5 ms·
There's an evil with social login in that you give up the knowledge of your social (presumably personal) network to random 3rd parties. That's even worse than e
by jiveturkey 9y ago
There's an evil with social login in that you give up the knowledge of your social (presumably personal) network to random 3rd parties. That's even worse than email address.
With password managers being essentially mandatory now, it's not too hard to create a new email/password based account for every new site.
But recently I realized that I don't use my FB for anything. I have zero friends, don't allow friend requests and am unsearchable AFAIK. So now I am going to start using that account for social login, that way I don't have to bother with email/password.
- Tyrannosaur 9y ago3rd party knowing about your social network is one thing; do you not also worry about Facebook knowing about all these 3rd party things too?
- Terr_ 9y agoOr even worse, anything that might create a bridge between the two, so that the different third-party sites are aware that you are on each-other.
- alangpierce 9y agoWebsites using Facebook login usually don't ask for any of your Facebook information, just your email address. They also implicitly have the public information on your profile since they have your Facebook ID, and I suppose it does reveal information to say that this user and email address is associated with this public Facebook profile. But they definitely don't get anything close to the read permissions you have on Facebook. Looking through some of my Facebook apps: Headspace, Stack Exchange, and Netflix only have my email address. Venmo is an example that asks for my friend list because they want to use it for social features.
- dstroot 9y ago>Websites using Facebook login usually don't ask for any of your Facebook information, just your email address. This is absolutely false. FB delivers a whole profile.
- alangpierce 9y agoPresumably you're just referring to the public profile? Public profiles can already be accessed for any user without their agreement (at least manually), so it's not extra information provided through FB login. See my second sentence for that caveat.
- tootie 9y agoI don't think password managers have as much penetration as you think and they only work on devices you own. Social login doesn't necessarily give up that much info. Your social network knows who logged in to. The third-party only gets whatever info you accede to which usually is just an email address or name. The huge bonus to users and site owners is that that site isn't storing a password for you. It's easy to screw up password storage.
- chiefalchemist 9y agoI think you just made a case for DuckDuckGo or (e.g.) LastPass to provided an authentication servive. Mind you, products would have to adopt it. But from a sec + privacy perspective it makes sense to have a 3rd party whose biz model isn't to harvest your personal details.
- jasonthevillain 9y agoMozilla Persona tried this. It was a good user experience, but it never gained enough traction and eventually they shut it down.
- chiefalchemist 9y agoMaybe it could be different now? Or maybe it's not a solo effort? If multiple companies leveraged their traction (read: user base) maybe it could work. God knows we need something. It's not safe "outside."
- web007 9y agoThis was OpenID, which lets you choose your third-party provider at will, or even self-host. It's mostly dead now. People wanted the convenience of FB/GOOG/TWIT over the freedom of self-hosting.
- rhizome 9y agoBut everybody just uses some library for that stuff, I wonder why there aren't visible "Log In with [list of 80 OpenAuth providers]" sites or services.
- alanh 9y agoHey, that’s a really bad idea, jiveturkey. Facebook flags and disables accounts with zero friends and zero activity outside of apps. Sometimes they allow you to restore the account by uploading a picture of yourself and waiting for verification. I don’t know how often they do this vs. not, but remind yourself that they could do it to you at any point.
- oedenfield 9y agoWouldn't that be just as bad as using one password for every site? One account gets compromised they all get compromised.
- AgentME 9y agoOnly if the facebook account gets compromised. If some random site you use facebook to log into gets compromised, your facebook account and every other site you log into with it is still safe. This is not exactly worse than web sites that allow you to sign up with an email address and request password resets: if your email address is compromised, then so are all your accounts. Actually, this situation is a bit worse, because there's also the chance that the user will choose the same password as they use with their email address or other accounts, so if the site they're logging into gets compromised, then their other accounts and email may be able to be compromised too.
- eklitzke 9y agoYou must be fun at parties.
- ryanmarsh 9y agoI downvoted this comment because it was ad hominem and did not add to the conversation.