User login with 3rd party services and email/password

Question

If you sign up for a product with Google OAuth and have the associated email registered in the database. Then have a user that wants to login using email/password. What is an elegant way to handle that?

I have seen some services like Medium using a magic link. I think it works like this. The user signs up with Google. Email is set in the database. Then if the user wants to sign in with email a magic link that expires within 15 min is sent to the inbox. There is a token inside the link that I assume when clicked will get the user from the database and log the user in.

Is the magic link and passwordless a good UX?

What are some alternatives that are elegant?

I think another solution is to sign the user in with Google. Then have a step 2 that asks for a username and password. I have seen some services doing this. Thoughts on this approach?

The third thing I can think of is sending a generated password to the users inbox. Then if the user wants to change it he/she can in a profile view. If the user wants to access it at a later date it'll be stored in the inbox.

Answer 1

Hi Michael Joseph Aubry,

When evaluating approaches like this, it's best to blur the lines between usability and security.

Is the magic link and passwordless a good UX? Yes it is. The best way to create a secure UX is to make it seamless. Fingerprint, magic link e.t.c are both relatively secure and usable, they lift the cognitive burden from the user of remembering equally strong passwords (unique ones with a hard to guess characters combination)

I think another solution is to sign the user in with Google. Then have a step 2 that asks for a username and password. I have seen some services doing this. Thoughts on this approach? I do not feel quite strongly about the need for a step 2. Let's take a look at Airbnb approach.

In summary, Sending users a magic link > sending a password because they do not have to do anything with the link approach. Sometimes though, a user may not have his/her GMail on the device s/he is trying to login from e.g trying to login on an office laptop but email lives on a mobile device. So better approach may be to send a link and also provide temporary password.

Answer 2

I see no reason to deal with passwords if you have OAuth / magic link, you simply dont need password (and therefore dont need your user to pick password after OAuth login for sure)

Generate and send password is also not convinient: try open your inbox and find StackExchange registration email.

Every time you send magic link, it has to contain new access token, required only once to auth person (may expire in XXX minutes if not used)

Magic link makes it easy to login for new and occasional users

• if user login say once / month, most likely he will have to reset password: to enter email, open link in email, enter new password, login with new password. Magic link is a pure pleasure compared to password recovery.

• When user evaluate new service he will not take it serious (there is no any value yet) and pick simple password. If service happends to be useful for user, the initial password remains as the user is to lazy to chenge it. As a regular user I do the same way too :)

My invention is to use simple personal data as login for services, where security is not concern. For example I use email + mobile phone pair to authenticate athletes for running events.

• I know they remember their emails and phones
• Person may have 300+ facebook friends but its personal email and phone is known only by several close friends
• at last, nothing bad will happend if someone, who know user email+phone log in. It will affect the results list, but not the result itself. So the athlete may feel confident.