4

Most sites, when you register via e.g. Facebook, redirect you to a page afterwards asking you to enter additional information that the site needs. Very often this includes setting a password for the site.

I don't understand why this is the case.

I am creating a site, and want to allow the user to register either via e.g. Facebook, or create an account directly on our system.

  • If they've registered via our system obviously they have set a password, and there is a settings screen once they've logged in where they can connect their account. My plan would be, from then on, then could log in via Facebook.
  • If they've registered via Facebook, they can obviously log in via Facebook. If they like, they could set a password in the settings screen later. That would allow them to log in with their email address (that we get from the Facebook login) and their new password. Or they could never do this, and continue always logging in via Facebook.

Is there a problem with this approach? Why do other sites force you to set a password on their site after you've registered via a social network?

Improve this question
1
  • The only reason it might be required is if you need to support authentication for something that couldn't use OpenID/OAuth authentication - say an API client application.
    – Aaron D
    Jul 12, 2015 at 14:56

2 Answers 2

Reset to default
1

Ideally you should not. If they have successfully authenticated through another means, don't impose further burdens on them. You can see that this method is used by the Stack Exchange network (for example) - after you have authenticated through Google, you don't have to create a password.

Improve this answer
2

The only reason I can think of for which this procedure can make sense is to prevent someone who has physical access to your computer/smartphone from logging in the site. Given that the Facebook session is usually opened for most users, anyone with access to the computer/smartphone of these users could get access to the site, impersonating them.

If you force the "attacker" to introduce a new password even after the Facebook login, you're eliminating this threat.

In any case, when physical access is gained, security is rather compromised.

(I would have liked to put this as a comment, but I have not enough reputation)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .