Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Myself and a friend are looking to launch a little forum site. I’m considering using the “Sign in with Facebook/Twitter” APIs, possibly exclusively (a la e.g. Lanyrd), for user login. I haven’t used either of these before, nor run a site with user logins at all.

What are the pros (and cons) of these APIs? Specifically:

  1. What benefits do I get as a developer from using them? What drawbacks are there?

  2. Do end users actually like/dislike them?

  3. Have you experienced any technical/logistical issues with these APIs specifically?

Here are the pros and cons I’ve got so far:

Pros

  • More convenient for the user (“register” with two clicks, sign in with one)
  • Possibly no need to maintain our own login system

 Cons

  • No control over our login process
  • Exclude Facebook/Twitter users who are worried about us having some sort of access to their accounts
  • Users’ accounts on our site are compromised if their Facebook/Twitter accounts are compromised.
  • And if we don’t maintain our own alternative login system:
    • Dependency on Facebook/Twitter for our login system
    • Exclude non-Facebook/non-Twitter users from our site
share|improve this question
2  
(cons :facebook interwebs) –  Thomas Eding Feb 11 '11 at 4:55
1  
Have you considered using more OpenID providers than just Facebook and Twitter? –  jprete Apr 11 '11 at 16:22
    
@jprete: no. (Technical quibble: we’re not considering using Facebook/Twitter as OpenID providers, rather login providers.) As far as the mainstream goes in the UK, everyone’s heard of Facebook and Twitter, and no-one’s heard of anything else. –  Paul D. Waite Apr 11 '11 at 17:00
1  
I suggest if you do end up going with Facebook/Twitter as login that you mention to your users that you don't have access to their login information at all, so that they will feel more comfortable. –  The Muffin Man Apr 11 '11 at 17:55
1  
@PaulD.Waite Nobody in the mainstream of the UK has heard of Google, Yahoo!, or the BBC? –  PeterL Aug 29 '12 at 13:00

12 Answers 12

up vote 15 down vote accepted

A con I would say is that a user might be paranoid that now they've logged onto your site using their Facebook/Twitter credentials they think that your site has full access to all of their information on those respective accounts.

share|improve this answer
4  
That’s a really good point. I’ve avoided using lots of apps on Facebook because they seem like they’re asking for complete access to all my information. (Even if they’re actually not — I think Facebook’s prompt is a bit off-putting in this respect.) The same would apply to using Facebook to log in somewhere. –  Paul D. Waite Mar 7 '11 at 13:08
    
agreed, that's why I don't use them, very off-putting. Though I have a fake facebook account if becomes very popular. –  Spooks Apr 11 '11 at 12:01
3  
This, never have used the Facebook/twitter to log into another site. A lot of it comes down to online shopping sites, as I want to keep my money/bank information faaaaaaaar away from facebook or any social networking site. –  falclif Apr 11 '11 at 16:27

Please don't do it.

Many people, especially those not based in US won't have a Facebook account and won't create one remembering all that has been said in relation to Facebook and its ignorance of users' privacy.

Contrary to what many believe in, there are lots of people who happily live without those social noise&junk sites and don't give a damn about them.

Why spit them in the face and reject them just because they haven't succumbed to the mass hysteria called Facebook?

Other points to consider:

  1. You will introduce a single point of failure by making it dependent on an external system. If they decide to shut down their OpenID or make you pay for it, you're massively screwed.

  2. They will gather data about your users and who knows what to do with it. At the very least they will use it in marketing purposes and ultimately make money on it and they won't give you a piece of the pie.

  3. Through taking them as an OpenID provider you will further support their quasi-monopoly and help them grow even further. Do a community service and do not contribute to that plague.

share|improve this answer
1  
Good point about the external dependency. I’m not sure on the gathering data stuff though. Surely the only data they get is the fact that the user has logged onto our website? I’m not saying that’s nothing, but I’m not sure if it’s significant. –  Paul D. Waite Feb 11 '11 at 0:02
3  
"They will gather data about your users and who knows what to do with it." It's not hard to imagine Facebook one day deciding to post on the user's wall each time they use Facebook to log in to an external site. And there will be nothing you can do about it should Facebook decide to make that change. –  Jason Mar 7 '11 at 15:50
    
I feel point 3 is gibberish. If someone grows well, he is likely creating ways for others to make money too. –  Alexander Jan 11 '12 at 23:04

Another con: exclude non-facebook and non-twitter users (or users that just don't feel safe sharing their login info to other sites). Or cause them inconvenience by making them create an external account. I personally don't like the single point-of-failure idea that if someone gets my Facebook/twitter login info they can get into any other site that uses the same info. But maybe I'm just paranoid.

share|improve this answer

I can see it being used as an option, but you'd lose a lot of potential visitors if you required a FB or Twitter login. Even if visitors have FB accounts, many wont want to use them for privacy purposes. I certainly wouldnt want to give some random site personally identifying info.

And you'll still probably need some form of user tracking system anyways, since you may want to track user info related to your site, such as preferences.

share|improve this answer
    
“ou'd lose a lot of potential visitors if you required a FB or Twitter login” — do you have any source for this though? I get that you wouldn’t want to do it (neither would I), but aside from our instincts, is there evidence of what users actually do? –  Paul D. Waite Feb 10 '11 at 21:54
    
“you'll still probably need some form of user tracking system anyways, since you may want to track user info related to your site” — sure, but we could still avoid maintaining our own login system — just store the preferences alongside whatever ID the Facebook/Twitter APIs give us for the user (assuming they actually do that). –  Paul D. Waite Feb 10 '11 at 21:56
1  
FB has 500 million users. The population of the world is almost 7 billion. That math isnt in your favor. If you consider the US, its 300 million population vs about 125 million US users. Again, not in your favor. And that ignores fake FB users. If you really want to go the FB route, you might consider instead making your site a FB app. –  GrandmasterB Feb 10 '11 at 22:02
2  
“B has 500 million users. The population of the world is almost 7 billion. That math isnt in your favor.” Not everyone has a computer! 125 million US users also isn’t bad at all. –  Paul D. Waite Feb 10 '11 at 22:09

A site I frequent has its own local login system/user accounts, but users have the option of linking their account to a Facebook account if they wish. So for those people they have the benefits of easy logging-in if they choose, and no one is forced to use a Facebook login if they don't want to. It works quite well, I'd say.

share|improve this answer

I played around with using OpenID, Facebook, and Twitter for logins. One time I was just testing it, and I couldn't login using Facebook for some reason. After looking at the Facebook developer page, I noticed their API server was down. So that's a big drawback when users can't login because Facebook is having some downtime. Twitter might have the same issues, as would OpenID.

share|improve this answer

It really depends what your target market is. For instance, in some target markets, that "exclude non-users" concern is a tiny one (almost all users have them and are happy to share). In others, it's a massive problem.

You can see it here in the answers: Programmers tend to be very careful with security and don't want to give access, hence all the "NO!" answers :-p Non-technical people are less careful about this.

But the obvious answer is do both fb/twitter and your own system if you can. Then everyone's happy.

share|improve this answer
    
Sure. Lanyrd, for example, seems to be doing fine relying solely on Twitter for authentication, but it’s targeted specifically at people who attend/speak at conferences, so it makes sense. –  Paul D. Waite Feb 11 '11 at 0:34

I have a Facebook account but when faced with a site that wants me to login using it, I do not. If there is an alternative method I will use it. If not, I don't really want to see what's on that site anyway. I hate going to sites and seeing what other Facebook friends have done on that site as well, it's creepy and intrusive of your privacy (especially when I didn't login through Facebook or tell the site my Facebook account).

share|improve this answer
2  
Logging in via Facebook doesn't mean the site is using your info to pull (via the Graph API) what you're friends have been doing. Some sites would simply like to avoid building an entire membership system of their own. There are a great deal of benefits for both parties. –  Chad Apr 11 '11 at 14:56
    
I would never sign into a site that only uses Facebook sign on and nor would nany other people. We don't know what you are doing with the data until you sign in. –  HLGEM Apr 11 '11 at 15:13
    
What data? I don't get it... why are you posting something so personal that you'd be "scared" of someone else "getting" it? That's not the smart way to be using social media on any platform. A single sign on like system, whether it's Facebook or not, is something the Internet could really benefit from. –  Chad Apr 11 '11 at 23:54

One con to doing it purely that way -- how do you test locally without complex external dependencies? How do you setup random test accounts? Demo accounts? Non-human user accounts? Typically you need a local authentication scheme to cover these permutations, even if the hope is most users store credentials externally.

Most important -- if you don't have an internet connection, you can't even hack, much less do material work, on your app at all. And, when you do have bugs in authentication or authorization, how can you be sure its not a facebook/twitter/other oauth issue if you can't run something simple and local to make sure your code is correct?

share|improve this answer
    
Simply create a new fb app, myAppTest. Use the test app's ID internally, use the real app's ID publicly. Not too bad really. –  Chad Apr 11 '11 at 14:53
    
Except when you are on a plane . . .. –  Wyatt Barnett Apr 11 '11 at 15:16

I would say that using an external log-in system can work very well -- look at how openID us used on stackoverflow and stackexchange. The advantage is great: you don't have to code all the log-in system, which is a big chunk out of the initial code-base you can simply ignore, and you don't stand the chance of getting it wrong, and can let someone else worry about what sort of password is sufficient, and how to reset it, and so on. And if they already have an openid somewhere (either from a blogging account, or one they set up to access stackoverflow) they don't need to remember another username/password combination.

The disadvantages are that many users find it a bit confusing, and may not want to create an openid on an external site if they haven't used one already.

Using a facebook login has all those benefits, plus the opportunity to interface with their facebook account if they permit.

The downside is that if you rely on facebook exclusively, you're tying yourself to them: if facebook ever change their API or ban your site, or users such as me refuse to log in to a site that may share data facebook (who are known to not be very cautious when it comes to not leaking that data to other companies). Note that IIRC, even having a facebook "like" or "login" link on your page will let facebook track which logged-in users view your site, a la doubleclick.

So, I would say:

  • ideally, you would allow logins with several external sites: openID sites, facebook, google, etc.
  • if you have a facebook login form, you don't put it right on the first page, only show it when users click "log in with facebook" (I'm never going to complain about having the option to do so :)).
  • To start off, decide which is quickest for you to set up, accounts and passwords, or openID or something else.
  • Decide whether it's worth adding accounts and passwords as well or not, if you have external log-in. (But make sure to have at least a couple of external log-in)
share|improve this answer

I am at the very least, wary of the headliners of social media, and especially of Facebook for their liberal disregard for elective information sharing. This distrust has a compounding factor that the seemingly vast majority of apps I have encountered request all my information, and then information on everyone I know to participate in their app context. Baloney. Government security clearance interviews ask for a lot of information as most would expect, but don't come even close to what FB "demands". I have an account, but its stock, only used for the core features.

That being said, I like federated Id in concept and practice (like openid and open auth in general). I think that using the providers supported by the major web mail providers is hard to argue with from a user perspective, for a couple of reasons. One, obvious benefits of federated Id (such as less pairs of login information to remember or otherwise manage with yet another local login information store app or addin). Second, I trust my email provider to do a fairly good job of guarding my personal information (and by consequence, my inbox) as long as I do my part of protecting my credentials (strength of username/pass, and judiciously control exposure ).

I might consider other Federated Id providers, but they would have to be compelling, per the purpose of Federated Id.

Lastly, integrating a multitude of providers is not necessarily easy. The stackexchange team have commented about the challenges a while ago. If I wasn't on a mobile device I would do the search for you.

share|improve this answer

Meh, I'm in another camp apparently. To me, the concept of Facebook is one that will stand the test of time. Perhaps it won't be Facebook in the future, who knows. However, going beyond privacy conspiracy theorist concerns (you can control your privacy), my opinion is this sort of service will become "utility". In that you pick up your phone to call someone, you run out to your mailbox to grab the mail... you'll "Facebook" your fiends to get in touch.

We're already experiencing significantly reduced email traffic now that people "Facebook" each other instead. It's only a matter of time, but email will continue to dwindle in usage.

Also, keep in mind that the types of people you want logged into your system may very well be the types who would have a Facebook account. Those that don't, typically (from my experience), aren't going to "participate" on your site anyway (or any site really, for that matter).

The fact is, whether it's facebook or not, a system where everyone can communicate instantly with people they approve of, will be the best candidate for an Internet "single sign on" system. You can't simply dismiss "2-click registration and no-click/1-click login" as small pros, they're HUGE!

For people worried about privacy, what are you putting out there on your Facebook profile that could be damaging if taken? Why are you putting it out there?

My vote (for what it's worth) is go for it! Go hog wild, completely replace your membership system with a Facebook-only system. I have, and my users like it so far.

share|improve this answer
1  
“Those that don't, typically (from my experience), aren't going to "participate" on your site anyway (or any site really, for that matter).” — Given the 2 upvotes for the “Please don’t do it” answer, I’d say that for some classes of user, they’ll participate lots despite their aversion to Facebook account. –  Paul D. Waite Apr 11 '11 at 15:06
    
robert: I rejected your suggested edit to the answer, since that should be a comment rather than an edit. –  user281377 Aug 29 '12 at 11:41
2  
The assertion that people without Facebook accounts don't participate in online communities is ridiculous. Facebook is lowest common denominator internet junkfood. Some people keep in touch with friends and family just fine without it. I know I do, and I'm still active in several online communities (including StackExchange and a handful of art websites). –  KChaloux Aug 29 '12 at 12:54
    
I wonder how you feel about this in 2013? –  DOK Nov 16 '13 at 1:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.