While I agree with the point that FB Connect should not be the only option, I don't see promoting password-based authentication is beneficial here. Implementing a traditional user&pass auth. scheme:
2) Actually requires quite significant work. It might be easy to add short sign-up and login forms to a site, but I doubt that implementing any external authentication mechanism would be really that much more work.
However, with password auth. the work doesn't end here. We typically need password reset/recovery and password change. The latter usually entails some kind of profile/settings page, while the former might require at least a dedicated login page.
In general, external authentication providers are good, as long as we don't limit ourselves to a single one. Adding Twitter / Google / BrowserID / Open ID / etc. is not that much more work, as the whole flow can be somewhat generalized. Having multiple authentication options also makes us prepared (from implementation PoV) for eventual support of user&pass auth., should we need it in the future.
1) Is really hard to get right from the security standpoint ( https://www.owasp.org/index.php/Authentication_Cheat_Sheet )
2) Actually requires quite significant work. It might be easy to add short sign-up and login forms to a site, but I doubt that implementing any external authentication mechanism would be really that much more work. However, with password auth. the work doesn't end here. We typically need password reset/recovery and password change. The latter usually entails some kind of profile/settings page, while the former might require at least a dedicated login page.
In general, external authentication providers are good, as long as we don't limit ourselves to a single one. Adding Twitter / Google / BrowserID / Open ID / etc. is not that much more work, as the whole flow can be somewhat generalized. Having multiple authentication options also makes us prepared (from implementation PoV) for eventual support of user&pass auth., should we need it in the future.