3 ms·

Your forgetting that his baby - Stack Overflow - allows you to use multiple logins for the same account, so you wouldn't depend on say Facebook.

pc86 4y ago
One of my litmus tests for whether a technical team knows what the hell they're doing is what happens when you sign up for a service with one 3rd party auth (e.g. Facebook) then try to sign in with another one, e.g. Google, with the same email. Top tier is having the accounts seamlessly merged, ideally with a notification along those lines. My favorite was getting an error because I was using a different service, but not telling me what that service was, and it somehow broke the login such that I had to restart the browser to be able to sign in.
- sk0g 4y ago
  The Epic Games launcher has a bizarre behaviour here. If you first sign in with your Xbox account, you can later sign in with the credentials of your Xbox account (email and password), as a 'native' account. I'm not sure what's shared, but that process made me uncomfortable. My hope is it's a password hash or they forward the sign in request to MS servers, but who knows.
- account42 4y ago
  > Top tier is having the accounts seamlessly merged Uhm, not without requiring you to log in with the other auth as well - otherwise your account security is as weak as the weakest supported auth instead of the just weakest auth you added.
- dns_snek 4y ago
  Disagree, I don't think accounts should be automatically merged under any circumstances. It's definitely not expected behavior for me as a user and as mentioned in a sibling comment, it would negatively affect security. If the service notices that an account with the same email already exists, you may ask me to login with the original provider again to link the accounts, and indeed, this would probably be my favorite solution. Second best would be to just create a second account without complaining. Playing fast and loose with authentication processes in the way you're describing is a guaranteed way to lose me as a customer if your service handles any valuable personal/confidential information. What if tomorrow a vulnerability is discovered where, say, Facebook provides the new unverified email address rather than the previous verified address during the OAuth login flow? It would immediately result in an arbitrary account takeover on your website. There are so many possible edge cases with this setup and the surface area increases with each new auth provider.

pc86 4y ago

One of my litmus tests for whether a technical team knows what the hell they're doing is what happens when you sign up for a service with one 3rd party auth (e.g. Facebook) then try to sign in with another one, e.g. Google, with the same email. Top tier is having the accounts seamlessly merged, ideally with a notification along those lines. My favorite was getting an error because I was using a different service, but not telling me what that service was, and it somehow broke the login such that I had to restart the browser to be able to sign in.

sk0g 4y ago
The Epic Games launcher has a bizarre behaviour here. If you first sign in with your Xbox account, you can later sign in with the credentials of your Xbox account (email and password), as a 'native' account. I'm not sure what's shared, but that process made me uncomfortable. My hope is it's a password hash or they forward the sign in request to MS servers, but who knows.
account42 4y ago
> Top tier is having the accounts seamlessly merged Uhm, not without requiring you to log in with the other auth as well - otherwise your account security is as weak as the weakest supported auth instead of the just weakest auth you added.
dns_snek 4y ago
Disagree, I don't think accounts should be automatically merged under any circumstances. It's definitely not expected behavior for me as a user and as mentioned in a sibling comment, it would negatively affect security. If the service notices that an account with the same email already exists, you may ask me to login with the original provider again to link the accounts, and indeed, this would probably be my favorite solution. Second best would be to just create a second account without complaining. Playing fast and loose with authentication processes in the way you're describing is a guaranteed way to lose me as a customer if your service handles any valuable personal/confidential information. What if tomorrow a vulnerability is discovered where, say, Facebook provides the new unverified email address rather than the previous verified address during the OAuth login flow? It would immediately result in an arbitrary account takeover on your website. There are so many possible edge cases with this setup and the surface area increases with each new auth provider.