Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

When creating a website is it poor practice not to give users the option to "create an account"? Especially with rapid development, it seems more secure with less effort to offload authentication. However, many sites that implement OAuth or OpenID also allow you to create an account.

I would not just rely on one or two sources (and definitely not only Facebook connect, if that is even an option), so the user would have choice of services and the option to sign up with one of them.

The specific implementation I use, OAuth, OpenID, or any other third-party identification is ultimately trivial, but is it bad practice not to allow users to create an account, even in the name of security?

share|improve this question
1  
    
Thanks--I had seen the first one but not the second. I definitely wouldn't ever rely only on Facebook to sign up. I would likely give a number of options to the user for OAuth providers, but I'm curious if it's bad practice not to allow any final alternative to OAuth. –  jandjorgensen Apr 15 '12 at 19:53
    
@jandjorgensen I think we have inconsistency between your questions title Is it bad practice to force users to use OAuth or OpenID rather than create an account? and the summarizing question at the end of the description Is it permissible only to allow OAuth or OpenID?. What does a NO answer mean, in this case? Could you edit the question to make it more clear what a NO or YES answer means? –  Benny Skogberg Apr 15 '12 at 19:58
    
Thanks for the suggestion--I edited the question to call attention to my primary concern: whether it is bad practice to not to allow accounts local to the site. –  jandjorgensen Apr 15 '12 at 20:05

3 Answers 3

up vote 7 down vote accepted

There are very few times when I feel it is appropriate to only have external logins. If what you're doing is tightly coupled with the service that you're using for a login (e.g. Klout using Facebook and Twitter), then I'm willing to make an exception. I know some of the Stack Overflow guys might disagree with this (see here), but I prefer to keep things decoupled, and while I might be in the minority, I'm not alone.

As I see it, you have two options:

  1. Only use OpenID / OpenAuth / etc. and lose a small number of potential users.
  2. Include the option for a separate login at the additional expense and make sure everyone is covered.

The biggest question is whether or not that tradeoff of missed users to saved hassle is worthwhile. I think it's obvious that my weight is behind the second option, but it really does depend on individual circumstances.

share|improve this answer
    
Thanks for the input--I am considering the first option. –  jandjorgensen Apr 17 '12 at 5:04

I think no. You can offer the fast and easy option to create an account with openAuth or OpenID, but there are lot of information that maybe the user don't want to share with your website.

So it's always a good idea to have both the options: standard registration and oA or oID.

You cannot force users to share some information with you. Or they could be forced to create a fake fb account to register on your (or other) website.

share|improve this answer
    
I wouldn't be restricting it to Facebook, especially since I'm not personally comfortable using Facebook for authentication (too much data associated). If I give them a lot of options is it still bad practice to force OAuth? –  jandjorgensen Apr 15 '12 at 19:54
    
Yes, you have to think to every user, I have 3 gmail account, 1 fb, 1tw, etc... there are people maybe with just one gMail account and if your user doesn't want to use his gMail account to register at your service or users will never register to your website or will create a second gMail account. Not so good... –  Andrea Turri Apr 15 '12 at 19:57

Sometimes.

In order to know whether it's a situation where it'll be a dealbreaker for people or a situation where most of your users won't care at all, you'll need to ask them. It isn't possible to make a blanket statement about what a group of people would want without knowing who they are and what they want in general.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.