8 ms·

<Unpopular :penguin:> You can get also locked out of your phone You can get also locked out of the email that you actually use for signing in because you can

by ridaj 6y ago

<Unpopular :penguin:> You can get also locked out of your phone You can get also locked out of the email that you actually use for signing in because you can never remember the password and they stupidly ask you to change it every 6 months with bizarre constraints You can get locked out of your password manager You can get hijacked The business you're signing into can go under The odds of these things happening are to be weighted against each other Yes you shouldn't use third-party sign-in for the bank account that holds all your money (though most consumer bank 2-factor authentication mechanisms, sadly, rely on third parties such as phone and email provider) Yes it's also ok to use third party sign-in for the odd website that you don't care about which somehow insists on asking you to create an account There are no absolutes in security risk management </>

RonanTheGrey 6y ago
> The odds of these things happening are to be weighted against each other Mmmmm not quite -- they have to be weighed against the consequences if they happen. For people who have had a Gmail account for over a decade (almost 2), they've probably got most of their life connected to it -- losing the account then is tantamount to a huge chunk of your life being erased. Photos. Conversations. Access to dozens or hundreds of other websites. Basically all that'd be left is your physical ID, your bank account and you get to start over from scratch. And while all of the above can happen, many things on that list are under your control: losing access to your Google account (usually) isn't. You're quite correct there are no absolutes but the problem is, when the consequence of something happening is extreme, the level of effort you put in to protect yourself from it must be equally extreme: to the point that it's generally good advice simply not to use 3rd party auth at all. I no longer do. I use email/password or OTP whenever possible. Sites that insist I use social login are sites I don't sign up with.

by ridaj 6y ago

RonanTheGrey 6y ago

> The odds of these things happening are to be weighted against each other Mmmmm not quite -- they have to be weighed against the consequences if they happen. For people who have had a Gmail account for over a decade (almost 2), they've probably got most of their life connected to it -- losing the account then is tantamount to a huge chunk of your life being erased. Photos. Conversations. Access to dozens or hundreds of other websites. Basically all that'd be left is your physical ID, your bank account and you get to start over from scratch. And while all of the above can happen, many things on that list are under your control: losing access to your Google account (usually) isn't. You're quite correct there are no absolutes but the problem is, when the consequence of something happening is extreme, the level of effort you put in to protect yourself from it must be equally extreme: to the point that it's generally good advice simply not to use 3rd party auth at all. I no longer do. I use email/password or OTP whenever possible. Sites that insist I use social login are sites I don't sign up with.