17 ms·
Anonymous Login
- lucb1e 12y agoI was so hoping for anonymous logins on Facebook, like they announced a little while ago on mobile if I recall correctly (Rooms or something?). But it's only for SSO.
- higherpurpose 12y agoShould be "Anonymous" Login.
- yk 12y agoHow is this supposed to work? Does this create a temporary FB profile, and you can then log in via FB's OAuth?
- whatusername 12y agoI would imagine similar to a SAML Persistent Name Alias. facebook knows who you are - but they just send a non-identifying string/GUID to the service who is trying to log you in. This is a consistent ID (so that service can build a profile) - but it does not contain any identifying data.
- yeldarb 12y agoBasically. Facebook already switched to using "app scoped ids" last year. So each app gets a different unique identifier for a Facebook user.
- fredley 12y agoThis looks great to me, if it works as I imagine it does: use Facebook to authenticate myself to services, but don't give them any information about me - just an anonymous token. I want to be able to use the convenience of Facebook login, but usually I don't because I'm worried about how much data the app I'm authenticating with has access to.
- vitalus 12y agoThey tell you exactly how much you're authorizing when you opt in to login via Facebook, right?
- deleted 12y ago[deleted]
- laurencei 12y agoThis doesnt make much sense. If someone is worried enough about privacy - then why are they even logging in via their Facebook profile in the first place? Realistically you would just use a throw-away email account and then no one knows. Secondly - as a developer - why would I want to accept anonymous logins? If I did - then I can just let them create a username + password with no email account instead?
- DougBTX 12y agoLooks like it replaces the pick-a-username and remember-a-password workflows with a single tap, lowering the bar for new users to start using the service. They can still favourite things, track data, get high scores, whatever the app is for, but delay handing over identifying information until it is actually needed, if ever. Interesting idea.
- laurencei 12y agoThe thing is - we already have the Facebook (or twitter etc) single login option. However the are plenty of articles that say this form of sign up is not necessarily effective.[1] For this idea to take off - you need to assume the reason for the current lack of uptake is that users dont trust the 3rd party with the Facebook data. However I personally believe, and would have thought, that most people dont trust Facebook with the linked data, since they are learning more about you? [1] http://blog.mailchimp.com/social-login-buttons-arent-worth-it/ http://blog.mailchimp.com/social-login-buttons-arent-worth-i...
- ryandvm 12y agoThe problem with the existing Facebook single login is that it gives the user another, somewhat daunting, screen that says "Are you sure you want to give this app access to your contacts, email, identity, etc.?" I'm sure Facebook has found that a large percentage of users bail out of new signups at that screen. And frankly, the user should be bailing out there. Regardless of Facebook's sketchy policy changes, they have demonstrated that they will at least do what they promised with my personal data, but there's no reason that I should a new app/service the same level of trust. With "Anonymous Login" users don't have to worry that the app will be able to do nefarious things with their Facebook data.
- csbrooks 12y agoI get how this works when I'm using a single device. But how do you identify that you're the same anonymous account when you switch from one device to another, without giving any personally identifying information?
- laurencei 12y agoI'm guessing this is linked to your Facebook account. So Facebook knows who you are - just the "3rd party" website doesnt
- Flimm 12y agoOh Mozilla. How I wish that you had finished your BrowserID project! Now we have to trust Facebook with this idea instead of you.
- untothebreach 12y agoWell, they do have Persona...if only it was more widely used
- krenoten 12y agoHopefully with FB investing in this idea, it will spur more conversation that will lead to comparisons with and interest in Persona.
- shiggerino 12y agoThese things usually end up doing the opposite. Like when they said they were going to let people use XMPP.
- acdha 12y agoYeah, Persona is such a simple solution to an annoying problem. I really hope Mozilla makes a second push as I've been enjoying how easily it solves the authentication for small apps.
- jbk 12y agohttp://www.computerworld.com/article/2488440/search/mozilla-stops-work-on-persona-sign-on-to-shift-resources-to-firefox-os-services.html http://www.computerworld.com/article/2488440/search/mozilla-...
- buro9 12y agoI still use Persona on over 300 sites for 50k+ users. It remains one of the best auth components I've ever used, and I have zero issues from users relating to it. What sucks is that at some point I'll have to remove this great component because they stopped working on it, and will inevitably sunset the hosted service.
- simonw 12y agoThis has been in beta since Facebook's F8 conference nearly a year ago. Has anyone here tried it out in their app yet, or encountered it in the wild?
- valevk 12y agoThis is solely made, because people are afraid to use facbook to login anywhere, becuase they don't want their friends to know.
- darkstar999 12y agoNo, I don't want some random website knowing my name, email, and friends list. This solves that problem.
- rabbyte 12y agoFacebook created that problem.
- bduerst 12y agoWebsites were still requiring email addresses, mailing addresses, phone numbers, etc. before universal login. If anything FB is closing the loop.
- rabbyte 12y agoI was there before Facebook changed the expectation. Obviously companies retrieved this information in other ways before federated identity but the idea that you can't get an app or a service without handing over your real name and friends list is entirely on Facebook.
- Aoyagi 12y agoOK, so I take it this is "anonymous" only for the application owner, Facebook still knows exactly where you log in, when and whatnot. So, and please correct me if I'm wrong, this is just logging in using Facebook without (probably) sharing "any" data with the software provider, right?
- chinathrow 12y agoDon't forget, that this is not so much anonymous towards FB. They have enough tracking power (mobile and web) to link the dots.
- vincentkriek 12y agoFirst thing I thought off. It means the application you are logging into does not know who you are but Facebook does get to know you are logging into that app.
- onion2k 12y agoWhichever way you look at it your privacy is better protected if one party knows rather than both parties knowing, so this is definitely a win if you already use Facebook. If you don't then the new option is irrelevant.
- meowface 12y agoTechnically speaking, of course they do. Google can also read all your emails. But I'm not sure Facebook would bother doing so. Hopefully the privacy policy regarding anonymous login specifies what they will or won't track.
- dec0dedab0de 12y agoIt is in their direct interest to do so. They could use that information to better target ads, and to keep an eye on the popularity of potential acquisitions.
- placeybordeaux 12y agoI think that for the people that do use facebook this actually does have a decent value. Useless for people that are actually worried about their privacy though.
- blueskin_ 12y ago>facebook >anonymous Very funny. "Sure it's anonymous, just trust us..."
- curiously 12y agoWhy would I use Facebook to build an anonymous login function?
- JustSomeNobody 12y agoI spit my coffee. Why isn't an entity with a more trustworthy past in handling privacy doing something like this? What entity would even qualify?
- guelo 12y agoThis is for services that don't need to email users but want to remember them across devices. You're lowering the barrier to entry somewhat but you still have a barrier just to provide the cross-device feature. Why not remove the barrier completely by just using cookies, and then later after the user has created enough state, and is presumably hooked to your service, give them the option to add the cross-device feature. You might even have enough goodwill at that point to be able to ask them for their email without having to use Facebook as a crutch.
- declan 12y agoI think <guelo>'s advice above is sound. I learned this lesson myself after testing early versions of http://recent.io http://recent.io -- there's a high barrier to convincing users to type in an email address and password, even if it's for personalized news recommendations across multiple devices. It's not necessarily a trust issue -- it's simply a hurdle. Fortunately there are other ways to do it...
- stickfigure 12y agoThis is absolutely horrible for the open web. What this means is that users who sign in to your website with this are Facebook's users, not your users. Facebook controls them and decides if and when your access to them shall be revoked. At least with an email address, you can bootstrap an independent relationship. Not here. Mozilla Persona got this right - authentication should be decentralized and establish an independent relationship between website and user. Too bad they gave up on it.
- rkuykendall-com 12y ago> At least with an email address, you can bootstrap an independent relationship. Not here. Wait, what if I want that? I'd say 95%+ of sites I sign up for I am just trying out. I don't want an independent relationship to be bootstrapped, I just want to play with the site. Chances are, after a week I will never see it again. But instead, I get a newsletter, and have to unsubscribe. Then I get a friend notification or something, and unsubscribe from those, or try to find out how to deactivate or delete my account. > Facebook's users, not your users Yes, that's true. I am a Facebook user. I have an account there, which I use. Why should I spread my email around to sites I don't really consider myself a user of, just because I want to save my game or explore the app or something?
- astromarch 12y agoYou only see two choices. That's bad. 1) Give your info to one site and let them rule you like a king 2) Give your info to lots of sites only to be annoyed I suggest a third option, 3) Use ssh style key login. You own the key, not Facebook/Google/Apple. You can lock the key locally with a password. One password for all websites. Only you know it. The password is not shared with others. You authenticate and encrypt in a cryptographically strong way that can't be defeated easily like SSL with "trusted" CAs can. Good luck getting Google to implement THAT in chrome though. Also, up yours YC for banning account creation on my IP. You think it's not easy as pie to find another one? Jerks. Why should I trust you with my information?
- stickfigure 12y agoCongratulations, you've just handed ownership of your electronic life over to Facebook. Now your access to the internet is gated by Facebook. What? You've used a nickname or an inaccurate photo or you're a sex offender or a drug offender or you've had a DUI or enough people have flagged you? Say goodbye to your entire internet identity, time to start from scratch - assuming FB doesn't recognize your IP address and ban you. The risks of submitting an email address are overblown. Websites are terrified that you will click the 'spam' button. They don't put those little 'unsubscribe' links at the bottom because they want you to click on them. I was one of the early adopters of the Facebook platform and 'social login'. Now I think it's a menace. They aren't doing anyone, except themselves, any favors with this.
- vitalus 12y agoI'm curious to see if we would see a lower bounce rate w/ anon login compared to regular FB login.
- greenjellybean 12y agohttps://en.wikipedia.org/wiki/SQRL https://en.wikipedia.org/wiki/SQRL
- TeMPOraL 12y agoFor a Facebook user like me, this is awesome. It's really irrelevant how much I trust Facebook (if at all) - I trust someone's random startup less. Giving me an option to use something while not giving the other side enough information to spam me with crap or milk me for marketing money is a win.
- clukic 12y agoThis is a small feature change with a big marketing angle. Facebook has been cutting the minimum amount of information shared when you "Connect with Facebook" with each iteration of their API. At launch, Facebook literally shared all of your information and most of your friend's information by default with no way to limit it. Then they pared it back to selective requests with a minimum of name, gender, and email. Then name, gender, and anoynimized email. Then it was name and anoynimized email. And now it is just an token specific to that site and nothing else. They started by building what site owners and developers want - everything about a user without having to build a complex form and have the user agree to fill it out. And they ended up with what the user wants - to share nothing at all with the site owner and fill out no forms. My guess is this will be stupidly successful, and good for absolutely no one, but Facebook.
- TeMPOraL 12y ago> My guess is this will be stupidly successful, and good for absolutely no one, but Facebook. Why? I see it being very good for Facebook users. I'm very happy about not giving any data about myself to random websites I want to check out just once. I especially look forward for the amount of spam (er, value-added marketing e-mails) it cuts out of the circulation.
- msoad 12y agoNote that the App don't know about you but Facebook know about you using that app because they can see all the API calls.
- bluepill 12y agoI tried to apply for the beta but it requires a FB account, which I obviously don't have since I want to stay anonymous ...
- sushimako 12y agoI wonder if Facebook will release an according `Anonymous Mail` feature. A way for site owners to reach their `Anonymous Login` users by sending notifications, newsletters, etc right into their FB inbox. This would surely attract site-owners by providing them with some kind of communication-channel to their users which is important for acquisition, retention, marketing and all that other stuff programmers usually don't like to do :) The user can unsubscribe/delete account with a click and never gets spam in his inbox for sharing his contact details. Did Persona give away the email-address to site-owners or were there attempts at something like described above (even if persona were just to act as a proxy to your email via api)?
- TeMPOraL 12y ago> This would surely attract site-owners by providing them with some kind of communication-channel to their users which is important for acquisition, retention, marketing and all that other stuff programmers usually don't like to do :) Yes, please. Give me a throw-away app-specific inbox but make sure that I can completely ignore it. It's not only programmers that don't like "acquisition, retention, marketing" - as a user I don't like being subjected to it either.
- smoyer 12y agoThis is in no way an anonymous login ... Facebook knows exactly who you are and what application(s) you're logging into. In fact, it's more data to mine so they can serve you targeted advertising. The proper term for this is "Federated Login". Most enterprises have some form that's used for SSO.
- iiiears 12y ago@smoyer You have no need to question citizen, Facebook coined a double plus good term and you accuse them of pettifogging,redefining words, Newspeak.
- deleted 12y ago[deleted]