24 ms·

Don't use third party auth to sign in

• superasn 6y ago
  I also think it can be the other way round too. Like I use this amazing app called Smart youtube player that works best if you sign in with your YouTube id. Now this app breaks some rules like skipping ads which may voilate their Tos which can put your account in jeopardy also.
• demadog 6y ago
  I realized that recently after Gmail locked my account for using email outreach software. I restored it but automatically had to start thinking about a backup plan where I’d have to point my MX records away from Gmail to something else immediately in order to prevent email downtime.
  • londons_explore 6y ago
    > for using email outreach software. I hope they ban people sending bulk email too... You should send that stuff from your own server or MailChimp etc.
    • lucb1e 6y ago
      Why is it okay to send bulk mail from service X or Y but not from service Z?
      • judge2020 6y ago
        Gmail doesn’t do anything to manage unsubscribing from an email list, so if you were sending email blasts from there, chances are there wasn’t an unsubscribe link. Mailchimp and related marketing services automatically wrap each email with an unsubscribe button for their own reputation sake.
    • sundarurfriend 6y ago
      I didn't understand what that meant, is it basically euphemism for almost-but-not-techically-spam emails many startups and "personal brands" send out?
      • judge2020 6y ago
        I would suspect; GSuite seems fine with being a SMTP relay for low-volume transactional emails and regular business communications, and nothing more.
• philjohn 6y ago
  I only ever use "sign in with" for throaway stuff I don't care enough about to register an account - if it's in any way important I setup an account, and add whatever form of 2FA I can.
  • damnencryption 6y ago
    I really wish 2fa was implemented in convenient form everywhere. There are ton of sites that just force me to use SMS.
    • philjohn 6y ago
      I wish more supported WebAuthN - it's so much lower friction than OATH TOTP or SMS. I've got everything on 3 yubikeys (including OATH TOTP) and I feel much safer than when I just used Authy
• deleted 6y ago
  [deleted]
• ukoki 6y ago
  To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email account, so make sure these are companies your trust and your access to these accounts is as secure as possible (ie strong unique passwords and app-based, not SMS-based two-factor authentication)
  • DaiPlusPlus 6y ago
    Yeah but they’ve still got your emails.
    • 0-_-0 6y ago
      For that you have this: https://takeout.google.com/ https://takeout.google.com/ You can export all your email in a single .mbox file. This might not work if your account is suspended, but if you set up email forwarding to an alternative address (e.g. to protonmail) that might still stay active so you can transition your addresses.
      • saagarjha 6y ago
        I wonder if Google lets you Takeout if they’ve locked your account…
        • londons_explore 6y ago
          They do now (although you only have 7 days to do so I think). It also depends on the reason for the block - if for example they suspect you of having illegal content (child porn) in your Gmail, you aren't allowed to takeout it.
          • sneak 6y ago
            That's great news. Facebook and Twitter don't (Facebook as of a few years ago, Twitter as of this year), as I learned the hard way.
• grezql 6y ago
  Has anyone else noticed random popups on 3rd party websites asking for google sign in? I even used firefox when it happened: https://imgur.com/a/JC52lBV https://imgur.com/a/JC52lBV (lequipe.fr) https://imgur.com/a/VSM3Uk9 https://imgur.com/a/VSM3Uk9 (reddit.com) https://imgur.com/a/KpVCYBL https://imgur.com/a/KpVCYBL (medium.com)
  • damnencryption 6y ago
    Yeah. Reddit is especially really intrusive and annoying. I feel like they just don't want people to use their site anymore. Whenever I open new Reddit, my memory and CPU usage goes up so badly.
    • MattGaiser 6y ago
      old.reddit.com.
      • lasagnaphil 6y ago
        Use a browser plugin like this to always use the old site: https://addons.mozilla.org/en-US/firefox/addon/old-reddit-redirect/ https://addons.mozilla.org/en-US/firefox/addon/old-reddit-re...
        • Fnoord 6y ago
          Doesn't work on Firefox Android. I never go to Reddit by typing URL; I go to Reddit because I follow a link to it.
          • mcjiggerlog 6y ago
            Creator of the extension here. It actually does work on Android, it's just not in the (very short) list of allowed extensions yet. There is a workaround to add custom addons, though: https://github.com/tom-james-watson/old-reddit-redirect/issues/42 https://github.com/tom-james-watson/old-reddit-redirect/issu...
• usr1106 6y ago
  The truth is you should not use Google login to Google services either. You get the service promise you pay for, none. If their secret algorithms decide that you are in breach of whatever ToS, they will lock you out. Not very likely for the average user. But more likely for HN reader who might experiment with programmatic access to the services or do other atypical stuff. Yes, I need to move away from gmail...
  • alisonkisk 6y ago
    You can pay for a Google account.
• mrkramer 6y ago
  "Never Use Google to Sign-In" he says it as he offers Google Sign-In through Disqus comment section on his blog.
  • lucb1e 6y ago
    If they had built their own comment section with Google login, that would be weird indeed. But if you just like Disqus comments (they certainly were hot when I actively blogged in 2012) and one of their login options is Google... I don't see the issue there unless they're really pushing you to use it.
    • mrkramer 6y ago
      Author said "If a website offers you to sign-in using Google (or any third-party service, say Facebook, Github, etc.), don’t use that feature." But he has Disqus comment section which offers login through Facebook, Twitter and Google. I would say that's little bit hypocritical. The similar thing is when a politician says corruption is bad and next thing you know he or she is involved in corruption scandal.
      • forgotpwd16 6y ago
        Disqus offers you sign-in using one of aforementioned services but you don't have to use that feature. You can make an account normally and sign-in using email/passsword. The author says you should prefer the later, not boycott any service offering the former.
  • diroussel 6y ago
    It’s ok to give advice and choice.
  • chimen 6y ago
    He's not offering Google Sign-In. Disqus does.
• rwoerz 6y ago
  Isn't that obvious? Convenience always hat some kind of price tag, particularly a security related one. I would have canceled my facebook account long ago if I had not chosen their login for a (unknown) number of service. What would be a better alternative? Use same credentials everywhere? No, because it is just a matter of time it would leak out of one service. Use unique credentials for each service in local password manager? Nay, because most of us at least want to sync between desktop an mobile. Use something like Chrome's password manager? That bears similar dangers like those the article points out.
  • krtkush 6y ago
    > What would be a better alternative? Use same credentials everywhere? No, because it is just a matter of time it would leak out of one service. Use unique credentials for each service in local password manager? Nay, because most of us at least want to sync between desktop an mobile. Use something like Chrome's password manager? That bears similar dangers like those the article points out. I use BitWarden and it works pretty well on all my iOS devices and across major browsers.
  • ClumsyPilot 6y ago
    Use any password manager
• yread 6y ago
  Or do it but don't use your google account for your business. Especially, if the business could be considered by anyone as spam, anything to do naked bodies, terrorism, weapons and such
• aidos 6y ago
  We went through a process of changing email domains recently and we use Google Sign In for many of our services. Switching emails over varied greatly between services. Sometimes it all just worked and my new email would sign in to my account and my email address on the service was updated automatically. Some allowed me to sign in fine, but I had to contact them directly to update the email address. A number of times I ended up having to go through recovery processes. I guess at least if you’re using your own domain, you’d be able to repoint mx records to do the recovery. I tend not to use it for my personal accounts, but honestly, Google Sign In for our work systems has generally been a good experience. Works well for our small team, anyway.
• deleted 6y ago
  [deleted]
• AHappyCamper 6y ago
  > "if Google (or third-party of your choice) locks your account for some reason, you will be locked out of all the services where you signed into using Google." But if the account I'd use to sign in is my Gmail account, and they had locked that account, wouldn't I be locked out anyway? Please explain it to me if I'm wrong (cause that happens often).
  • lordnacho 6y ago
    You'd be locked out of recovery emails, but not the service. You could potentially changed the email/username as long as you still had the login details.
• ThePhysicist 6y ago
  We also offer multiple third-party signup solutions for our service in addition to "traditional" e-mail based signup. For every service we retrieve and store the users' e-mail address on our server (we also need that to e.g. send out invoices) and enable e-mail based login and password reset/generation by default (you can disable it or add 2FA), so your account will not be lost just because your OAuth provider blocks your credentials.
  • sneak 6y ago
    That's great, but I'd wager that a majority of users that use Google login are doing so @gmail.com, so their email address is also toast if their Google account is suspended. I suppose you, as a site operator, are doing all you can do, though.
  • lovelearning 6y ago
    Won't the password reset link of a blocked Google user get emailed to their inaccessible gmail inbox?
    • Jochim 6y ago
      I think it's to protect against the Identity Provider revoking access to the service you're dealing with rather than them blocking your account. We saw this recently with "Sign in with Apple" and Epic Games, where Apple denied access to Epic and the accounts that did not share their actual email were effectively lost.
      • judge2020 6y ago
        Except that Apple didn’t go through with revoking it: https://www.epicgames.com/help/en-US/epic-accounts-c74/connect-accounts-c110/how-do-i-retain-access-to-my-epic-games-account-after-sign-in-with-apple-ends-a6894 https://www.epicgames.com/help/en-US/epic-accounts-c74/conne... > Apple previously stated they would terminate “Sign In with Apple” support for Epic Games accounts after September 11, 2020, but today provided an indefinite extension. https://www.epicgames.com/id/login https://www.epicgames.com/id/login
• jsilence 6y ago
  If Google blocks your account you clearly have done something wrong and rightfully so deserve to be deprived of any web service. /sarcasm
  • sdwolfz 6y ago
    This might sound like sarcasm to us but I've honestly heard people claim this with a serious face, as well as: "I'm not doing anything bad, so they'll never block me". Guess it's not a problem until it actually happens to them.
    • nottorp 6y ago
      There were pieces of news about google accounts being blocked for being "associated" with an account that did bad things. I think most were contractors using both their own accounts and the customer's accounts to put apps in the play store... which will associate you with random people that pay you to make an app, maybe forever?
      • jsilence 6y ago
        Having an identity provider service intermingled with services by the same company and not differentiating between providing the identity service and any other service is the core of this problem. Really sad that Mozilla Persona did not make it. To me this was promising solution for 'identity provider service'. This section of service should be heavily regulated since it hs a lot of power. Also probably it should be paid for.
• alerighi 6y ago
  Not really, in a lot of sites even if you sign up with Google you then can do a simple 'reset password' with the email associated with your Google account and set a password. The real solution to the problem would be a standadized passwordless local authentication for sites, I mean the site uses an API of the browser to auth the user, that way you don't need third parties to authenticate and you have everything in your PC. The W3C is working on it.
• akmarinov 6y ago
  Same goes for Facebook Login, Twitter Login and Sign in with Apple
• znpy 6y ago
  I'd argue, never use a third party service to log in, if you can. I always use my email to sign up. If I can't register by email, there's a good chance I won't use that service.
• chpmrc 6y ago
  It’s worth noting that you’ll get the same outcome if you register everywhere with a free Gmail/iCloud/whatever account. The only sure way you won’t lose access is to set up your own domain and use a decent email provider that allows to use it (Yes, ironically even Google Workspace/GSuite).
• omarmhaimdat 6y ago
  I usually use it for random websites, but not for services I use everyday
• angry_octet 6y ago
  Good point, but if Google suspends my account I've got bigger things to worry about than the dozens of sites I've used once or twice a year. Paying for your own domain also comes with its own troubles. If you're not using Google (or some other service) as your mail forwarder, good luck being able to email anyone. Stealing you custom domain is also a real possibility, and negates your investment in Gmail 2FA.
  • jhasse 6y ago
    How could my domain be stolen? :O
    • undebuggable 6y ago
      - does you registrar have physical office? is it in a country with legislation friendly towards the country you're based in? - does your registrar send Auth-Info code over email in plain text? - did you enter real contact and residence data when registering the domain including public WHOIS database? This is only a fraction of the attack vector.
      • jhasse 6y ago
        > does you registrar have physical office? Yes. > is it in a country with legislation friendly towards the country you're based in? It's in the same country. > does your registrar send Auth-Info code over email in plain text? Of course not, that would be a big red-flag. > did you enter real contact and residence data when registering the domain including public WHOIS database? I have no idea what a public WHOIS database is, never registered anything there. For the registrar I've entered my real contact and residence data, should I've not?
        • undebuggable 6y ago
          I mean the contact details specified at the registrar and returned over the WHOIS protocol. Depending on the nature of a conflict the entity returned by the WHOIS requests might be considered the owner of the domain. Unfortunate phrasing on my side:) Actually there exist scammers reaching out to well known mailbox names and requesting a fee for an entry in "WHOIS database".
• throw_m239339 6y ago
  Remember OpenID? Yes, that's what it was for, OAuth wasn't never meant for signing in other websites who just want your mail or something... Of course, all these big tech corps quickly dropped OpenID, they don't want people to control their online credentials or identity...
  • coder543 6y ago
    Really, I think OpenID died because it didn’t see significant enough adoption. I remember the user flows being a bit clunky, which certainly didn’t help. With OpenID, basically everyone used a third party ID provider, and so you were just as dependent on that provider as with OAuth. Did you actually self host OpenID? If so, that’s a lot to ask of each person in the world. If you didn’t self host OpenID, I don’t think you had much “control of your online credentials or identity.” If OAuth was never meant for signing in, then putting Auth in the name was a funny choice. You add the qualifier “websites who just want your mail or something”, but I’ve never seen a single mailing list sign up that used OAuth.
    • progval 6y ago
      > Did you actually self host OpenID? If so, that’s a lot to ask of each person in the world. You could pay someone to host it with reasonable guarantees they won't delete your account on a whim and no recourse. Or you can use a free service that you somewhat trust with your own domain, so you can point the domain to another provider if you need to. Almost no technical knowledge required for that. > If you didn’t self host OpenID, I don’t think you had much “control of your online credentials or identity.” Same for email, which is what identity relies on instead of OpenID. And self-hosting OpenID is much easier than email: you just need domain + LAMP (or equivalent), and don't have to deal with DKIM, SPF, being blacklisted from Gmail/Hotmail, ...
      • coder543 6y ago
        > You could pay someone to host it with reasonable guarantees they won't delete your account on a whim. Each user having to find a hosting provider and pay them... it seems like a non-starter. Think about the non-technical people in your life. That solution would only help the very few people who both understand the details of OpenID, and care about the possibility of losing account access at a deep level. Most people have other important stuff going on in life, so good luck convincing them to adopt self-hosted OpenID at greater cost (and effort) to themselves. This is even assuming that the hosting provider also acts as a domain registrar so each person doesn’t also have to figure out how to buy and own a domain name, to truly own their OpenID, because that would either make this solution much less meaningful in terms of control (with no custom domain), or make it that much harder. > Same for email, which is what identity relies on instead of OpenID. I’m not here to argue for self hosted email. There are many email hosting providers that make it relatively easy for you to bring your own domain name... but this is irrelevant. Signing in with an email and password continues to work even if the email account has been suspended. So, it’s not the existential threat that the article is concerned about. I think the more realistic solution for users is the new FIDO2 standard that will hopefully see adoption soon. I think Google has done a similar thing on Android, but Apple has for sure made every (up to date) iPhone, iPad, and Mac able to act as a FIDO2 Platform Authenticator. Even if the user signs up via OAUTH, websites can give the user the choice to sign in via FIDO2 on each device. At that point, users could sign in from those devices even if their Google account were suspended, giving the website a chance to help the user migrate their account authentication. The FIDO2 flows seem very user friendly, but... the standard is so new, broad adoption remains to be seen.
• jpswade 6y ago
  That’s not strictly true, once you’re signed up, you can usually login using your email address if you need to.
• spodek 6y ago
  > Never Use Google to Sign-In Never Use Google.
  • hermitmaster 6y ago
    You beat me to the punch. I fully abandoned Google and Facebook over two years ago. No regrets.
    • chinzsteel 6y ago
      Sincerely interested in knowing how you did this. Any guide is appreciated. Thank you :)
• Multicomp 6y ago
  I was forced to use sign in with google for dnd beyond as they don't support byo-email address (!), only google, twitch, apple, and yahoo. We need a name and shame site for websites that can't be bothered to write a back end database for the 3 columns needed to store emails, salts, and hashes.
  • ayende 6y ago
    2FA, reset your password, making sure that password emails gets through, preventing login enumeration, preventing dictionary attacks, etc. Those are just the things off the top of my head, it's not just three columns
    • kevincox 6y ago
      Rate limiting is also a big one.
    • Multicomp 6y ago
      That reinforces the point of the article, but is semi-orthogonal to my point. Convenience strikes again. They use the google third party sign in since a big company like dnd can't be bothered to implement 3 columns plus your nice to haves. And they are nice to haves, arguably obvious and easily upgraded to required table stakes, but not _required_ to implement email-based sign in. The first three of your listed iftems are also effectively mitigated with a password manager.
• Shivetya 6y ago
  well I am one who uses certain email addresses and even google sign-in on sites which I don't care about. it makes it easy to isolate spam and more. i maintain a twenty five year old mindspring account just for sites I have no financial connection to.
• SergeAx 6y ago
  > Every respectable service allows you to create accounts using your email address This way I should maintain my own email server, because I can be locked out of my email by any of cloud providers as easy.
  • AlexSW 6y ago
    Would(n't) just having your own domain and pointing it at an email server one doesn't directly manage work?
    • dingaling 6y ago
      True, but then again you never really have "your own" domain, you have use of it as long as the leasing corporation grants it.
  • fauigerzigerk 6y ago
    You just have to use your own domain. No need to run an email server. Of course most people don't have their own domain and linking a domain to a cloud email service is either expensive (Google, Microsoft, Fastmail, etc) or impossible (iCloud).
• 205g0 6y ago
  Hijacking this thread for a simple price comparison: Since people recommend to buy a domain and connect this to some service. The problem is that this service will run for decades as a private plan, so let's do together a price and feature comparison since the lock-in is huge. GSuite: - pros: vast ecosystem of GMail extensions, eg mail merge - con: just 30gb total storage MS: - pros: 50GB email, 1TB cloud, Office apps included (not that I like them but sometimes you still need them), dirt cheap family plan for $30+ you get 6tb Yandex: - free, but yeah all my serious stuff like bank accounts there, IDK iCloud: - super expensive Dropbox: - no email and ios camera upload broken/lags years behind for ages and super expensive What do you think? Are there any better options out? Which would you take?
  • monkin 6y ago
    Yyy... what the hell?
• jackjeff 6y ago
  Also. HOW do you know it’s a real Google sign-in instead of a fake password stealing form? We’ve trained generations of users to accept it’s alright to give their Google/Facebook/Twitter credentials to any random site under the sun.
  • drivebycomment 6y ago
    Only type your Google password if the site is accounts.google.com. https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/ https://www.wordfence.com/blog/2017/01/gmail-phishing-data-u... Better yet, use FIDO.
• tyingq 6y ago
  There does seem to be a need for Google to clarify their rules for "banning" an email used for sign-in. It seems like things should be more granular, such that being banned on YouTube doesn't make your thermostat quit working, ruin your phone contacts/photos/etc, or cut you off from your unspent AdWords funds.
  • BlueTemplar 6y ago
    It's worse than that : considering the importance that YouTube has taken, for some people being banned from YouTube might be considered to be akin to be banned from exercising their profession, or even just be able to be a full-fledged citizen.
  • _jal 6y ago
    Next, consider what they were up to with Sidewalk Labs in Toronto before that project was 86ed. "Google + Sidewalk: bring the dystopia of robo-support to the civil service!" Or maybe "Google + Sidewalk: Snowcrash was the blueprint, right?"
• aboringusername 6y ago
  I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated to the relevant authority, namely the "justice" system to make such considerations. If your house could be removed at a whim because a bot decided you were a bad person it would likely cause an uproar, it wouldn't be tolerated. Yet here it is. Google can offer their services and the legal system seemingly doesn't want to be involved. Why?
  • ThreeFx 6y ago
    Because there is no clear jurisdiction for the web. That's it.
    • riedel 6y ago
      It is already bad, that we need jurisdiction for such things in the web. I think we actually need such things to happen more often, so ppl can finally vote with their fest a long time ago for some freedom against a tiny bit of convenience. I think what we lack is a decent amount of social pressure.
      • ethbr0 6y ago
        What we need is the largest tech companies broken into smaller pieces. The de facto monopoly of most of these players exists in their cross-border market share, making enforcement under traditional antitrust law in any one country difficult. Unfortunately, it's also something of an international zero sum game due to efficiences of scale -- if the US breaks up Amazon, Alibaba gains world market share, and we're back in the same place. The most effective remedy I can think of offhand is government involvement in a special, independent branch of the company, dedicated to increasing interoperability and exposing services, empowered by legislation. If we're going to have monopolies, at least they can be open ones. E.g. 18F + Google Takeout, backed up by regulation
• trident5000 6y ago
  Google also loves to give all your data to 3rd parties like Google Pay. I have never had more spam.
• vishnugupta 6y ago
  A big reason for me to use my own custom domain + Fastmail for email was to get away from Google login.
• figassis 6y ago
  Isn’t this grounds for a class action lawsuit? Google and friends have the right to lock you from use of their services, but when such services encroach in your use of other services unrelated to google, that you may even have paid for, should google have the right to blanket block? Is it technically difficult to exempt google signin from account locks? Can we maybe also legally claim that if a company hosts your identify, that it has no right to hold it hostage? I mean, if I’m arrested, my identity automatically erased. Finally, is it not possible to require that all such block critical to someone’s data require some form of govt approved appeals process? I’m asking these questions so maybe someone can enlighten me on why they were not yet attempted, or if they where, why they failed? Is it legal complexity? Cost? Lack of large scale support, as in, is it only a niche concern that only the HN crowd is complaining about?
  • xbar 6y ago
    You were dumb. Then you were dumber. Then you were even dumber. Then you sued Google because a lot of other folks were like you. Ok.
    • figassis 6y ago
      So name calling...bc why not?
• zakki 6y ago
  Google map changed the name of the road in my hometown. Just recently I guess. I mean it was correct . And I don’t know how to correct it. I don’t want to talk to a machine either.
• LoSboccacc 6y ago
  > you will be locked out of all the services where you signed into using Google most services keep your identity even if you sign in with another authenticator, because your profile key is your email.
• loginatnine 6y ago
  I agree with the general premise of this article that gmail/outlook/facebook owns too much power being able to lock you down with no due process. However, for random sites, entering an email/password worries me because I have no idea how this password is handled server side, is it stored in plaintext or with a weak algorithm? The vast majority here don't care that much because they use a password manager but I'm worried about the ones that don't, they can be impacted if there is a database leak or if the site owner is shady and starts looking through its database for passwords that look reusable and try them on other important website. How easy would it be to set a nice honeypot website that requires a username/password? A properly set up google sign in makes it impossible to do that at least. Thoughts?
  • eitland 6y ago
    > [...]starts looking through its database for passwords that look reusable and try them on other important website. How easy would it be to set a nice honeypot website that requires a username/password? > A properly set up google sign in makes it impossible to do that at least. Thoughts? Getting a good password manager and using it correctly removes the threat of someone getting your password and abusing it on other sites.
    • loginatnine 6y ago
      Absolutely and I have mentioned it in my comment. However, we all know that most of the people reuse passwords, more than often weak ones. That's who I'm worried for.
      • eitland 6y ago
        I understand. I actually tried to read your comment twice and missed it :-D I guess I have had a busy week.
• paulryanrogers 6y ago
  Technically email becomes the skeleton key regardless. And that is dependent upon at least one third party: domain registrars. And possibly email providers too. Though the post does have a good point on that non-email auth providers add more risk to the equation.
  • kevincox 6y ago
    > that is dependent upon at least one third party: domain registrars Kind of. You will have a bad day (or month) if your domain registrar is screwing you. But you do own the domain. So you should be able to get it back. With Google/Facebook and similar you have no right to your account.
    • quesera 6y ago
      > But you do own the domain. Be careful not to overstate here -- this is only true for restricted definitions of "own". However, your point remains valid. Control of a domain name is much more predictable and defensible than control of a Google/etc account. Choose the TLD and the registrar carefully, and do not fail to pay registration fees.
• anonymousse1234 6y ago
  Buy your own domain and hosting for few bucks on Hetzner, OVH etc. they both support 2FA. Don't use Google for login. It's pretty simple and foolproof. OVH supports Yubikeys, has DNSSEC and will give you 5GB mailbox for free in your domain just for buying it from them. You can also pay like 20$ per year for 100GB of space for WWW, backups (preferably encrypted) and other stuff.
• johnchristopher 6y ago
  I learned that lesson with stackoverflow when they first used openid then added their own. Now login in is a chore to me.
• bobmaxup 6y ago
  Whats the issue here? The alternative would have been to use email, which, presumably would have been a gmail.com address. If Google locked you out of your account, you wouldn't be able to access your email account either.
  • raesene9 6y ago
    Although this isn't practical for everyone, this is one of the reasons I use a personal domain name and then host the MX record with an e-mail service. That way if, for some reason, that e-mail service were to close my account, I could repoint the MX record elsewhere and still have access to my accounts.
• intricatedetail 6y ago
  This is what happens when you combine greed with lack of regulation. Google should be split into separate independent companies. When company is above the law and too big to fail it means we failed to address it. Write to your local representative and ask them to raise this problem.
  • intricatedetail 6y ago
    Just want to add, this is not capitalism if you have one rule for big guys and one rule for small shops. Small companies cannot afford creative accounting which then finances an army of lawyers and grease for politicians. If a small company pays e.g. 30% of tax it is unacceptable that big boys can wiggle out if it through offshore contraptions. If a company suddenly is in position to game the system and obtain unfair competitive advantage it is when it should be split. Every business should have equal chances and we let companies like Google, Facebook or Amazon abuse their position. It's time to stop it. They need to be split and pay the right tax.
• ycombonator 6y ago
  This applies to all “as a service” products. Unless you can’t provision a server and stand up open source services on your own there is no reason to use 3rd party services.
• kanakiyajay 6y ago
  Another alternative to prevent such a situation from happening is connecting not just Google sign-in but combine with facebook or email as well.
• nukst 6y ago
  I might be missing the point here, but I find it quite annoying that I was already logged into my Google account and trying to sign in in a website[1] using the 'Sign in with Google' did not work. I don't take my cellphone to work and that little Google auth system kept asking for in-phone confirmation since "I was trying to log in from an unknown device" but singing in Gmail in that exact same device worked just fine. [1] Figma
  • z92 6y ago
    You can turn that off by turning off 2 factor authentication, where ever that setting is.
• ognarb 6y ago
  People use third parties auth because it's convenient. > Please enable JavaScript to view the comments powered by Disqus. The blog post author is using Disqus because it's convenient.
• kevincox 6y ago
  On the other hand if you want to use 2 factor authentication adding and rotating security keys across dozens of sites isn't the best plan either. So we are kinda stuck in a rough spot. I really wish that OpenID stuck around. It would have been fantastic to have the choice of provider including running your own. I think the saving grace of using Google login is that usually you can still "reset your password" via email and get in that way even if Google locks you out.
• cybernoodles 6y ago
  The original HN post was titled Never Use Google to Sign In. Did HN change the title?
  • gurjeet 6y ago
    Yes, it did. See my comment in sibling comments for slightly longer response. - OP
• sebringj 6y ago
  Oh, it sounds like this complaint stemmed from a person creating a one-time account use just for some rando site then got angry when google noticed it wasn't be used at all. The fallout of the arguments that follow may have merit but you should follow why the fuse was lit for context.
• dmitryminkovsky 6y ago
  This is a strong and succinct argument. I'm disturbed it never really occurred to me, probably because I am in part naive and take certain things for granted, like that I will never have a dispute with Google wherein they disable my account. But of course that is possible even at "no fault" on my part, and of course Google is judge/jury/executioner when it comes to their services. Yikes. One thing I don't understand is: the author suggests a remedy is using your email address instead of third party sign in. But what if your email address is Gmail? For example, I just went to my Stack Overflow account and added my email address as a sign in method. But then of course I realized: my email address is Gmail. So what's the difference? How are we supposed to put this into practice without running our own email? Email is just another form of third party auth.
  • satya71 6y ago
    The difference is you can still sign in with email and password. OAuth would fail on a locked account.
    • dmitryminkovsky 6y ago
      Yeah that’s true. Still pretty bad, though, right? What if the service requires you to 2F confirm an existing auth to change auth settings (to add another login if you are locked out of your email)?
• pbronez 6y ago
  Perhaps the courts could be helpful here. A long-established Google account has significant value to the user. If Google terminates such an account, value is destroyed and damages are incurred. You should be able to demonstrate the value of the lost account to a court and demand restitution from the host. If successful, this would impose a cost to Google for shutting down accounts capriciously and incentivize them to do better. This would be a challenging lawsuit to win. You’d probably need support from an organization like EFF to manage it.
  • beagle3 6y ago
    If successful, google will terminate all free accounts, as will every other free provider (... which will not necessarily be a bad thing)
    • TravisLS 6y ago
      I doubt it. These lawsuits would be few and far between and Google still derives a ton of value from its free accounts in the aggregate. They might just get better at terminating the right accounts...
    • riku_iki 6y ago
      Free accounts is an efficient way to trace users for their Ads business. No way they will terminate it.
    • RonanTheGrey 6y ago
      Honestly it'd be hard for any 3rd party accounts to make that claim except Google, Facebook, Microsoft, and maybe? Twitter and github? At one point I was signed up in over 300 places using my Google account. Eventually the thought occurred to me, "what happens if I get locked out of this account?" And I don't really mean shutting it down. I lost a Microsoft account with over $3000 worth of purchases and 10 years of history, because I lost access to the recovery email address it used. So since then I've made sure to "spread the risk" so to speak. Through 2 years of effort it is now only a handful. Some of them remain because either a) there's no other way to sign up or b) there's no way to convert it to an email based account. But still - that's 2 years. 2 years of weekly, sometimes daily, moving yet another thing off that login (but it still uses the email! that's the next step -- kill the email). The level of effort has been gargantuan. For some people, it would simply never ever happen. To lose a Google account would not only be damaging, it would be like your entire life being erased. The level of damage here is enormous and Google has to take responsibility for the power it has amassed. If they want to terminate all free accounts, it'd be a wonderful thing. Either people would finally be free of the behemoth, or Google's incentives would change to finally care about users (well.... hopefully).
• ClumsyPilot 6y ago
  I am now at a point where I would rather have the passport office / home office issue certificates for each citizen: 'John Doe number 145, signed by the British Government' You could use that for 2-way SSL with Banks, trusted email providers, etc. At least we would have 1 reliable identity that can obly be messed with by going through the courts. I wouldn't was to use that identify for every random website, but at least we'd have something reliable.
• jordan801 6y ago
  Sort of seems like everyone is going off. When this article doesnt really give any examples. It just says there are lots of examples. I have around 8 gmails. Theyre all connected to various things via OAuth2 and I have never once had any of them locked. Maybe im ignorant to some detail here, but, this sounds like a spammer retaliating because they got caught.
  • notRobot 6y ago
    It is not a rare occurance: https://hn.algolia.com/?q=locked+out+Google https://hn.algolia.com/?q=locked+out+Google
• annoyingnoob 6y ago
  Speaking of relying on third parties, I saw this message at the bottom of the page: Ghostery blocked comments powered by Disqus.
• rasengan 6y ago
  You can use Handshake [1] to third party auth without risk of losing your credentials. Simply authenticate against the public key associated with your name! [1] https://handshake.org https://handshake.org
• svnpenn 6y ago
  Doubly so with GitHub. I have had my GitHub account removed multiple times with no reason. Then if you email them, it can take weeks before they bring it back.
• usr1106 6y ago
  Who has changed the the title of the HN submission? It was "Never use Google to sign in" and it's still that when following the link. According to submission rules it should not redacted.
  • gurjeet 6y ago
    OP here. I certainly did not change the title, and would like to know who changed the title and why? In the article I clearly call out that using any third-party is a risk, so I don't see a reason why the moderator felt the need to say that in the submission title as well.
  • cheschire 6y ago
    I had to goto the second page to find someone asking this same question I had, and now when I come back to reply to it I find it's been downvoted even further into grey. What is actually going on @dang ? He asked a legit question and even the OP isn't sure what's up.
• SmokeyHamster 6y ago
  Yeah, I just realized this myself. Never really thought about it until I started seeing Google, Twitter, Facebook and other large companies, start banning people for political reasons. Imagine if you signed into some site using your Facebook account, and then some intern at Facebook moderating posts didn't like some political statement you ban, and suspended your account? Like the article says, you're not just locked out of Facebook, but any other account that uses Facebook to authenticate. That give these sites an insane amount of power. You can argue these massive companies have a right to ban whoever they want on their own platforms, for whatever reason they want. But they shouldn't have a right to ban people on other platforms. Even if a ban/suspension is made in error and can be reversed, that could still cause someone a lot of harm, or be used as a political weapon. That's legitimately scary.
• anderslemke 6y ago
  The risk of getting your account locked is just one of the reasons you shouldn't use Google (and the like) to sign in. But how did we end up in this horrible state of authentication? Why don't we have something as easy to use as the DNS, but for authentication? Imagine what authentication would look like, if we all started running is the same direction, instead of implementing our own authentication again and again. If we had something open source, that would allow you to sign in to all the sites you use, while completely protecting your privacy, so none of them know who you are. This dream can come true. Technically at least. I've taken the the first baby steps with https://promiseauthentication.org https://promiseauthentication.org which proves that this is possible. But, for this to become a reality, we really need to start running in the same direction. A collective movement towards a sane, privacy-first Single Sign-On provider that's easy to use for everybody.
  • sedatk 6y ago
    > which proves that this is possible. How does it prove that?
    • anderslemke 6y ago
      I've built Promise, to prove (to myself at least), that it would be technically possible to build authentication infrastructure, that can be used across sites, without having to store any data unencrypted, and furthermore, not storing any personal data at all. And it works. It's a bold choice of words, I acknowledge that. And the proof is only as strong as my abilities to write software. This is yet another reason why Promise needs a movement behind it. To strengthen the proof. To strengthen security.
      • sedatk 6y ago
        I understand, but don't you still have the capability to ban a domain/user? How is it different than Google in the context of the post?
        • anderslemke 6y ago
• ayyyolo 6y ago
  100% Not only do they control the content you see, the content you can access, but also history of the content you've accessed. Fuck this planet.
• jasonlfunk 6y ago
  What annoys me is that when I do chose to login with A third party service and the app still makes me create an account and put it a password. They treat third parties as a fancy way to auto fill the email address field.
• menzoic 6y ago
  You can set up gmail with your own domain that you have control over.
• eafer 6y ago
  > Every respectable service allows you to create accounts using your email address, so please use that method to create your accounts. Sadly this isn't true. I can't register to download my electric bill without a google, facebook or twitter account. Electric companies are local monopolies so I can't switch to another supplier either. My email account still belongs to google, so I can't claim that this makes any difference in my life. It's a bit disturbing nonetheless.
• lordgrenville 6y ago
  So no Advent of Code?
• okr 6y ago
  When you use Google or FB or others to sign in, you just get some data, that you can trust. Internally, on my website, i may have an account, that i then link to this Google or FB account. 1) If Google shuts down an account, authorization might still work for the purpose of logging in somewhere else. Your email might not work anymore, like any other services within Google. But authorization does. That it does not, is an implementation detail. 2) Since internally i have created an account, that is only linked to your Google account, i can always allow you to also login via any other method. Maybe with your facebook account. 3) I think, things will become better. You use your devices to authorize yourself. And i then trust your device. Then there is no 3rd party involved anymore.
  • antonfire 6y ago
    Regarding point 3, the trend is in the direction of making your devices a lot less "yours", and a lot more hooked into 3rd (4th, etc) party services.
    • okr 6y ago
      Many people use yubikeys, for example. As a user, i declare ownership over these keys. I buy these. They become mine. And i use them then for authorization. So it is a mix, i would argue. For machines it is just important to identify you. And in the past, so i have read the users, they all want to get away from password authorization. Just make the darn thing recognize me. (and sometimes not)
• jiveturkey 6y ago
  oversimplified and wrong
• mrlala 6y ago
  No thanks, I prefer convenience over paranoia.
  • aiisjustanif 6y ago
    It’s not paranoia, it’s perfectly reasonable in the case of digital download being time to an email address 3rd party auth.
• aiisjustanif 6y ago
  This reminded me that I learned DuckDNS[1] recently removed the option for local auth through their site. It’s only 3rd party auth now. I was mildly triggered. [1] www.duckdns.org
• maxekman 6y ago
  A thing which I try to practice since I switched to DDG a year ago is to not say “google” but instead “search”. They don’t deserve their own verb, let’s take it back!
• syabro 6y ago
  Where can I check which websites I looged in with google? I found https://myaccount.google.com/permissions?gar=1 https://myaccount.google.com/permissions?gar=1 but 26 apps is like 1/10 of what I have I think
  • uda 6y ago
    OAuth apps don't necessarily appear there, only apps using additional scopes than basic profile verification and email address
    • drivebycomment 6y ago
      I think all OAuth apps are supposed to show up there - I have both apps with basic account info only, and apps with more.
• uda 6y ago
  1. This isn't a clear cut, though some services don't allow using both Oauth 2.0 and email / username login, most do. So if the service provider allows both, create a simple user + link your account. 2. Developers should always allow restoring passwords for SSO only users, it is ridiculous for it to even be an issue. 3. As a user, refrain fro using free email accounts to identify on a platform, as others already said, buy a domain not an expensive one, and stick to it, remember to renew, and setup your email address with a reliable service, there are good providers for $1 a month. Update: line separation...
• catovh 6y ago
  Even when some service allow registering using good 'ol email, some still refuses to accept any non gmail/outlook address. Met a service that wouldn't allow me to register using my own domain email address a week ago. Baffled me staring at the google, fb and twitter sso button with the form for email address giving error of "please use an email address from a reputable provider".
  • sreevisakh 6y ago
    I have faced that at least on four occasions. Some were even for paid accounts. Who expects someone to pay to create a spam account?
• ryandrake 6y ago
  > Every respectable service allows you to create accounts using your email address, so please use that method to create your accounts. This is a major take-away, too. I have used this as a litmus test for a while. If a service requires you to log in via one of these third parties, and doesn't offer a "create an E-mail based account" option, stay away! They're not a serious business. Or, even better, favor services/stores that don't require you to create an account.
  • kminehart 6y ago
    I mean, the article is pretty lean. It basically says, "Don't use OAuth because if you're locked out of your account on the OAuth provider, you won't be able to sign in." I don't disagree with that. I don't think it's fair to expect every website I sign up for to be able to safely store passwords. OAuth is a convenient and much safer way to allow users to authenticate to your website or service. I don't think it's fair to dismiss every service that doesn't provide this option.
• gurjeet 6y ago
  _A plea to the moderators:_ Please change the title of the submission back to match the title of the blog post, "Never Use Google to Sign-In". To be fair to Google I have clearly called out all third-parties in the blog post, some by name. I used Google's name in the title because that name elicits reaction from almost 100% of the audience, since almost everyone has used Google services at some point. I myself am a happy user of Google services, except for one incident [1] a few years ago when I was locked out of my account for 20 days. I was able to recover it because I finally remembered my linked yahoo email's password; I had forgotten that, and never bothered to save it in password manager, because I hadn't used it for many years. For the record, I was also blocked out of GitLab for 7 days [2] for no apparent reason. This was resolved after a few days of follow-up with their support folks. Upon account recovery, the reason given was that my account was accidentally caught by their spam filters. Back on topic: Changing the title from "Google" to "Third Party Auth" significantly softens the impact and urgency I want the reader to feel upon reading the title, and the short article that follows. [1]: https://support.google.com/mail/forum/AAAAK7un8RUAzmxJAkP8gU/?hl=en&gpf=%23!topic%2Fgmail%2FAzmxJAkP8gU%3Bcontext-place%3Dtopicsearchin%2Fgmail%2Fgurjeet https://support.google.com/mail/forum/AAAAK7un8RUAzmxJAkP8gU... [2]: https://forum.gitlab.com/t/gitlab-com-account-blocked-need-help/38789 https://forum.gitlab.com/t/gitlab-com-account-blocked-need-h... - OP
  • bzb6 6y ago
    I.e. you want this article to be clickbait and now you are unhappy that it is not.
    • gurjeet 6y ago
      I want the title to reflect what prompted this article in the first place. Just as others are calling out, I noticed those Google login boxes on unrelated websites. I want the reader to also make that connection and then read the article to understand what’s at stake.
    • baby 6y ago
      All titles are clickbait, researchers, bloggers, youtuber, conference speakers, and journalists who succeed are also ones who know how to choose good titles
• k_bx 6y ago
  Services that create separate accounts for email, Google and Facebook despite providing the same email are the worst.
• relaunched 6y ago
  For the average user, with poor password hygiene, I'd advise them to use a federated identity option that is more likely to have a decent password - they are more likely to have a good password for an account they care about. I think the conclusion of the article is flawed. I think the risk of getting locked out is far lower than the odds of any single, or even all of, other (non-major tech co) website you might join getting breached. It's fair to argue the impact might be less also - and I'm happy to have this debate. In my experience, typical users aren't the ones that get their google accounts banned - they are always banned for doing something significantly more sophisticated.
• sourcex 6y ago
  I recently got locked out of my Amazon account. While trying to get it unlocked, I faced one of the worst experiences with Amazon customer team. I even reached to Jeff's email, but no reply. Finally, I have to file an official complaint in the consumer court to get my account unlock. All of these event took around 14-15 days. During these days, I was suddenly unable to use my Echo, Prime video, Kindle books, readwise, and prime now services. I never really tried any other competitor service before, and was solely reliant on Amazon's offering. That time I realized the amount of power such single sign-in yielded. I can only imagine what happens when you use it for every service via a third party and use it daily, only to suddenly see it lock you out. I hope there's a better way to login in the future, maybe something like trusona or magic PS: I did not do anything wrong but still suffered lot of psychological pain due to this mistake by Amazon's internal security.
• alex_young 6y ago
  What if the site you’re using is properly configured and uses this third party to confirm your email address? Can’t you then sign in using a different trusted intermediary or email if something goes awry with the one you used the first time?
• amaccuish 6y ago
  I look back fondly of the days, where my BlackBerry, online receiving messages, would use 5mb a day.
• fiddlerwoaroof 6y ago
  Many sites seem to use the email associated with the third party account as the identifier: so, if I lose access to Google, I can use the email address to reset the password or use Facebook or Apple sign-in, as long as those accounts serve up the same e-mail address.
  • voiper1 6y ago
    My sign in as google uses the @gmail address, which I don't have access to other than signing into google, so I wouldn't be able to get the reset email link. Interestingly, since I use my own domains, my facebook signin is different than my gmail address. But interesting, I've never tried using a second oauth as a match to the first.
    • fiddlerwoaroof 6y ago
      I know this is how discourse handles federated identity: it uses the Oauth2 server to match the account's email address against the Facebook/Google/Twitter account's stored email address. Spotify works this way too.
• bookofjoe 6y ago
  How about "Never use Google (or any third-party service) to sign-in"
• ridaj 6y ago
  <Unpopular :penguin:> You can get also locked out of your phone You can get also locked out of the email that you actually use for signing in because you can never remember the password and they stupidly ask you to change it every 6 months with bizarre constraints You can get locked out of your password manager You can get hijacked The business you're signing into can go under The odds of these things happening are to be weighted against each other Yes you shouldn't use third-party sign-in for the bank account that holds all your money (though most consumer bank 2-factor authentication mechanisms, sadly, rely on third parties such as phone and email provider) Yes it's also ok to use third party sign-in for the odd website that you don't care about which somehow insists on asking you to create an account There are no absolutes in security risk management </>
  • RonanTheGrey 6y ago
    > The odds of these things happening are to be weighted against each other Mmmmm not quite -- they have to be weighed against the consequences if they happen. For people who have had a Gmail account for over a decade (almost 2), they've probably got most of their life connected to it -- losing the account then is tantamount to a huge chunk of your life being erased. Photos. Conversations. Access to dozens or hundreds of other websites. Basically all that'd be left is your physical ID, your bank account and you get to start over from scratch. And while all of the above can happen, many things on that list are under your control: losing access to your Google account (usually) isn't. You're quite correct there are no absolutes but the problem is, when the consequence of something happening is extreme, the level of effort you put in to protect yourself from it must be equally extreme: to the point that it's generally good advice simply not to use 3rd party auth at all. I no longer do. I use email/password or OTP whenever possible. Sites that insist I use social login are sites I don't sign up with.
• jimmaswell 6y ago
  I've found the law of headlines equally applies to headlines telling me what to do.
• MeinBlutIstBlau 6y ago
  I've had that happen to me before and it killed this feature for me entirely. I now only use it for things I don't care about.
• psychotr0n 6y ago
  Most services offer password reset and would likely help you recover your account. This is not something you have to worry about too much especially if the service you are using isn't that important to you.
• nikolay 6y ago
  This is not an easy issue. It boils down to responsive customer service at the end. Even if you host your email, your hosting provider can suspend your account if, let's say, your credit card rebilling fails. There should be a better and more resilient way to identify people online in 2020!
  • sreevisakh 6y ago
    Hosting is still better than registering with Google/FB for several reasons: 1. Registering with email is not usually an SSO. Authentication is using password and email is used only for recovery. Your won't get locked out of other services even if email server fails for some reason. 2. Hosting providers usually engage customers much better than ad and social media companies. Chances of getting your service back up with customer support assistance is much better. 3. In case the hosting provider locks you out without recourse, you can always move to another provider and point your DNS records there. For this, it's better to have a different company as registrar and hosting provider. 4. DNS so far is the least affected/abused online resource. The chances of you getting locked out of your domain name is low, unless you fail to renew. They give sufficient warning as well. Let's take advantage of that until companies decide to wreck that. > There should be a better and more resilient way to identify people online in 2020! I don't think that's an accident. The choices and freedoms available for authentication seems to be diminishing with time. It was possible to specify the authentication provider a decade ago.
• nearmint 6y ago
  I had a similar problem. I used Google to sign in on digitalocean, then I changed the main domain in google apps and readded the original domain seperately on Google Apps. But probably because some kind of ID mismatch, I was now unable to sign-in on Digitalocean with the original e-mail address recreated in Google Apps. Password recovery didn't work either, for some reason digitalocean doesn't do password reset for accounts that were created using Google sign-in. I was forced to create a support ticket with digitalocean and wait.
  • capableweb 6y ago
    And after that? They probably put a human to communicate with you, verify some identity and then give you access to your servers again, I'm sure? Compare that with Google (and Facebook, those are the two I have experience with) who will simply lock you out of your account and if you ask for help, they say they cannot. "But what about the three years of photos I've stored?" I asked. "They have now been deleted since your account was terminated" they told me. "Why?" "We cannot tell you".
• awinter-py 6y ago
  not to mention permissions very easy to accidentally share your whole address book
• mippenhappen 6y ago
  No shit.
• qwerty456127 6y ago
  > Every respectable service allows you to create accounts using your email address, so please use that method to create your accounts. Although using e-mail sign-up actually provides a number of privacy-related benefits over using the Google account way, it still doesn't solve the main problem - because the e-mail usually is GMail anyway (and when it's not - you can get blocked by Microsoft, Yahoo or anything else too, and you can also loose your own domain). "Every respectable service" should let and recommend (but not require) you set a secondary e-mail and/or another way to contact you but they usually don't.
• djsumdog 6y ago
  I miss Open ID: https://battlepenguin.com/tech/the-decline-of-openid/ https://battlepenguin.com/tech/the-decline-of-openid/
• glokk 6y ago
  Apart from the kick-out risk, using SSO from Google/Facebook isn't good for your privacy neither. They usually have an iframe in their SDK that can track you even when you don't click on the login button.
• homakov 6y ago
  I see many people in this thread dread existing auth scene and ask for a better solution. Client certificates, but usable and no hardware - https://github.com/sakurity/securelogin https://github.com/sakurity/securelogin this is the only sovereign answer to auth battles.