Death spirals. June 2nd, 2014
There's a phenomenon in Myrmecology called an Ant Mill, more colloquially known as the death spiral, where the old pheromone trails left behind by previous ants get confused with new trails being laid down. Like a man lost in the desert, the ants start following their own scent and become trapped in a circle, unable to even see that there is another path to take. They continue marching ever onward until they die of starvation.
When my mother and I moved to California in 1998, she went to the DMV to register for a CA drivers license.
The CA DMV informed her that, in addition to her Michigan ID, she needed to have a Social Security card. She lost her Social Security card years ago, so she went to the Social Security office to file for a reprint, which, she learned, required a California drivers license first.
It was only after showing numerous forms of ID and several pieces of mail at both addresses that they allowed for a reprint of her Social Security card, allowing her to get a state drivers license.
Today I tried to login to Meetup to see when the next San Diego JS meetup was. The login I used didn't work, so I tried logging in with my Facebook account, thinking maybe that's what I had used before.
It turns out I hadn't, I just had the wrong email address. However, since Facebook wasn't linked to my existing account, Meetup created a new account for me using the information on Facebook.
Realizing my mistake, I logged out, found the correct email address for my real Meetup account, and went to add my Facebook account to it.
Failure. Since my Facebook account is now attached to a different account, I can't claim it.
Ok, open up another browser and log back in via Facebook to detach the account. Here's where things got silly.
If you created a Meetup account via Facebook, you cannot detach Facebook because then you wouldn't be able to log in to the account any more. Thankfully, Meetup provides a convenient link to delete your account.
Deleting your account requires that you enter your password. Because I created the Meetup account via Facebook, I never provided a password, so the form refused to let me delete my account.
Ok, lets add a password to the account. Sorry, changing your password requires entering the existing password (which doesn't exist).
That's right, if you created your account by logging into facebook, you cannot delete the account.
Thankfully, registering with Facebook DOES copy over the email address that Facebook has on file. I was able to use that in the Forgot My Password page to get it to reset the non-existent password and let me enter a new one, whereupon I could use the new password to delete the account, freeing up my Facebook login.
Then, and only then, was I able to attach my Facebook account to my real Meetup account.
Now, perhaps this wouldn't have happened if my Facebook account and my Meetup account were on the same email address. It surely wouldn't have happened if I had linked my Facebook account earlier. However, it absolutely wouldn't have happened if:
- Meetup had asked me to confirm that I wanted to create a new account with my Facebook login.
- Meetup had asked me to set a password when I created the account.
- Meetup had recognized that I didn't have a password when I tried to delete the account.
- Meetup had recognized that I didn't have a password when I went to the password change page.
- Meetup had allowed me to merge the two accounts when I tried to attach Facebook to my real account.
After all, what's the point of using an OAuth provider if you don't trust it authoritatively.