I'd say the main con is that the site isn't reliable. I'm not being facetious. If you're going to use 3rd party sign on, being on the front page of HN shouldn't be enough to bring it down. Imagine if you posted your company's site instead of the underlying technology and your sign-in was negatively affected.
My personal feelings, that aside, is that though many of us are privacy conscious, adding more and more dependencies to your site results in us having to trust more entities. Even if they don't store anything, we have to trust they aren't lying, that redirection is implemented properly, etc.
I think the best thing you can do if you care about the privacy of your users is minimize the amount of information necessary. So if your site doesn't require email, don't take it. If a phone number isn't necessary, don't ask for it. Use usernames, only ask for an email when the user is doing something that would require it (e.g. they need a receipt).
One thing that I love is when a site actually gives you a temporary username the minute you visit the "app" portion and you can use the site as if you created an account without having to do anything. That's usually a sign that the administrators really do care about you not jumping through hoops.
So if your site doesn't require email, don't take it.
I'd even say "don't ask for it". Landing on the site I get a big banner that takes up a lot of the screen asking for my email. For a service that is talking about data protection and privacy, this sets off alarms. It may be completely honest and genuine, but since it takes so much of my screen it feels like you really want that data from me.
If your target audience is privacy conscious people you gotta know how privacy conscious people think. If you can't think like them, well then I'm also concerned that you don't have our interests in mind.
Do you work on high traffic websites? Surges in traffic such as these often expose underlying bottlenecks. Give the people a break, I'm sure they'll work on fixing it after today.
I'm not criticizing the people. Do you not think it's legitimate criticism that using a niche 3rd party login system can be bad precisely because they're still ironing out the kinks?
As always, it depends. A quality SaaS provider is going to have more expertise in their niche. They'll have more advanced functionality that can be turned on quickly (SSO for that big new partner).
Your outage is within your control
This was the standard argument against cloud infrastructure and the industry has continued to shift in that direction anyway.
Generally up to the website on how to implement the system. Some have done with usernames, some without.
Generally, users aren't looking for a 'I forgot my password' button if they aren't asked for a password in the first place.
Comments
I'd say the main con is that the site isn't reliable. I'm not being facetious. If you're going to use 3rd party sign on, being on the front page of HN shouldn't be enough to bring it down. Imagine if you posted your company's site instead of the underlying technology and your sign-in was negatively affected.
My personal feelings, that aside, is that though many of us are privacy conscious, adding more and more dependencies to your site results in us having to trust more entities. Even if they don't store anything, we have to trust they aren't lying, that redirection is implemented properly, etc.
I think the best thing you can do if you care about the privacy of your users is minimize the amount of information necessary. So if your site doesn't require email, don't take it. If a phone number isn't necessary, don't ask for it. Use usernames, only ask for an email when the user is doing something that would require it (e.g. they need a receipt).
One thing that I love is when a site actually gives you a temporary username the minute you visit the "app" portion and you can use the site as if you created an account without having to do anything. That's usually a sign that the administrators really do care about you not jumping through hoops.
Site still down so couldn’t read it, but from your post, I wonder if SQRL would fit the bill?
https://www.grc.com/sqrl/sqrl.htm
I'd even say "don't ask for it". Landing on the site I get a big banner that takes up a lot of the screen asking for my email. For a service that is talking about data protection and privacy, this sets off alarms. It may be completely honest and genuine, but since it takes so much of my screen it feels like you really want that data from me.
If your target audience is privacy conscious people you gotta know how privacy conscious people think. If you can't think like them, well then I'm also concerned that you don't have our interests in mind.
Do you work on high traffic websites? Surges in traffic such as these often expose underlying bottlenecks. Give the people a break, I'm sure they'll work on fixing it after today.
I'm not criticizing the people. Do you not think it's legitimate criticism that using a niche 3rd party login system can be bad precisely because they're still ironing out the kinks?
Keep in mind the alternative is that you are ironing out the kinks of a homegrown login system.
The big thing in my mind is the ability to migrate away from a SaaS.
You mean the alternative is better, right? Your outage is within your control, not in the hands of people with much less skin in the game.
As always, it depends. A quality SaaS provider is going to have more expertise in their niche. They'll have more advanced functionality that can be turned on quickly (SSO for that big new partner).
This was the standard argument against cloud infrastructure and the industry has continued to shift in that direction anyway.
How would you use usernames without email? Users won't understand a system where you can't click an "I forgot my password" button and recover.
Generally up to the website on how to implement the system. Some have done with usernames, some without. Generally, users aren't looking for a 'I forgot my password' button if they aren't asked for a password in the first place.
This is a good question, generally you’d only do this in situations where the data itself isn’t too important, like Reddit.
That being said where I seen it used there’s usually a huge disclaimer asking you to put in your email