To Link or Not to Link Social Logins with a Matching Email

Question

I have a site that allows logging in through:

1. Email (must be verified and unique)
2. Facebook
3. Twitter
4. LinkedIn.

Once you have created an account through one of those 4 methods, I provide the ability to link additional accounts. However, if you have signed up through email, then attempt to login through facebook, I check to see if the email returned from facebook already exists in the system. If the email is already associated to a verified account, I simply link the account and log them in.

I think of this as a convenient method to login and have tried to think of security, privacy and inconvenience issues that could present themselves, but haven't been able to think of any. I could perhaps see people thinking of their facebook account as distinct and not as an email address then maybe being confused as to why their account got associated to their existing account.

I have read this thread, but it seems to be a slightly different question since they are dealing with unique usernames, not emails. Are there security issues I might not be thinking of? I have looked at other sites as an example and it seems to be varied as to what they implement, though there are quite a few sites that will create an SEPERATE account for you if login with social, ie: I had an existing account created using x, then signed up with facebook and it's treated as a separate account.

Is there something I might not be thinking of from a UX standpoint that would necessitate me not linking the accounts automatically?

Workflow:

• A User signs up with email/password
  • A User verifies email. Can now login.
  • A User can link social accounts on their profile.
• A User can sign up with social.
  • A User can sign in immediately, there is no verification.
  • A user can link other accounts & set a password on their profile.
• If a user already has an existing account, and attempt to login through a social method
  • If there is a matching verified email address, the account is linked and the user is signed in. There is an informational message letting the user know.
  • If there is no matching email address, a new unique account is created.

Answer 1

The social accounts anyways confirms if the user wants to log in to the service with the current account or not, so I see no issue or security concern with not linking the social accounts if the email address is same as the one the user signed up with.

It is always a great practise to link the account if the emails match and that is what the user mostly wants. If you think that the user wants to create a separate account then give him an option of choosing what do do if a similar account is found instead of deciding on your own.

Users like to feel in control, specially with their account(the reason you call it My account is because they should feel in control) so let it be the user's prerogative and not the developer's.

Answer 2

I wouldn't say that there are any security concerns because if access to the e-mail is required in all cases, you know that the user should be owner of both accounts.

However, the user may not want to link the accounts for whatever reason. A lot of times this may just be paranoia of granting additional permissions to your site that they'd rather you not have. But even if you just use the e-mail portion of the account and no other access is granted, you should still offer the user some options if they attempt to log in with a new account under the same e-mail address:

• Log in with their existing account
• [if your system can handle it] Log in with their new account but don't link them
• Link the accounts and log in

That way the user isn't forced to have their information stored in an extra database somewhere on the internet if they just forgot which info they used to log in the first time.

Answer 3

Actually it follows the same logic as the other post you linked. The reasoning on the UX side is simple: we all use so many services and apps that we don't remember, if we get logged out after weeks (or months) of using (or nonuse), how we registered in the first place.

Secondarily, not all users are comfortable with every type of social login. Facebook's login was compromised early this year (and has since been amended) where some access was automatically provided to the application/site without user consent. My own research over the past few years is that while a large percentage of users will happily use Facebook to login, there is significant distrust with it too. Twitter is more trusted but used much less. Google is more trusted, but their login service required a full email and password to set up, which is more cumbersome than the one-button register Facebook and Twitter offer. And frankly unless it's an enterprise or business-oriented app/site, LinkedIn just seems superfluous.

That means options are good, but it can also lead to confusion. So unless you store a cookie/data of what the user used to register, they may make a mistake. Then you're left with user orphans, where someone might accidentally have two or more accounts. That's a terrible experience.

I've found two simple solutions to this problem, in order of best UX:

1. Only offer 1 service and/or email: this solves the confusion problem for 99.9% of users because if you don't trust Facebook today for login, you won't trust them in a month or two. Or, more importantly, you'll remember that you didn't trust them. So upon returning to the login/register screen, users will know which path to follow.
2. Use a phone number: This one's awesome for mobile, though with web it's more challenging because it requires a deeper level of trust. I've built three apps now that have used phone number registration and it rarely fails because users are concerned that their number is now compromised. It's a safe practice. That's not necessarily true on web however, meaning the experience of typing in your phone number on a desktop-based site (or even a mobile site, oddly) has a level of distrust beyond that of mobile apps. There is one way to mitigate that distrust: make that number entry field a numpad keyboard. It's stupid but it makes sense. Users will trust it more if it's easier to type in the number, especially if simple things like formatting are handled automatically.

The only alternative, as mentioned earlier, is to record how the user registered (but not their registration info), which has a number of problems associated to it, so it's not recommended.

Answer 4

I would argue from a user standpoint there ARE security concerns. Remember you have to design for all levels of computer skill. People are concerned with security. How will Grandma Jenkins know that if she signs on with her Facebook account that her FB login/pw will be confidential/secure?

What is your site or service? Does it look legit or bogus from an outsider/new user?

If I'm on a new site and given the option to use my e-mail or social login:

E-mail = If my first impressions are that the site or service is legit or useful I will provide my real e-mail address - if not I'm signing up with my defacto bogus [email protected] throwaway e-mail.

Facebook = Tinder is an example when you don't have any other option so yes I'll login with FB - but it's an app that has already been vetted. It makes sense too as FB is a social site as well as Tinder. Why doesn't Tinder have an option to sign on with a JP Morgan Chase, Bank of America, or Wells Fargo login? ...because it doesn't make sense.

Linkedin = Professional use only, unless your site is business/career related good luck getting people to use their Linkedin credentials. Again does it make sense to have that as an option in terms of your site's content/service/demographics?

From a user standpoint it's definitely a convenient and nice feature to have the OPTION to link accounts after the site is deemed useful.

So it depends on the focus of your site and user personas. Provide more details on your site and related user personas if you want to discuss further.

Answer 5

There is always a security concern if you handle payments on your website, if the user never used his facebook account but has the same email linked to the facebook account. And if the hacker somehow gained access to the facebook account and the user never knew about it because he never uses his facebook account. So now the hacker can log into your website and make purchases on the users behalf without the users consent. So unless the user manually consents to pre approving facebook to their list of social logins, you should not automatically link them together.

Answer 6

There is one security issue that can occur if you are not checking if the email address of the 3rd party social network is verified by that 3rd party. So when linking a user's social account to an existing account automatically, you should ensure that 3rd party network does not allow unverified emails to be used for OAuth authentication or has a way to tell if an email is verified or not. This is usually the case for most major providers, but you have to keep that in mind. Otherwise, there is going to be a pretty bad security issue