Authentication: Usage of FB / Google profile e-mail as a basis for logging in

[citizenos]

Authentication: Usage of FB / Google profile e-mail as a basis for logging in

[tiblu]

@moll @infokujur Let's start discussing the problem here.

[moll]

My argument against using Google and Facebook is that people may have different security practices for handling their Google & Facebook accounts and their Id-card & Mobile-Ids. Right now signatures given through "hard" authentication can be accessed through Google and Facebook. I don't think that's good, especially given there's been no warning of that to people.

[ilmartyrk]

Needs more input

[anettlinno]

Triage 37. Sending to In Preparation for gathering more input for making the decision. Main question is if we trust the email that FB and Google provides? @loorm @tiblu @ilmartyrk your input is appreciated.

[ilmartyrk]

Current login flow after we get user info from Google or Facebook is that

1. we check if we have any users connected with that Google or Facebook profile id. If the user exists we log in.
2. If connection does not exist we check if any user has the email address sent from Google or Facebook. If e-mail exists we create a new connection for that user and user will be logged in into this existing user account.
3. If we don't find any users with that e-mail we create a new account, mark the e-mail address as verified and log the user in

Current flows PRO-s
User can access previously created account with the existing e-mail thus can choose between multiple login methods. After UserConnection is created user can change the e-mail and use different e-mail address to get invites etc.
CON-s
If user intends to use different e-mail he/she will manually have to change the e-mail address, we also don't display any info that the e-mail is used that we got from Google/Facebook

Possible solutions.

1. We don't use the email from Google/Facebook response at all. This could result in new accounts being created.
2. We use the email, but don't mark the e-mail as verified and send out verification e-mail if new account is created
3. We create a new message that display that e-mail we got from Google/Facebook response is now added to the user profile - this should be implemented anyway if we keep using the e-mail address

[loorm]

I don't see, what is the problem, that we would be solving. Don't fix, what isn't broken. I agree with Mikk above, that I think FB and Google are good at verifying e-mails.