2 ms·
Because developer time is incredibly valuable to startups, the amount of users who don't want to use facebook/google/etc is relatively small so it's not worth s
by ig1 15y ago
Because developer time is incredibly valuable to startups, the amount of users who don't want to use facebook/google/etc is relatively small so it's not worth spending the extra time to implement.
I think you underestimate the complexity of managing your own auth. It takes a lot longer than a couple of hours to do it right. Testing alone would take longer than that. Authentication is one of the most important part of many apps, it's not something you should be skimping on or doing in a hurry. It's much better to pass it off to a third-party until you have the time and resources to do it correctly.
(here's a bunch of things you might not have considered: password resets, https, stopping spam bots creating accounts, users changing email addresses, etc.)
- sthlm 15y agoI completely agree with that. Although I also think that relying on one third-party auth solution is bad. I would propose an intermediate solution: Implement the use of several auth solutions (e.g. like StackOverflow does). It takes some more time since ID management won't be as simple, but it's still incredibly less complex than implementing your own solution. Frankly, I would happily move away from local auth solutions (except for critical services, e.g. banking). But I don't want to entirely rely on one account type either.