15 ms·
> lost access to paid services that I had set up with social login I signed up to Quora with my Facebook account, back in the day. Deleted Facebook in 2013 and
by moreira 5y ago
> lost access to paid services that I had set up with social login
I signed up to Quora with my Facebook account, back in the day. Deleted Facebook in 2013 and lost access to my Quora account, with no possible way to recover it.
I haven't used a social login since. In my case, it was fairly harmless, but it made me realise how dangerous social login is. Every time there's a signup, I look for "signup with email". It's the safer option. And if you can, use your own domain for email (Google's paid email offering supports this, as does Fastmail and countless other email providers). That way if your email provider decides to flip you off, you switch DNS records and you're up and running somewhere else, and everything keeps on running.
But: If you don't have a copy of emails then you lose all saved emails, so make sure you have a backup strategy in place.
- londons_explore 5y agoThere really needs to be a zero cost custom-domain email hosting solution. I'd love to have webmail on my own domain, hosted by someone else, and with ads on the side. Those ads should generate ~$20 per user per year (after all, they can be targeted based on emails I'm sending and receiving, and I'll be looking at them many minutes every day - the perfect combination for high revenue ads). With $20/user/year, there should be no difficulty paying the hosting costs of such a mail server and staff to look after it.
- xuki 5y agoSome domain registrars provide a catch all email for your domains. Just forward that to your own gmail (or whatever service you are using). That way you are in control of the email addresses and can take advantage of free email services.
- maratc 5y agoI use mail forwarders on my custom domain so anything sent to me@mydomain.co is simply forwarded to myregular@gmail.com. Except the domain renewal fees, it's free. If Gmail blocks me, I can readdress the forwarding to hotmail or usa.net or whatever.
- mynegation 5y agoThat works but to cover your bases you need some sort of regular IMAP backup as well.
- deleted 5y ago[deleted]
- kwhitefoot 5y agoI just use Thunderbird and tell it to keep everything local.
- theothertom 5y agoMy domain registrar provides free, simple mail hosting with a domain - maybe yours does too?
- weird-eye-issue 5y agoJust a heads up you could use Cloudflare Email Routing to forward *@foo.com to foo@gmail.com for free It looks like Zoho might have a free plan too but I've never tried it https://www.zoho.com/mail/zohomail-pricing.html https://www.zoho.com/mail/zohomail-pricing.html ImprovMX also does email routing for free along with webhooks and such
- lkxijlewlf 5y agoI use the free plan from Zoho and it's been solid. But... I have been using it for a while and it is my understanding that certain features I have (IMAP) are no longer in the free plan.
- spaetzleesser 5y agoJust looked at their pricing and it looks quite sane. How good is their calendar and does it sync to iOS and Android?
- lkxijlewlf 5y agoI use the Zoho app (iOS and Android) for mail and calendar, so yeah, it syncs that way. I haven't tried setting up another mobile app.
- hultner 5y agoTheir Calendar is exactly like any other caldav icalendar, works fine on iOS and any other platform using the calendar standard protocol. Been using Zoho for many years, switched from my free grandfathered Google Apps account to Zoho around 2014.
- ZetaZero 5y agoCloudflare Email Routing is still in private beta. I'm eagerly awaiting it
- jgrahamc 5y ago
- rglullis 5y agoWhy can't you just go around selling your data to the highest bidders and use the money to pay for the myriad of already-existing hosting providers? I'll tell you why: because you are not worth that much to advertisers. If you are so cheap to the point of asking to get your data harvested, chances are you never going to be a high-value customer.
- tobyhinloopen 5y agoSure, let’s do that. Where can I sell my data?
- rglullis 5y agoNo one wants to buy the data from cheapskates.
- dspillett 5y agoThe comment you replied to said exactly why this won't work: “If you are so cheap to the point of asking to get your data harvested, chances are you never going to be a high-value customer.” Though I think “high-value bit of cattle” or “high-value mark” are closer to how the stalking side of the advertising industry sees us!
- ClumsyPilot 5y ago> If you are so cheap to the point of asking to get your data harvested, chances are you never going to be a high-value customer. But if you are so dumb as to not know your data us harvested, you are a great gullible idiot, er, I mean customer. I don't think logic holds any water. There is no rational 'free market' reason you can't sell your data, it's just logistically too difficult to deal with millions of individual 'sellers' istead of paying $supplier to get all of it at once.
- rglullis 5y ago1) I did not say anything about not having data harvested. 2) Even if the data is being harvested, doesn't mean that there is any morality in trying to get a share of the profits. That doesn't make you smart, it makes you a cheap accomplice. 3) "free market" would apply only if all exchanged data were offered by those that own the data, and if they could determine how and when the data could be used. GDPR has shown already that some sites would rather not serve their sites to European citizens than comply with data regulations. You can bet that the intersection of high-value prospects who would be interested in selling their data for some meager dollars/year is very, very small.
- pydry 5y agoSomething like improvmx but, like $3-4 a month instead of $9 with just bare bones POP3 and SMTP for personal use only would suit me. I'd like to self host data and webmail and pay somebody else manage the headache of delivering and receiving.
- utucuro 5y agoFastmail handles the whole thing admirably as far as I'm concerned. Get your custom domain, create a mail user with Fastmail: username@mydomain.com Set things up nicely (do read the docs), particularly look at catchalls, wildcards and aliases Give out separate email addresses to each and every service you use: service@username.mydomain.com Bonus: You can easily send emails back from each address you give out and if you create a label called "service" for the example above, mail coming to that address will be automatically labelled without needing to create a rule. I used to use spamgourmet and used to get some resistance from sites using misguided email validation considering it a spam service (oh the irony) - now with Fastmail, everything just works.
- chrisweekly 5y ago+1 for Fastmail "just works". It's a bargain, has great UX, and all the features I could think of.
- dspillett 5y ago> There really needs to be a zero cost custom-domain email hosting solution. Unfortunately I doubt that would work. Any email solution hoping to get significant use will need to be able to send as well as receive and/or store & organise, because if someone is needing to run their own send route elsewhere they'll run their own receive route there too, and any free email solution that allows sending will be abused in any way possible by junk mailers and other scammy types. It would be a constant fight to keep the service off black-lists and dealing with the backlash from: * people blocked rightly because of service abuse * people blocked because of a false positive in what-ever automated checks you do (the admin involved in doing all the checks manually will be excessive enough that it can't all be done manually) * those who are inconvenienced by the service, even temporarily, being on a blacklist And that mass of spammers such a service will attract will be worthless: they'll have everything quickly automated and won't even glance at a single one of the adverts. > With $20/user/year, there should be no difficulty paying the hosting costs I doubt $20/user/year would cover it unless you get a decent number of subscribers. And I doubt there would be enough people who would sign up for this, who are not already using gmail or similar big providers that already exist or mail provision included with their web hosting or domain registration service. Of course my gut reaction could be quite wrong here: why don't you give it a go? If you are right then there is a market to corner that no one else is looking at yet so you could make it big.
- Calamitous 5y agoSounds like a startup opportunity you should jump on. ;)
- malka 5y agoIt is a basic utility, and it should be provided by (nation) states. Every citizen should have a domain, or a subdomain.
- manigandham 5y agoThe largest email providers already show ads to the free tier. They don't earn that much per user and it's just not worth supporting custom domains at that scale. If they cant make it work, why would anyone else have more success by offering even more features for free? And if you're already buying a domain name then why not just pay for the email account too?
- deleted 5y ago[deleted]
- rubenbe 5y agoA friend of mine had a similar problem with her Spotify account after she canceled her facebook account. Self-made Spotify playlists usually can have quite a bit of a sentimental value. I can only image what services the OP would have lost access to in case he/she used social login for all signups.
- bayindirh 5y agoSocial logins only carry your information and a token, and you can enter to your profile and add a password too (99% of the time). So, you can use social login (OpenID Connect in reailty), as an automated form filler and add your password, so your account will be effectively won't depend on that provider anymore. I use a lot of services like that.
- phkahler 5y ago>> Social logins only carry your information and a token, and you can enter to your profile and add a password too (99% of the time). I think the whole point is not having to create yet another password. One solution to all of this is to have some kind of durable identity verification that the user controls and can use everywhere. There are serious challenges with that of course, which is why we don't have it yet.
- wongarsu 5y agoI use a durable identity verification that I control and can use anywhere (within reason): a standard offline password manager (keepass) synced via dropbox. I create "yet another password", but I never see it or directly interact with it (outside of tweaking the password generator to fulfil weird password requirements)
- bayindirh 5y ago> I think the whole point is not having to create yet another password. That's the fallacy. You're always creating a new password. Only its storage location is changing. You can store a password in a variety of ways and places. When you use a social login, you're using a time limited password stored in the OIDC provider. And if you lose your account there, you lose all your passwords. Also, you can store your passwords in OS key chains (Linux, macOS), browser password managers (Mozilla Lockwise/Firefox), in myriad of other online/offline password managers, on a text file or paper. Many sites allow you to "reset" your password for an account created with a social login. However, if you created an account with Google OIDC and lose access to your GMail account, that's another matter.
- raxxorrax 5y ago
- spaetzleesser 5y agoI am not that smart but I always thought that using one company's authentication system to log into another site can be a source of massive trouble. I connect all my logins with my (custom-domain) E-mail and also do regular IMAP backups of my E-mails. I run Thunderbird once a week and sync all mails.
- marcosdumay 5y agoYes, do not force failures to be correlated. Ideally one goes in life forcing failures to be uncorrelated, but that's extra work. Anyway forcing them to be correlated is also extra work, so just don't.
- jventura 5y ago> Deleted Facebook in 2013 and lost access to my Quora account, with no possible way to recover it. Did the same but lost my Spotify account. Needless to say, but I haven’t used Spotify since then..
- riggsdk 5y agoI created my Spotify account back when they only had the option to create it with a Facebook account (or at least they hid the email option very well). Eventually I disabled my facebook account and realized that disabled my spotify too. I spent an hour or so with Spotify support to transfer all my playlists to a new account since they couldn't (at least back then) convert my account to be a non-FB account. So much time wasted. Never again.
- kojeovo 5y agoThey may have fixed this. Either that or I did something explicitly that resulted in my Spotify account being accessible by the email I used on FB.
- CyanDeparture 5y agoThis is naive question, but I think a valid one, and I'd love to know what you think, is using a domain name to sign in, just moving the issue of losing an account to the domain provider? So instead of Google, your host controls your sign-in instead?
- moreira 5y agoIt is, but you're much less likely to find your account suspended by your domain name provider. People lose Google accounts and Amazon accounts and all kinds of other accounts because there's so much going on with them and something somewhere triggers an automated ban (for Google, we've seen issues with people and their YouTube, or their Play Store apps, or in this case, their Gmail). But you're far less likely to ever have any issues with your domain name provider, because you literally only have your domain with them, and don't interact with them outside of that. I would say if you want to be extra safe, your domain provider would NOT be your hosting provider. Because you can lose your hosting, too, and we've seen stories like that here a few times.