6 ms·

While this is probably the right move for users, Facebook OAuth is less and less relevant. We see a trend across our customer deployments: more people are choo

While this is probably the right move for users, Facebook OAuth is less and less relevant. We see a trend across our customer deployments: more people are choosing Google as an OAuth provider over Facebook than ever before. Google will overtake Facebook this year. Customer preference used to be: 1) Email & Password 2) Facebook. Now it's: 1) Email & Password 2) Google and/or Facebook (tied for 2nd). Other companies in our space (Janrain in particular) have confirmed this. I bet Facebook knows this and is trying to regain trust. The problem with what they are doing now is that more and more publishers and apps will probably just skip Facebook altogether. The primary reason Facebook was pushed so hard by so many for so long was because of the data provided. Take that away and people may move off the platform entirely.

krschultz 12y ago
I wonder if this is related to Android or Google Apps for Business more than any particular customer (dis)-satisfaction with Facebook. I know that I have been leaning on the Google+ login a lot more now than before, because it integrates so well with my Android phone.
- mblevin 12y ago
  My sample-size-of-a-few take is that it's a combination of factors: 1) The probability that a Facebook users at somepoint has had a bad experience with rogue Facebook app publishing personal information (or even an accidental acceptance) or was witness to a friend's experience is non-trivial 2) The increasing awareness of the scope and scale of personal data that is taken from logins and shared with advertisers 3) The demographic shift in Facebook usage to older users 4) The large secular increase in awareness of ongoing privacy and financial information breaches that rightly or wrongly is associated with over-sharing of personal information
  - guelo 12y ago
    Seeing a friend post embarrassing spam or porn is a horror inducing visceral experience. It wakes people up to the fact that Facebook's business is fundamentally unseemly.
    - mblevin 12y ago
      Exactly - given an average of 500+ friends and years of being active daily or weekly for a large chunk of that time, the probability that you've at least witnessed an embarrassing incident is many orders of magnitude greater than just having done it yourself. I really believe there's a high level of wariness among the general FB user population that no amount of marketing or changes in authorization policy can fix. It's a level of trust that's irretrievable.
- amyjess 12y ago
  For me, I see Facebook as an application. It's a social network, just one thing of many I use. Google, on the other hand, is a platform. It's Gmail and YouTube and Maps and G+ and the Play Store and Drive and a whole bunch of other things. Not just a single app, but a family of apps that share a common identity. I don't see my Google account as just credentials for an app; I see it as a common login for a whole ton of different apps. In particular, I'm used to the paradigm of "use my Google account to pull my identity and my data down to my Android device", and I don't see any problem in extending that paradigm to apps that aren't made by Google.
  - deleted 12y ago
    [deleted]
  - nemothekid 12y ago
    Immediately thought of this the Steve Yegge rant from a while back - https://plus.google.com/+RipRowan/posts/eVeouesvaVX https://plus.google.com/+RipRowan/posts/eVeouesvaVX He argued Facebook is more a platform than Google is - apparently because its easier for developers to build inside of Facebook's platform than Googles.
    - bduerst 12y ago
      Huh, he seems to focus pretty heavily on G+ API, which was probably pretty bad when he posted this in 2011. Any idea if it's gotten better?
      - dragonwriter 12y ago
        > Huh, he seems to focus pretty heavily on G+ API, which was probably pretty bad when he posted this in 2011. The repost of this (I don't know how close it was to the original sharing) was about a month after Google first released the initial, extremely limited G+ API -- and only four months after Google introduced G+. (Google had already rolled out another set of APIs at the time of that repost.) > Any idea if it's gotten better? G+ in specific has a much more robust API than it did at the time (unsurprisingly, given how new it was then), and more significantly Google in general has really developed very much in a way that seems to be in the direction Yegge was calling for in the essay.
- Angostura 12y ago
  In my case, I simply don't use Facebook or Google Auth for site logins simply because I can't be bothered to work out how the data might get used, what the tracking implications are, whether things would suddenly show up on my Facebook feed etc. Faced with the choice of trying to understand that lot, or typing my e-mail and password in, I'll go for the latter. I surely can't be the only one.
testguy34 12y ago
I've never seen a single site that uses Google login over Facebook. Facebook also owns mobile login on the iPhone. Google is closer to shutting down Google+ than winning any war with Facebook.
- nostromo 12y ago
  > I've never seen a single site that uses Google login over Facebook. My comment was about the user's choice. Most big publishers with a lot of reach (HuffPost, NYTimes, etc.) will give you more than one OAuth option. And in those cases people are choosing Google more than ever. For mobile apps, you're right, Facebook OAuth is popular on the iPhone. But on Android...
- sureshv 12y ago
  It's been dead on IOS for a while: https://code.google.com/p/google-plus-platform/issues/detail?id=900 https://code.google.com/p/google-plus-platform/issues/detail...
  - malka 12y ago
    Such assholery by Apple. Not even remotely surprising, though.
- toomuchtodo 12y ago
  Google+ doesn't need to exist to beat Facebook; Facebook simply needs to fall out of favor, which appears to be happening: http://www.forbes.com/sites/parmyolson/2015/01/27/facebook-active-users-decline/ http://www.forbes.com/sites/parmyolson/2015/01/27/facebook-a... http://www.pewinternet.org/2015/01/09/social-media-update-2014/ http://www.pewinternet.org/2015/01/09/social-media-update-20... http://www.theguardian.com/technology/2013/nov/10/teenagers-messenger-apps-facebook-exodus http://www.theguardian.com/technology/2013/nov/10/teenagers-...
  - deleted 12y ago
    [deleted]
carrotking 12y ago
Twitter OAuth is even worse, however. It doesn't even give you an email address.
- deleted 12y ago
  [deleted]
- sureshv 12y ago
  That's been fixed for mobile apps if you use Fabric/TwitterKit.
  - treve 12y ago
    I don't think you can call that fixed if the solution is proprietary.
haberman 12y ago
If Google and/or Facebook wanted to get a leg up on this, they would provide some guarantee (that the site owner is required to respect) that signing in with Google/Facebook is sufficient to start using the site. Nothing is more aggravating than deciding to sign in with Google or Facebook, only to make the site force you to create a new username/password anyway. It's like, the whole reason I was willing to let you correlate my identity with this Google or Facebook account is to buy the convenience of not having to make a new username/password, confirm my email address, etc. If you make me do that anyway, I've sold you a little bit of privacy for absolutely nothing in return. This makes me feel used. It feels like a bait-and-switch.
- johnmaguire2013 12y ago
  Agree. It's terrible UX with the current system too: Every time you click the button you sit and hope to god that you will see a dashboard on the next load. But you have no idea. Unpredictability is the biggest usability sin, imo.
- rspeer 12y ago
  For what it's worth, you can get most of that privacy back by revoking the app's permission to use your Google account, at https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions . I once made the mistake of trying to actually log in to Quora, they pulled that bait and switch, and I had to do this just so that Quora would stop re-directing me to their signup process.
- hobarrera 12y ago
  That's just right. By signing up on a new website using facebook, I get all the downsides of facebook login (having to log into facebook, having them track me, giving the website a bunch of personal data), and I still have to do the manual registration form. There are no upsides for me (except maybe not having to manually type my email address).
tracker1 12y ago
So be it... honestly, for the most part this is and should be about basic authentication for identity. As long as you offer Facebook/Google/Twitter (and maybe another) with a fallback to an email/passphrase account, it's generally all you should need. Yeah, if you are trying to tightly integrate, it might help... but in general, having a "share" link it enough, and given how many places are using FB for comments, and the like, I never liked the result. When an app asks for permissions it really doesn't need, that is another thing I really don't like.
prostoalex 12y ago
Half of the implementations out there involve Step 1: Log in with Facebook Step 2: Sweet, what we meant is we're pulling your primary e-mail address and filling it in for you. You still have to set up password, confirm it, enter your birthday and set up a security question as we use our own password validation and password reset flow anyways.
shultays 12y ago
more people are choosing Google as an OAuth provider over Facebook than ever before. Google will overtake Facebook this year Personally, I use google in logins because I actually use facebook more and don't want to share my facebook profile. I don't think using one service for logins means anything, hell I have an email which I use solely for registrations so I can reduce the spam I get in my real mail.
peloton 12y ago
Looked up the latest Janrain report. Looks like the trend reversed and Facebook increased their share: "Facebook is regaining ground lost in Q4 2014, with noteworthy growth in the Consumer Brand (9% increase) and B2B (11% increase) verticals Google+ saw an overall decrease of 6% from last quarter, widening the gap with Facebook to 8% with a total share of 37%" http://janrain.com/blog/social-login-trends-across-the-web-q1-2015/ http://janrain.com/blog/social-login-trends-across-the-web-q...

krschultz 12y ago

I wonder if this is related to Android or Google Apps for Business more than any particular customer (dis)-satisfaction with Facebook. I know that I have been leaning on the Google+ login a lot more now than before, because it integrates so well with my Android phone.

mblevin 12y ago
My sample-size-of-a-few take is that it's a combination of factors: 1) The probability that a Facebook users at somepoint has had a bad experience with rogue Facebook app publishing personal information (or even an accidental acceptance) or was witness to a friend's experience is non-trivial 2) The increasing awareness of the scope and scale of personal data that is taken from logins and shared with advertisers 3) The demographic shift in Facebook usage to older users 4) The large secular increase in awareness of ongoing privacy and financial information breaches that rightly or wrongly is associated with over-sharing of personal information
- guelo 12y ago
  Seeing a friend post embarrassing spam or porn is a horror inducing visceral experience. It wakes people up to the fact that Facebook's business is fundamentally unseemly.
  - mblevin 12y ago
    Exactly - given an average of 500+ friends and years of being active daily or weekly for a large chunk of that time, the probability that you've at least witnessed an embarrassing incident is many orders of magnitude greater than just having done it yourself. I really believe there's a high level of wariness among the general FB user population that no amount of marketing or changes in authorization policy can fix. It's a level of trust that's irretrievable.
amyjess 12y ago
For me, I see Facebook as an application. It's a social network, just one thing of many I use. Google, on the other hand, is a platform. It's Gmail and YouTube and Maps and G+ and the Play Store and Drive and a whole bunch of other things. Not just a single app, but a family of apps that share a common identity. I don't see my Google account as just credentials for an app; I see it as a common login for a whole ton of different apps. In particular, I'm used to the paradigm of "use my Google account to pull my identity and my data down to my Android device", and I don't see any problem in extending that paradigm to apps that aren't made by Google.
- deleted 12y ago
  [deleted]
- nemothekid 12y ago
  Immediately thought of this the Steve Yegge rant from a while back - https://plus.google.com/+RipRowan/posts/eVeouesvaVX https://plus.google.com/+RipRowan/posts/eVeouesvaVX He argued Facebook is more a platform than Google is - apparently because its easier for developers to build inside of Facebook's platform than Googles.
  - bduerst 12y ago
    Huh, he seems to focus pretty heavily on G+ API, which was probably pretty bad when he posted this in 2011. Any idea if it's gotten better?
    - dragonwriter 12y ago
      > Huh, he seems to focus pretty heavily on G+ API, which was probably pretty bad when he posted this in 2011. The repost of this (I don't know how close it was to the original sharing) was about a month after Google first released the initial, extremely limited G+ API -- and only four months after Google introduced G+. (Google had already rolled out another set of APIs at the time of that repost.) > Any idea if it's gotten better? G+ in specific has a much more robust API than it did at the time (unsurprisingly, given how new it was then), and more significantly Google in general has really developed very much in a way that seems to be in the direction Yegge was calling for in the essay.
Angostura 12y ago
In my case, I simply don't use Facebook or Google Auth for site logins simply because I can't be bothered to work out how the data might get used, what the tracking implications are, whether things would suddenly show up on my Facebook feed etc. Faced with the choice of trying to understand that lot, or typing my e-mail and password in, I'll go for the latter. I surely can't be the only one.

testguy34 12y ago

I've never seen a single site that uses Google login over Facebook. Facebook also owns mobile login on the iPhone. Google is closer to shutting down Google+ than winning any war with Facebook.

nostromo 12y ago
> I've never seen a single site that uses Google login over Facebook. My comment was about the user's choice. Most big publishers with a lot of reach (HuffPost, NYTimes, etc.) will give you more than one OAuth option. And in those cases people are choosing Google more than ever. For mobile apps, you're right, Facebook OAuth is popular on the iPhone. But on Android...
sureshv 12y ago
It's been dead on IOS for a while: https://code.google.com/p/google-plus-platform/issues/detail?id=900 https://code.google.com/p/google-plus-platform/issues/detail...
- malka 12y ago
  Such assholery by Apple. Not even remotely surprising, though.
toomuchtodo 12y ago
Google+ doesn't need to exist to beat Facebook; Facebook simply needs to fall out of favor, which appears to be happening: http://www.forbes.com/sites/parmyolson/2015/01/27/facebook-active-users-decline/ http://www.forbes.com/sites/parmyolson/2015/01/27/facebook-a... http://www.pewinternet.org/2015/01/09/social-media-update-2014/ http://www.pewinternet.org/2015/01/09/social-media-update-20... http://www.theguardian.com/technology/2013/nov/10/teenagers-messenger-apps-facebook-exodus http://www.theguardian.com/technology/2013/nov/10/teenagers-...
- deleted 12y ago
  [deleted]

carrotking 12y ago

Twitter OAuth is even worse, however. It doesn't even give you an email address.

deleted 12y ago
[deleted]
sureshv 12y ago
That's been fixed for mobile apps if you use Fabric/TwitterKit.
- treve 12y ago
  I don't think you can call that fixed if the solution is proprietary.

haberman 12y ago

If Google and/or Facebook wanted to get a leg up on this, they would provide some guarantee (that the site owner is required to respect) that signing in with Google/Facebook is sufficient to start using the site. Nothing is more aggravating than deciding to sign in with Google or Facebook, only to make the site force you to create a new username/password anyway. It's like, the whole reason I was willing to let you correlate my identity with this Google or Facebook account is to buy the convenience of not having to make a new username/password, confirm my email address, etc. If you make me do that anyway, I've sold you a little bit of privacy for absolutely nothing in return. This makes me feel used. It feels like a bait-and-switch.

johnmaguire2013 12y ago
Agree. It's terrible UX with the current system too: Every time you click the button you sit and hope to god that you will see a dashboard on the next load. But you have no idea. Unpredictability is the biggest usability sin, imo.
rspeer 12y ago
For what it's worth, you can get most of that privacy back by revoking the app's permission to use your Google account, at https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions . I once made the mistake of trying to actually log in to Quora, they pulled that bait and switch, and I had to do this just so that Quora would stop re-directing me to their signup process.
hobarrera 12y ago
That's just right. By signing up on a new website using facebook, I get all the downsides of facebook login (having to log into facebook, having them track me, giving the website a bunch of personal data), and I still have to do the manual registration form. There are no upsides for me (except maybe not having to manually type my email address).

tracker1 12y ago

So be it... honestly, for the most part this is and should be about basic authentication for identity. As long as you offer Facebook/Google/Twitter (and maybe another) with a fallback to an email/passphrase account, it's generally all you should need. Yeah, if you are trying to tightly integrate, it might help... but in general, having a "share" link it enough, and given how many places are using FB for comments, and the like, I never liked the result. When an app asks for permissions it really doesn't need, that is another thing I really don't like.

prostoalex 12y ago

Half of the implementations out there involve Step 1: Log in with Facebook Step 2: Sweet, what we meant is we're pulling your primary e-mail address and filling it in for you. You still have to set up password, confirm it, enter your birthday and set up a security question as we use our own password validation and password reset flow anyways.

shultays 12y ago

more people are choosing Google as an OAuth provider over Facebook than ever before. Google will overtake Facebook this year Personally, I use google in logins because I actually use facebook more and don't want to share my facebook profile. I don't think using one service for logins means anything, hell I have an email which I use solely for registrations so I can reduce the spam I get in my real mail.

peloton 12y ago

Looked up the latest Janrain report. Looks like the trend reversed and Facebook increased their share: "Facebook is regaining ground lost in Q4 2014, with noteworthy growth in the Consumer Brand (9% increase) and B2B (11% increase) verticals Google+ saw an overall decrease of 6% from last quarter, widening the gap with Facebook to 8% with a total share of 37%" http://janrain.com/blog/social-login-trends-across-the-web-q1-2015/ http://janrain.com/blog/social-login-trends-across-the-web-q...