4 ms·
Obviously bad permissions are bad. But "sign-up with email" means that you need to manage you users identities which is complex and risky. You can delegate that
by sbergot 4y ago
Obviously bad permissions are bad. But "sign-up with email" means that you need to manage you users identities which is complex and risky. You can delegate that using something like Auth0 but then it costs you money.
If I am creating a new service today I will probably won't bother and just offer social logins.
- never_inline 4y agoIf you have a password manager synced across browsers, like chrome or firefox's builtin ones, it should be fairly simple, right?
- mort96 4y agoThat ruins the experience for all users who don't want to give you their Facebook or Twitter.
- martin_a 4y agoEven better: I don't have Facebook or twitter, therefore I'm out. :-)
- anubiskhan 4y agoIs "Sign-in with your Hacker News account" a thing?
- ThunderSizzle 4y agoI really don't see how using KeePass or alt is hard, and it doesn't cost money. If anything, it's 2FA that has me more concerned, because it has made my phone number a near single point of failure with the way everyone wants to use my phone number for it still.
- capableweb 4y ago> which is complex and risky It really isn't, it's fairly basic. It's mostly "basic" because people have been implemented those things for so long that there basically are established patterns you can reuse with very few drawbacks. As long as read up on how to implement it and use common sense, you can get authentication working (& being secure) under a day. Edit: Today you can even do it the lazy way and implement "passwordless" email login as a step to see if it's worth implement the simple email+password way later. Basic steps: 1) Allow users to request login, which creates a login token in the DB and sends a URL to the users inbox 2) Allow users to exchange login token for a auth token that eventually expires somehow, delete login token from DB and store login token 3) be able to lookup if a login token is correct when hitting other API endpoints Congrats, you now have a basic authentication scheme
- acheron 4y agoI will never use social logins to sign up for anything. What a terrible idea. I assume anyone doing that is just doing it for tracking or scamming purposes.
- JohnFen 4y agoYou'd be excluding a whole lot of people who don't have any social media accounts, and a lot of others who aren't willing to use them for this purpose.