Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth.
(I've been meaning to do a blog post on this topic...)
Our analytics show that many people on mobile and consumer websites do indeed want to use OAuth.
(I've been meaning to do a blog post on this topic...)
The problem however is that people easily forget what they used to login with, and when they try things like a password reset, we can't really reset their passwords if they used social logins. Or they might forget whether they used google or facebook to login...
So the main problem that I personally have with social logins is that they create fragmentation, and a simple login form becomes a memory-exercise for the user.
If a user forgets the method they used to sign up, we'll still return the right user record to your app.
Be careful implementing this, because it can be a security issue if you're not cautious.
They then try to enter email and password. When it rejects them, they try to reset the password, and get frustrated that the reset password does not work...
We relatively regularly answer support emails and just tell users "It looks like you used your google account to sign in last time, just hit the right button and you'll get in instantly"
I have multiple google accounts because I want separate google identities.
I don't want to merge them together because they're separate accounts for separate purposes, but that's a difficult position to keep because of how absurdly difficult it can be to deal with multiple google accounts. Even though Google supports multiple accounts, their base assumption is that people have exactly one Google account which is exactly one identity which incorporates all of one person.
I've been unable to accept calendar invites sent to my work account because Google Calendar insisted on opening to my personal account when I clicked the link; even if I opened my work calendar using the drop-down, and closed the other window, the link would only open to my personal calendar and then tell me 'you don't have access to this calendar'.
It feels as though the parent poster was asking for Google to understand that one person can have multiple accounts, rather than assuming a 1:1 mapping between the two and behaving as such.
Using OAuth is fine and all... but it's not eliminating the customer from having to sign-in still... ie. they are still typing a username and password, just not into your system.
So what are the benefits (both perceived and actual)?
Most people do not log out of Facebook and Google on their devices, so they do not have to sign-in. They just click "Facebook" then "Approve." That's much easier than filling out your email and password -- particularly on a mobile device.