Hacker News Reader

Comment by robinhood | Hacker News Reader

Damn it, I broke it. I'll fix it today, or remove it entirely, I still don't know about it. I like the idea of being able to quickly log in, but it's yet another feature to maintain, so...

View on HN

My personal recommendation is to drop third-party logins and allow users to sign-up via usernames (without emails). That means you need to deal with "lost password with no way to recover" situations and spam but it's still better than third parties controlling the most important aspect of your application.

FB integration, though, might be nice for initial import of friend data that's already there.

You can't import ANY data from your friends from Facebook. Facebook doesn't allow to.

Really?!

This has been the case for many years.

Looks like about 2 years. https://techcrunch.com/2015/04/28/facebook-api-shut-down/

Oh, wow, walled garden indeed

Damn. That's not surprising, but it is disappointing.

That's true, but you can see if any of your FB friends are also using the same service! 'Importing' isn't ok, but verifying via API is ok.[0]

[0]: https://developers.facebook.com/docs/graph-api/common-scenar...

Exactly. Excellent point. Moreover, you can't import any of your Facebook contacts anyway, so it's pretty pointless, and I hate relying on third parties.

I actively avoid sites that offer only FB logins.

I've deleted my FB and have no desire to recover it. Any service that's FB only can count me out.

(yeah, I can create a dummy account for that purpose alone, but I rather not bother)

PLEASE PLEASE have a non-FB option.

I got added by someone else to a Facebook group that eventually went on a troll raid. I rarely go on Facebook and didn't even participate in any troll raids. Just from being in the group, my account was disabled. I have been locked out of my apps for three weeks and Facebook hasn't answered any appeal I sent them.

I'm a fan of FB login. In practice it's pretty trivial to maintain once it's set up, I don't recall ever having to do any updates to an FB login system once set up.

It's nice that I don't have to create yet-another-password for a new app as well. I use a password manager so it's not a big deal for me, but for other users it could be so they may just use a shared password and having FB login would be a way to have them not do that.

Counterpoint since I only see anti-FB replies below: I absolutely love seeing OAuth login. I don't have to create yet another password, or worry about whether your site has reasonable password security. Even when I choose to create a login instead, just seeing it gives me some confidence that you're competent enough to set it up, and probably gave some thought to the security trade-offs surrounding login in general.

Have you tried using a password manager? There's no need to worry about a site having reasonable password security when every site has its own unique 15-20 character password that you don't need to know.

You don't have to remove it indefinitely, just come back with something that works with more networks, like google, github, gitlab, yahoo etc., something you have to maintain only the integration instead of the logic.

I have mainly python experience with python-social-auth, but I see PHP has a few pretty good social auth libraries, to name one, I came across HybridAuth[1].

[1] https://github.com/hybridauth/hybridauth

Please, please remove it. I actively avoid sites with fb logins, as it appears others in this thread do as well. Your idea can stand on its own without that sort of crutch.

Why? Just don't log in with it if you don't like it, why does it specifically have to be removed?

Wherever you see the "login with facebook" button, you have FB tracking you. This is why lots of people avoid sites that have this button. It adds very little and puts a lot of people off. Why keep it around on an OSS project if it's going to do nothing of real value and will put off both users of the CRM and people who would like to host a CRM but don't want the FB affiliation?

I get that you might like it, that's fine, but it's not serving any good purpose here. Google login would be more widespread if you must have a 3rd party button. Yes, Google track as well and yes, that's also going to put people off, but if you feel the need to have one at all, get a more useful one. Or better yet, remove them all, have local user registration and put a hook in place for developers to plugin other buttons using different contrib repos. Then you can have both without polluting the core project with 3rd party deps.

If you're concerned about tracking then are you using an ad blocker? Then the FB integration has no affect on you.

Reply on news.ycombinator.com