14

When creating a website is it poor practice not to give users the option to "create an account"? Especially with rapid development, it seems more secure with less effort to offload authentication. However, many sites that implement OAuth or OpenID also allow you to create an account.

I would not just rely on one or two sources (and definitely not only Facebook connect, if that is even an option), so the user would have choice of services and the option to sign up with one of them.

The specific implementation I use, OAuth, OpenID, or any other third-party identification is ultimately trivial, but is it bad practice not to allow users to create an account, even in the name of security?

Improve this question
4
  • 1
    Related ux.stackexchange.com/questions/78/… and ux.stackexchange.com/questions/11965/…
    – Ben Brocka
    Apr 15, 2012 at 19:42
  • Thanks--I had seen the first one but not the second. I definitely wouldn't ever rely only on Facebook to sign up. I would likely give a number of options to the user for OAuth providers, but I'm curious if it's bad practice not to allow any final alternative to OAuth.
    – ramblinjan
    Apr 15, 2012 at 19:53
  • @jandjorgensen I think we have inconsistency between your questions title Is it bad practice to force users to use OAuth or OpenID rather than create an account? and the summarizing question at the end of the description Is it permissible only to allow OAuth or OpenID?. What does a NO answer mean, in this case? Could you edit the question to make it more clear what a NO or YES answer means?
    – Benny Skogberg
    Apr 15, 2012 at 19:58
  • Thanks for the suggestion--I edited the question to call attention to my primary concern: whether it is bad practice to not to allow accounts local to the site.
    – ramblinjan
    Apr 15, 2012 at 20:05

3 Answers 3

Reset to default
8

There are very few times when I feel it is appropriate to only have external logins. If what you're doing is tightly coupled with the service that you're using for a login (e.g. Klout using Facebook and Twitter), then I'm willing to make an exception. I know some of the Stack Overflow guys might disagree with this (see here), but I prefer to keep things decoupled, and while I might be in the minority, I'm not alone.

As I see it, you have two options:

  1. Only use OpenID / OpenAuth / etc. and lose a small number of potential users.
  2. Include the option for a separate login at the additional expense and make sure everyone is covered.

The biggest question is whether or not that tradeoff of missed users to saved hassle is worthwhile. I think it's obvious that my weight is behind the second option, but it really does depend on individual circumstances.

Improve this answer
1
  • Thanks for the input--I am considering the first option.
    – ramblinjan
    Apr 17, 2012 at 5:04
0

I think no. You can offer the fast and easy option to create an account with openAuth or OpenID, but there are lot of information that maybe the user don't want to share with your website.

So it's always a good idea to have both the options: standard registration and oA or oID.

You cannot force users to share some information with you. Or they could be forced to create a fake fb account to register on your (or other) website.

Improve this answer
2
  • I wouldn't be restricting it to Facebook, especially since I'm not personally comfortable using Facebook for authentication (too much data associated). If I give them a lot of options is it still bad practice to force OAuth?
    – ramblinjan
    Apr 15, 2012 at 19:54
  • Yes, you have to think to every user, I have 3 gmail account, 1 fb, 1tw, etc... there are people maybe with just one gMail account and if your user doesn't want to use his gMail account to register at your service or users will never register to your website or will create a second gMail account. Not so good...
    – Andrea Turri
    Apr 15, 2012 at 19:57
0

Sometimes.

In order to know whether it's a situation where it'll be a dealbreaker for people or a situation where most of your users won't care at all, you'll need to ask them. It isn't possible to make a blanket statement about what a group of people would want without knowing who they are and what they want in general.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.