3 ms·
The article's fundamental argument is that using any separate service to sign in is a problem, and doesn't really distinguish between signing in with Google or
by laurex 8y ago
The article's fundamental argument is that using any separate service to sign in is a problem, and doesn't really distinguish between signing in with Google or signing in with Facebook, yet many products with a huge need for security (protecting PII of users) that I'm familiar with use Google sign-in. That seems to indicate a fatal flaw somewhere, either in the writer's understanding of Google sign-in, or the assumptions most companies are making about security.
- travbrack 8y agoIt's silly. A security flaw could exist in any other oauth provider, or password manager. I bet Facebook handled the incident better than many others in the industry would have.
- dvfjsdhgfv 8y ago> I bet Facebook handled the incident better than many others in the industry would have. And you base this assumption on what grounds?
- travbrack 8y agoThings I've read about their bug bounty program and things I've read about other tech companies bug bounty programs. No, I don't have links.
- wolco 8y agoMost companies are making incorrect assumptions about security everyday.
- tacomonstrous 8y agoFrom the article: >But at this moment, a sign-on service by Google or Microsoft has one big advantage over Facebook’s: Those companies did not lose control of 50 million people’s accounts, and Facebook did.
- deleted 8y ago[deleted]