5 ms·

As a product owner, why wouldn't I want to piggyback on the millions of dollars of R&D + security that the big companies have put in? And as a user, why would

• xenocratus 6y ago
  > why would I trust my password... Do you use the same password everywhere, by any chance? :)
  • ethbr0 6y ago
    I used to, but some websites stopped accepting "abc123"! Thankfully, it's still fine for my bank login.
• ts330 6y ago
  this is a MASSIVE selling point, BUT, when your users contact support trying to gain access to their account and can't describe what their email address might be... trust me, there is pain in your future.
  • gowld 6y ago
    Users can just tell the vendor what their real email address is when they want support, until Apple bans vendors who ask for contact info.
• chrisshroba 6y ago
  As a product owner, because what if that service provider decides to (mis-?)interpret something you did as against their TOS and revoke your access to their sdk, thereby making it more difficult for many of your users to log in? And as a user, what if Facebook/Google/Twitter/Apple decides you've violated their ToS, blocks you from your account, and now you can no longer log into any of the sites you've linked with one of those providers? I know this is a bit extreme, and for many people, the risk is totally worth the reward, but I think that is one of the chief concerns many people have with trusting a third party for all their sign-ins. It's a single point of failure.
• karlshea 6y ago
  Well one issue as a user is trying to remember which third-party auth was used when I first created the account (did I use Facebook? Google? Twitter?).
  • hawkoy 6y ago
    Well, you can get access to the email on all three so it's not a huge problem for vast majority of whom only maintain single email address.
• danShumway 6y ago
  > why would I trust my password Other people have mentioned this, but if you're not reusing passwords, this shouldn't be a concern for you. Don't reuse passwords! On the security front, companies that are implementing 3rd-party sign-in can still get hacked and leak your personal information. If that information is supplied by Apple instead of you, it's all the same. You don't automatically get better security because you're using 3rd-party sign-in, you only get better security if you're being forced to stop doing something bad (reusing passwords, enabling 2FA) or if Apple is providing less information than an account would ask for during signup. To Apple's credit on that front, they do mask your email, which is a legitimate privacy improvement. But it would be better for that to be a generic service that allowed you to generate an anonymous email at any time for anything, rather than a perk that's hardwired into an anti-competitive scheme to make it harder for you to migrate devices or change services.
• deleted 6y ago
  [deleted]
• hawkoy 6y ago
  As a user, I recently deleted x account. I used login with x on a few services and now I can't access them anymore. This situation is solvable by implementing forget password and storing user's email but many services don't and with a system similar to apple's where you mask the email or phone number, you can't do anything.
• Aeolun 6y ago
  Mainly to prevent the big companies from knowing every website you’ve ever visited.
• manigandham 6y ago
  It's true that oauth is very secure but I wouldn't assume major sites are rolling their own authentication. The standard password hashing methods and workflows are all well known and implemented. Even if the local auth system was poor, an email/password combo is simpler and faster without leaking data to social providers. There's no reason to remember which provider you used, or login to them first, or worry about loose permissions especially with future changes. It also limits the blast radius in case your social account ever gets compromised, and it's useful for completely anonymous and disposable accounts.