22 ms·

Users don't like social login

553 points by AndrewDucker 14y ago

hp50g 14y ago
To be honest I don't get to see social logins. Adblock and ghostery seem to put and end to them and my participation. And that's the way I like it :)
guan 14y ago
I don’t like social login, but I do like not having to create yet another account.
- LandoCalrissian 14y ago
  I would much rather make a new account with my e-mail than have anything linked to my Google/Facebook account. I'm really uncomfortable exposing other sites to that information.
- price 14y ago
  Indeed. The article doesn't make the context clear up front (perhaps because it's on a blog and partly aimed at people who already know what the blog is about), but the author and Mozilla have a solution to that problem that isn't "social". The post mentions it toward the end: "We built the Persona protocol to reduce data sharing to the minimum needed for the user to easily log in: the browser mediates the login without leaking data to the identity provider. In the end, Persona is the easy login solution that respects users." Ben is a smart guy, I've read about Persona, and it seems to be really well thought out and to have learned from the failings of e.g. OpenID. I intend to use it the next time I need an easy login solution for users.
- jdechko 14y ago
  I don't like social login because I'm not on any social networks. It could be a great service, but as soon as I see that it's Facebook/Twitter/G+ only, I'm out.
- ersii 14y ago
  That's what I like with Persona, since I've made my personal domain a Identity Provider. I just log on and click okay to authenticate. Not tied into Google/Yahoo/Facebook/MyLittlePonySocial - but not having to create a new account. Oh, and I own the data (Not the AppData of course though).
jpdevereaux 14y ago
While I'd like to agree, I'd also like to see something beyond anecdotal evidence on this. It'd give me a great excuse next time someone wants a Facebook login and a Twitter login and a Pinterest login [sic] on the same site.
- arindone 14y ago
  100% agreed -- anecdotal blog posts should not be up-voted to oblivion simply because the community at HN agrees with them. (Though I find it ironic that such a technical community doesn't consider lack of data in arguments like these an issue.)
jdlshore 14y ago
In case you're not familiar with them, this blog comes from the Mozilla Identity team, which is creating a unified login product called "Persona." It's basically the features of social login (you don't have to create a new account for every site) without the drawbacks (an advertising-driven company knowing your every login). I use Persona on my costs-real-money subscription site[1] and I'm very happy with it. Integration was easy, the user experience is pretty good, and it's been stable and reliable. The best thing, of course, was not having to implement my own password-management infrastructure, which saved me a ton of time, as well as insulating me from the hard security problems that come along with such a beast. If you decide to try Persona, I heartily recommend it. There are a couple of gotchas to be aware of: 1- On iOS, only Safari works due to Persona using a pop-up window for login. People using Chrome on iOS will get a confusing "relay frame not found" error. 2- Signup flow could be better. When users create an account, they get a confirmation email. Clicking the link in that confirmation email redirects them to the Persona site, not back to your site. It's possible this is configurable and I haven't figured it out yet. 3- Persona emails are case-sensitive. There's some rare issues that occur as a result. At one point, it could crash the login, but I believe that's been fixed. Don't let these flaws stop you, though--Persona is very well done and constantly getting better. I've had hundreds of people sign up for paid accounts and only two have had trouble to the point of asking for help. (And nobody's cancelled their subscription because of login problems. :-) ) [1] Let's Code Test-Driven JavaScript, letscodejavascript.com
- judofyr 14y ago
  Re: your second point: https://developer.mozilla.org/en-US/docs/DOM/navigator.id.request https://developer.mozilla.org/en-US/docs/DOM/navigator.id.re... > returnTo: Absolute path to send new users to after they've completed email verification for the first time. The path must begin with '/'. This parameter only affects users who are certified by Mozilla's fallback Identity Provider.
  - zimbatm 14y ago
    I wonder how confusing for the user it is to subscribe to site A and receive a confirmation email from Person instead of that site.
uribs 14y ago
Yes, actually we don't want ANY login/registration. Just put auth info in a cookie, and let the user associate it with an e-mail address later, once he actually knows he will keep using the service. I believe "I can't be arsed to register" is one of the top reasons websites lose prospective users.
- yebyen 14y ago
  I learned today that StackOverflow (and company) have responsive support persons who respond via e-mail, that will help you recover and merge your cookie-based StackExchange accounts if you've lost access and there is sufficient evidence that they belong to you. (I thought I had registered the account under the myid.net provider (who is now defunct?) but no.) That has to cost a lot of money. With the dozens of ways you can authenticate with StackExchange, I don't know why I was surprised to learn I had previously created an account without actually creating an account, but it was so. Also, anyone who reads Korean can tell me if this says "sorry we're closed"? http://kingdon.myid.net http://kingdon.myid.net
  - rogerbinns 14y ago
    What is infuriating about the stackoverflow sites is that they treat each site separately so you end up with multiple logins across the "network" that you really don't care about. Then they do that annoying thing where they display the page, then detect you are "logged in", and then tell you to refresh.
    - k3n 14y ago
      That site is very good at Q&A, but UX wise it's terrible. It's as if they've only ever tested it with their own devs, and never done any real hallway or external usability testing. I've tried to participate in their "meta" site, but the pedantic and condescending tone there is even worse than it is on the main sites.
      - presidentender 14y ago
nicksergeant 14y ago
Technical people don't like social login. Real people (non-tech / nerd) prefer not having to create individual accounts for all sorts of different services. I've seen proof of this time and time again.
- patja 14y ago
  Tangentially related, for similar reasons Paypal remains my payment processor. Lots of people have Paypal accounts and find it much more convenient to use it rather than haul out their credit card and hand key all of their address and payment info. Every time I think about switching I review how many people use PayPal Express checkout rather than credit card DirectPay (both of which I offer), and I think about how many people simply wouldn't pay if the minimal friction of the PayPal Express button wasn't there on my checkout form. Lowest friction wins.
  - wingspan 14y ago
    Totally agree! Because I am not the biggest fan of PayPal, one of the best things I did to speed up ecommerce for myself was to memorize my CC details.
    - tempestn 14y ago
      I have recently been converted to the joy of filling in credit card details (and address and phone number and...) with LastPass' form fill function. I previously had my CC details memorized for similar reasons, but I didn't realize just how much time I was wasting typing this stuff in over and over until it was magically done for me. And since security is what LastPass does, I have no problem with having their extension save my CC info in a secure manner.
      - wingspan 14y ago
        I am an avid LastPass user and I already have my CC details in LastPass. But, until now I didn't realize you can add them to the Form Fill details! Thank you tempestn!
goronbjorn 14y ago
Mailchimp had similar findings, albeit coming from a different angle: http://blog.mailchimp.com/social-login-buttons-arent-worth-it/ http://blog.mailchimp.com/social-login-buttons-arent-worth-i...
yesimahuman 14y ago
I think adding social auth was one of the biggest mistakes we made for the beta of Jetstrap. Users constantly forget which service they use. We added email/pass authentication, but now older users think they had a password when they didn't, and with django social auth you can't reset the password for a social account. It was one big mess not at all worth it. I'd like to try Persona and see how that compares, but I think normal email/pass is better than plain social auth.
- snaky 14y ago
  Why don't put the way the user was logged in by last time in cookie and just highlight it next time for him? Or even more explicit - add the "you have logged in this way last time" under the appropriate button? Technically that's easy to implement.
  - tempestn 14y ago
    If a user returns relatively quickly they generally remember how they logged in. The problem is when they come back after some months. At that point, they've probably completely forgotten how they logged in, and have cleared their cookies for some reason or another. It's a standard troubleshooting suggested by many websites. (Not saying it should be so, but it is.)
  - yesimahuman 14y ago
    That's an okay solution in the short term. Long-term though it doesn't seem to solve the problem.
biznickman 14y ago
Users always complain about social logins. On iOS apps that I've built, I've found Facebook login to have something like a 50% conversion. I'd be curious to hear whether or not the conversion is improved by using Mozilla's Persona product. Is the only sales pitch here that the login is managed by a non-profit organization? Not sure how that makes this a better product overall. Can anybody clarify?
- callahad 14y ago
  Major difference: Social auth outsources your user table. Persona outsources your password column. You still have your own users, and you still have a portable identifier for them. What's more, Persona is built as a fully-decentralized architecture with a temporary centralized fallback. That means that one button can support all users, via their email provider's native authentication mechanisms (in the future) or via Mozilla's centralized fallback (for now).
  - biznickman 14y ago
    That answers that!
  - dasil003 14y ago
    I don't understand your first point. How can you have an app function without a users table? The main issue as I see it is just the baggage that comes with a private company login. For instance, Facebook login raises questions about what Facebook will do with the login information, and also what the site will try to do with your Facebook data and permissions. Those questions will increasingly become a concern for everyone, but beyond that some people have opted completely out of Facebook because they find it actively harmful and so they are excluded a priori. Persona is simply a login mechanism with the users interest in mind. People may take or it leave it, but it will be on its own merits rather than being overshadowed by needlessly related general concerns with a third-party product.
callahad 14y ago
Hi, I'm on the Persona team at Mozilla. If you'd like to learn more about what and why Mozilla is doing with authentication, I gave a 45-minute talk at PyCon US this past Saturday. You can find the video here: http://pyvideo.org/video/1764 http://pyvideo.org/video/1764 I'm also happy to answer questions in-thread or via email.
- jamesaguilar 14y ago
  My main question is: where is the support for the assertion made in the article title? As far as I can tell, it's just made, and then the remainder of the article treats it as a premise or a claim to be supported only with vague anecdotes. The proliferation of sites that only or primarily accept social logins seem to suggest that it's not a sound premise. However, I'd be interested to know if you guys have some data that's not shared in the article that suggests it is.
  - callahad 14y ago
    Hopefully someone else will chime in with actual citations, but we've seen a preponderance of evidence from our own user studies, from MailChimp, TechCrunch, and Voo.st's published comments, from Gawker Media's creation of an in-house non-social mechanism shortly after they tried to go social-only, and from private conversations with companies who have daily active user counts well into the millions. > The proliferation of sites that only or primarily accept social logins seem to suggest that it's not a sound premise. I'm not sure that necessarily follows. Google's own advertising for G+ authentication touts its privacy features, which suggests that Google also believes that users are uncomfortable with social auth as it exists today. (Anecdotes aren't data, but they're what I have on hand at the moment. Sorry! Still at PyCon.)
    - jamesaguilar 14y ago
      All right. Thanks for this. Best of luck with your talk. I was nervous the last time I gave one and my audience was much smaller than yours will be. ;)
bozho 14y ago
And here's my How-To for adding Persona authentication to your site: http://techblog.bozho.net/?p=1056 http://techblog.bozho.net/?p=1056
- callahad 14y ago
  Thanks for that post! Do you have any suggestions for how the official documentation (https://developer.mozilla.org/en-US/docs/Persona/Quick_Setup https://developer.mozilla.org/en-US/docs/Persona/Quick_Setup) could be improved?
  - bozho 14y ago
    Hi. I have to confess I neglected my promise to contribute to the official documentation, but I haven't found the time..
fakeer 14y ago
I actually do not login to website that asks me login either using Google a/c, Facebook or so. Twitter being an exception because everything at Twitter I've anyway made public, but I hesitate still.
- paranoiacblack 14y ago
  That's a strange opinion to have though, because before doing login through either of these services, you will be asked if you want to give that app permission to certain parts of your account. For example, I might have you log in through Google to verify your email and I don't see a reason why you wouldn't let me see it; you've already shared your email with my app to register an account in the first place.
  - fakeer 14y ago
    I should have been clearer. Most of the website, do not just ask Email. Most ask other info too, like my DOB, full name, Other Profile information. And when I say I "do not use", I am talking about the first time logins of course. I don't really know what kind of a website it is, legit or just a vapour. And I do not know in advance what information it will ask. Take the example of The Old Reader, till recently they wanted to take control of your Contacts too(along with Reader; now they don't). I knew it once I was at past the Google SigIn page(and I aborted right there). It was frustrating even for those few seconds. Many do this. So, I have given up on them altogether. I mean I have OpenID accounts set up especially for this with the data I would like to provide for this. There Mozilla's Persona(it's Identity Management System)- etc. Why not use these? And do not even get me started on Facebook. I don't open a website again if the only way to login was via Facebook. Paranoid? No, rather pissed off. (By the way, whenever I tried using Facebook logins the above mentioned problems surfaced only in bigger multitude).
    - mynameisvlad 14y ago
      Because everyone has Google, and the lowest setting on Sign in with Google+ contains some personal information from your account, including things like DoB, Full name, etc. Google recommends OAuth2 over OpenID for authentication, and I'd rather be using the service Google supports the most in order to provide the best experience to users. Just because you use OpenID and Persona doesn't mean that the majority of people will. But the majority of people will have a Gmail account, or a Facebook account.
AznHisoka 14y ago
There's an "evil" incentive to have social logins such as Twitter + FB. It gives you a free access token, which can be extremely useful, especially if you're building a social media analytics service, or some sort of tool that requires making API calls.
janus 14y ago
The worst offenders are sites that lead you into logging in with a social account and then ask you to add your email and create a password anyway.
- davidroberts 14y ago
  The worst offenders are those that lead you into a social login, then post every page you view on your facebook wall. I've learned some fascinating things about my friends' reading tastes this way, but I'm sure they weren't happy about it.
- anoncow 14y ago
  Some use social login as an alternative to valid email id testing(atleast i do). Saves money when your outbound email is quota restricted (appengine).
  - paranoiacblack 14y ago
    Yes, I do this exact same thing. I really don't want to store password on my side and I'm of the impression that sites like Google, Facebook, and Twitter do this better than I ever will and that most of the users visiting the site will have some kind of account on these sites. Ignoring man-in-the-middle attacks, if one of the above thinks the email is valid, I have no reason not to. As a disclaimer, though, I've worked on highly specialized apps where the users belong to a certain organization bound by one of the above. For example, I made a website for my school and every student there has an email address that is tied to that school's Google Apps for Edu account, so I'm guaranteed that all valid users (students) will be able to log in via Google.
- jbigelow76 14y ago
  I whole heartedly agree with this. Any site that tries that I immediately stop creating the account.
IheartApplesDix 14y ago
As hard as remembering different passwords for different sites is for the end user, I really think it's about time the user took a step toward meeting security and engineers in the middle. Did 20th century humans think key rings were too complicated? Why are we implementing tokenization, one way hashing, etc. when the end customer can do this much more securely? Oh yeah, we'd like to get at their data when they're not around..
- martinced 14y ago
  Exactly. But sadly you're in a tiny minority of people thinking about the security implications. Most developers don't: which is why we're having countless OAuth exploits and whatnots. Schneier wrote a long time that anything too complex cannot ever be secure. That's the case of OAuth and of many federated/unique/single sign-on logins.
nijiko 14y ago
I seriously thought this was going to be an interesting article instead I read a post touting their new login button.
mikec3k 14y ago
I prefer logging in with Facebook or Twitter rather than having to remember yet another login. You can always revoke access later.
breck 14y ago
We just implemented Persona across all our sites and are very happy with it. We did it in a way that's completely independent of our normal email/password login as well, but integrates seamlessly. That made me really happy, as the reliability of our system hasn't decreased a bit. The Persona team was also really helpful, though it turned out we didn't need much help implementing it.
IheartApplesDix 14y ago
I doubt users really care about what type of login they use. Instead, users are starting to associate social logins with spammy bullshit, federated identity marketed shitfest of Web 3.0, built on the SAML/HTML5-based Intelectual Property and right forfeiture platform.
switch33 14y ago
Surprisingly companies are finally realizing this. Like companies really thought people would not care to give away all their 'social' unneeded information for some random x or y service.
anonfunction 14y ago
The point about having multiple providers and forgetting which one you used rang true to me. My gotos are twitter, google, or github and it seems I change based on the type of app I'm connecting with.
harryh 14y ago
Claiming what users like or do not like without metrics is deeply suspicious.
mixmastamyk 14y ago
In case anyone was wondering (like I was), Mozilla Persona is built on BrowserID introduced last year.
neilkumar 14y ago
With regards to the last point - privacy from your identity provider -- isn't that somewhat moot for most sites as they have those facebook/twitter/google+/etc share/like/plus icons that report back anyways.
shmerl 14y ago
I wish more sites would start using Persona, instead of privacy disrespecting FB or G+ login helpers. Even OpenID isn't as widely used as it could be.
FuzzyDunlop 14y ago
> We also noticed that users dislike the NASCAR-style > plastering of branded login buttons. This reminds me quite vividly of Stack Overflow's login page. I can never remember if I signed up direct, with OpenID, or Google, or whatever else is there. I've been starting to dig Mozilla and Firefox again lately (the last week of developer tools news cemented that), so I'd love to see their idea take off and gain full adoption.
- callahad 14y ago
  Thanks! You can help it take off: try Persona out and let me know about your experience. Persona can't be the right solution without outside voices to help shape it. Of course, if you think Mozilla is on the right track, ask a site you use to support Persona. :)
- larsberg 14y ago
  I rely on LastPass for confusing sites like that one. If it weren't for that addon, I'd never know, for example, which of the 7 or so Windows Live accounts that have been generated on my behalf is The Right One for which website.
  - nonamegiven 14y ago
    I merely bought and installed an xbox 360, and now I have a small number of windows live or hotmail or xbox accounts, I haven no idea which are distinct accounts and which are linked in some way. Ptthht, ptthht. Trying to cancel the auto re-up of their gold account was a nightmare of circular hate. Ptthht.
- archagon 14y ago
  I usually hate social logins, but I actually like the way SO does it because you can bind your account to multiple services. Now I no longer have to remember which specific one I picked.
  - tracker1 14y ago
    Ditto.. I also really appreciate it when you are writing a comment for a blog you crossed in a search. Never been to X site before, likely won't be back.. but like to comment when an article's content is dated, or no longer relevant. Sometimes that gets harder than others.
dochtman 14y ago
If you want to run your own Persona Identity Provider (so you can login directly with your own email account and control the authentication from your own domain/site/server instead of having to remember yet another password for the fallback Identity Provider provided by persona.org), here's a tiny little piece of Python code that implements that: https://bitbucket.org/djc/persona-totp https://bitbucket.org/djc/persona-totp In particular, the authentication method I use is Google Authenticator-compatible TOTP (RFC 6238).
- StavrosK 14y ago
  That's fantastic, thank you! You just showed me simple examples of at least two technologies I considered complicated to implement.
daredevildave 14y ago
This is exactly what I said to Ben when we implemented Persona at PlayCanvas. Social logins might be OK if you are making a photo-sharing app or a social newsreader, but if your business relies on _companies_ signing up, my suspicion is people won't be comfortable signing up with their Facebook account. We wanted the benefits of a secure login system without all the social baggage. Persona provides that. Though we also support Google OpenID as lots of people already have a GMail or Google Apps account. As an aside, I won't sign up for _anything_ using Facebook, I simply don't trust them or the app not to broadcast my every move to people.
jvandenbroeck 14y ago
Bold claims without any evidence backing it up.
- malbiniak 14y ago
  I'm glad to see I'm not alone. I had high hopes of seeing data and research (no offense, TechCrunch) to support this claim. I'm in the camp of not liking social authentication, especially when it's the only option, but I'm also a sample set of 1.
SeanDav 14y ago
I agree very much with this. What I do is use "dummy" facebook, google, email etc accounts to log into sites that either require social logins or make it easy to try with social logins, but that I don't trust yet. I am generally suspicious of sites that require or "encourage" logins with social details.
lukeh 14y ago
We (PADL) have developed a SASL/GSS mechanism for Persona, which you can get here: https://github.com/PADL/gss_browserid https://github.com/PADL/gss_browserid Internet Draft here: http://tools.ietf.org/html/draft-howard-gss-browserid-00 http://tools.ietf.org/html/draft-howard-gss-browserid-00 This lets you use Persona to authenticate to non-web services such as IMAP, SMTP, SSH, NFS, CIFS, etc. We (or should I say, I) are pretty excited about it!
- StavrosK 14y ago
  Hey, that looks very interesting! I hope it goes places.
lnanek2 14y ago
It would be nice to see actual user studies rather than quoting TechCrunch. Tech journalists are not everyone's target market.
recurser 14y ago
Just a random data point, but one of my apps with a definite non-technical demographic gets 97% of logins via facebook, 2.5% via twitter, and 0.5% via email/password registration. I haven't tested it obviously, but I don't think removing Facebook login would do much for conversions.
jsp78 14y ago
Is there an option to not provide my email as part of the "identity" because I could see that being a barrier to signing up for some sites?
- callahad 14y ago
  You must provide an email address, but you're free to use disposable or other addresses.
Aissen 14y ago
Meanwhile, the Persona vs Personas mess is not fixed yet: http://www.getpersonas.com/ http://www.getpersonas.com/ https://persona.org https://persona.org Context: Personas should have been renamed to "Themes". But apparently it's not done yet.
lubujackson 14y ago
I love the concept of Persona and hopes it catches on. One question I can't seem to find the answer to, though. Users are allowed to have multiple emails tied to one Persona account. If they login to my site with one email I will see that email address and can bind their account data to it. If they sign in with their other email address, will I be able to identify them as the same person?
- saurik 14y ago
  Alternatively, what happens when someone graduates, changes ISPs, a domain name expires, or they get a new job, and someone later takes control of their email address? As concrete example, if you attend UCSB, you can easily get them to give you saurik@ right now on various of their servers I used to use for vaguely-official UCSB uses. The problem with Persona is that they simply don't seem to understand that for real people, email addresses are just a convenience, not a canonical way to maintain identity. They also fail to see that even people like myself, who have carefully tended an email address for well over a decade, are not immune to this problem. I have previously commented on this here: https://news.ycombinator.com/item?id=4233391 https://news.ycombinator.com/item?id=4233391
  - sergiosgc 14y ago
    What is the alternative, then? That's the million dollar question. Even phone numbers, which have a large personal switching cost are ephemeral for many people. SSNs or other government mandated IDs are not acceptable. I see no better alternative.
    - saurik 14y ago
      First, you seem to have immediately disciunted standard usernames, which have flaws, but are not "fundentally flawed". Second, you seem to assume that the primary key has to be something the user even knows; I do not. My Facebook account has a number: that number will never change, no matter what I do to my email addresses or even if my Facebook username changes; that number, and that number alone, defines my account. I will be honest and say I actually did have that number memorized a long time ago, but for years now I have not known it, nor would 99.999% of Facebook users. The same is true of Google's account infrastructure (which even has much much longer numbers). When you use OpenID, you get back an opaque string, which can be arbitrarily complex and encode whatever is required by the federated identity provider. There simply are not fixed identity nodes for people: you have to make them.
vxNsr 14y ago
Relevant XKCD: http://xkcd.com/927/ http://xkcd.com/927/
adrianhoward 14y ago
"Users don’t like social login" should actually read "Some people don't like social login in some contexts - other people like it, or even prefer it, in others". At least that's what I've seen in user testing... but that's not as interesting I guess.
meerita 14y ago
I'm 1Password user. I dont' have to trouble anymore with logins nor selling my ID to Facebook, Twitter or Google. I only use social on those apps where the owners think you only need Twitter/Facebook as the option to use their apps.
StavrosK 14y ago
To see an example of Persona, you can visit http://www.yourpane.com http://www.yourpane.com and click the "Persona" button (don't enter an email address).
k_bx 14y ago
Biggest problem with social login for me is that I have all of them (google, twitter, facebook etc.), and sometimes multiple (google, twitter).
hawkw 14y ago
This just in: users don't like social login, water is wet, sky blue..
muratmutlu 14y ago
"Lesson 2: Social Sign-in is Better Than Email Sign-in After dozens of failed A/B tests to improve the conversion rates of our landing page, we came up with the idea to enable social sign-in (i.e., signing up for a Buffer account and logging in using your Twitter, Facebook or LinkedIn account). After all, Buffer is for posting on Twitter, Facebook and LinkedIn so it only seemed logical that our potential users would be able to quickly and conveniently sign up using one of their existing accounts." http://sixrevisions.com/user-interface/ux-design-mistakes/ http://sixrevisions.com/user-interface/ux-design-mistakes/
martinced 14y ago
The biggest problem with "social login" ain't about advertizing companies like FB and Google having all your infos. The biggest problem has actually nothing to do with social: the problem is security of all these single-sign on / unique ID. We're in 2013 and hardly a day goes by without a major security exploit found affecting Rails, Java, OAuth, Flash, etc. There are so many botnets out there that sites we rely upon for our daily workflow are getting taken down (GitHub)... Yet people don't talk about security. They don't even mention it. Not in the TFA. Not in this thread (besides two insightful comments). As long as people will keep thinking that they can put all their eggs in one basket online and "really really have this basket by hyper-secure" we're gonna be in big trouble. It doesn't help that several people on HN are selling snake-oils products "put all your passwords in this unbreakable app, we guarantee you nothing bad could ever happen".
- callahad 14y ago
  > As long as people will keep thinking that they can put all their eggs in one basket online and "really really have this basket by hyper-secure" we're gonna be in big trouble. That's why Persona is based on a federated protocol: it's designed to spread your eggs across many baskets, and it even lets individuals bring their own basket.
drdaeman 14y ago
I really hate when my identity is provided to me by some third party. It universally applies to both social networks and Persona. I don't like the very idea of leasing my own identity. This said, I really wish Persona project will fail as much as possible. I only hope there'll be a day I'll finally truly possess my own network identities, and third parties (social networks, email providers, etc) will act as notaries who just assert them for others to verify.
- TheCoelacanth 14y ago
  > I only hope there'll be a day I'll finally truly possess my own network identities, and third parties (social networks, email providers, etc) will act as notaries who just assert them for others to verify. If you have your own domain name, that's exactly what Persona does. The protocol is completely decentralized. Mozilla only provides a fallback for domains that don't support Persona.
  - drdaeman 14y ago
    I believe domain names are still inappropriate for identities. Even XRI i-numbers was a better idea. One just can't own a domain name. It only can be leased for a limited time, for a price, and even then, at least in some TLDs one can't be sure the lease won't be revoked at someone's whim. There's no real difference whenever one leases email address from a provider or domain name from a registrar. Maybe I'm overzealous about it, but I really wish to be the source of my own identity and posess it like I posess my GPG key.

553 points by AndrewDucker 14y ago

hp50g 14y ago

To be honest I don't get to see social logins. Adblock and ghostery seem to put and end to them and my participation. And that's the way I like it :)

guan 14y ago

I don’t like social login, but I do like not having to create yet another account.

LandoCalrissian 14y ago
I would much rather make a new account with my e-mail than have anything linked to my Google/Facebook account. I'm really uncomfortable exposing other sites to that information.
price 14y ago
Indeed. The article doesn't make the context clear up front (perhaps because it's on a blog and partly aimed at people who already know what the blog is about), but the author and Mozilla have a solution to that problem that isn't "social". The post mentions it toward the end: "We built the Persona protocol to reduce data sharing to the minimum needed for the user to easily log in: the browser mediates the login without leaking data to the identity provider. In the end, Persona is the easy login solution that respects users." Ben is a smart guy, I've read about Persona, and it seems to be really well thought out and to have learned from the failings of e.g. OpenID. I intend to use it the next time I need an easy login solution for users.
jdechko 14y ago
I don't like social login because I'm not on any social networks. It could be a great service, but as soon as I see that it's Facebook/Twitter/G+ only, I'm out.
ersii 14y ago
That's what I like with Persona, since I've made my personal domain a Identity Provider. I just log on and click okay to authenticate. Not tied into Google/Yahoo/Facebook/MyLittlePonySocial - but not having to create a new account. Oh, and I own the data (Not the AppData of course though).

jpdevereaux 14y ago

While I'd like to agree, I'd also like to see something beyond anecdotal evidence on this. It'd give me a great excuse next time someone wants a Facebook login and a Twitter login and a Pinterest login [sic] on the same site.

arindone 14y ago
100% agreed -- anecdotal blog posts should not be up-voted to oblivion simply because the community at HN agrees with them. (Though I find it ironic that such a technical community doesn't consider lack of data in arguments like these an issue.)

jdlshore 14y ago

In case you're not familiar with them, this blog comes from the Mozilla Identity team, which is creating a unified login product called "Persona." It's basically the features of social login (you don't have to create a new account for every site) without the drawbacks (an advertising-driven company knowing your every login). I use Persona on my costs-real-money subscription site[1] and I'm very happy with it. Integration was easy, the user experience is pretty good, and it's been stable and reliable. The best thing, of course, was not having to implement my own password-management infrastructure, which saved me a ton of time, as well as insulating me from the hard security problems that come along with such a beast. If you decide to try Persona, I heartily recommend it. There are a couple of gotchas to be aware of: 1- On iOS, only Safari works due to Persona using a pop-up window for login. People using Chrome on iOS will get a confusing "relay frame not found" error. 2- Signup flow could be better. When users create an account, they get a confirmation email. Clicking the link in that confirmation email redirects them to the Persona site, not back to your site. It's possible this is configurable and I haven't figured it out yet. 3- Persona emails are case-sensitive. There's some rare issues that occur as a result. At one point, it could crash the login, but I believe that's been fixed. Don't let these flaws stop you, though--Persona is very well done and constantly getting better. I've had hundreds of people sign up for paid accounts and only two have had trouble to the point of asking for help. (And nobody's cancelled their subscription because of login problems. :-) ) [1] Let's Code Test-Driven JavaScript, letscodejavascript.com

judofyr 14y ago
Re: your second point: https://developer.mozilla.org/en-US/docs/DOM/navigator.id.request https://developer.mozilla.org/en-US/docs/DOM/navigator.id.re... > returnTo: Absolute path to send new users to after they've completed email verification for the first time. The path must begin with '/'. This parameter only affects users who are certified by Mozilla's fallback Identity Provider.
- zimbatm 14y ago
  I wonder how confusing for the user it is to subscribe to site A and receive a confirmation email from Person instead of that site.

uribs 14y ago

Yes, actually we don't want ANY login/registration. Just put auth info in a cookie, and let the user associate it with an e-mail address later, once he actually knows he will keep using the service. I believe "I can't be arsed to register" is one of the top reasons websites lose prospective users.

yebyen 14y ago
I learned today that StackOverflow (and company) have responsive support persons who respond via e-mail, that will help you recover and merge your cookie-based StackExchange accounts if you've lost access and there is sufficient evidence that they belong to you. (I thought I had registered the account under the myid.net provider (who is now defunct?) but no.) That has to cost a lot of money. With the dozens of ways you can authenticate with StackExchange, I don't know why I was surprised to learn I had previously created an account without actually creating an account, but it was so. Also, anyone who reads Korean can tell me if this says "sorry we're closed"? http://kingdon.myid.net http://kingdon.myid.net
- rogerbinns 14y ago
  What is infuriating about the stackoverflow sites is that they treat each site separately so you end up with multiple logins across the "network" that you really don't care about. Then they do that annoying thing where they display the page, then detect you are "logged in", and then tell you to refresh.
  - k3n 14y ago
    That site is very good at Q&A, but UX wise it's terrible. It's as if they've only ever tested it with their own devs, and never done any real hallway or external usability testing. I've tried to participate in their "meta" site, but the pedantic and condescending tone there is even worse than it is on the main sites.
    - presidentender 14y ago

nicksergeant 14y ago

Technical people don't like social login. Real people (non-tech / nerd) prefer not having to create individual accounts for all sorts of different services. I've seen proof of this time and time again.

patja 14y ago
Tangentially related, for similar reasons Paypal remains my payment processor. Lots of people have Paypal accounts and find it much more convenient to use it rather than haul out their credit card and hand key all of their address and payment info. Every time I think about switching I review how many people use PayPal Express checkout rather than credit card DirectPay (both of which I offer), and I think about how many people simply wouldn't pay if the minimal friction of the PayPal Express button wasn't there on my checkout form. Lowest friction wins.
- wingspan 14y ago
  Totally agree! Because I am not the biggest fan of PayPal, one of the best things I did to speed up ecommerce for myself was to memorize my CC details.
  - tempestn 14y ago
    I have recently been converted to the joy of filling in credit card details (and address and phone number and...) with LastPass' form fill function. I previously had my CC details memorized for similar reasons, but I didn't realize just how much time I was wasting typing this stuff in over and over until it was magically done for me. And since security is what LastPass does, I have no problem with having their extension save my CC info in a secure manner.
    - wingspan 14y ago
      I am an avid LastPass user and I already have my CC details in LastPass. But, until now I didn't realize you can add them to the Form Fill details! Thank you tempestn!

goronbjorn 14y ago

Mailchimp had similar findings, albeit coming from a different angle: http://blog.mailchimp.com/social-login-buttons-arent-worth-it/ http://blog.mailchimp.com/social-login-buttons-arent-worth-i...

yesimahuman 14y ago

I think adding social auth was one of the biggest mistakes we made for the beta of Jetstrap. Users constantly forget which service they use. We added email/pass authentication, but now older users think they had a password when they didn't, and with django social auth you can't reset the password for a social account. It was one big mess not at all worth it. I'd like to try Persona and see how that compares, but I think normal email/pass is better than plain social auth.

snaky 14y ago
Why don't put the way the user was logged in by last time in cookie and just highlight it next time for him? Or even more explicit - add the "you have logged in this way last time" under the appropriate button? Technically that's easy to implement.
- tempestn 14y ago
  If a user returns relatively quickly they generally remember how they logged in. The problem is when they come back after some months. At that point, they've probably completely forgotten how they logged in, and have cleared their cookies for some reason or another. It's a standard troubleshooting suggested by many websites. (Not saying it should be so, but it is.)
- yesimahuman 14y ago
  That's an okay solution in the short term. Long-term though it doesn't seem to solve the problem.

biznickman 14y ago

Users always complain about social logins. On iOS apps that I've built, I've found Facebook login to have something like a 50% conversion. I'd be curious to hear whether or not the conversion is improved by using Mozilla's Persona product. Is the only sales pitch here that the login is managed by a non-profit organization? Not sure how that makes this a better product overall. Can anybody clarify?

callahad 14y ago
Major difference: Social auth outsources your user table. Persona outsources your password column. You still have your own users, and you still have a portable identifier for them. What's more, Persona is built as a fully-decentralized architecture with a temporary centralized fallback. That means that one button can support all users, via their email provider's native authentication mechanisms (in the future) or via Mozilla's centralized fallback (for now).
- biznickman 14y ago
  That answers that!
- dasil003 14y ago
  I don't understand your first point. How can you have an app function without a users table? The main issue as I see it is just the baggage that comes with a private company login. For instance, Facebook login raises questions about what Facebook will do with the login information, and also what the site will try to do with your Facebook data and permissions. Those questions will increasingly become a concern for everyone, but beyond that some people have opted completely out of Facebook because they find it actively harmful and so they are excluded a priori. Persona is simply a login mechanism with the users interest in mind. People may take or it leave it, but it will be on its own merits rather than being overshadowed by needlessly related general concerns with a third-party product.

callahad 14y ago

Hi, I'm on the Persona team at Mozilla. If you'd like to learn more about what and why Mozilla is doing with authentication, I gave a 45-minute talk at PyCon US this past Saturday. You can find the video here: http://pyvideo.org/video/1764 http://pyvideo.org/video/1764 I'm also happy to answer questions in-thread or via email.

jamesaguilar 14y ago
My main question is: where is the support for the assertion made in the article title? As far as I can tell, it's just made, and then the remainder of the article treats it as a premise or a claim to be supported only with vague anecdotes. The proliferation of sites that only or primarily accept social logins seem to suggest that it's not a sound premise. However, I'd be interested to know if you guys have some data that's not shared in the article that suggests it is.
- callahad 14y ago
  Hopefully someone else will chime in with actual citations, but we've seen a preponderance of evidence from our own user studies, from MailChimp, TechCrunch, and Voo.st's published comments, from Gawker Media's creation of an in-house non-social mechanism shortly after they tried to go social-only, and from private conversations with companies who have daily active user counts well into the millions. > The proliferation of sites that only or primarily accept social logins seem to suggest that it's not a sound premise. I'm not sure that necessarily follows. Google's own advertising for G+ authentication touts its privacy features, which suggests that Google also believes that users are uncomfortable with social auth as it exists today. (Anecdotes aren't data, but they're what I have on hand at the moment. Sorry! Still at PyCon.)
  - jamesaguilar 14y ago
    All right. Thanks for this. Best of luck with your talk. I was nervous the last time I gave one and my audience was much smaller than yours will be. ;)

bozho 14y ago

And here's my How-To for adding Persona authentication to your site: http://techblog.bozho.net/?p=1056 http://techblog.bozho.net/?p=1056

callahad 14y ago
Thanks for that post! Do you have any suggestions for how the official documentation (https://developer.mozilla.org/en-US/docs/Persona/Quick_Setup https://developer.mozilla.org/en-US/docs/Persona/Quick_Setup) could be improved?
- bozho 14y ago
  Hi. I have to confess I neglected my promise to contribute to the official documentation, but I haven't found the time..

fakeer 14y ago

I actually do not login to website that asks me login either using Google a/c, Facebook or so. Twitter being an exception because everything at Twitter I've anyway made public, but I hesitate still.

paranoiacblack 14y ago
That's a strange opinion to have though, because before doing login through either of these services, you will be asked if you want to give that app permission to certain parts of your account. For example, I might have you log in through Google to verify your email and I don't see a reason why you wouldn't let me see it; you've already shared your email with my app to register an account in the first place.
- fakeer 14y ago
  I should have been clearer. Most of the website, do not just ask Email. Most ask other info too, like my DOB, full name, Other Profile information. And when I say I "do not use", I am talking about the first time logins of course. I don't really know what kind of a website it is, legit or just a vapour. And I do not know in advance what information it will ask. Take the example of The Old Reader, till recently they wanted to take control of your Contacts too(along with Reader; now they don't). I knew it once I was at past the Google SigIn page(and I aborted right there). It was frustrating even for those few seconds. Many do this. So, I have given up on them altogether. I mean I have OpenID accounts set up especially for this with the data I would like to provide for this. There Mozilla's Persona(it's Identity Management System)- etc. Why not use these? And do not even get me started on Facebook. I don't open a website again if the only way to login was via Facebook. Paranoid? No, rather pissed off. (By the way, whenever I tried using Facebook logins the above mentioned problems surfaced only in bigger multitude).
  - mynameisvlad 14y ago
    Because everyone has Google, and the lowest setting on Sign in with Google+ contains some personal information from your account, including things like DoB, Full name, etc. Google recommends OAuth2 over OpenID for authentication, and I'd rather be using the service Google supports the most in order to provide the best experience to users. Just because you use OpenID and Persona doesn't mean that the majority of people will. But the majority of people will have a Gmail account, or a Facebook account.

AznHisoka 14y ago

There's an "evil" incentive to have social logins such as Twitter + FB. It gives you a free access token, which can be extremely useful, especially if you're building a social media analytics service, or some sort of tool that requires making API calls.

janus 14y ago

The worst offenders are sites that lead you into logging in with a social account and then ask you to add your email and create a password anyway.

davidroberts 14y ago
The worst offenders are those that lead you into a social login, then post every page you view on your facebook wall. I've learned some fascinating things about my friends' reading tastes this way, but I'm sure they weren't happy about it.
anoncow 14y ago
Some use social login as an alternative to valid email id testing(atleast i do). Saves money when your outbound email is quota restricted (appengine).
- paranoiacblack 14y ago
  Yes, I do this exact same thing. I really don't want to store password on my side and I'm of the impression that sites like Google, Facebook, and Twitter do this better than I ever will and that most of the users visiting the site will have some kind of account on these sites. Ignoring man-in-the-middle attacks, if one of the above thinks the email is valid, I have no reason not to. As a disclaimer, though, I've worked on highly specialized apps where the users belong to a certain organization bound by one of the above. For example, I made a website for my school and every student there has an email address that is tied to that school's Google Apps for Edu account, so I'm guaranteed that all valid users (students) will be able to log in via Google.
jbigelow76 14y ago
I whole heartedly agree with this. Any site that tries that I immediately stop creating the account.

IheartApplesDix 14y ago

As hard as remembering different passwords for different sites is for the end user, I really think it's about time the user took a step toward meeting security and engineers in the middle. Did 20th century humans think key rings were too complicated? Why are we implementing tokenization, one way hashing, etc. when the end customer can do this much more securely? Oh yeah, we'd like to get at their data when they're not around..

martinced 14y ago
Exactly. But sadly you're in a tiny minority of people thinking about the security implications. Most developers don't: which is why we're having countless OAuth exploits and whatnots. Schneier wrote a long time that anything too complex cannot ever be secure. That's the case of OAuth and of many federated/unique/single sign-on logins.

nijiko 14y ago

I seriously thought this was going to be an interesting article instead I read a post touting their new login button.

mikec3k 14y ago

I prefer logging in with Facebook or Twitter rather than having to remember yet another login. You can always revoke access later.

breck 14y ago

We just implemented Persona across all our sites and are very happy with it. We did it in a way that's completely independent of our normal email/password login as well, but integrates seamlessly. That made me really happy, as the reliability of our system hasn't decreased a bit. The Persona team was also really helpful, though it turned out we didn't need much help implementing it.

IheartApplesDix 14y ago

I doubt users really care about what type of login they use. Instead, users are starting to associate social logins with spammy bullshit, federated identity marketed shitfest of Web 3.0, built on the SAML/HTML5-based Intelectual Property and right forfeiture platform.

switch33 14y ago

Surprisingly companies are finally realizing this. Like companies really thought people would not care to give away all their 'social' unneeded information for some random x or y service.

anonfunction 14y ago

The point about having multiple providers and forgetting which one you used rang true to me. My gotos are twitter, google, or github and it seems I change based on the type of app I'm connecting with.

harryh 14y ago

Claiming what users like or do not like without metrics is deeply suspicious.

mixmastamyk 14y ago

In case anyone was wondering (like I was), Mozilla Persona is built on BrowserID introduced last year.

neilkumar 14y ago

With regards to the last point - privacy from your identity provider -- isn't that somewhat moot for most sites as they have those facebook/twitter/google+/etc share/like/plus icons that report back anyways.

shmerl 14y ago

I wish more sites would start using Persona, instead of privacy disrespecting FB or G+ login helpers. Even OpenID isn't as widely used as it could be.

FuzzyDunlop 14y ago

> We also noticed that users dislike the NASCAR-style > plastering of branded login buttons. This reminds me quite vividly of Stack Overflow's login page. I can never remember if I signed up direct, with OpenID, or Google, or whatever else is there. I've been starting to dig Mozilla and Firefox again lately (the last week of developer tools news cemented that), so I'd love to see their idea take off and gain full adoption.

callahad 14y ago
Thanks! You can help it take off: try Persona out and let me know about your experience. Persona can't be the right solution without outside voices to help shape it. Of course, if you think Mozilla is on the right track, ask a site you use to support Persona. :)
larsberg 14y ago
I rely on LastPass for confusing sites like that one. If it weren't for that addon, I'd never know, for example, which of the 7 or so Windows Live accounts that have been generated on my behalf is The Right One for which website.
- nonamegiven 14y ago
  I merely bought and installed an xbox 360, and now I have a small number of windows live or hotmail or xbox accounts, I haven no idea which are distinct accounts and which are linked in some way. Ptthht, ptthht. Trying to cancel the auto re-up of their gold account was a nightmare of circular hate. Ptthht.
archagon 14y ago
I usually hate social logins, but I actually like the way SO does it because you can bind your account to multiple services. Now I no longer have to remember which specific one I picked.
- tracker1 14y ago
  Ditto.. I also really appreciate it when you are writing a comment for a blog you crossed in a search. Never been to X site before, likely won't be back.. but like to comment when an article's content is dated, or no longer relevant. Sometimes that gets harder than others.

dochtman 14y ago

If you want to run your own Persona Identity Provider (so you can login directly with your own email account and control the authentication from your own domain/site/server instead of having to remember yet another password for the fallback Identity Provider provided by persona.org), here's a tiny little piece of Python code that implements that: https://bitbucket.org/djc/persona-totp https://bitbucket.org/djc/persona-totp In particular, the authentication method I use is Google Authenticator-compatible TOTP (RFC 6238).

StavrosK 14y ago
That's fantastic, thank you! You just showed me simple examples of at least two technologies I considered complicated to implement.

daredevildave 14y ago

This is exactly what I said to Ben when we implemented Persona at PlayCanvas. Social logins might be OK if you are making a photo-sharing app or a social newsreader, but if your business relies on _companies_ signing up, my suspicion is people won't be comfortable signing up with their Facebook account. We wanted the benefits of a secure login system without all the social baggage. Persona provides that. Though we also support Google OpenID as lots of people already have a GMail or Google Apps account. As an aside, I won't sign up for _anything_ using Facebook, I simply don't trust them or the app not to broadcast my every move to people.

jvandenbroeck 14y ago

Bold claims without any evidence backing it up.

malbiniak 14y ago
I'm glad to see I'm not alone. I had high hopes of seeing data and research (no offense, TechCrunch) to support this claim. I'm in the camp of not liking social authentication, especially when it's the only option, but I'm also a sample set of 1.

SeanDav 14y ago

I agree very much with this. What I do is use "dummy" facebook, google, email etc accounts to log into sites that either require social logins or make it easy to try with social logins, but that I don't trust yet. I am generally suspicious of sites that require or "encourage" logins with social details.

lukeh 14y ago

We (PADL) have developed a SASL/GSS mechanism for Persona, which you can get here: https://github.com/PADL/gss_browserid https://github.com/PADL/gss_browserid Internet Draft here: http://tools.ietf.org/html/draft-howard-gss-browserid-00 http://tools.ietf.org/html/draft-howard-gss-browserid-00 This lets you use Persona to authenticate to non-web services such as IMAP, SMTP, SSH, NFS, CIFS, etc. We (or should I say, I) are pretty excited about it!

StavrosK 14y ago
Hey, that looks very interesting! I hope it goes places.

lnanek2 14y ago

It would be nice to see actual user studies rather than quoting TechCrunch. Tech journalists are not everyone's target market.

recurser 14y ago

Just a random data point, but one of my apps with a definite non-technical demographic gets 97% of logins via facebook, 2.5% via twitter, and 0.5% via email/password registration. I haven't tested it obviously, but I don't think removing Facebook login would do much for conversions.

jsp78 14y ago

Is there an option to not provide my email as part of the "identity" because I could see that being a barrier to signing up for some sites?

callahad 14y ago
You must provide an email address, but you're free to use disposable or other addresses.

Aissen 14y ago

Meanwhile, the Persona vs Personas mess is not fixed yet: http://www.getpersonas.com/ http://www.getpersonas.com/ https://persona.org https://persona.org Context: Personas should have been renamed to "Themes". But apparently it's not done yet.

lubujackson 14y ago

I love the concept of Persona and hopes it catches on. One question I can't seem to find the answer to, though. Users are allowed to have multiple emails tied to one Persona account. If they login to my site with one email I will see that email address and can bind their account data to it. If they sign in with their other email address, will I be able to identify them as the same person?

saurik 14y ago
Alternatively, what happens when someone graduates, changes ISPs, a domain name expires, or they get a new job, and someone later takes control of their email address? As concrete example, if you attend UCSB, you can easily get them to give you saurik@ right now on various of their servers I used to use for vaguely-official UCSB uses. The problem with Persona is that they simply don't seem to understand that for real people, email addresses are just a convenience, not a canonical way to maintain identity. They also fail to see that even people like myself, who have carefully tended an email address for well over a decade, are not immune to this problem. I have previously commented on this here: https://news.ycombinator.com/item?id=4233391 https://news.ycombinator.com/item?id=4233391
- sergiosgc 14y ago
  What is the alternative, then? That's the million dollar question. Even phone numbers, which have a large personal switching cost are ephemeral for many people. SSNs or other government mandated IDs are not acceptable. I see no better alternative.
  - saurik 14y ago
    First, you seem to have immediately disciunted standard usernames, which have flaws, but are not "fundentally flawed". Second, you seem to assume that the primary key has to be something the user even knows; I do not. My Facebook account has a number: that number will never change, no matter what I do to my email addresses or even if my Facebook username changes; that number, and that number alone, defines my account. I will be honest and say I actually did have that number memorized a long time ago, but for years now I have not known it, nor would 99.999% of Facebook users. The same is true of Google's account infrastructure (which even has much much longer numbers). When you use OpenID, you get back an opaque string, which can be arbitrarily complex and encode whatever is required by the federated identity provider. There simply are not fixed identity nodes for people: you have to make them.

vxNsr 14y ago

Relevant XKCD: http://xkcd.com/927/ http://xkcd.com/927/

adrianhoward 14y ago

"Users don’t like social login" should actually read "Some people don't like social login in some contexts - other people like it, or even prefer it, in others". At least that's what I've seen in user testing... but that's not as interesting I guess.

meerita 14y ago

I'm 1Password user. I dont' have to trouble anymore with logins nor selling my ID to Facebook, Twitter or Google. I only use social on those apps where the owners think you only need Twitter/Facebook as the option to use their apps.

StavrosK 14y ago

To see an example of Persona, you can visit http://www.yourpane.com http://www.yourpane.com and click the "Persona" button (don't enter an email address).

k_bx 14y ago

Biggest problem with social login for me is that I have all of them (google, twitter, facebook etc.), and sometimes multiple (google, twitter).

hawkw 14y ago

This just in: users don't like social login, water is wet, sky blue..

muratmutlu 14y ago

"Lesson 2: Social Sign-in is Better Than Email Sign-in After dozens of failed A/B tests to improve the conversion rates of our landing page, we came up with the idea to enable social sign-in (i.e., signing up for a Buffer account and logging in using your Twitter, Facebook or LinkedIn account). After all, Buffer is for posting on Twitter, Facebook and LinkedIn so it only seemed logical that our potential users would be able to quickly and conveniently sign up using one of their existing accounts." http://sixrevisions.com/user-interface/ux-design-mistakes/ http://sixrevisions.com/user-interface/ux-design-mistakes/

martinced 14y ago

The biggest problem with "social login" ain't about advertizing companies like FB and Google having all your infos. The biggest problem has actually nothing to do with social: the problem is security of all these single-sign on / unique ID. We're in 2013 and hardly a day goes by without a major security exploit found affecting Rails, Java, OAuth, Flash, etc. There are so many botnets out there that sites we rely upon for our daily workflow are getting taken down (GitHub)... Yet people don't talk about security. They don't even mention it. Not in the TFA. Not in this thread (besides two insightful comments). As long as people will keep thinking that they can put all their eggs in one basket online and "really really have this basket by hyper-secure" we're gonna be in big trouble. It doesn't help that several people on HN are selling snake-oils products "put all your passwords in this unbreakable app, we guarantee you nothing bad could ever happen".

callahad 14y ago
> As long as people will keep thinking that they can put all their eggs in one basket online and "really really have this basket by hyper-secure" we're gonna be in big trouble. That's why Persona is based on a federated protocol: it's designed to spread your eggs across many baskets, and it even lets individuals bring their own basket.

drdaeman 14y ago

I really hate when my identity is provided to me by some third party. It universally applies to both social networks and Persona. I don't like the very idea of leasing my own identity. This said, I really wish Persona project will fail as much as possible. I only hope there'll be a day I'll finally truly possess my own network identities, and third parties (social networks, email providers, etc) will act as notaries who just assert them for others to verify.

TheCoelacanth 14y ago
> I only hope there'll be a day I'll finally truly possess my own network identities, and third parties (social networks, email providers, etc) will act as notaries who just assert them for others to verify. If you have your own domain name, that's exactly what Persona does. The protocol is completely decentralized. Mozilla only provides a fallback for domains that don't support Persona.
- drdaeman 14y ago
  I believe domain names are still inappropriate for identities. Even XRI i-numbers was a better idea. One just can't own a domain name. It only can be leased for a limited time, for a price, and even then, at least in some TLDs one can't be sure the lease won't be revoked at someone's whim. There's no real difference whenever one leases email address from a provider or domain name from a registrar. Maybe I'm overzealous about it, but I really wish to be the source of my own identity and posess it like I posess my GPG key.