Funniest shit is when you finally sometimes fall victim to the feeling of "Ok fine, I'll use Twitter for the auth so I don't have to fill out the fucking 10 field form just to be able to sign up, why you need to know my current position anyways?" and when you're finished, they're just using the auth to autofill the username and email for the signup form and you have to fill it out regardless.

This is the absolute worst and why does it seem to happen 80% of the time?

Because most teams didn't write their user-auth code, it's either a framework or another team. But the PO want "Sign in with Twitter" so you hack this together.

It's so they can feed the data into the sales team in case their algo thinks you are a viable target to sell things to.

They know people don't always update their profiles and use throwaway accounts. They nudge you to provide actual data.

"Nudge"? You sound like a project manager

Forcing to create a new password and field out additional fields isn't a nudge

Before 3rd party sign up existed, I remember there were patterns, where the website you have registered had an option to add your "friends". Caveat was that it asked for your email and password to your email, so it could download your list of contacts. Crazy part is a ton of people didn't see a problem with this...

...Didn't fucking facebook did it at one point ?

Linkedin. FB probably too, but too lazy to check

Linkedin was worse. It used the login/pw to send emails to your friends from your email account, inviting them to join Linkedin.

Clubhouse too. Remember Clubhouse?

https://news.ycombinator.com/item?id=25685454

there's a big difference between a permitted contacts api and just giving up your regular gmail password.

Wait, after finding out the site is obviously just trying to grab as much info from you as can be profitably marketed and even after it sets itself up for further abuse, you are still considering signing up?! I really hope I'm missing sarcasm there, cause otherwise you need to readjust the amount red flags you are willing to ignore.

"Sign up with" is a tracker's paradise anyway, but not even offering something untrackable like email is just screaming out for everyone to hear that you are the product. With the abusive access demanded, it's down to victim, really.

Have some pride, people, and don't fall for these scams!

What I don't understand is that OAuth (and related) is supposed to be a protocol, so why can't I as a user get the option to enter one ?

Imagine if you could only pick Gmail or Outlook in the form for email !

that was a thing with openid but it pretty much died out.

Obviously bad permissions are bad. But "sign-up with email" means that you need to manage you users identities which is complex and risky. You can delegate that using something like Auth0 but then it costs you money.

If I am creating a new service today I will probably won't bother and just offer social logins.

> which is complex and risky

It really isn't, it's fairly basic. It's mostly "basic" because people have been implemented those things for so long that there basically are established patterns you can reuse with very few drawbacks.

As long as read up on how to implement it and use common sense, you can get authentication working (& being secure) under a day.

Edit: Today you can even do it the lazy way and implement "passwordless" email login as a step to see if it's worth implement the simple email+password way later. Basic steps: 1) Allow users to request login, which creates a login token in the DB and sends a URL to the users inbox 2) Allow users to exchange login token for a auth token that eventually expires somehow, delete login token from DB and store login token 3) be able to lookup if a login token is correct when hitting other API endpoints

Congrats, you now have a basic authentication scheme

That ruins the experience for all users who don't want to give you their Facebook or Twitter.

Even better: I don't have Facebook or twitter, therefore I'm out. :-)

Is "Sign-in with your Hacker News account" a thing?

I will never use social logins to sign up for anything. What a terrible idea. I assume anyone doing that is just doing it for tracking or scamming purposes.

If you have a password manager synced across browsers, like chrome or firefox's builtin ones, it should be fairly simple, right?

I really don't see how using KeePass or alt is hard, and it doesn't cost money.

If anything, it's 2FA that has me more concerned, because it has made my phone number a near single point of failure with the way everyone wants to use my phone number for it still.

You'd be excluding a whole lot of people who don't have any social media accounts, and a lot of others who aren't willing to use them for this purpose.