4 ms·

Another issue is what privacy are you losing by handing FB or Google all of your authentication? Offloading this is a huge privacy fail. It probably is a secur

by zie 9y ago

Another issue is what privacy are you losing by handing FB or Google all of your authentication? Offloading this is a huge privacy fail. It probably is a security win, but it's a huge privacy fail. Here Google/FB/etc, get MORE information for your giant catch-all, know-all database, thanks! Unfortunately better alternatives that are not a security win don't really exist yet.

noir_lord 9y ago
Yep, side project I'm thinking of playing with in a month or two when the batteries are recharged pretty much completely rules out using either (health data). I wouldn't sign up to my own side project if I had to use either in that case.
- jopsen 9y ago
  I'll have to admit I prefer services that has a "sign up with" particularly google, github or facebook in that order :) It's one less password to manage...
  - pfranz 9y ago
    I feel like an old person for hating those things. * I have a password manager because I have to manage 100s of passwords already and most aren't moving to Google anytime soon. * There are a few occasions where I've had to share my credentials with friends or family. It's nice to change the password temporarily and not give them access to my whole Google account. * I don't want to sign into Google on every devices/computer. Similar to the passwordless recommendation: I don't want to sign into email on every device I use the account on. * I don't want Google to know anything about me it doesn't have to. I have a Facebook account and Google account, but I rarely log in. I switched my email away from Google years ago for this reason. * What if I want to create a test account or second account to play around? I like the idea of single signon, but I don't trust the Big Boys with my data. Exclusively having "sign up with" buttons usually makes me leave the site.
    - jopsen 9y ago
      I used to feel that way... then I gave up :) I wish we had better federated sign-in solutions, but open-id probably won't be it... and U2F while cool won't solve the account recoverability problem.
ams6110 9y ago
What privacy are you losing? Real question. You're probably revealing to FB or Google that you're a user of web app X, but beyond that? Does using FB or Google auth enable any additional tracking of activities within the app or site? I would think only if the site developer was using Facebook or Google ads or tracking anyway. Asked another way -- if I sign into a website using FB auth, am I also signing into FB itself at that time? And so can be tracked around the web as if I had logged into FB directly?
- twright0 9y ago
  I believe that sign-in-with-X implementations require actually authenticating with X in that context. So in order to sign in with Google to a website, I need to sign into Google itself in the same browser. So in that sense, you are enabling Google to track you in that browser - but no differently than if you just logged into gmail. You could sign back out of Google immediately afterwards. But just the fact that an app uses Google authentication doesn't give Google any kind of privileged access to that app's data (beyond purely the data that they're logging in on this browser at this point in time) unless the app is pushing data actively back to Google (which they could do anyway for a gmail-managed email address, I guess) or you believe that Google will then subsequently forge authentication requests to that app and pull data out itself. Both of these things are hypothetical violations of your privacy enabled by using auth-with-Google, but for most use cases are rather unlikely, I would guess.
  - zyb09 9y ago
    It's not that bad. The only thing Google/FB/Twitter gets to know is that a user Y is using app X. Nothing more, and not detailed usage stats, just the basic fact. For that they handle the complete user registration, recovery & auth process for you, with all the work and pain attached to it. Granted if your OAuth provider were really evil, they could log into the users App X account and access whatever data he has inside the app, so you have decide if that a concern or not.
    - zie 9y ago
      Yes, but they get "only" that, but with it, they get, time/date of when you use the app(and perhaps how long, depending on how you/they handle logouts). Plus they get this for EVERY app that's used. You start aggregating this information and suddenly you can tell a LOT about a person. Plus this is all for ad dollars, FB/Google/etc can(will/do?) sell this information, to anyone willing to pay for it. For a hello world app, no big. For a game app, what happens when your employer buys the data, and notices you are playing games on "company" time... Of course lots more privacy failures can be easily imagined here. I picked low privacy failures, but larger failures are very easy to imagine.. Especially when we know that most large governments also have this data, directly siphoned from Google/FB/etc.

by zie 9y ago

noir_lord 9y ago

Yep, side project I'm thinking of playing with in a month or two when the batteries are recharged pretty much completely rules out using either (health data). I wouldn't sign up to my own side project if I had to use either in that case.

jopsen 9y ago
I'll have to admit I prefer services that has a "sign up with" particularly google, github or facebook in that order :) It's one less password to manage...
- pfranz 9y ago
  I feel like an old person for hating those things. * I have a password manager because I have to manage 100s of passwords already and most aren't moving to Google anytime soon. * There are a few occasions where I've had to share my credentials with friends or family. It's nice to change the password temporarily and not give them access to my whole Google account. * I don't want to sign into Google on every devices/computer. Similar to the passwordless recommendation: I don't want to sign into email on every device I use the account on. * I don't want Google to know anything about me it doesn't have to. I have a Facebook account and Google account, but I rarely log in. I switched my email away from Google years ago for this reason. * What if I want to create a test account or second account to play around? I like the idea of single signon, but I don't trust the Big Boys with my data. Exclusively having "sign up with" buttons usually makes me leave the site.
  - jopsen 9y ago
    I used to feel that way... then I gave up :) I wish we had better federated sign-in solutions, but open-id probably won't be it... and U2F while cool won't solve the account recoverability problem.

ams6110 9y ago

What privacy are you losing? Real question. You're probably revealing to FB or Google that you're a user of web app X, but beyond that? Does using FB or Google auth enable any additional tracking of activities within the app or site? I would think only if the site developer was using Facebook or Google ads or tracking anyway. Asked another way -- if I sign into a website using FB auth, am I also signing into FB itself at that time? And so can be tracked around the web as if I had logged into FB directly?

twright0 9y ago
I believe that sign-in-with-X implementations require actually authenticating with X in that context. So in order to sign in with Google to a website, I need to sign into Google itself in the same browser. So in that sense, you are enabling Google to track you in that browser - but no differently than if you just logged into gmail. You could sign back out of Google immediately afterwards. But just the fact that an app uses Google authentication doesn't give Google any kind of privileged access to that app's data (beyond purely the data that they're logging in on this browser at this point in time) unless the app is pushing data actively back to Google (which they could do anyway for a gmail-managed email address, I guess) or you believe that Google will then subsequently forge authentication requests to that app and pull data out itself. Both of these things are hypothetical violations of your privacy enabled by using auth-with-Google, but for most use cases are rather unlikely, I would guess.
- zyb09 9y ago
  It's not that bad. The only thing Google/FB/Twitter gets to know is that a user Y is using app X. Nothing more, and not detailed usage stats, just the basic fact. For that they handle the complete user registration, recovery & auth process for you, with all the work and pain attached to it. Granted if your OAuth provider were really evil, they could log into the users App X account and access whatever data he has inside the app, so you have decide if that a concern or not.
  - zie 9y ago
    Yes, but they get "only" that, but with it, they get, time/date of when you use the app(and perhaps how long, depending on how you/they handle logouts). Plus they get this for EVERY app that's used. You start aggregating this information and suddenly you can tell a LOT about a person. Plus this is all for ad dollars, FB/Google/etc can(will/do?) sell this information, to anyone willing to pay for it. For a hello world app, no big. For a game app, what happens when your employer buys the data, and notices you are playing games on "company" time... Of course lots more privacy failures can be easily imagined here. I picked low privacy failures, but larger failures are very easy to imagine.. Especially when we know that most large governments also have this data, directly siphoned from Google/FB/etc.