4 ms·

What security do you get from them that you don't get from a password manager and a random password for every service? I specifically avoid all external OAuth f

What security do you get from them that you don't get from a password manager and a random password for every service? I specifically avoid all external OAuth flows for my personal accounts because there is almost always an extra data grab associated with it.

zmer 6y ago
I agree. Given randomized passwords I don't see any risk with individual sign-ups rather than login partners. I will not sign up for a site/service if it only uses login partners for authentication.
creato 6y ago
Password managers have a few problems. Sometimes they just don't work well (e.g. banking sites that partially obfuscate your username really confuse them). Sometimes websites make it hard to copy and paste passwords. Apps don't always work with password managers, requiring manually retrieving the password. But mainly, password managers are inherently a bit scary as a single point of failure. You might say that OAuth has the same problem, but I think it's better because no passwords are stored anywhere (even if encrypted), and I use a hardware 2FA key for my preferred OAuth account. I think the concern about "data grabs" is a bit overblown. I don't believe the OAuth logins that inform you of what information is being shared is lying, and if I don't like what is being shared I won't use it.
- enitihas 6y ago
  > banking sites that partially obfuscate your username really confuse them) Is there a bank allowing sign in by Facebook/Google? > Sometimes websites make it hard to copy and paste passwords. Yes, and that's why password managers do autofill.
  - netheril96 6y ago
    > Yes, and that's why password managers do autofill. There are a ridiculous number of websites and apps that support neither password paste nor autofill.
    - enitihas 6y ago
      How does a website control autofill if the password manager extension does it? Some stupid websites do block paste, but one can use an extension to force enable paste everywhere, which IMHO is required for one's sanity.
      - creato 6y ago
        It seems like when websites are just janky and/or non-standard, password managers struggle to understand what fields are username/password fields, or whether it is a login vs. signup vs. password reset form, etc. To me, installing weird one-off extensions is a far bigger surface area of risk than just using OAuth.
nemothekid 6y ago
Do password managers work inside native apps? That's the number 1 place I use sign in with Google/Apple.
- NameDoesntExist 6y ago
  There's an accessibility service that my password manager installs that allows it to autofill native apps.
  - creato 6y ago
    I don't know the details of what is going on here but it sounds very sketchy. I vastly prefer an OAuth login to installing a native app, let alone one that appears to have very deep system access, and access to all my passwords at the same time.
  - adwww 6y ago
    Using the Lastpass accessibility service on Android only works about 40% of the time for me. Over half the times I go to use it I sit there trying to trigger it a few times, then give up and have to go and copy / paste the password from the app.

zmer 6y ago

I agree. Given randomized passwords I don't see any risk with individual sign-ups rather than login partners. I will not sign up for a site/service if it only uses login partners for authentication.

creato 6y ago

Password managers have a few problems. Sometimes they just don't work well (e.g. banking sites that partially obfuscate your username really confuse them). Sometimes websites make it hard to copy and paste passwords. Apps don't always work with password managers, requiring manually retrieving the password. But mainly, password managers are inherently a bit scary as a single point of failure. You might say that OAuth has the same problem, but I think it's better because no passwords are stored anywhere (even if encrypted), and I use a hardware 2FA key for my preferred OAuth account. I think the concern about "data grabs" is a bit overblown. I don't believe the OAuth logins that inform you of what information is being shared is lying, and if I don't like what is being shared I won't use it.

enitihas 6y ago
> banking sites that partially obfuscate your username really confuse them) Is there a bank allowing sign in by Facebook/Google? > Sometimes websites make it hard to copy and paste passwords. Yes, and that's why password managers do autofill.
- netheril96 6y ago
  > Yes, and that's why password managers do autofill. There are a ridiculous number of websites and apps that support neither password paste nor autofill.
  - enitihas 6y ago
    How does a website control autofill if the password manager extension does it? Some stupid websites do block paste, but one can use an extension to force enable paste everywhere, which IMHO is required for one's sanity.
    - creato 6y ago
      It seems like when websites are just janky and/or non-standard, password managers struggle to understand what fields are username/password fields, or whether it is a login vs. signup vs. password reset form, etc. To me, installing weird one-off extensions is a far bigger surface area of risk than just using OAuth.

nemothekid 6y ago

Do password managers work inside native apps? That's the number 1 place I use sign in with Google/Apple.

NameDoesntExist 6y ago
There's an accessibility service that my password manager installs that allows it to autofill native apps.
- creato 6y ago
  I don't know the details of what is going on here but it sounds very sketchy. I vastly prefer an OAuth login to installing a native app, let alone one that appears to have very deep system access, and access to all my passwords at the same time.
- adwww 6y ago
  Using the Lastpass accessibility service on Android only works about 40% of the time for me. Over half the times I go to use it I sit there trying to trigger it a few times, then give up and have to go and copy / paste the password from the app.