I also don't think that facebook connect poses a single point of failure. If it becomes one then it is not the fault of the identity provider but the fault of the relying party, so if he only uses services that only offer auth via fb, or he did not connect his accounts with other identity providers then he should not complain right?
back
1 comments
Nothing poses a single point of failure unless one uses it that way.
If you add other identity providers then sure, you're less vulnerable - just like if you replicate your database and set up failover. There are many ways to avoid certain SPOFs but possibility to fix doesn't make a SPOF stop being a SPOF. It's all about how you use them.
If you use FB Connect as the only way to sign into some of your accounts then FB Connect becomes a single point of failure for these accounts, period. That's what happened to Om. There might be only 30% of his accounts affected, but for these 30% accounts, FB Connect was a SPOF.
For me it's easier to use old-fashioned login/email+password signup with a password manager like 1Password than signing up with multiple online identities to every new account (who does that anyway and many websites allow you connect only one identity). Classic email+password has a failover by default in its design - if I forget my password I can reset it by email (I need both to forget password and have broken email at the same time to don't be able to login).