associate GitHub/Twitter account with an existing Gittip account

[chadwhitacre]

Reticketed from #80. Right now you can register using either GitHub or Twitter but then you're stuck. You can't link a second account to your Gittip profile.

[chadwhitacre]

Also from #80:

if the participant_id is taken you should have the option of authenticating with the other network to associate at that point

[chadwhitacre]

Will need to deal with folding two Gittip accounts together, if a Twitter account is already associated with a different account or something.

[chadwhitacre]

I believe this would amount to sticking a UI knob in the "Linked Accounts" section of one's profile and making sure the /associate machinery for each network is able to handle it. Theoretically we can add as many accounts from each network as we like. Should also be able to unlink accounts (at this point probably disallowing removal of the last linked account).

[ironfroggy]

Should this also allow multiple twitter accounts linked to one gittip account, or multiple github accounts?

[chadwhitacre]

@ironfroggy Yeah, maybe.

+2 from @alex and @JustinLilly via IRC.

[chadwhitacre]

Also +1 from @readthedocs, though I merged his manually since he was trending and had money ending up in both.

[lyndsysimon]

It is also unclear at this point that this is not possible through the UI. When logged in an lyndsysimon, I went to the homepage and entered my own Twitter handle (@lyndsysimon). It said "Are you lyndsysimon from Twitter?
You’ll have to sign out and sign back in to claim this account."

So.. I signed out and back in, thinking that perhaps the system would give me the option to link an existing account on authentication. Obviously, it didn't, and now I have a second account with a pseudo-random name (749e9142746a) - presumably because of the conflict with my existing GitHub account's name.

[mirisuzanne]

I had the same experience as @lyndsysimon - but my twitter and github have different names already. I'd love to get them merged.

[chadwhitacre]

+1 from @voidspace.

[chadwhitacre]

Here's the two cases we need cover:

• Link a {Twitter,GitHub} account to an existing Gittip account.
• Merge one Gittip account into another Gittip account.

[chadwhitacre]

Soo ... I actually made a start on this a couple weeks ago. I just stash applied it and now I'm trying to get my head back in the game.

[chadwhitacre]

It looks like this is half of the implementation for linking (not merging).

[chadwhitacre]

I keep track of which accounts you have linked, Twitter and/or GitHub, and whichever you don't have, I show a link on the profile page to link it.

There's a new "action" called "link," but that's stubbed out right now.

Time to implement the "link" action.

[ironchefpython]

Quick question. Currently, would you say that tips go to identities (i.e. the person with a particular github account or twitter account), or that tips go to gittip user (the person who owns the gittip account)? If it's the former, then "merging" gittip accounts is trivial, you simply take a source gittip account, and each associated identity would get reassociated with the target account.

If in the future, you allow tipping organizations, then this would make transfering "ownership" of an orgainzation trivial, you associate it with a target account, and all tips predged to that organiztion go along with it.

[chadwhitacre]

I think this is actually where merge wants to happen as well. You would sign in with a certain Gittip account, either using GitHub or Twitter, or other means in the future. You would go to your profile page and "link" another account. We need to notice when the other account you're trying to link is already known to Gittip, and do the merge at that point, probably after a prompt--"This Twitter account is already linked to another Gittip account. Do you want to merge them?"

From a security point of view this is how people could hijack Gittip accounts, if they compromised the weakest link in the chain of Twitter, GitHub, $WHATEVER. Like email. Someone's Hotmail is compromised, and then an attacker uses that compromised email account to merge a target Gittip account with another Gittip account. As a precaution we could require authentication with all linked accounts when performing a merge, maybe?

Also, what about the case of associating multiple Twitter accounts with a single Gittip account? The reason to do that would be to collect money directed at multiple Twitter accounts into one Gittip account. It wouldn't really be useful for authenticating, since you could only be authenticated with on Twitter account per browser session.

Do we want to let Gittip users specify which of their linked accounts can actually be used for authentication? This would be a security measure as well. A user could link an email account but not allow it to be used for authentication.

[chadwhitacre]

@ironchefpython Identities. I'm thinking merging can be pretty simple, yes. Even in a more complex world where we had more than two kinds of accounts to link, or where we supported linking multiple instances of a kind of account with a Gittip account, it's probably best to keep merging simple. In other words, we're not really talking about merging two Gittip accounts, but rather simply about relinking a single Twitter account (e.g.) from one Gittip account to another.

[ironchefpython]

@whit537 Good, because as soons as you allow multiple twitter accounts to be merged into a gittip account, people are going to merge in the twitter accounts they used to promote their applications, events, company, etc. And at some point down the road, people are going to want to unmerge those twitter accounts and give them to someone else, and they will be assuming the tips pledged to that twitter identity follow the twitter account.

[chadwhitacre]

Ah, I see. I misspoke, sorry. Tips are linked to a Gittip account. But you raise an interesting point, and it lands us right back in #27, and I think that's a good reason not to support multiple accounts of the same kind yet.

[ironchefpython]

@whit537 Actually, that's why I'm bringing it up in this issue. Perhaps you should delay implementing the association of both a githup and a twitter account with the same gittip account until you consider the pros and cons of associating tips with an identity. Right now, since identites and gittip users are one and the same, there's still the opportunity to keep that information, the identites to which the tips were originally pledged. When you link mutiple identies into a single gitip account, that information will be lost.

[chadwhitacre]

@ironchefpython I was supposed to avoid getting sucked back into #27 by working on this issue. ;-)

[chadwhitacre]

@ironchefpython I think the best thing to do for now is to only support one instance of each kind of account on a Gittip account. So you can't have two Twitter accounts on a single Gittip account, but you can have a Twitter and a GitHub both linked to one Gittip account. It's not impossible that someone would sign up with GitHub and then link a non-personal Twitter account, but I think that's unlikely enough that it shouldn't prevent us from implementing the much more common case where an individual has both GitHub and Twitter accounts and wants them on the same Gittip account.

Multiple instances per kind would be for the case you discuss, associating multiple project/event/org Twitter accounts with a single Gittip account, and we want to dodge that for now.

[chadwhitacre]

Okay, so "link" is not going to merge. If we have:

A: [GitHub-0, Twitter-0]
B: [GitHub-1]

And then B clicks "Link your Twitter account" and it's Twitter-0, then we get:

A: [GitHub-0]
B: [GitHub-1, Twitter-0]

By "not going to merge," I mean that A still exists as a Gittip account and still has GitHub-0 associated with it. We simply changed the association of the Twitter-0 account.

[chadwhitacre]

We do need to support merge, though. I think that's what most of the people mentioned on this ticket are actually interested in at this point (having not had the possibility of linking before), and I just reopened #313 for that.

[ironchefpython]

Acutally, I think getting sucked into #27 might be a good idea. There's a lot of people who have provided input on projects and earmarks and organizations and distribution, and it seems (to me at least) that this is the number 1 gap.

My view is that people want to communicate more than just a dollar amount when they tip. When I tip
jeresig, am I tipping his prior work on jQuery, his current work at Khan Academy, or maybe some obscure javascript library he maintains? Allowing me to tip John via his twitter account, with a hashtag of #KahnAcademy clearly indicates my interest in his educational work. Allowing me to specify a hashtag or a github repository in my tip is a good step down the road to #27, because it will offer way for people to donate to a project through an individual. Today, they would be able to cash a check for the amount recieved on behalf of a project and use the money to pay for hosting or licences or consulting, but in the future you could allow people to allocate percentage-based resitribution of those tips, so tips could flow to the current maintainer, or to upstream projects.

But (in my opinion), the first step is to associate tips with either an identity (where an identity is a github or twitter user), or an identity plus an activity (where an activity is a twitter hashtag or a github repository).

[yegle]

OK I'm confused because I accidentally created two different account...

Checkout these two pages:

https://www.gittip.com/96ef096b06b9/
https://www.gittip.com/yegle/

According to this comment [https://github.com/whit537/www.gittip.com/issues/289#issuecomment-8519029] this shouldn't happen at all right?

[chadwhitacre]

@yegle Sorry for the confusion. 😦 That comment refers to behavior that hasn't been implemented. It was mentioned on this ticket as something to build, not something already built.

Now that you've created two Gittip accounts, you'll probably want to merge them once we land #313.

[chadwhitacre]

+1 from @cmbeelby on #394

[chadwhitacre]

+1 from @crw via email.

[merwok]

+1 from me too.

[chadwhitacre]

+1 from @cathalgarvey via Twitter.

[chadwhitacre]

I've implemented this. See here for details.