Hacker News Reader

Comment by Smerity | Hacker News Reader

This is a good time to remind ourselves: Facebook's API is a service and can be a single point of failure for your business. Unlike AWS, you don't even pay for it and it has a history of being problematic[1].

Allowing users to log in to your application using Facebook is quite common. It can be easier for users. It can give you access to demographic data with less work. But the API can die, change, or act generally unpredictable. And you have zero control over it.

This particular issue is impacting 9gag, Pinterest and others. Whilst many of these sites support user logins without Facebook, just as many of them don't. Imagine if tomorrow Facebook charge to connect to their API or there's some extreme exploit. How much damage would your application face?

[1]: http://techcrunch.com/2011/08/11/facebook-wins-worst-api-in-...

View on HN

I find it ridiculous that so many sites use FB as main login method, this is a critical part and relying on something that you have no control over, which is also probably collecting data about users that use your site, is a big red flag. Sure, it's more conveniant for many users to just click 'Login with FB', but I find it short-sighted.

I've found sites that only allow logins via Facebook to be very convenient to use. The moment I see them doing that, I know immediately that it's a site that I have no reason to use. I can move on right away, rather than wasting time with it.

You can get the best of both worlds by making it so that your user (has to?) also set a password when they finish logging in via facebook the first time.

This way, if facebook ever down (or removes their services), you have an _out_ for your users to login via the traditional username/password.

You don't even have to make them set a password when they first register - just verify their email address and handle setting a password though the usual forgotten-password flow if you ever need to.

Why even verify their email address? It's already been done by Facebook?

Verify they still have access to that email.

A lot of people have 6yo+ facebook accounts. I quite enjoy the fact that my verified facebook email goes to a dead account that I only monitor on a 6 month basis... it saves me from a ton of spam.

Remember when they changed everyones default email to be username@facebook.com? Yeah, thats pretty much all you're going to get from the API.

A) not true, the API releases "primary email" which is usually NOT facebook. and B) even if it were that's why you check and verify: if u pull a @fb address don't save it, just prompt the user.

To me as both an app user and developer, single sign on feels like the Right Thing To Do. I'm sick of running through the same sign up flow for every single service I use, like a hamster wheel. Maybe the solution isn't fb, it's some kind of apple or google SSO? Why aren't AAPL and GOOG pushing their own SSO hard on the mobile ecosystems they control?

shrug maybe all my developer friends are wrong. I don't bother with FB API.

The solution is definitely not Facebook, Google, or Apple. They all plugged SSO into an existing platform and allow developers to perform actions on my behalf with the same credentials. Sadly, Microsoft's Passport.net was the closest anyone has gotten to a real solution because they treated their own properties as just another consumer. They killed that by trying to tie it directly into your Windows login which are inherently insecure.

> Why aren't AAPL and GOOG pushing their own SSO

because neither of them has a controlling amount of the required market (which is basically the entire internet!).

Mozilla has a project called persona (http://www.mozilla.org/en-US/persona/), which aims to solve this by splitting the login from verification and authentication, but preserves privacy (unlike oauth). If vendors of services can give up their desire to control the userbase, this could be the solution.

It also gets you the worst of both worlds, in that you have to build both a Facebook auth solution, and store some form of user password hash on your servers

And the worst of all worlds for the user. When I use Facebook logins for a site, it's because I don't know if there's value in the site so I want signup and evaluation to be as quick and painless as possible. I don't want to have to go through other steps, I want a one-click registration and login.

A pet peeve of mine is when I click on the login with facebook button and the site still makes me fill out my name, username, email address, and set a password. So what's the point of logging in with facebook?

It's so a) they get all you and your friends' social data, b) they can prefill your signup form and 3) to make sharing easier and friction-free.

I'm assuming that you have multiple (throw-away)-facebook accounts? Because you don't give a site that you don't know has any value access to your facebook account? Right?

I have one throw away with no friends and no info (I consider this best-practice) for these situations.

>You can get the best of both worlds by making it so that your user (has to?) also set a password when they finish logging in via facebook the first time.

Then why are they bothering to sign in with facebook at all? It is now a more involved process than simply signing up with email/password, which is what facebook logins are supposed to be for avoiding.

Also, unlike AWS, you can't choose to migrate to a different provider in a way that will be completely transparent to your users.

I think all the points you make are obvious. If you rely on something that you have no control over, you're liable to get burned if you don't pay attention to API changes or if Facebook doesn't keep it's contracts from an architectural standpoint.

But it's also the price you pay if you want to tap into their user base. So it is what it is. You just have to keep your head on a swivel. shrugs

>But it's also the price you pay if you want to tap into their user base. So it is what it is.

It is? The facebook userbase is entirely and completely unwilling to sign up with a password? Putting a facebook login button on your site doesn't tap into facebook's userbase. If you want to try to tap into their userbase, you need actual integration with facebook, which can be done even though you had them sign up using a password. That way they can still use your site when facebook fucks up, and only the "automatically spam my friends" stuff stops working.

Interesting correlation between popularity and quality - i.e. the worst APIs are probably the most used.

Or maybe the less used APIs just don't reveal themselves as crap yet, because of the lack of experience with them?

I'm yet to see a very well done API.

That was my interpretation. In most of IT (operating systems, software, APIs, etc) the more you use something the more you grow to hate it.

Apparently, the Stackexchange network handles this by linking an account to an email id. If you cannot login by using facebook, you can use google to login provided you have the same email id and link the accounts.

Reply on news.ycombinator.com