social login for ecommerce, security concerns, norms <p>Given an ecommmerce site that allows comments, saving wishlists, etc, social login via eg <a href="http://hybridauth.sourceforge.net/" rel="nofollow">hybridauth</a> seems like a great addition. </p> <p>Later, if a user places an order, the ecommerce site then also stores address information, order history etc. -- but not credit card data, which is handled by a third party.</p> <p>Given a site such as this, what would be best practice as far as: 1) Is social login sufficient - no additional password required? 2) Should all users be required to generate a login password (thusly social login doesn't offer much benefit other than pre-filling signup form)? 3) Should users be required to generate a password later, eg. at the point where they enter address information?</p>