Hacker News Reader

Comment by nostromo | Hacker News Reader

While this is probably the right move for users, Facebook OAuth is less and less relevant.

We see a trend across our customer deployments: more people are choosing Google as an OAuth provider over Facebook than ever before. Google will overtake Facebook this year. Customer preference used to be: 1) Email & Password 2) Facebook. Now it's: 1) Email & Password 2) Google and/or Facebook (tied for 2nd). Other companies in our space (Janrain in particular) have confirmed this.

I bet Facebook knows this and is trying to regain trust. The problem with what they are doing now is that more and more publishers and apps will probably just skip Facebook altogether. The primary reason Facebook was pushed so hard by so many for so long was because of the data provided. Take that away and people may move off the platform entirely.

View on HN

If Google and/or Facebook wanted to get a leg up on this, they would provide some guarantee (that the site owner is required to respect) that signing in with Google/Facebook is sufficient to start using the site.

Nothing is more aggravating than deciding to sign in with Google or Facebook, only to make the site force you to create a new username/password anyway.

It's like, the whole reason I was willing to let you correlate my identity with this Google or Facebook account is to buy the convenience of not having to make a new username/password, confirm my email address, etc. If you make me do that anyway, I've sold you a little bit of privacy for absolutely nothing in return. This makes me feel used. It feels like a bait-and-switch.

For what it's worth, you can get most of that privacy back by revoking the app's permission to use your Google account, at https://security.google.com/settings/security/permissions .

I once made the mistake of trying to actually log in to Quora, they pulled that bait and switch, and I had to do this just so that Quora would stop re-directing me to their signup process.

Agree. It's terrible UX with the current system too: Every time you click the button you sit and hope to god that you will see a dashboard on the next load. But you have no idea. Unpredictability is the biggest usability sin, imo.

That's just right. By signing up on a new website using facebook, I get all the downsides of facebook login (having to log into facebook, having them track me, giving the website a bunch of personal data), and I still have to do the manual registration form. There are no upsides for me (except maybe not having to manually type my email address).

Half of the implementations out there involve

Step 1: Log in with Facebook

Step 2: Sweet, what we meant is we're pulling your primary e-mail address and filling it in for you. You still have to set up password, confirm it, enter your birthday and set up a security question as we use our own password validation and password reset flow anyways.

I wonder if this is related to Android or Google Apps for Business more than any particular customer (dis)-satisfaction with Facebook.

I know that I have been leaning on the Google+ login a lot more now than before, because it integrates so well with my Android phone.

For me, I see Facebook as an application. It's a social network, just one thing of many I use.

Google, on the other hand, is a platform. It's Gmail and YouTube and Maps and G+ and the Play Store and Drive and a whole bunch of other things. Not just a single app, but a family of apps that share a common identity. I don't see my Google account as just credentials for an app; I see it as a common login for a whole ton of different apps. In particular, I'm used to the paradigm of "use my Google account to pull my identity and my data down to my Android device", and I don't see any problem in extending that paradigm to apps that aren't made by Google.

As a user, I actually prefer Google's Oauth login precisely for lack of the underlying platform.

It lets the site confirm that I'm the Gmail account I say I am, and if I accidentally give it publishing permissions, it can shit all over my Google+ profile without anybody impacted. Giving a Facebook app publishing permission is a bigger hassle, so Facebook logins carry more cognitive load.

Immediately thought of this the Steve Yegge rant from a while back - https://plus.google.com/+RipRowan/posts/eVeouesvaVX

He argued Facebook is more a platform than Google is - apparently because its easier for developers to build inside of Facebook's platform than Googles.

Huh, he seems to focus pretty heavily on G+ API, which was probably pretty bad when he posted this in 2011. Any idea if it's gotten better?

> Huh, he seems to focus pretty heavily on G+ API, which was probably pretty bad when he posted this in 2011.

The repost of this (I don't know how close it was to the original sharing) was about a month after Google first released the initial, extremely limited G+ API -- and only four months after Google introduced G+. (Google had already rolled out another set of APIs at the time of that repost.)

> Any idea if it's gotten better?

G+ in specific has a much more robust API than it did at the time (unsurprisingly, given how new it was then), and more significantly Google in general has really developed very much in a way that seems to be in the direction Yegge was calling for in the essay.

My sample-size-of-a-few take is that it's a combination of factors:

1) The probability that a Facebook users at somepoint has had a bad experience with rogue Facebook app publishing personal information (or even an accidental acceptance) or was witness to a friend's experience is non-trivial

2) The increasing awareness of the scope and scale of personal data that is taken from logins and shared with advertisers

3) The demographic shift in Facebook usage to older users

4) The large secular increase in awareness of ongoing privacy and financial information breaches that rightly or wrongly is associated with over-sharing of personal information

Seeing a friend post embarrassing spam or porn is a horror inducing visceral experience. It wakes people up to the fact that Facebook's business is fundamentally unseemly.

Exactly - given an average of 500+ friends and years of being active daily or weekly for a large chunk of that time, the probability that you've at least witnessed an embarrassing incident is many orders of magnitude greater than just having done it yourself.

I really believe there's a high level of wariness among the general FB user population that no amount of marketing or changes in authorization policy can fix. It's a level of trust that's irretrievable.

In my case, I simply don't use Facebook or Google Auth for site logins simply because I can't be bothered to work out how the data might get used, what the tracking implications are, whether things would suddenly show up on my Facebook feed etc.

Faced with the choice of trying to understand that lot, or typing my e-mail and password in, I'll go for the latter. I surely can't be the only one.

Twitter OAuth is even worse, however. It doesn't even give you an email address.

That's been fixed for mobile apps if you use Fabric/TwitterKit.

I don't think you can call that fixed if the solution is proprietary.

I've never seen a single site that uses Google login over Facebook. Facebook also owns mobile login on the iPhone. Google is closer to shutting down Google+ than winning any war with Facebook.

> I've never seen a single site that uses Google login over Facebook.

My comment was about the user's choice. Most big publishers with a lot of reach (HuffPost, NYTimes, etc.) will give you more than one OAuth option. And in those cases people are choosing Google more than ever.

For mobile apps, you're right, Facebook OAuth is popular on the iPhone. But on Android...

It's been dead on IOS for a while:

https://code.google.com/p/google-plus-platform/issues/detail...

Such assholery by Apple. Not even remotely surprising, though.

Google+ doesn't need to exist to beat Facebook; Facebook simply needs to fall out of favor, which appears to be happening:

http://www.forbes.com/sites/parmyolson/2015/01/27/facebook-a...

http://www.pewinternet.org/2015/01/09/social-media-update-20...

http://www.theguardian.com/technology/2013/nov/10/teenagers-...

Looked up the latest Janrain report. Looks like the trend reversed and Facebook increased their share:

"Facebook is regaining ground lost in Q4 2014, with noteworthy growth in the Consumer Brand (9% increase) and B2B (11% increase) verticals

Google+ saw an overall decrease of 6% from last quarter, widening the gap with Facebook to 8% with a total share of 37%"

http://janrain.com/blog/social-login-trends-across-the-web-q...

    more people are choosing Google as an OAuth provider over Facebook than ever before. Google will overtake Facebook this year

Personally, I use google in logins because I actually use facebook more and don't want to share my facebook profile. I don't think using one service for logins means anything, hell I have an email which I use solely for registrations so I can reduce the spam I get in my real mail.

So be it... honestly, for the most part this is and should be about basic authentication for identity. As long as you offer Facebook/Google/Twitter (and maybe another) with a fallback to an email/passphrase account, it's generally all you should need.

Yeah, if you are trying to tightly integrate, it might help... but in general, having a "share" link it enough, and given how many places are using FB for comments, and the like, I never liked the result. When an app asks for permissions it really doesn't need, that is another thing I really don't like.

Reply on news.ycombinator.com