We can log in with google or facebook. Android users should have google account already linked, ios users could create one. If someone doesn't want to use google, he can log in with facebook. Is the standard username (email) and password pair really needed?

  • 11
    I have none of the accounts you talk about and do not wish to create one, and I bet I'm not the only one. Commented Jan 8, 2017 at 16:34
  • By the way, if some application don't accepts login outside code-signed applications (like websites) is it good to use SRP (combined with some key stretching function, of course)? Commented Jan 8, 2017 at 18:25
  • 2
    I dont have Facebook and I wouldn't use Google for signup. Thus you would have lost me as a customer
    – BlueWizard
    Commented Jan 8, 2017 at 20:27
  • "If someone doesn't want to use google, he can log in with facebook." - the logic of why the users' preference is considered in the first half of the sentence while it is all but disregarded in the second half of the sentence totally escapes me. Commented Jan 8, 2017 at 21:51

4 Answers 4


If someone doesn't want to use google, he can log in with facebook

What if they don't want to log in with either? You've already answered your own question. A separate user/pass should be allowed because some users don't trust services with access to other accounts. A service should honor that for whatever reason that user has because that's a good experience. Logging in with a third party account should be seen as added benefit or enhancement.

It should not be mandatory because it blocks users that don't have Facebook, google, twitter, or whatever other third party you think the user should have to have to be able to log in.

Additionally, I see other issues with even using third party login to begin with which some of your users might have.

  1. What if the third party is deprecated? How will I reconnect with my account in the context of your application
  2. What if I lose access to the third party account?
  3. What if I don't trust your application with the permissions signing in with the third party would entail?
  4. What if I just don't have or don't want these third party accounts?

If you only gave me the option to log in with a Friendster third party log in, I'd be pretty irked and opt not to use your service.

  • "Logging in with a third party account should be seen as added benefit or enhancement." - or at least as an avoidable downside, rather than a mandatory one. Commented Jan 9, 2017 at 7:40

Some users won't want to give a second app access to their Facebook or Google information.

Some apps only require Facebook login (for example) to ensure the identity of the user. This is because it is important for the service the app offers. In those cases having verified users gives a better user experience for the rest of users, so it is beneficial in the long term. The app might also use some of the content from the social networks, or even the service (or some of the services) it offers depends on those.

If it's not your case and there is not really much benefit to your community/app-service from limiting the login to Social networks, give the possibility to sign up with a simple email.

  • 1
    "require Facebook login (for example) to ensure the identity of the user" - while it's just an example, how does a Facebook login ensure the identity of a user? It seems like all Facebook does is ensure the account name is not instantly recognizeable as a fantasy name, and sometimes not even that. Commented Jan 8, 2017 at 21:49
  • Good point @O.R.Mapper maybe I didnt express it correctly, I meant ensure that the email is validated.
    – Alvaro
    Commented Jan 8, 2017 at 23:43

I think it can be depend on how the users register to your site, if your sign up processes using facebook or google (direct login using it) absolutely you don't need the username/password anymore.

But if the registration is a form that must be filled with username, password,confirm password ETC, Then you must give an extra input field for these.

My last project, I did an A/B testing to see the heatmap of the page, which is similiar case with yours, and what I get is still many users like to input this things rather than give a shot with facebook/google account.


Short answer: Username and password are old school, use public keys.

Long answer: The best solution for the user would be an easy and good implementation of public key authentication. No application should depend on third party services, if not necessary. What about users without an X account? What about users in countries blocking X?

  • 3
    Client certs would be good as an option on a web app but totally impractical for an app given that apps don't even have access to your personal certificates, at least not in iOS. Commented Jan 8, 2017 at 16:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.