1

Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login with their Facebook or native account?

Are there any security implications? Is it as bad as notifying a user that their password is wrong while their username is valid instead of simply flashing that the user entered the wrong combination?

Improve this question

1 Answer 1

Reset to default
2

Generally, the fewer things you say, the better off you are. I wouldn't tell the user anything.

Actually, if you are going to use social login, I would recommend not having any other login alternative. All you really need is a user's unique identity (within your system) e.g. their email address. (Note: in some countries, you cannot use email as an identifier).

If you do offer social login, why go through the burden of maintaining username/passwords for those individuals? The day you get hacked, the damage will be minimal.

Improve this answer
4
  • 1
    I guess sometimes people don't feel comfortable sharing a third party account with the service they're using. Personally, I like using burner email accounts for web services that aren't well known or that I think have lax security measures in place.
    – Charming Robot
    Commented Jan 13, 2019 at 20:33
  • I guess you're right about: "Generally, the fewer things you say, the better off you are. I wouldn't tell the user anything." After a second thought, I came to realize that the worst that can happen if I don't provide such functionality, is that the user will try making 2 extra clicks. VS. a stalker typing out a <user-a> email and knowing that they <user-a> signed up to my service using their google account or whatever.. Thanks!
    – Charming Robot
    Commented Jan 13, 2019 at 20:36
  • 1
    There are people who do not have an account on those social sites because they have reasonable objections to the usage terms of those sites. There are also users who do have an account but want higher security for other sites that they are using than what they have for those social sites. Or they might simply not want to give you information about their social network account.
    – kasperd
    Commented Jan 13, 2019 at 22:03
  • Your remark about the burden of maintaining usernames and passwords I don't buy. Sure a lot of sites have gotten password storage wrong. But I can assure you that securely hashing passwords is still a lot easier than correctly and securely using a third party identity provider.
    – kasperd
    Commented Jan 13, 2019 at 22:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .