News for hackers. Stuff that matters.

A comment on Ask HN: Mobile devs who added Apple Sign In, what conversion changes?. Parent comment

Re:Ask HN: Mobile devs who added Apple Sign In, what convers... by cmroanirgo on Saturday March 28, 2020 @03:06PM (#22713512)
This. I'm not a big user of SSO in general, but on the few sites that I did use it, I'd forget whether I used SSO or not. Also, using SSO locks you into using that vendor. I've a couple of accounts that I'd like to change to normal uname/pwd but am locked into the SSO vendor (which I'm hoping to move away from)
[ Parent | on HN ]
Re:Ask HN: Mobile devs who added Apple Sign In, what convers... by tmarman on Saturday March 28, 2020 @08:21PM (#22715346)
On all sites/apps I’ve built offering SSO, we’ve gone out of our way to support linking of accounts and detecting existing accounts when claims like emails are found. Also allowing for merges after the fact.

I would consider this a best practice when iffering any “ sign in with...”

[ Parent | on HN ]
Re:Ask HN: Mobile devs who added Apple Sign In, what convers... by badtuple on Saturday March 28, 2020 @08:41PM (#22715434)
This seems like a nice user experience, but I'd be worried about leaking which email address has an account with us.
[ Parent | on HN ]
Re:Ask HN: Mobile devs who added Apple Sign In, what convers... by Nextgrid on Saturday March 28, 2020 @10:01PM (#22715776)
Wouldn’t the sign in mechanism (which validates e-mail) prevent this, in the sense than they won’t be able to get a third-party account to authenticate with for a particular e-mail without verifying ownership of that e-mail to the third-party provider?
[ Parent | on HN ]
Re:Ask HN: Mobile devs who added Apple Sign In, what convers... by nevi-me on Saturday March 28, 2020 @10:11PM (#22715811)
You address this by only linking accounts once a user has successfully signed in with another provider. That way if their email exists from another provider, you're more certain that it's the same account
[ Parent | on HN ]
Re:Ask HN: Mobile devs who added Apple Sign In, what convers... by godzillabrennus on Saturday March 28, 2020 @08:23PM (#22715358)
Would make sense to create package for popular mvc frameworks that does this.
[ Parent | on HN ]
Re:Ask HN: Mobile devs who added Apple Sign In, what convers... by ec109685 on Sunday March 29, 2020 @02:35AM (#22716888)
No it doesn’t. All the SSO providers (besides Apple in some cases) provide a verified email address to the site that can use to dedupe.
[ Parent | on HN ]