Hacker News Reader

Comment by jiveturkey | Hacker News Reader

There's an evil with social login in that you give up the knowledge of your social (presumably personal) network to random 3rd parties. That's even worse than email address.

With password managers being essentially mandatory now, it's not too hard to create a new email/password based account for every new site.

But recently I realized that I don't use my FB for anything. I have zero friends, don't allow friend requests and am unsearchable AFAIK. So now I am going to start using that account for social login, that way I don't have to bother with email/password.

View on HN

I don't think password managers have as much penetration as you think and they only work on devices you own.

Social login doesn't necessarily give up that much info. Your social network knows who logged in to. The third-party only gets whatever info you accede to which usually is just an email address or name.

The huge bonus to users and site owners is that that site isn't storing a password for you. It's easy to screw up password storage.

I think you just made a case for DuckDuckGo or (e.g.) LastPass to provided an authentication servive.

Mind you, products would have to adopt it. But from a sec + privacy perspective it makes sense to have a 3rd party whose biz model isn't to harvest your personal details.

Mozilla Persona tried this. It was a good user experience, but it never gained enough traction and eventually they shut it down.

Maybe it could be different now? Or maybe it's not a solo effort? If multiple companies leveraged their traction (read: user base) maybe it could work.

God knows we need something. It's not safe "outside."

This was OpenID, which lets you choose your third-party provider at will, or even self-host.

It's mostly dead now. People wanted the convenience of FB/GOOG/TWIT over the freedom of self-hosting.

But everybody just uses some library for that stuff, I wonder why there aren't visible "Log In with [list of 80 OpenAuth providers]" sites or services.

The issue is UX: I’d much prefer a widget that had three or four common providers and then an advanced mode that lets me pick an alternative

Hey, that’s a really bad idea, jiveturkey. Facebook flags and disables accounts with zero friends and zero activity outside of apps. Sometimes they allow you to restore the account by uploading a picture of yourself and waiting for verification. I don’t know how often they do this vs. not, but remind yourself that they could do it to you at any point.

3rd party knowing about your social network is one thing; do you not also worry about Facebook knowing about all these 3rd party things too?

Or even worse, anything that might create a bridge between the two, so that the different third-party sites are aware that you are on each-other.

Websites using Facebook login usually don't ask for any of your Facebook information, just your email address. They also implicitly have the public information on your profile since they have your Facebook ID, and I suppose it does reveal information to say that this user and email address is associated with this public Facebook profile. But they definitely don't get anything close to the read permissions you have on Facebook.

Looking through some of my Facebook apps: Headspace, Stack Exchange, and Netflix only have my email address. Venmo is an example that asks for my friend list because they want to use it for social features.

>Websites using Facebook login usually don't ask for any of your Facebook information, just your email address.

This is absolutely false. FB delivers a whole profile.

Presumably you're just referring to the public profile? Public profiles can already be accessed for any user without their agreement (at least manually), so it's not extra information provided through FB login. See my second sentence for that caveat.

Wouldn't that be just as bad as using one password for every site? One account gets compromised they all get compromised.

Only if the facebook account gets compromised. If some random site you use facebook to log into gets compromised, your facebook account and every other site you log into with it is still safe.

This is not exactly worse than web sites that allow you to sign up with an email address and request password resets: if your email address is compromised, then so are all your accounts. Actually, this situation is a bit worse, because there's also the chance that the user will choose the same password as they use with their email address or other accounts, so if the site they're logging into gets compromised, then their other accounts and email may be able to be compromised too.

Reply on news.ycombinator.com