|
I am building a app (and a online site to go with) and need inputs from you guys regarding using authentication provided by google/FB/MS vs classic way of login (register users and maintain username/password). It's a side project and i am trying to reduce the development time in every possible way without compromising the quality of the app/website. would you guys will be willing to use a website where only way to authenticate is using either Google/FB/MS account ?
|
|
|
|
|
|
|
One is that I don't have any of those accounts, and the main reason is that if an app forces me to log in using social media I suspect they really just want my personal data, my contact lists etc, that they're going to want to constantly bug me to share, to harasses my contacts etc etc.
|
|
|
|
|
Yep. That is true. But I have created a dummy account just for authentication purpose. Not sure if others are also doing that. the only reason i am thing about that because it will save me some time and headache that comes with maintaining password.
|
|
|
|
|
I have a spare account for places like those. I do face problems when I am using a computer where I have my main account logged in.
If I did not had spare account, I will not login because I wont read terms and conditions and I wont trust the site. Basically, when I browse a new site, the mode is guilty until proven innocent.
"It is easy to decipher extraterrestrial signals after deciphering Javascript and VB6 themselves.", ISanti[ ^]
|
|
|
|
|
The problem with rolling your own password database is that you have to do it right - encryption, security, etc. Note that in many jurisdictions, any database that contains personally-identifiable information requires extra precautions. Ignoring them can cost you big bucks/euros/...
Using FB/Google/etc. gets around some of this requirement, at the cost of adding to the already vast amount of information that they know about your clients (e.g. they know that your clients visit your website).
For mainstream sites, IMO most members of the public would be quite happy with authentication via FB/Google/etc. If, OTOH, you are building a site to host discussions about <your favorite conspiracy theory>, you may wish to reconsider. 
Freedom is the freedom to say that two plus two make four. If that is granted, all else follows.
-- 6079 Smith W.
|
|
|
|
|
Daniel Pfeffer wrote: The problem with rolling your own password database is that you have to do it right - encryption, security, etc. Note that in many jurisdictions, any database that contains personally-identifiable information requires extra precautions. Ignoring them can cost you big bucks/euros/...
Yep. And that is why i want to avoid it. it's a lot of work and not that many befits. Usually if i see a option to use Google/FB/MS i take that. But again i have a dummy account just for that. I am not sure if most guys do take that option or not.
|
|
|
|
|
CS2011 wrote: Usually if i see a option to use Google/FB/MS i take that. But again i have a dummy account just for that. I am not sure if most guys do take that option or not.
That is up to them. Creating an additional account is not exactly rocket science...
Freedom is the freedom to say that two plus two make four. If that is granted, all else follows.
-- 6079 Smith W.
|
|
|
|
|
Without a rock-solid reason do not get into building your own user management system...
"The greatest enemy of knowledge is not ignorance, it is the illusion of knowledge". Stephen Hawking, 1942- 2018
|
|
|
|
|
The other option I've not seen mentioned here is running your own LDAP rather than rolling a database. Every cloud service I've looked at offers the option of spinning up an AD server. It requires a little bit of compliance and maintenance, but it scales well and addresses a number of security concerns out of the box.
"Never attribute to malice that which can be explained by stupidity."
- Hanlon's Razor
|
|
|
|
|
CS2011 wrote: would you guys will be willing to use a website where only way to authenticate is using either Google/FB/MS account ?
It can be quite convenient. As others have said, I'm not keen though on having some one-off site gather a bunch of personal information.
CS2011 wrote: and i am trying to reduce the development time in every possible way
There's quite a few open source examples of using Google/FB/etc for authentication, in a variety of languages.
Rolling your own authentication can be a PITA. Besides the obvious (encrypting the password) it requires:
Are you sending an email with a link to confirm registration?
How does the user change their password?
How does the user recover a lost password (more emails usually)
What about 2-factor authentication (typically a text message)
Which means setting up an email server (along with the associated risk of more open ports and the overhead of setting up yet another secure server), one-time tokens expirable tokens for registration, password change and password recovery, possibly connecting to an SMS provider for 2-factor authentication, and probably CSRF/XSRF/XSS protection.
[edit]Oh, and cookies or some other mechanism to implement "Remember Me"[/edit]
Latest Article - A Concise Overview of Threads
Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny
Artificial intelligence is the only remedy for natural stupidity. - CDP1802
|
|
|
|
|
No for the same reason as many above I would not use cross website authentication. I do not think you have to write your own either. Plenty of options:
Google: cloud user authentication
"If we don't change direction, we'll end up where we're going"
|
|
|
|
|
the app/website i am building will be free to use. As per now i am not aware of any service which is providing that free of cost. So my options are limited to use some already written module for user management and maintain the server/security etc or avoid it altogether by using Google/FB/MS etc. In case if you know of any service which provide that service for fee up to say 1000 users definitely i will be willing to give it a try.
|
|
|
|
|
I'd prefer to not use Google/FB/MS for logging into anything but as a developer I recognize the convenience of utilizing it for speed, ease, and so on.
Why do I prefer not to? A multitude of reasons. First... single password, multiple sites. With individual logins I can create a unique password for it. If your site gets compromised, only that site is compromised. Second, the big guys aren't perfect either. Google just admitted it knew about a security bug which gave developers access to private profile data and chose not to disclose it. Facebook just had a bug that allowed your account to be impersonated on linked services. Twitter had that bug where all logins and passwords were being written in plain text to the internal error logs. MS has had their own security problems in the past.
I tend to avoid sites and services that force me through one of those routes if there is a viable alternative. I also recognize that those views put me in the minority.
|
|
|
|
|
Sorry, absolutely not. But I'd be happy to create an account at the website (or better yet, use the website as a guest without having to sign in).
/ravi
|
|
|
|
|
I have a "totally legit" google ID that I use for logging onto websites that allow to be authenticated via one.
|
|
|
|
|
Company switched over to gmail some weeks ago, and I was used to having spam fully disabled. Gmail is a bit fiddly with it but you can make a filter which I assumed meant any spam would go to the inbox.
So when I noticed the spam count of 1 this morning. Click the tab and see a Microsoft Insider Program newsletter.
My first reaction is, "Oh okay, it's a newsletter that a bunch of others might have clicked spam to, and gmail with its black box just following what the masses it told it."
but "I stopped getting spam things. Odd, the filter is working. I have really bad spam in my inbox."
NO "is google hiding any potential Microsoft tools which could make me switch back to office?"
Let me actually read the stub alert for its reason.
"Ahhh, redirected from my old account and gmail unable to verify sender."
That is all good. No worries.
...
Test sending to the old email account to see if my filter works on those as well.
Email arrived into Inbox.
|
|
|
|
|
But these are still in production, to my surprise: Wilesco D16[^]
I had one when I was a kid, probably handed down from my uncle. I never bothered to oil the piston before running it, but it worked anyway. I wonder what became of it. It probably disappeared when we moved to Texas. Or it still is hidden in a storage box.
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
Got mine...somewhere...still.
|
|
|
|
|
Why are they not charging their cell phones on these?
That's a steam powered generator. I'm ready to run my house off of a couple of those. 
|
|
|
|
|
Why don't you 3D print a generator[^]?
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
Those two together are perfect. Now all I need is fire and water and I can power my home and charge my phone.
I'm going off grid!
|
|
|
|
|
Even better: Wilesco T125 Steam Turbine Generator[^]
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
A rather costly toy.
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
