4 ms·
If you're designing an OAuth login system, it's important to consider what happens to your user when they are locked out by their provider and can no longer "Co
by rectang 5y ago
If you're designing an OAuth login system, it's important to consider what happens to your user when they are locked out by their provider and can no longer "Continue with Facebook" or "Continue with Google" to use your service.
- SkyPuncher 5y agoNot really. Most of these services tie back to an account (most with an actual email address). Should a SSO provider ever stop working, you simply "reset their password". Send them a message to validate ownership of the account, then ask them to set a password OR authenticate with a different SSO provider. ---- These are the types of threats engineers _love_ wasting time analyzing.
- rectang 5y ago> Most of these services tie back to an account (most with an actual email address). Indeed, that design helps address the problem. But it also has implications for signup flow as you now need an email — which is why I'm advocating that engineers "consider" the issue. > These are the types of threats engineers _love_ wasting time analyzing. Sheesh, where's that hostility coming from?
- user3939382 5y agoThe other day I wanted to switch Trello from "sign in with Google" to an email/password. The first step in the process was "To verify you before completing this action, please provide your Atlassian password". I don't have one, I'm signing in via Google...
- Sanzig 5y agoMy Spotify account was originally created using a Facebook link. I eventually switched over to an email/password before I deleted my Facebook account, but my Spotify account name is an annoyingly long gibberish hash value that I can't change (I assume it's something like a hashed value of my Facebook UID but I've never bothered to check).
- monkeybutton 5y agoMy Spotify account created with a regular email has the weird hash username too. After updating the app its a coin flip whether or not the UUID looking string is what I see displayed. I don't understand how they can make such a large and complex service but not get user's display names correct?
- ashtonkem 5y agoI specifically avoid using oauth to reduce the impact if google bans me for whatever reason.
- rectang 5y agoI do the same with my personal accounts. With work accounts that use GSuite, though, I've been mostly using Google for SSO. Expecting ordinary users to make these kinds of decisions is unrealistic.
- ashtonkem 5y agoYeah, I don’t expect ordinary users to make that decision. But I have no ability to fix this stuff, so I just make decisions for myself in order to minimize unnecessary risks.
- b0afc375b5 5y agoIt's basically a single point of failure (SPOF) and with proper risk assessment, one ultimately concludes to use email/password whenever available.