Dealing with Connected Social Accounts and Potential Orphans

Question

Our application has the following signup paths:

Twitter Connect Facebook Connect Email/Password

Once you signup with one, you have the option to connect either both social account (in the case of an Email signup) or the other social account (in the case of a Twitter or Facebook signup). By connecting each account you also have the ability to sign-in with that account going forward.

The question is, what's the best way to deal with potential orphaned accounts. For example:

1. User A signs up with Twitter account 'mytwitter'

2. User A signs out

3. User B signs up with Facebook

4. User B connects Twitter account 'mytwitter' to their Facebook login.

At this point User A's account would be orphaned.

I see a few options:

1. Always require an Email/Password no matter how you signup. This isn't ideal since it creates friction.

2. Merge User A with User B, which seems messy and has to have some privacy concerns.

3. Send a message to User B that that Twitter account already exists. That doesn't seem ideal either.

Anyone have experience with solving this? Seems like it would be a common problem.

Answer 1

It really depends on what your system offers and does. Have you answered the question yourself and asked your customers who fit into this use case?

I'll make a few assumptions and hopefully give you enough information to make a decision:

Merging Accounts

This is where you can create a flow for your users to connect to a different account. Assuming they are logged in, offer them the ability to link accounts by signing into the site (while logged in) via a different authorization flow (eg. Twitter or Connect, etc... If the account authorizes and already exist - you can link the two together. This is going to be your safest route because the user is making an educated decision to merge accounts.

Orphans

If your users DON'T want you to merge the accounts and you don't want to merge them. Solution is easy, you will have to make a decision from system perspective.

1. If removal of such accounts negatively affects the system, keep them in the system
2. If the system / data / customers wont be affected and there is benefit in cleaning the data up - remove the orphans after a period of time

Answer 2

In reality, User A and User B are the same person. Since the usernames are unique on each platform, I would present the user with a message to the effect of "It looks like there is an existing account, would you like to merge them" after the twitter authentication process validates them. After that, its a development problem for the merging of accounts and the database updates.

Another similar question:

Facebook connect vs existing account - How to link those two?

I just found a really good article about this issue this morning, wanted to share: http://blog.mailchimp.com/social-login-buttons-arent-worth-it/