6 ms·

While providing third-party login services as way to sign-up had some benefits, omitting the "Sign-Up with email" option downgrades the experience dramatically.

While providing third-party login services as way to sign-up had some benefits, omitting the "Sign-Up with email" option downgrades the experience dramatically. And, you know what? Providing only third-party sign-up options with "unnecessary" privileges ruins the entire experience. A few weeks ago, I wanted to sign-up for a Product Hunt account, and in just a few seconds, my experience.. you know.. "downgraded" because there was no other way to sign-up other than through third-party services. After hesitating for some time, I forced myself to try to sign-up with my Twitter account. I clicked the Twitter icon, and it took me to Twitter, where I got these "cute/honest" permissions requested by the app I'm willing to authorize: 1. See Tweets from your timeline (including protected Tweets) as well as your Lists and collections. 2. See your Twitter profile information and account settings. 3. See accounts you follow, mute, and block. 4. Follow and unfollow accounts for you. 5. Update your profile and account settings. 6. Post and delete Tweets for you, and engage with Tweets posted by others (Like, un-Like, or reply to a 8. Tweet, Retweet, etc.) for you. 7. Create, manage, and delete Lists and collections for you. 8. Mute, block, and report accounts for you. 9. See your email address. Oh man! 4 and 5 and specially, 6 are my all-time favorites. Are all these permissions really needed to be able to create a PH account with my Twitter? I mean, cmon.. this is not supposed to be an alternative front-end app for Twitter like "Apollo", "RiF" and "Relay" are for Reddit, this is just a website where people post their e-products once they launched, simple, huh! I cancelled this process, and I still haven't created a PH account yet, but hearing OP screaming with this scary submission today makes me think again 'n' again.. maybe forever.. to proceed down this path.

varispeed 4y ago
Before 3rd party sign up existed, I remember there were patterns, where the website you have registered had an option to add your "friends". Caveat was that it asked for your email and password to your email, so it could download your list of contacts. Crazy part is a ton of people didn't see a problem with this...
- ilyt 4y ago
  ...Didn't fucking facebook did it at one point ?
  - justsomehnguy 4y ago
    Linkedin. FB probably too, but too lazy to check
    - criddell 4y ago
      Clubhouse too. Remember Clubhouse? https://news.ycombinator.com/item?id=25685454 https://news.ycombinator.com/item?id=25685454
      - jabroni_salad 4y ago
        there's a big difference between a permitted contacts api and just giving up your regular gmail password.
    - darth_aardvark 4y ago
      Linkedin was worse. It used the login/pw to send emails to your friends from your email account, inviting them to join Linkedin.
capableweb 4y ago
Funniest shit is when you finally sometimes fall victim to the feeling of "Ok fine, I'll use Twitter for the auth so I don't have to fill out the fucking 10 field form just to be able to sign up, why you need to know my current position anyways?" and when you're finished, they're just using the auth to autofill the username and email for the signup form and you have to fill it out regardless.
- weird-eye-issue 4y ago
  This is the absolute worst and why does it seem to happen 80% of the time?
  - ComodoHacker 4y ago
    They know people don't always update their profiles and use throwaway accounts. They nudge you to provide actual data.
    - weird-eye-issue 4y ago
      "Nudge"? You sound like a project manager Forcing to create a new password and field out additional fields isn't a nudge
  - xena 4y ago
    It's so they can feed the data into the sales team in case their algo thinks you are a viable target to sell things to.
  - moritonal 4y ago
    Because most teams didn't write their user-auth code, it's either a framework or another team. But the PO want "Sign in with Twitter" so you hack this together.
sbergot 4y ago
Obviously bad permissions are bad. But "sign-up with email" means that you need to manage you users identities which is complex and risky. You can delegate that using something like Auth0 but then it costs you money. If I am creating a new service today I will probably won't bother and just offer social logins.
- never_inline 4y ago
  If you have a password manager synced across browsers, like chrome or firefox's builtin ones, it should be fairly simple, right?
- mort96 4y ago
  That ruins the experience for all users who don't want to give you their Facebook or Twitter.
  - martin_a 4y ago
    Even better: I don't have Facebook or twitter, therefore I'm out. :-)
    - anubiskhan 4y ago
      Is "Sign-in with your Hacker News account" a thing?
- ThunderSizzle 4y ago
  I really don't see how using KeePass or alt is hard, and it doesn't cost money. If anything, it's 2FA that has me more concerned, because it has made my phone number a near single point of failure with the way everyone wants to use my phone number for it still.
- capableweb 4y ago
  > which is complex and risky It really isn't, it's fairly basic. It's mostly "basic" because people have been implemented those things for so long that there basically are established patterns you can reuse with very few drawbacks. As long as read up on how to implement it and use common sense, you can get authentication working (& being secure) under a day. Edit: Today you can even do it the lazy way and implement "passwordless" email login as a step to see if it's worth implement the simple email+password way later. Basic steps: 1) Allow users to request login, which creates a login token in the DB and sends a URL to the users inbox 2) Allow users to exchange login token for a auth token that eventually expires somehow, delete login token from DB and store login token 3) be able to lookup if a login token is correct when hitting other API endpoints Congrats, you now have a basic authentication scheme
itsacomment 4y ago
Wait, after finding out the site is obviously just trying to grab as much info from you as can be profitably marketed and even after it sets itself up for further abuse, you are still considering signing up?! I really hope I'm missing sarcasm there, cause otherwise you need to readjust the amount red flags you are willing to ignore. "Sign up with" is a tracker's paradise anyway, but not even offering something untrackable like email is just screaming out for everyone to hear that you are the product. With the abusive access demanded, it's down to victim, really. Have some pride, people, and don't fall for these scams!
BlueTemplar 4y ago
What I don't understand is that OAuth (and related) is supposed to be a protocol, so why can't I as a user get the option to enter one ? Imagine if you could only pick Gmail or Outlook in the form for email !
- alexiaa 4y ago
  that was a thing with openid but it pretty much died out.

varispeed 4y ago

Before 3rd party sign up existed, I remember there were patterns, where the website you have registered had an option to add your "friends". Caveat was that it asked for your email and password to your email, so it could download your list of contacts. Crazy part is a ton of people didn't see a problem with this...

ilyt 4y ago
...Didn't fucking facebook did it at one point ?
- justsomehnguy 4y ago
  Linkedin. FB probably too, but too lazy to check
  - criddell 4y ago
    Clubhouse too. Remember Clubhouse? https://news.ycombinator.com/item?id=25685454 https://news.ycombinator.com/item?id=25685454
    - jabroni_salad 4y ago
      there's a big difference between a permitted contacts api and just giving up your regular gmail password.
  - darth_aardvark 4y ago
    Linkedin was worse. It used the login/pw to send emails to your friends from your email account, inviting them to join Linkedin.

capableweb 4y ago

Funniest shit is when you finally sometimes fall victim to the feeling of "Ok fine, I'll use Twitter for the auth so I don't have to fill out the fucking 10 field form just to be able to sign up, why you need to know my current position anyways?" and when you're finished, they're just using the auth to autofill the username and email for the signup form and you have to fill it out regardless.

weird-eye-issue 4y ago
This is the absolute worst and why does it seem to happen 80% of the time?
- ComodoHacker 4y ago
  They know people don't always update their profiles and use throwaway accounts. They nudge you to provide actual data.
  - weird-eye-issue 4y ago
    "Nudge"? You sound like a project manager Forcing to create a new password and field out additional fields isn't a nudge
- xena 4y ago
  It's so they can feed the data into the sales team in case their algo thinks you are a viable target to sell things to.
- moritonal 4y ago
  Because most teams didn't write their user-auth code, it's either a framework or another team. But the PO want "Sign in with Twitter" so you hack this together.

sbergot 4y ago

Obviously bad permissions are bad. But "sign-up with email" means that you need to manage you users identities which is complex and risky. You can delegate that using something like Auth0 but then it costs you money. If I am creating a new service today I will probably won't bother and just offer social logins.

never_inline 4y ago
If you have a password manager synced across browsers, like chrome or firefox's builtin ones, it should be fairly simple, right?
mort96 4y ago
That ruins the experience for all users who don't want to give you their Facebook or Twitter.
- martin_a 4y ago
  Even better: I don't have Facebook or twitter, therefore I'm out. :-)
  - anubiskhan 4y ago
    Is "Sign-in with your Hacker News account" a thing?
ThunderSizzle 4y ago
I really don't see how using KeePass or alt is hard, and it doesn't cost money. If anything, it's 2FA that has me more concerned, because it has made my phone number a near single point of failure with the way everyone wants to use my phone number for it still.
capableweb 4y ago
> which is complex and risky It really isn't, it's fairly basic. It's mostly "basic" because people have been implemented those things for so long that there basically are established patterns you can reuse with very few drawbacks. As long as read up on how to implement it and use common sense, you can get authentication working (& being secure) under a day. Edit: Today you can even do it the lazy way and implement "passwordless" email login as a step to see if it's worth implement the simple email+password way later. Basic steps: 1) Allow users to request login, which creates a login token in the DB and sends a URL to the users inbox 2) Allow users to exchange login token for a auth token that eventually expires somehow, delete login token from DB and store login token 3) be able to lookup if a login token is correct when hitting other API endpoints Congrats, you now have a basic authentication scheme

itsacomment 4y ago

Wait, after finding out the site is obviously just trying to grab as much info from you as can be profitably marketed and even after it sets itself up for further abuse, you are still considering signing up?! I really hope I'm missing sarcasm there, cause otherwise you need to readjust the amount red flags you are willing to ignore. "Sign up with" is a tracker's paradise anyway, but not even offering something untrackable like email is just screaming out for everyone to hear that you are the product. With the abusive access demanded, it's down to victim, really. Have some pride, people, and don't fall for these scams!

BlueTemplar 4y ago

What I don't understand is that OAuth (and related) is supposed to be a protocol, so why can't I as a user get the option to enter one ? Imagine if you could only pick Gmail or Outlook in the form for email !

alexiaa 4y ago
that was a thing with openid but it pretty much died out.