the free tier.
- jiveturkey 9y agoThere's an evil with social login in that you give up the knowledge of your social (presumably personal) network to random 3rd parties. That's even worse than email address. With password managers being essentially mandatory now, it's not too hard to create a new email/password based account for every new site. But recently I realized that I don't use my FB for anything. I have zero friends, don't allow friend requests and am unsearchable AFAIK. So now I am going to start using that account for social login, that way I don't have to bother with email/password.
- Tyrannosaur 9y ago3rd party knowing about your social network is one thing; do you not also worry about Facebook knowing about all these 3rd party things too?
- Terr_ 9y agoOr even worse, anything that might create a bridge between the two, so that the different third-party sites are aware that you are on each-other.
- alangpierce 9y agoWebsites using Facebook login usually don't ask for any of your Facebook information, just your email address. They also implicitly have the public information on your profile since they have your Facebook ID, and I suppose it does reveal information to say that this user and email address is associated with this public Facebook profile. But they definitely don't get anything close to the read permissions you have on Facebook. Looking through some of my Facebook apps: Headspace, Stack Exchange, and Netflix only have my email address. Venmo is an example that asks for my friend list because they want to use it for social features.
- dstroot 9y ago>Websites using Facebook login usually don't ask for any of your Facebook information, just your email address. This is absolutely false. FB delivers a whole profile.
- MediaMonitorWD 9y agoI'm a media researcher with a PhD. Here my stats: 55% Google 25% Facebook 20% Others
- scrollaway 9y ago100% (Blizzard login). My site is based on a Blizzard game, so it doesn't really make sense to have an account unless it's linked to a blizzard account. But what that means is that if your upstream login provider is down or having issues, your users can't log into your site, so don't do this unless it really makes sense for you. https://cdn.discordapp.com/attachments/282271461853626368/426471681800929296/unknown.png https://cdn.discordapp.com/attachments/282271461853626368/42... OTOH, we don't really have to deal with spam; that part has been nice.
- pvg 9y agoHave you written much about your site/service elsewhere?
- scrollaway 9y agoNot terribly much. Feel free to ask if you wish to know anything.
- SlowRobotAhead 9y agoSide topic I hadn’t considered... If you don’t use 2FA on your google or Facebook account, how are delighted authentications any better than password reuse? They actually seem worse / less secure.
- sp332 9y agoYou get to set permissions on a per-app basis, so that's a lot less access than going them your password. And if they abuse the access you give them, you can deauth just that app instead of changing the password and breaking all the apps. Edit: I think you were asking about the other direction. It's still not as bad, because if you are sharing passwords and any service was breached, all you services would be exposed. But with delegated authentication, breaching one service doesn't expose your whole account. The one exception is if they breach Google or Facebook.
- SlowRobotAhead 9y agoGotcha on the edit, and yea that was the direction. But if you lost the gmail/Facebook login you also loss all of the sites you used. Classic single sign on issue.
- osrec 9y agoWe offer Google login on https://usebx.com/app https://usebx.com/app . Usually 50% of users make use of it. Some will just try it out with the Google login and then sign up with their company email address.
- asdojasdosadsa 9y agoHey! Just a suggestion: Try to make the google sign in stand out a bit more, for it to be easier to spot. Maybe the 'G' logo or something Ps. Good looking demo
- osrec 9y agoThanks for the feedback - totally agree with you! We will incorporate the change into our next release in a couple of weeks :)
- adtac 9y agoCurious: has anyone integrated Github login? What percentage of your users use Github?
- hamstercat 9y agoI'm also curious about it. I think it makes great sense for services that target developers as their main audience, but I don't see it used a lot in the wild.
- thurt 9y agoexample: codewars.com has a prominent "GitHub Login" button that precedes email login
- petercooper 9y agoWe solely use GitHub logins on http://rubyflow.com http://rubyflow.com but it's very much developer focused. This doesn't stop the spammers, however, who now all seem to have GitHub accounts too :-)
- SubiculumCode 9y agoAs a user I detest social logins, and would prefer an account at the website to hci I want access. It is a privacy thing.
- vortico 9y agoTens of thousands, email + password only. Not one person has complained.
- samblr 9y agoDoes here anybody knows about who is using login with amazon ? I just looked up - login with amazon is possible.
- londev 9y agoAt https://chartlocks.com https://chartlocks.com we have around: 45% email 30% Google 20% Facebook 5% Twitter
- stickfigure 9y agoI have a B2B app. It allows Google Sign-In only. My last B2B app was the same. Nobody complained. Understand your audience. If you can just go with something like Google, do it; you'll save a ton of time and can focus on developing features your customers are willing to actually pay money for. Authentication method is not usually a value proposition. Only implement multi-service auth as a last resort. It's great for mass-market consumer apps, but the development workload is significant and you will end up with a support workload for merging accounts no matter how clever your implementation is.
- sebleon 9y ago> development work is significant Not true, these guys invested a lot in making their sdks easy to integrate. You should be able to have fb/twitter/Pinterest/etc login in an afternoon
- hamstercat 9y agoParent is talking about the time it takes to integrate multiple ways to login, and I agree with him. When you implement only one way (be it social login with Google/Facebook/etc or an email/password combination depending on your target audience) it's usually easy. When you have multiples ways to login, you end up having to (1) maintain more code, but also (2) need a way to reconcile users who end up signing in with multiple methods.
- smaudet 9y ago'Maintaining more code' is code for 'I can't write code/I am drowning in unrelated problems/I am just plain lazy' Its a fine philosophy to apply to an entire project where you may talking tens of thousands of lines vs thousands vs hundreds. It doesn't apply to a situation like this, where you are talking perhaps a few hundred lines, tops. If you are doing it right, I wouldn't think you are implementing much more than a thin wrapper around an existing login provider. There are so many valid open source implementations of this out there, this should be zero issue from a maintainabilty/testing perspective.
- hamstercat 9y agoIn a previous job I had, I was responsible for the authentication service of the organization (big B2C company). Even if it wasn't available from the get go, over time about half of the logins were done with social media, Facebook and Google in our case.
- jfaucett 9y agoAll my side projects and any projects I control use exclusively social login. Here's why. 1. Its way easier on me. I don't have to worry about password resets or users hacking an account in the site. OAuth and be done. 2. I don't have to deal with any outgoing or incoming emails and complaints dealing with login. 3. I don't have to worry about scammers, since google/facebook pretty much require phone, a non fake email, 2 Factor auth, etc to sign up. So I can put all that overhead onto google and get the added benefit that most of the users signing up are legit. 4. Legit users. I can't say enough how much having legit users helps the overall quality of almost any platform. Allowing people with a fake-email to sign up and create accounts allows for all kinds of headaches that are largely avoided by using exclusively social sign in. 5. Simplicity. One Click login, where the user immediately sees what information I want to collect and can say yes/no. Login/Sign-Up is done in literally one click.
- lancewiggs 9y agoThen I would never sign up to any of these sites. While I’ve been an edge case for a few years, I suspect it will be increasingly normal - especially for customers who are willing to pay.
- f2n 9y agoI am unlikely to use your site if it requires me to use a Google or Facebook login. Those companies already have too much power to fuck my life up, I have no interest in giving them any more.
- hirsin 9y agoWould a different social login provider be more acceptable? Github for instance? Something or someone that isn't as interested in using your data
- f2n 9y agoGithub maybe... I've been more hesitant to use them, as they control a significant portion of open source project's infrastructure, and could generally make a lot of headaches for me. If you don't have a simple email-based signup I'm going to be hesitant to use your site.
- fairpx 9y agoI used to think social login were a must. But email login still seems to be very popular. Many users told me they wouldnt sign up unless there was an email option
- dethos 9y agoOne of the side projects I currently manage has a social login implementation and ~40% of the users use it, the remaining use the standard email flow.
- lossolo 9y ago0% of my over 10k users use social login. I do not allow social login because of privacy concerns.
- smoyer 9y agoNone (we don't provide that option) but we know that users want this feature and some of the software infrastructure we purchase supports it.
- ssimoni 9y agoBbot (bbot.menu) - food and drink delivery system for bars and restaurants. 20% facebook, 20% email, 60% anonymous ordering only (most prefer to not get an account to drink a beer obviously).
- rutierut 9y agoFor a while I used it almost exclusively until I realized how much I was fucking my users over just because I was to lazy to properly implement a password system (still do not store them myself) besides the already huge power these corporations hold you make it very hard for users to delete their account with them by letting GlobalCorp™ hold their other accounts hostage.
- fiddlerwoaroof 9y agoIt’s funny how back when sites like StackOverflow were starting up, “social” logins like OpenID and, later, OpenID Connect were going to replace passwords. Now it’s “just use a password manager”. Of the two, I strongly prefer a federated login system like OpenID that lets the user pick an identity provider
- danielskogly 9y agoFacebook login is all we have on Wishy.gift, which considering I really care about privacy, might seem weird. We use the login to auth, seed display name, and for the unique Facebook ID that we only store hashed. There's no analytics of any kind on the site, and except for the display name (which I'm planning on making editable) there's nothing to identify a user if somebody gets access to the database. One of the things we want to achieve with the service, is to make it hard or very inconvenient to peek at what's been checked off in your own wishlist, and therefore we only use 1 service for login. It was and still is a really difficult compromise between simplicity, the functionality of the service, and the privacy of our users - which includes my entire family, SO, SO's family, several friends, and many others. Having reached 200+ users as well, I'm not really sure how we'd go about replacing it with something else as well.
- somishere 9y agoCitizensgbr.org: Email 50% Facebook 35% Google 15% Our email setup is a passwordless/magic-link implementation built on top of Firebase's email login, similar to Medium and others. We get a significant amount of grief about it, mainly due to emails being delayed or ending up in spam/routed folders. But also due to the links sometimes opening in a different browser to the one currently in use. There is no plan to allow users to set their own password. We generally suggest using social login when there is a problem with email but we have a lot of push back. In our experience people using email do not trust social login, based on what they think we are getting access to, and what we might do with the data. [To be clear we collect the absolute minimum data required for social login, (email address, name, Id, avatar url) and use it only to create the account/authenticate the user] We are considering trialling mobile phone auth in the not so distant future.
- amyboyd 9y ago70% through FB, 30% through email/password. This is for a consumer-facing mobile app. Though just yesterday 2 people signing up said "I probably shouldn't use Facebook now" and referenced the Cambridge Analytica news.
- clementmas 9y ago60% of users on TravelMap.net register with a social account. 60% Facebook / 40% Google The stats seem to vary depending on the types of clients.
- emmelaich 9y agoI would exempt the use of Google auth on dedicated Gsuite domains. I wouldn't call them 'social' -- especially as thing s like G+ are disabled or discouraged.
- xialvjun 9y agoI have a Web Auth proposal about this, but no one cares. https://www.reddit.com/r/programming/comments/7p5yha/proposalbuilt_in_private_key_authorization_system/ https://www.reddit.com/r/programming/comments/7p5yha/proposa... https://github.com/w3c/webauthn/issues/820 https://github.com/w3c/webauthn/issues/820 https://github.com/whatwg/html/issues/3337 https://github.com/whatwg/html/issues/3337
- davewasthere 9y ago60k+ users. Only offered Facebook login (as an alternative login) which less than 1% of users actually use. Audience is quite young though. 13-20. That said, am reworking a similar site to allow all social auth as first class citizen (Microsoft AD+Outlook/hotmail, Facebook, Google & Twitter) - as well as supporting existing Email/Password auth. Will see how that changes things.