6 ms·

Good luck. For others, let this serve as another lesson to never sign in somewhere with any account if you can help it. This week there's also this other pers

by jraph 4y ago

Good luck. For others, let this serve as another lesson to never sign in somewhere with any account if you can help it. This week there's also this other person that says there are soft locked into Google because they signed in with Google to many places. Go to the trouble of creating a regular account. It's less trouble in the end. (here it was not possible, but of course, it looks like it was a scam, so maybe it's a red flag anyway)

pmontra 4y ago
There is no way to create a regular account on Travis. It's only sign in with GitHub and a few others that they added recently. https://app.travis-ci.com/signin https://app.travis-ci.com/signin I understand why they are doing it, because they have to pull from GitHub, but it's not the only way. They could create a regular user on GitHub and ask people to let that user pull from their repositories. Obviously it's more trouble for the user, it would harm adoption and growth, that user could be banned and halt all of Travis. Travis is the only site I have ever used in that way, because I have a customer that uses it. With hindsight I think that I should create a per customer account on GitHub, just in case something bad happens to Travis.
- devjab 4y ago
  > With hindsight I think that I should create a per customer account on GitHub, just in case something bad happens to Travis. Is it too late to do that? My immediate line of thinking to this thread of "sometimes you have to use an account to sign in" was that then you'll need to create a new account specifically to sign into that service. If you have to sign into that service. Maybe I'm weird, but I tend to even use a DuckDuckGo e-mail when I sign up, so that a specific service is in no way linked directly to me and so that I can stop forwarding e-mails from any specific service. To be fair, I sort of wonder why Github has an API that allows 3rd parties to star projects with your account. I get that the author of this post on HN is responsible for not reading the "clicked through pages" part of the processes and that they should consider themselves sort of lucky it was only abused for star farming, but why do we have that sort of "facebooky" functionality on Github in the first place?
  - fedorareis 4y ago
    A lot of the APIs that allow for things like starring projects have been around for a long time. Before GitHub introduced an official mobile app there were a number of unofficial mobile apps that used those types of APIs to give users a “fully functional” GitHub app. I would say though that if GitHub is allowing requests like that through the API then they should be banning the API token and the account it was issued to if it uses the API maliciously
- toastal 4y ago
  I believe it goes against the ToS for Microsoft GitHub to have more than one account per human.
  - pmontra 4y ago
    https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#b-account-terms https://docs.github.com/en/site-policy/github-terms/github-t... > One person or legal entity may maintain no more than one free Account This means that for nearly all of us it is one account per person. The rules are more relaxed for corporations https://docs.github.com/en/site-policy/github-terms/github-corporate-terms-of-service#b-account-terms https://docs.github.com/en/site-policy/github-terms/github-c... > A User’s login may not be shared by multiple people. and that's it. So there could be joe@company1.com, joe@company2.com, etc. Probably only the joe in his current company can login because the others have revoked its access.
- BHSPitMonkey 4y ago
  > With hindsight I think that I should create a per customer account on GitHub, just in case something bad happens to Travis. In case you missed it: https://news.ycombinator.com/item?id=33906591 https://news.ycombinator.com/item?id=33906591
DarrenDev 4y ago
You can't always avoid it. I had an incident only a week ago where I had to sign up to Snyk and the only way to do so was to use a third party sign in -- no option to create a new account using email. The end results was me signing in using a Google account tied to the client, resulting in an immediate account disabled message from Google. It took a week to get the account re-opened, but left a bad taste in my mouth. If a billion dollar company can't be bothered to create their own sign in, what can we do? I was so pissed off at the time that I wanted to open a support ticket with Snyk and vent, but of course, couldn't find any way to do that on their website.
- jraph 4y ago
  Maybe a way to handle this kind of situation would be to create a dedicated Google account? (I haven't encountered the situation myself, didn't try it)
  - glogla 4y ago
    Google is known to link accounts by ip address, name similarity, phone numbers, emails, etc. There are for example stories of companies with their Google Cloud disabled because former employee using their personal account pushed app Google didn't like to Play Store.
    - angry_octet 4y ago
      And anyway you need a phone number for each account now. What a PITA, by design of course.
- Tepix 4y ago
  The best way to fix the problem is not to sign up to such companies and complain instead. If you can't find a feedback form, perhaps they are not interested in feedback? In that case there's always twitter.
- stainablesteel 4y ago
  just heard of snyk and googled > Snyk is a Boston-based cybersecurity company specializing in cloud computing... how is it secure [or wise] to require you to share an external login? that's infuriating
nashashmi 4y ago
I came across the same realization after disconnecting from twitter. I am signed into multiple places using twitter. Even though I have deactivated my account, I have to reactivate every time to login on a site like disqus. FB, Twit, Goog, need to separate oauth login from the rest of their service.
- nashashmi 4y ago
  Anyone know how to list which sites I used my twitter login on?
  - franga2000 4y ago
    Don't know about twitter, but most providers have some sort of "Applications" tab in the user settings that lists every site you gave an oauth grant to.
  - forgotpwd16 4y ago
    https://twitter.com/settings/connected_apps https://twitter.com/settings/connected_apps Kinda deeply nested into settings submenus.
    - nashashmi 4y ago
      It shows blank for me. And I know have had more than three sites that used it. I think that is for third party apps that help you tweet. I never used any.
- anshumankmr 4y ago
  You say the morally correct thing, but being a Managed Identity Provider is gonna cost loads of money and they really have no business incentive to do this, in fact it may be negative for some of their KPIs like the no. of sign ups they have on their site. The best course of action would have been for you to de-couple your Identity Provider from your account completely, I have done that over a course of a few months. I have de-coupled myself from Google Sign in on my most frequented sites, using Email + a Password manager + 2FA wherever its supported. though I have also have even used Apple's sign in for some apps
benplumley 4y ago
Tailscale only allows you to create a new account by signing in with Google, Microsoft or GitHub. It's a real shame because it's a great service otherwise, but this left a very sour taste.
- glogla 4y ago
  Oh that's a shame.
- gdhdjdvr 4y ago
  Head scale FTW? I mea n you need to self host it and deal with all that... But it is your network...
- Tepix 4y ago
  I don't use services that force me to give up privacy like that. A VPN service no less? That's almost funny.
  - franga2000 4y ago
    Tailscale is a real VPN, not a privacy proxy using VPN tech. VPNs have nothing to do with privacy, this is no worse than any other service doing it.
    - mkl 4y ago
      Virtual Private Networks are all about privacy. They aren't necessarily about anonymity though.
      - BossingAround 4y ago
        Private != privacy. Private corporate networks do not guarantee privacy either.
        mkl 4y ago
        They do guarantee privacy from the outside world. They don't necessarily guarantee anonymity or privacy within the network.
plugin-baby 4y ago
> For others, let this serve as another lesson to never sign in somewhere with any account if you can help it. +1 to this. I got locked out of my StackOverflow account because they stopped supporting my auth provider, I think a couple of years ago.
- CannisterFlux 4y ago
  Not sure if you care any more after a couple of years, but https://meta.stackoverflow.com/q/309839 https://meta.stackoverflow.com/q/309839 This question is about a Facebook account that was deleted but it should apply to OpenID providers that go away too. The mods' comments seem to indicate that the "Contact Us" link gets you through to a human that may be able to help as well.
matkoniecz 4y ago
Or do not do > i logged in, clicked through a bunch of pages because its the same drill everytime GitHub is clearly listing list of permissions, and yes - I check it before accepting log in and in some cases have not granted permission because scope was overly large.

by jraph 4y ago

pmontra 4y ago

There is no way to create a regular account on Travis. It's only sign in with GitHub and a few others that they added recently. https://app.travis-ci.com/signin https://app.travis-ci.com/signin I understand why they are doing it, because they have to pull from GitHub, but it's not the only way. They could create a regular user on GitHub and ask people to let that user pull from their repositories. Obviously it's more trouble for the user, it would harm adoption and growth, that user could be banned and halt all of Travis. Travis is the only site I have ever used in that way, because I have a customer that uses it. With hindsight I think that I should create a per customer account on GitHub, just in case something bad happens to Travis.

devjab 4y ago
> With hindsight I think that I should create a per customer account on GitHub, just in case something bad happens to Travis. Is it too late to do that? My immediate line of thinking to this thread of "sometimes you have to use an account to sign in" was that then you'll need to create a new account specifically to sign into that service. If you have to sign into that service. Maybe I'm weird, but I tend to even use a DuckDuckGo e-mail when I sign up, so that a specific service is in no way linked directly to me and so that I can stop forwarding e-mails from any specific service. To be fair, I sort of wonder why Github has an API that allows 3rd parties to star projects with your account. I get that the author of this post on HN is responsible for not reading the "clicked through pages" part of the processes and that they should consider themselves sort of lucky it was only abused for star farming, but why do we have that sort of "facebooky" functionality on Github in the first place?
- fedorareis 4y ago
  A lot of the APIs that allow for things like starring projects have been around for a long time. Before GitHub introduced an official mobile app there were a number of unofficial mobile apps that used those types of APIs to give users a “fully functional” GitHub app. I would say though that if GitHub is allowing requests like that through the API then they should be banning the API token and the account it was issued to if it uses the API maliciously
toastal 4y ago
I believe it goes against the ToS for Microsoft GitHub to have more than one account per human.
- pmontra 4y ago
  https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#b-account-terms https://docs.github.com/en/site-policy/github-terms/github-t... > One person or legal entity may maintain no more than one free Account This means that for nearly all of us it is one account per person. The rules are more relaxed for corporations https://docs.github.com/en/site-policy/github-terms/github-corporate-terms-of-service#b-account-terms https://docs.github.com/en/site-policy/github-terms/github-c... > A User’s login may not be shared by multiple people. and that's it. So there could be joe@company1.com, joe@company2.com, etc. Probably only the joe in his current company can login because the others have revoked its access.
BHSPitMonkey 4y ago
> With hindsight I think that I should create a per customer account on GitHub, just in case something bad happens to Travis. In case you missed it: https://news.ycombinator.com/item?id=33906591 https://news.ycombinator.com/item?id=33906591

DarrenDev 4y ago

You can't always avoid it. I had an incident only a week ago where I had to sign up to Snyk and the only way to do so was to use a third party sign in -- no option to create a new account using email. The end results was me signing in using a Google account tied to the client, resulting in an immediate account disabled message from Google. It took a week to get the account re-opened, but left a bad taste in my mouth. If a billion dollar company can't be bothered to create their own sign in, what can we do? I was so pissed off at the time that I wanted to open a support ticket with Snyk and vent, but of course, couldn't find any way to do that on their website.

jraph 4y ago
Maybe a way to handle this kind of situation would be to create a dedicated Google account? (I haven't encountered the situation myself, didn't try it)
- glogla 4y ago
  Google is known to link accounts by ip address, name similarity, phone numbers, emails, etc. There are for example stories of companies with their Google Cloud disabled because former employee using their personal account pushed app Google didn't like to Play Store.
  - angry_octet 4y ago
    And anyway you need a phone number for each account now. What a PITA, by design of course.
Tepix 4y ago
The best way to fix the problem is not to sign up to such companies and complain instead. If you can't find a feedback form, perhaps they are not interested in feedback? In that case there's always twitter.
stainablesteel 4y ago
just heard of snyk and googled > Snyk is a Boston-based cybersecurity company specializing in cloud computing... how is it secure [or wise] to require you to share an external login? that's infuriating

nashashmi 4y ago

I came across the same realization after disconnecting from twitter. I am signed into multiple places using twitter. Even though I have deactivated my account, I have to reactivate every time to login on a site like disqus. FB, Twit, Goog, need to separate oauth login from the rest of their service.

nashashmi 4y ago
Anyone know how to list which sites I used my twitter login on?
- franga2000 4y ago
  Don't know about twitter, but most providers have some sort of "Applications" tab in the user settings that lists every site you gave an oauth grant to.
- forgotpwd16 4y ago
  https://twitter.com/settings/connected_apps https://twitter.com/settings/connected_apps Kinda deeply nested into settings submenus.
  - nashashmi 4y ago
    It shows blank for me. And I know have had more than three sites that used it. I think that is for third party apps that help you tweet. I never used any.
anshumankmr 4y ago
You say the morally correct thing, but being a Managed Identity Provider is gonna cost loads of money and they really have no business incentive to do this, in fact it may be negative for some of their KPIs like the no. of sign ups they have on their site. The best course of action would have been for you to de-couple your Identity Provider from your account completely, I have done that over a course of a few months. I have de-coupled myself from Google Sign in on my most frequented sites, using Email + a Password manager + 2FA wherever its supported. though I have also have even used Apple's sign in for some apps

benplumley 4y ago

Tailscale only allows you to create a new account by signing in with Google, Microsoft or GitHub. It's a real shame because it's a great service otherwise, but this left a very sour taste.

glogla 4y ago
Oh that's a shame.
gdhdjdvr 4y ago
Head scale FTW? I mea n you need to self host it and deal with all that... But it is your network...
Tepix 4y ago
I don't use services that force me to give up privacy like that. A VPN service no less? That's almost funny.
- franga2000 4y ago
  Tailscale is a real VPN, not a privacy proxy using VPN tech. VPNs have nothing to do with privacy, this is no worse than any other service doing it.
  - mkl 4y ago
    Virtual Private Networks are all about privacy. They aren't necessarily about anonymity though.
    - BossingAround 4y ago
      Private != privacy. Private corporate networks do not guarantee privacy either.
      - mkl 4y ago
        They do guarantee privacy from the outside world. They don't necessarily guarantee anonymity or privacy within the network.

plugin-baby 4y ago

> For others, let this serve as another lesson to never sign in somewhere with any account if you can help it. +1 to this. I got locked out of my StackOverflow account because they stopped supporting my auth provider, I think a couple of years ago.

CannisterFlux 4y ago
Not sure if you care any more after a couple of years, but https://meta.stackoverflow.com/q/309839 https://meta.stackoverflow.com/q/309839 This question is about a Facebook account that was deleted but it should apply to OpenID providers that go away too. The mods' comments seem to indicate that the "Contact Us" link gets you through to a human that may be able to help as well.

matkoniecz 4y ago

Or do not do > i logged in, clicked through a bunch of pages because its the same drill everytime GitHub is clearly listing list of permissions, and yes - I check it before accepting log in and in some cases have not granted permission because scope was overly large.