Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

After user has granted permissions to an app to fetch certain data from Facebook, while he does a 'Login with Facebook', is it OK for me to create an account for him on my app using his data fetched from facebook ?

share|improve this question
1  
isn't that the purpose of "Login with Facebook" ? –  kmonsoor Nov 9 '13 at 22:42
    
This could very well be a legal question in disguise. Certainly in Europe you can't store personal information without explicit permission. Facebook has that permission (else no Facebook account would exist), but that permission isn't transferable. –  MSalters Nov 10 '13 at 11:05
    
@MSalters: Is that still applicable to me if I dont host in Europe or I'm not a european company, but still engage european audience ? –  user01 Nov 10 '13 at 12:05
    
Yes it is for users of your site that come from Europe. –  Marjan Venema Nov 10 '13 at 15:26
    
I guess you can create your account but if you do that that account must be Facebook login only. If you want to have your account to be split from facebook it should be a user demands. Some site which want to keep users their own propose the fill the user form with facebook/g+/linkedin and then ask for login with third party as optional or the more classic user/pass –  ColdCat Dec 11 '13 at 15:33

4 Answers 4

To be on the up and up, you should notify the user of your intention and explain the benefit of auto creating an account for them.

One benefit would be that if the user decides to delete their Facebook account, they should still be able to login with the account that you create for them, as long as the user is provided with login details.

share|improve this answer
    
The point of logging in with Facebook (or any other OAuth provider) is specifically not to have to have another set of login details, and not divulging any of the Facebook login details to the site allowing logins through Facebook. So how am I gonna provide them with login details when they delete their Facebook account? At that point I can no longer verify that they own that account, so I should not give them any site specific login details for that account. If someone wants to delete their Facebook account, they will have to decouple it... –  Marjan Venema Nov 10 '13 at 15:33
    
... from all sites where they used it before doing so. Decoupling meaning that on each site they login with their Facebook account and then set up a different means of authentication. Either by using a different OAuth provider, or site specific login details. –  Marjan Venema Nov 10 '13 at 15:35

If you are going to store any state for the user (I can't imagine a useful service that doesn't do this), then you have to create an account in your own database that is linked to the Facebook account. Look at how Stack Exchange works when you log in with Facebook; it stores information about all your activity and lets you create your own Stack Exchange profile.

share|improve this answer
    
But the thing is, I say "Login with facebook" (not "Sign up using Facebook"), & still create an account.. isn't this a concern. Do some others also do it this way ? –  user01 Nov 11 '13 at 3:46
1  
No, this is not a concern. Every website that uses Login with Facebook works this way. –  Kevin Borders Nov 11 '13 at 15:15

The users intent when they 'Log in with Facebook' is to create a relationship with your site, associated with their Facebook account. That is the entire function of the action, and so I do not believe that you are breaking the trust of the user by storing persistent data related to their choices and preferences on your site. The relationship is meant to be persistent, otherwise it is not much of a relationship.

However, you should provide users with a 'Log Out' control, that clears their session cookie and allows them to return to anonymity should they choose. But if they log in with Facebook again, the user will expect you to remember the preferences they chose previously; this is impossible without storing persistent user data in your application (and that's really the definition of 'account'... a persistent user token tied to their preferences).

share|improve this answer

I hate it when I choose “log in with XXX” and then the site makes me pick yet another password.

Often I give up using the site at that point.

I expect a site to remember my email address and Facebook ID and maybe my name but nothing else. If the above is stored in an account it is not a problem for me, provided I never have to do anything to manage that account.

share|improve this answer
    
Where did the OP say anything about making you choose another password? Creating an account based on a Facebook login does not need another password as account access/login is always deferred to Facebook. –  Marjan Venema Nov 10 '13 at 15:28
    
@MarjanVenema, I have had a few websites in the last month, do this to me with uisng my Google acount, so I expect they do the same with Facebook –  Ian Nov 10 '13 at 22:46
2  
@ian that is bizarre as it's defeating the entire point of using a openID login. Are you sure they weren't phishing sites? –  DA01 Nov 11 '13 at 1:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.