Hacker News Reader

Comment by nikcub | Hacker News Reader

re: 4, that is because of the namespace collision between fb and tw. ie. if I signin with my fb username and then somebody signs in with a tw account with the same username

View on HN

But why not just use OAuth/Facebook Connect to both sign up and log in to the service (where username collision makes no difference)? Why require a username and password in addition?

It's really in case Facebook "screws them" -- in that scenario, nobody is tied to the Facebook login and can still access the site. Allowing them to Facebook Connect now lets them at least take advantage of viral "things" -- e.g. a wall post is posted when you sign up.

It's not just for collision prevention. It's so that prizes users have their own login, should fb/twitter OAuth be down.

actually, I did not have to provide a username. I signed in with twitter using my email address. Perhaps the additional username was only required for Facebook connections? Between the two, Twitter is the only one with a true username identification.

I assume it will prompt you if there is a username collision. that is what I did when I recently implemented it. I wouldn't even show that step and assume that primary username is tw or fb username unless there was a collision

there was a security hole on a site not long ago that would let you login to another account if you had the same username on one of the other logins. can't remember which site

Reply on news.ycombinator.com