8 ms·
Speaking as a user, I strongly prefer OAuth login whenever possible, so I don't need to manage a new account. I trust the security of big players like Apple, Go
by creato 6y ago
Speaking as a user, I strongly prefer OAuth login whenever possible, so I don't need to manage a new account. I trust the security of big players like Apple, Google, etc. a lot more than random app/website developers. There is some range of value (to me) of services where I will be willing to log in/sign up with an existing OAuth account, but I will not bother if I have to make a new account.
That said, which one it is matters. My order of preference is: Apple, Google, more minor players like GitHub, and way at the bottom of the list, I won't use Facebook's.
- Larrikin 6y agoWhat security do you get from them that you don't get from a password manager and a random password for every service? I specifically avoid all external OAuth flows for my personal accounts because there is almost always an extra data grab associated with it.
- zmer 6y agoI agree. Given randomized passwords I don't see any risk with individual sign-ups rather than login partners. I will not sign up for a site/service if it only uses login partners for authentication.
- creato 6y agoPassword managers have a few problems. Sometimes they just don't work well (e.g. banking sites that partially obfuscate your username really confuse them). Sometimes websites make it hard to copy and paste passwords. Apps don't always work with password managers, requiring manually retrieving the password. But mainly, password managers are inherently a bit scary as a single point of failure. You might say that OAuth has the same problem, but I think it's better because no passwords are stored anywhere (even if encrypted), and I use a hardware 2FA key for my preferred OAuth account. I think the concern about "data grabs" is a bit overblown. I don't believe the OAuth logins that inform you of what information is being shared is lying, and if I don't like what is being shared I won't use it.
- enitihas 6y ago> banking sites that partially obfuscate your username really confuse them) Is there a bank allowing sign in by Facebook/Google? > Sometimes websites make it hard to copy and paste passwords. Yes, and that's why password managers do autofill.
- netheril96 6y ago> Yes, and that's why password managers do autofill. There are a ridiculous number of websites and apps that support neither password paste nor autofill.
- enitihas 6y agoHow does a website control autofill if the password manager extension does it? Some stupid websites do block paste, but one can use an extension to force enable paste everywhere, which IMHO is required for one's sanity.
- creato 6y agoIt seems like when websites are just janky and/or non-standard, password managers struggle to understand what fields are username/password fields, or whether it is a login vs. signup vs. password reset form, etc. To me, installing weird one-off extensions is a far bigger surface area of risk than just using OAuth.
- nemothekid 6y agoDo password managers work inside native apps? That's the number 1 place I use sign in with Google/Apple.
- NameDoesntExist 6y agoThere's an accessibility service that my password manager installs that allows it to autofill native apps.
- creato 6y agoI don't know the details of what is going on here but it sounds very sketchy. I vastly prefer an OAuth login to installing a native app, let alone one that appears to have very deep system access, and access to all my passwords at the same time.
- adwww 6y agoUsing the Lastpass accessibility service on Android only works about 40% of the time for me. Over half the times I go to use it I sit there trying to trigger it a few times, then give up and have to go and copy / paste the password from the app.
- megous 6y agoDo you realize you still have to trust the developer implemented their side of oauth correctly? It's not like Google is sending engineers to every implementor to verify that.
- sp332 6y agoWell I don't give the app developer my password, and Google limits the information that they can get about my account on their end. What could a malicious or incompetent app developer do to my Google info?