3 ms·
If you use SSO with the account you were going to use your e-mail address with, it makes little difference whether you used OAuth2 vs traditional e-mail based a
by jchw 4y ago
If you use SSO with the account you were going to use your e-mail address with, it makes little difference whether you used OAuth2 vs traditional e-mail based authentication. You're locked out.
If something happens, like OAuth2 stops working, most websites allow password reset to the e-mail address connected to the account, and then can log-in without OAuth2.
The concern here is probably related to some Log-in with Google scripts that run on the frontend, although if they were just using normal OAuth2, then I think they are wasting their time: whatever sensitive information Google gets via OAuth2 they also get via the unencrypted e-mails you're sending to them anyways...
- giancarlostoro 4y agoArguably if you can prove to the provider that the email is FUBAR and you own the account, it might be easier for them to change out the email on you. Maybe a good reason to support login via email and / or phone number. If you lose both, you're screwed.
- codazoda 4y agoI use a custom domain and forward all mail to a web based email provider for this reason. If my provider drops me, I can move to another and update my forwarding. There’s still a risk I could lose the domain somehow, but I don’t hear about that happening nearly as often.
- jhot 4y agoI do this as well but with anonaddy.com which acts more like a proxy than forwarding. The yearly price is low (something like $12) to use your own domain and much lower than paid email plans.
- dwheeler 4y agoI do this as well. I encourage people to own their own domain and use that for email; it is more complex to set up, but you have far more control long term.
- derwiki 4y agoI have a Gmail rule set up to forward all of my mail to a Protonmail account as a back up. So I can still perform password resets, etc
- VWWHFSfQ 4y agoI'm pretty sure they reject incoming mail when your gmail gets locked. so those forwarding rules will stop working
- endisneigh 4y agosource?
- ses1984 4y agoWhether they reject it or not, it’s less likely they would follow forwarding rules.
- endisneigh 4y agoBased on what?
- jchw 4y agoIf you wanna gamble on this solution, that's definitely your prerogative. I think it's unreasonable to assume that any function of your account will continue to work if it becomes locked, inaccessible, or possibly compromised. A better backup is a custom domain. Which, of course, is not really great with Gmail.
- endisneigh 4y agoThere’s no reason to believe email delivery would stop working just because your account is locked. Such misinformation lol.
- cypress66 4y agoNo. It makes a massive difference. Even if you're locked out from your email account, you can still login no problem to any website using your username/email and password.
- Macha 4y agoExcept those that make you click a link or copy a code from your email if your IP changes
- jchw 4y agoYes, to be fair, that's still a marginal improvement, assuming you aren't forced to validate your email address at any point, which might be the case for lower security stuff. On the other hand, either way, you can often use an existing session to do the same thing without needing to reauthenticate.
- 411111111111111 4y agoHaving goggles oauth doesn't preclude a secondary login method such as username/password. They just didn't want to support it and found some reason to justify the removal, that's as much as you can get from the given facts