Comment by redbell | Hacker News Reader

Comment by redbell | Hacker News Reader

Parent Full thread

While providing third-party login services as way to sign-up had some benefits, omitting the "Sign-Up with email" option downgrades the experience dramatically. And, you know what? Providing only third-party sign-up options with "unnecessary" privileges ruins the entire experience.

A few weeks ago, I wanted to sign-up for a Product Hunt account, and in just a few seconds, my experience.. you know.. "downgraded" because there was no other way to sign-up other than through third-party services. After hesitating for some time, I forced myself to try to sign-up with my Twitter account. I clicked the Twitter icon, and it took me to Twitter, where I got these "cute/honest" permissions requested by the app I'm willing to authorize:

1. See Tweets from your timeline (including protected Tweets) as well as your Lists and collections.

2. See your Twitter profile information and account settings.

3. See accounts you follow, mute, and block.

4. Follow and unfollow accounts for you.

5. Update your profile and account settings.

6. Post and delete Tweets for you, and engage with Tweets posted by others (Like, un-Like, or reply to a 8. Tweet, Retweet, etc.) for you.

7. Create, manage, and delete Lists and collections for you.

8. Mute, block, and report accounts for you.

9. See your email address.

Oh man! 4 and 5 and specially, 6 are my all-time favorites. Are all these permissions really needed to be able to create a PH account with my Twitter? I mean, cmon.. this is not supposed to be an alternative front-end app for Twitter like "Apollo", "RiF" and "Relay" are for Reddit, this is just a website where people post their e-products once they launched, simple, huh!

I cancelled this process, and I still haven't created a PH account yet, but hearing OP screaming with this scary submission today makes me think again 'n' again.. maybe forever.. to proceed down this path.

Funniest shit is when you finally sometimes fall victim to the feeling of "Ok fine, I'll use Twitter for the auth so I don't have to fill out the fucking 10 field form just to be able to sign up, why you need to know my current position anyways?" and when you're finished, they're just using the auth to autofill the username and email for the signup form and you have to fill it out regardless.

This is the absolute worst and why does it seem to happen 80% of the time?

Because most teams didn't write their user-auth code, it's either a framework or another team. But the PO want "Sign in with Twitter" so you hack this together.

It's so they can feed the data into the sales team in case their algo thinks you are a viable target to sell things to.

They know people don't always update their profiles and use throwaway accounts. They nudge you to provide actual data.

"Nudge"? You sound like a project manager

Forcing to create a new password and field out additional fields isn't a nudge

Before 3rd party sign up existed, I remember there were patterns, where the website you have registered had an option to add your "friends". Caveat was that it asked for your email and password to your email, so it could download your list of contacts. Crazy part is a ton of people didn't see a problem with this...

...Didn't fucking facebook did it at one point ?

Linkedin. FB probably too, but too lazy to check

Linkedin was worse. It used the login/pw to send emails to your friends from your email account, inviting them to join Linkedin.

Clubhouse too. Remember Clubhouse?

https://news.ycombinator.com/item?id=25685454

there's a big difference between a permitted contacts api and just giving up your regular gmail password.

Wait, after finding out the site is obviously just trying to grab as much info from you as can be profitably marketed and even after it sets itself up for further abuse, you are still considering signing up?! I really hope I'm missing sarcasm there, cause otherwise you need to readjust the amount red flags you are willing to ignore.

"Sign up with" is a tracker's paradise anyway, but not even offering something untrackable like email is just screaming out for everyone to hear that you are the product. With the abusive access demanded, it's down to victim, really.

Have some pride, people, and don't fall for these scams!

What I don't understand is that OAuth (and related) is supposed to be a protocol, so why can't I as a user get the option to enter one ?

Imagine if you could only pick Gmail or Outlook in the form for email !

that was a thing with openid but it pretty much died out.

Obviously bad permissions are bad. But "sign-up with email" means that you need to manage you users identities which is complex and risky. You can delegate that using something like Auth0 but then it costs you money.

If I am creating a new service today I will probably won't bother and just offer social logins.

> which is complex and risky

It really isn't, it's fairly basic. It's mostly "basic" because people have been implemented those things for so long that there basically are established patterns you can reuse with very few drawbacks.

As long as read up on how to implement it and use common sense, you can get authentication working (& being secure) under a day.

Edit: Today you can even do it the lazy way and implement "passwordless" email login as a step to see if it's worth implement the simple email+password way later. Basic steps: 1) Allow users to request login, which creates a login token in the DB and sends a URL to the users inbox 2) Allow users to exchange login token for a auth token that eventually expires somehow, delete login token from DB and store login token 3) be able to lookup if a login token is correct when hitting other API endpoints

Congrats, you now have a basic authentication scheme

That ruins the experience for all users who don't want to give you their Facebook or Twitter.

Even better: I don't have Facebook or twitter, therefore I'm out. :-)

Is "Sign-in with your Hacker News account" a thing?

I will never use social logins to sign up for anything. What a terrible idea. I assume anyone doing that is just doing it for tracking or scamming purposes.

If you have a password manager synced across browsers, like chrome or firefox's builtin ones, it should be fairly simple, right?

I really don't see how using KeePass or alt is hard, and it doesn't cost money.

If anything, it's 2FA that has me more concerned, because it has made my phone number a near single point of failure with the way everyone wants to use my phone number for it still.

You'd be excluding a whole lot of people who don't have any social media accounts, and a lot of others who aren't willing to use them for this purpose.

Reply on news.ycombinator.com