39 ms·

Google Login will be mandatory for Firebase accounts

73 points by dinosaurs 11y ago

ChrisClark 11y ago
Sure, don't mind.
iLoch 11y ago
I was gonna write a long post about how Google just doesn't get it, but I think I give up.
- pbreit 11y ago
  The 4th most valuable company in the world after only 17 years "doesn't get it"? Yes, you should give up.
- steego 11y ago
  I would have much rather you written the long post than this useless short post.
vonklaus 11y ago
I think it is pretty fucked up that google is bundling their free email, storage and suite of office products with their free/low cost nosql database. There just aren't any noSQL options out there right now.
- geofft 11y ago
  > If your team does not already use Google products, you can create a "slimmed down" Google account using any existing email address here. This Google account won't be tied to any Gmail, Google+, or other Google products.
- ars 11y ago
  > that google is bundling their free email, storage and suite of office products with their free/low cost nosql database. They aren't. Next time you should read the article before posting.
- cwyers 11y ago
  I think it is pretty fucked up that people expect Google to continue to give away free hosted databases and complain about having to use Google's account system to login.
- pbreit 11y ago
  I think this is facetious but I don't really get it.
- deelowe 11y ago
  I think it's pretty fucked up you didn't read TFA. "I don't have an existing Google account and I don't want to sign up for Gmail, Google+, or any other Google services. What should I do? It is easy to create a Google account for any existing email address without tying it to any Google services. It will only be used for identification and login. You can sign up for this "slimmed down" Google account here. You can also create this type of Google account via the existing migration flow on firebase.com."
- jessaustin 11y ago
  "whoosh" [hint for ESL folks: the adjective "free" used twice]
  - vonklaus 11y ago
    Haha and people ask why I use satire tags when it is "obvious". Also, a good hint was the lack of noSQL options in the marketplace....
stephengoodwin 11y ago
Context: Firebase was bought by Google in 2014[1] [1] http://techcrunch.com/2014/10/21/google-acquires-firebase-to-help-developers-build-better-realtime-apps/ http://techcrunch.com/2014/10/21/google-acquires-firebase-to...
jessaustin 11y ago
I didn't know about this: https://accounts.google.com/SignUpWithoutGmail https://accounts.google.com/SignUpWithoutGmail
- boulos 11y ago
  Sadly HN's URL trimmer buries the lede here: /SignUpWithoutGmail (see my other comment for where this came from James's FAQ).
  - jessaustin 11y ago
    Are you on a phone? I don't see any trimming, either logged in or from an incognito window.
    - boulos 11y ago
      Ha, yes sorry about that (I've gotten so used to the new responsive thing I didn't even think twice about it).
- scrollaway 11y ago
  Is this the same as Google Apps accounts? I can't sign up to a google account without gmail from an address I previously used for a Google Apps account.
sbashyal 11y ago
I really hope that the next generation of companies founded and run by people who grew up being on the other side will refrain from making this kind of decisions.
- genericone 11y ago
  Straight from the link: I don't have an existing Google account and I don't want to sign up for Gmail, Google+, or any other Google services. What should I do? It is easy to create a Google account for any existing email address without tying it to any Google services. It will only be used for identification and login. You can sign up for this "slimmed down" Google account here. You can also create this type of Google account via the existing migration flow on firebase.com.
- geofft 11y ago
  Why do you object to this decision? If I'm building a service that needs an account system with 2FA, detection of automated attacks, and some decent amount of internal security, I am surely not going to build it myself. It is just like rolling my own crypto in all the wrong ways. There are a couple of providers that will do this for me, for free: Google, Facebook, Twitter, Amazon, and GitHub come to mind. Each has some tradeoffs of public perception, losing audience members who refuse to have an X account, etc., but it's mostly a tossup. For a technical service like this I might have gone with GitHub, but if they're owned by Google, having only Google logins seems like the right choice. (Among other things, you already have a Google account in a sense when using Firebase, it's just run by a separate team at Google.) Sandstorm, a project that encourages you to self-host all your web services, came to the same conclusion: https://github.com/sandstorm-io/sandstorm/issues/150#issuecomment-62084752 https://github.com/sandstorm-io/sandstorm/issues/150#issueco... Is there a better third-party alternative here, or a way to do this securely and easily yourself that I'm missing?
  - sbashyal 11y ago
    I already have a Firebase account setup with my work email address. So you are implying that having a Google account is required for 2FA?
boulos 11y ago
A Google Login isn't as drastic as it used to be. From the FAQ: > I don't have an existing Google account and I don't want to sign up for Gmail, Google+, or any other Google services. What should I do? It is easy to create a Google account for any existing email address without tying it to any Google services. It will only be used for identification and login. You can sign up for this "slimmed down" Google account here. You can also create this type of Google account via the existing migration flow on firebase.com.
- tjohns 11y ago
  > A Google Login isn't as drastic as it used to be. To be fair, it's been possible to create a Google account without Gmail for a long time now. I remember creating one ~7 years ago, back when I ran my own mail server.
- CaptSpify 11y ago
  although true now, Google has a bad history of trying to coerce you into other services. Youtube/Voice ?
  - cballard 11y ago
    How, specifically, are you "coerced" into those services? Voice and YouTube are owned by Google. I'd expect a Google account to just work on all Google properties, without me having to sign up for each individually. If you don't want to use those services, just don't visit them. What's the issue?
    - anon1385 11y ago
      You really don't remember what happened with the forced merging/conversion of YouTube accounts into G+ accounts, the forced use of 'real names' on YouTube and the changes to YouTube comments? Before the final forced conversion they spent months and months trying to trick people into agreeing to change their account against their will using a bunch of interface design dark patterns. >If you don't want to use those services, just don't visit them. What's the issue? A lot of people did leave YouTube because of it, but that means they lost all their playlists and favourites and comments. Also that can't ever repair things for the people who had aspects of their personal lives suddenly exposed by Google sticking their real life identity on their previously pseudonymous YouTube videos and comments.
JoshMnem 11y ago
This only means that the developers have to login with a Google account? Firebase is a Google-owned product, so why would that be a surprise? It doesn't sound like your app's users have to login with Google. Edit: if you don't want someone telling you how to login, maybe check out Kinto? http://kinto.readthedocs.org/en/latest/overview.html http://kinto.readthedocs.org/en/latest/overview.html
aleem 11y ago
Firebase has stagnated for quite some time now. Months ago I mailed them about Twitter now allowing email addresses in their Auth but Firebase has yet to catch up. This means you cannot get email addresses of users signing up via Twitter. They suggested I manually ask the user to type it in, which obviously defeats the purpose of OAuth. A request has been pending for over a year to add the client IP in their ServerValue response which is a common security ask but the boilerplate response of we're working on it has got no traction. They still don't have a password reset email template so you must use the forgot pass template. Even so, their forgot password mail adds the username in the URL. If like me, you use the email address as the username this won't work. That's because they don't encode the email address in the URL. I brought this up months ago, they acknowledged the bug and then suggested I manually ask the user to type it in. This still doesn't work. There were some other issues but I gave up on the service.
- deleted 11y ago
  [deleted]

73 points by dinosaurs 11y ago

ChrisClark 11y ago

Sure, don't mind.

iLoch 11y ago

I was gonna write a long post about how Google just doesn't get it, but I think I give up.

pbreit 11y ago
The 4th most valuable company in the world after only 17 years "doesn't get it"? Yes, you should give up.
steego 11y ago
I would have much rather you written the long post than this useless short post.

vonklaus 11y ago

I think it is pretty fucked up that google is bundling their free email, storage and suite of office products with their free/low cost nosql database. There just aren't any noSQL options out there right now.

geofft 11y ago
> If your team does not already use Google products, you can create a "slimmed down" Google account using any existing email address here. This Google account won't be tied to any Gmail, Google+, or other Google products.
ars 11y ago
> that google is bundling their free email, storage and suite of office products with their free/low cost nosql database. They aren't. Next time you should read the article before posting.
cwyers 11y ago
I think it is pretty fucked up that people expect Google to continue to give away free hosted databases and complain about having to use Google's account system to login.
pbreit 11y ago
I think this is facetious but I don't really get it.
deelowe 11y ago
I think it's pretty fucked up you didn't read TFA. "I don't have an existing Google account and I don't want to sign up for Gmail, Google+, or any other Google services. What should I do? It is easy to create a Google account for any existing email address without tying it to any Google services. It will only be used for identification and login. You can sign up for this "slimmed down" Google account here. You can also create this type of Google account via the existing migration flow on firebase.com."
jessaustin 11y ago
"whoosh" [hint for ESL folks: the adjective "free" used twice]
- vonklaus 11y ago
  Haha and people ask why I use satire tags when it is "obvious". Also, a good hint was the lack of noSQL options in the marketplace....

stephengoodwin 11y ago

Context: Firebase was bought by Google in 2014[1] [1] http://techcrunch.com/2014/10/21/google-acquires-firebase-to-help-developers-build-better-realtime-apps/ http://techcrunch.com/2014/10/21/google-acquires-firebase-to...

jessaustin 11y ago

I didn't know about this: https://accounts.google.com/SignUpWithoutGmail https://accounts.google.com/SignUpWithoutGmail

boulos 11y ago
Sadly HN's URL trimmer buries the lede here: /SignUpWithoutGmail (see my other comment for where this came from James's FAQ).
- jessaustin 11y ago
  Are you on a phone? I don't see any trimming, either logged in or from an incognito window.
  - boulos 11y ago
    Ha, yes sorry about that (I've gotten so used to the new responsive thing I didn't even think twice about it).
scrollaway 11y ago
Is this the same as Google Apps accounts? I can't sign up to a google account without gmail from an address I previously used for a Google Apps account.

sbashyal 11y ago

I really hope that the next generation of companies founded and run by people who grew up being on the other side will refrain from making this kind of decisions.

genericone 11y ago
Straight from the link: I don't have an existing Google account and I don't want to sign up for Gmail, Google+, or any other Google services. What should I do? It is easy to create a Google account for any existing email address without tying it to any Google services. It will only be used for identification and login. You can sign up for this "slimmed down" Google account here. You can also create this type of Google account via the existing migration flow on firebase.com.
geofft 11y ago
Why do you object to this decision? If I'm building a service that needs an account system with 2FA, detection of automated attacks, and some decent amount of internal security, I am surely not going to build it myself. It is just like rolling my own crypto in all the wrong ways. There are a couple of providers that will do this for me, for free: Google, Facebook, Twitter, Amazon, and GitHub come to mind. Each has some tradeoffs of public perception, losing audience members who refuse to have an X account, etc., but it's mostly a tossup. For a technical service like this I might have gone with GitHub, but if they're owned by Google, having only Google logins seems like the right choice. (Among other things, you already have a Google account in a sense when using Firebase, it's just run by a separate team at Google.) Sandstorm, a project that encourages you to self-host all your web services, came to the same conclusion: https://github.com/sandstorm-io/sandstorm/issues/150#issuecomment-62084752 https://github.com/sandstorm-io/sandstorm/issues/150#issueco... Is there a better third-party alternative here, or a way to do this securely and easily yourself that I'm missing?
- sbashyal 11y ago
  I already have a Firebase account setup with my work email address. So you are implying that having a Google account is required for 2FA?

boulos 11y ago

A Google Login isn't as drastic as it used to be. From the FAQ: > I don't have an existing Google account and I don't want to sign up for Gmail, Google+, or any other Google services. What should I do? It is easy to create a Google account for any existing email address without tying it to any Google services. It will only be used for identification and login. You can sign up for this "slimmed down" Google account here. You can also create this type of Google account via the existing migration flow on firebase.com.

tjohns 11y ago
> A Google Login isn't as drastic as it used to be. To be fair, it's been possible to create a Google account without Gmail for a long time now. I remember creating one ~7 years ago, back when I ran my own mail server.
CaptSpify 11y ago
although true now, Google has a bad history of trying to coerce you into other services. Youtube/Voice ?
- cballard 11y ago
  How, specifically, are you "coerced" into those services? Voice and YouTube are owned by Google. I'd expect a Google account to just work on all Google properties, without me having to sign up for each individually. If you don't want to use those services, just don't visit them. What's the issue?
  - anon1385 11y ago
    You really don't remember what happened with the forced merging/conversion of YouTube accounts into G+ accounts, the forced use of 'real names' on YouTube and the changes to YouTube comments? Before the final forced conversion they spent months and months trying to trick people into agreeing to change their account against their will using a bunch of interface design dark patterns. >If you don't want to use those services, just don't visit them. What's the issue? A lot of people did leave YouTube because of it, but that means they lost all their playlists and favourites and comments. Also that can't ever repair things for the people who had aspects of their personal lives suddenly exposed by Google sticking their real life identity on their previously pseudonymous YouTube videos and comments.

JoshMnem 11y ago

This only means that the developers have to login with a Google account? Firebase is a Google-owned product, so why would that be a surprise? It doesn't sound like your app's users have to login with Google. Edit: if you don't want someone telling you how to login, maybe check out Kinto? http://kinto.readthedocs.org/en/latest/overview.html http://kinto.readthedocs.org/en/latest/overview.html

aleem 11y ago

Firebase has stagnated for quite some time now. Months ago I mailed them about Twitter now allowing email addresses in their Auth but Firebase has yet to catch up. This means you cannot get email addresses of users signing up via Twitter. They suggested I manually ask the user to type it in, which obviously defeats the purpose of OAuth. A request has been pending for over a year to add the client IP in their ServerValue response which is a common security ask but the boilerplate response of we're working on it has got no traction. They still don't have a password reset email template so you must use the forgot pass template. Even so, their forgot password mail adds the username in the URL. If like me, you use the email address as the username this won't work. That's because they don't encode the email address in the URL. I brought this up months ago, they acknowledged the bug and then suggested I manually ask the user to type it in. This still doesn't work. There were some other issues but I gave up on the service.

deleted 11y ago
[deleted]