All geek questions in one place

Why shouldn't I use Facebook Connect or OpenId to log in users?

Jeff Atwood claims that we should stop asking users to register on our sites because we must use their “Internet driver license”, [their] existing Twitter, Facebook, Google or OpenID credentials to authenticate them.

While I am starting to think that he may be right, I still could not decide, and I am looking for arguments against having foreign sites gain control over their personal web pages.

Do you see any dangers for user authentication?

+4
source share
3 answers

if you want to get a deeper response based on who has been involved in this technology before, you should listen to the recent .NET rocks with Rob Connery who were specifically on this issue. http://www.dotnetrocks.com/default.aspx?showNum=626

After listening, I decided NOT to use OpenID on my site.

Here is a link to Rob's blog blog on the topic: http://blog.wekeroad.com/thoughts/open-id-is-a-party-that-happened

+6
source

Here are a few reasons why not, although each one has reservations:

  • If you only authenticate one external service, anyone who does not use this service cannot use yours.
  • If your external authentication service is disabled, users will not be able to use yours until their backup is returned; similarly, slowing down their authentication server will also affect you.
  • Users are required to authenticate with another service, requiring them to accept this EULA service, which may be a turning point for some; Similarly, it connects you morally with what your authentication service accepts. In particular, this can make you a companion, assistant or partner of the auth site, as users should see their logo every time they try to use your service.
  • The external auth domain takes the perfect snapshot of your viewer, giving them a lot of information about what your company is doing. Because their analytic tools and staff are generally second to none, they may know more about your user base than you.

The main way to avoid this problem is to allow people to use the service of their choice, and not just one service. If you are limited to development, then to limit development time, using OpenID is the best option, since many other authentication domains also qualify as OpenID, and therefore resolve most of the above problems.

+6
source

I think that using identifiers from any of these big names is fine if you do not provide a service that needs an endpoint, such as email, chat, etc.

However, OpenID is simply not trustworthy. If in doubt, try this OpenID

http://opennoid.appspot.com/anyid

This is a one-time identifier that does not require a password to enter.

0
source

Source: https://habr.com/ru/post/1336807/

More articles:


All Articles