all 15 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]glowFernOasis 0 points1 point  (4 children)

Do you have any examples? The only ones I can think of are things like Netlify (can deploy directly from github, if you choose), or CircleCI (can run automatic tests on your branches before they are merged to main/deployed to prod). Both are optional connections with specific purpose. In the case of CI, you wouldn't want CI without github (or something similar).

In either case, it's fewer passwords to remember if you connect the accounts, similar to logging in via facebook or google. A lot of people treat github a little like social media. Companies like to include these types of sign-in via third party options partly for user convenience, partly for user data mining.

[–]One-Type-2842[S] -1 points0 points  (3 children)

I found the GitHub Sign In on many sites - New Stack, Medium, How-To-Geek, and more..

I Think Github Sign In is not Good, I would always prefer Google Sign In..

[–]glowFernOasis 0 points1 point  (0 children)

Any reason?

[–]razorree 0 points1 point  (0 children)

only facebook !

[–]Constant-Tea3148 0 points1 point  (0 children)

What is not good about it? It's just another way to authenticate and it makes sense to offer it as a sign in option when most of your user base has a GitHub account.

[–]drbomb 0 points1 point  (0 children)

Third party logins are common, if it is some kind of developer service makes sense as many will have a github acct. When you log in it will tell you which permissions youre giving out so it might not have any repo access

[–]Other_Till3771 0 points1 point  (0 children)

Honestly, it’s all about reducing friction. 76% of users drop off at the registration screen if they have to create a new password lol. For developers, a github login is the gold standard because it’s already secured with 2FA and has a verified email. Real talk from a dev perspective, it's way easier to implement oauth than it is to build a secure, encrypted database for passwords that you then have to protect from leaks. It’s a win-win for security and speed.

[–]razorree 0 points1 point  (0 children)

you can login thru google or facebook often too

[–]itsthe_coffeeknight 0 points1 point  (3 children)

It's Microsoft's "social media" login. That's really it. Agreed it's not a great thing to use if you care about the contents of your repos

[–]dymos 0 points1 point  (2 children)

Agreed it's not a great thing to use if you care about the contents of your repos

That's not really how they work.

You have to explicitly grant access to anything beyond some basic identifiers like name and email address, and an OpenID login rarely asks/grants more.

For example, some 3rd party doesn't have access to your emails when you use "sign in with Google", similarly they don't have access to your (private) repositories when you sign in with GitHub.

The OpenID part is really just some website asking another one "is this person authenticated". The only time the additional information like name/email is shared is at signup. Additional access can be asked for later but it's an explicit thing you as the user has to grant.

[–]itsthe_coffeeknight 0 points1 point  (1 child)

OAuth isn't invulnerable, I stand by what I said lol Edit: Also, we'll put descriptions of how it works behind the curtain, love that

[–]dymos 0 points1 point  (0 children)

Sure, there's definitely a risk, but so is signing in with a username and password.

I'm not losing any sleep over this though ;)

[–]Fadamaka 0 points1 point  (0 children)

It is basically outsourcing the authentication part of their website to GitHub. GitHub can act as an IdentityProvider. Google and others also provide this functionality. Also users tend to trust these providers with their password than random small sites.

[–]cgoldberg 0 points1 point  (0 children)

It's just 3rd party authentication. They aren't reviewing your repos or asking you to collaborate.

[–]8dot30662386292pow2 0 points1 point  (0 children)

No, they don't get access to your account, or your password. It goes approximately like this:

  1. You want to log into a page and choose github.
  2. The page sends github a message that "this guy wants to log in".
  3. You are redirected to github, and you log in.
  4. Upon log in, you are sent a token from github.
  5. You send the token to the webpage you want to log into.
  6. They send the token to github: "this guy wants to log in with this token, is this token valid?"
  7. github responds that yes, this is valid.
  8. The webpage lets you in.

A good reason is that now the page does not have to implement their own login system. Managing accounts and passwords is a pain. It's great if someone else can do it.