3 ms·
On the flip side, people used to argue for SSO as a privacy/security feature - rather than sharing your email and creating passwords with every site, just let a
by wonnage 6y ago
On the flip side, people used to argue for SSO as a privacy/security feature - rather than sharing your email and creating passwords with every site, just let a trusted intermediary like Google/Facebook handle those nasty details!
- ffpip 6y agoThey still get your email with SSO. And name, profile pic too. Which they don't via the normal method. With SSO via Google, FB, you have to agree to share data with them.. email is a thousand times better
- lstamour 6y agoThat’s not true of Apple which means it’s not true of all SSO. Sometimes users are offered a choice of claims. It’s allowed, just rarely implemented.
- dan15 6y ago> With SSO via Google, FB, you have to agree to share data with them Not sure about Google, but with FB you can choose which information to share with the site.
- sebastien_b 6y agoBut doesn’t that mean if it gets compromised (which I think one popular one did a while back?), then you’re basically screwed for every site you used it with? Personally, I always use email, plus 2FA when available. I don’t trust “single” sign-ins anywhere - I’d rather control the access to the credentials myself.
- lstamour 6y agoThis is why FIDO2 is considered a strong alternative to SSO, and, in some cases, persistent session cookies. That said, the likelihood of a site getting compromised is a lot higher than the odds of, say, Google getting compromised. And Google could just deny your logins on unfamiliar devices. Which would cause other problems, but is more likely to happen with Google doing the authentication than at a small random site that doesn’t know what devices I regularly use to begin with. There’s always trade offs of course.
- Yetanfou 6y agoJust use single-correspondent mail addresses for signing up, i.e. weirdwebsite-myname@example.org and strangesite-myname@example.org (using a hyphen instead of a plus sign to get past unhelpful mail address sanitizers), add a regex for * -myname to /etc/aliases and you're set. You don't need to set up special addresses, the regex alias will make sure the mail ends up in your INBOX. I've done this for more than 20 years without being inundated in spam, I never use my 'real' address for interaction with others than friends and family.