3 ms·
>don’t know what you do if Facebook decides your a robot and suddenly 50,000 people can’t authenticate to your site This is exactly why I am paranoid about dep
by unclebucknasty 8y ago
>don’t know what you do if Facebook decides your a robot and suddenly 50,000 people can’t authenticate to your site
This is exactly why I am paranoid about depending entirely on social sign up/in. So if the API provides it, I believe it's a good idea to capture the email address associated with the social account and either generate a hard password for later reset if necessary or request the user set one up. The latter obviously reduces a little convenience of the social sign up, but does hint to the user that they can sign-in otherwise and gives them control.
Authentication is just too important to completely outsource without recourse.
- brokenwren 8y ago> Authentication is just too important to completely outsource without recourse I agree 100%. You need to own your users and all of their data. Along those same lines, I wouldn't want my user data going into a multi-tenant, cloud-hosted solution like Okta. I'd much prefer to store everything on my own servers or use an on-premise solution like FusionAuth or KeyCloak.
- unclebucknasty 8y ago>...use an on-premise solution like FusionAuth or... https://news.ycombinator.com/user?id=brokenwren https://news.ycombinator.com/user?id=brokenwren I see what you did there. :) Good luck.
- brokenwren 8y agoHaha. I try to be upfront that I work for FusionAuth. I mentioned it in my other comments in the thread but forgot to mention it here. Thanks for keeping me honest. ;)