Finding the place to enter and save and confirm a password sounds a lot harder than just putting in my first name, last name, email and a password in the first place.

Yeah, most new services allow sign-up with e-mail. However, there was a brief period which made it almost impossible to register without a social registration path.

I've run into that a few times, yeah. I walk away if that's the requirement to join.

Especially with increasingly convenient password manager UX’es (e.g. integration on iOS)

>> Social logins only carry your information and a token, and you can enter to your profile and add a password too (99% of the time).

I think the whole point is not having to create yet another password.

One solution to all of this is to have some kind of durable identity verification that the user controls and can use everywhere. There are serious challenges with that of course, which is why we don't have it yet.

I use a durable identity verification that I control and can use anywhere (within reason): a standard offline password manager (keepass) synced via dropbox. I create "yet another password", but I never see it or directly interact with it (outside of tweaking the password generator to fulfil weird password requirements)

> I think the whole point is not having to create yet another password.

That's the fallacy. You're always creating a new password. Only its storage location is changing. You can store a password in a variety of ways and places. When you use a social login, you're using a time limited password stored in the OIDC provider. And if you lose your account there, you lose all your passwords.

Also, you can store your passwords in OS key chains (Linux, macOS), browser password managers (Mozilla Lockwise/Firefox), in myriad of other online/offline password managers, on a text file or paper.

Many sites allow you to "reset" your password for an account created with a social login. However, if you created an account with Google OIDC and lose access to your GMail account, that's another matter.

But that also creates security risks especially relating to information exposure. The ID provider will always know which services you use, how often you perform logins etc.

A secured password manager is the superior option, especially since you would not compromise every service in case your password is known by third parties.

How do people remember which social login they used for any given site? There are usually multiple and they overlap between sites and none work with every site.

I make it easy by Never using social login because I don't want the chance of being locked out and password managers are easy enough.

So they are always in my password manager, and that part of life is good.

People generally tend to use one of them, mostly Google.

However, I always sign-up with an e-mail directly if possible, and don't use OIDC login pathways. If I had to use or was lazy during registration, I change my password immediately, so I can use an e-mail/password/2FA path.