4 ms·

Around 300 at this point, sans any deleted ones. I don't think I know a single password anymore, since they're all randomized and separate for each site. > Obv

Around 300 at this point, sans any deleted ones. I don't think I know a single password anymore, since they're all randomized and separate for each site. > Obviously, anything with OAuth is "bundled" into my Google account. Maybe it's just me, but I try to never use centralized identity providers (outside of things that I really don't care about) and use separate e-mail auth whenever possible, across multiple e-mail accounts (some self-hosted). Same with considering separate Google accounts for phones, services like e-mail, a separate one for any content creation on YouTube and so on (ideally without any of them coming in contact with one another). The idea is that one account getting closed/suspended shouldn't result in ALL of the linked stuff becoming inaccessible. I don't even do anything weird online, it's just that nowadays you hear lots of stories about people getting banned based on some heuristics by automated systems, with no ways of getting in contact with the support. Even something like a VPN might trip those systems up. Similar things have happened to me before (a SaaS provider didn't want to do business with me) for no good reason even without a VPN, but trying a year later with the same credit card didn't result in the other account being auto-suspended. How odd. I guess the next step would be to have usernames, phone numbers and even payment methods (apparently virtual credit cards sometimes work) also be more randomized and more compartmentalized, though something tells me it'd be a pain to do that. That said, I largely believe that privacy online is mostly dead due to how much fingerprinting there is, though one can still protect themselves from automated systems acting weird, because nobody genuinely cares about that, at least at the scale where they're needed.

Froedlich 3y ago
I have about 150 accounts, though some of them are logins for vendors I dealt with once, a decade or more ago. > I guess the next step would be to have usernames, phone numbers and even payment methods (apparently virtual credit cards sometimes work) also be more randomized and more compartmentalized, though something tells me it'd be a pain to do that. --- I do that. It's no trouble. I use various usernames to 'fuzz' tracking. Yes, anyone who really cared could track me by my IP address, but trackers are like whales sieving krill; they get so much, they don't bother to look very hard.
xp84 3y ago
> people getting banned … with no ways of getting in contact with the support This is the most out-of-whack part in my humble opinion. Most of us have a tremendous amount of data and things like auth tokens tied up in Google, and Apple, and due to their scale and the fact that at least for GOOG it’s a “free service,” they’ve set the expectation up that “support” should be limited to searching an FAQ, and also that any account they ban must be some kind of troll account that shouldn’t be listened to. God forbid they give you a phone number where you could bother a person until your problem was solved. Using ad-supported services for vital stuff is risky. But I know even Apple isn’t very helpful, even for those of their iCloud users who pay.
- eastbound 3y ago
  Google cornered themselves: I’d never give my credit card to Google. I switched to Apple precisely because I have my emails in Google. Even if both had non-support, it’s better to at least not have to report credit card fraud against the company who also has my emails…
- str3wer 3y ago
  at least they now let download all datas when they ban an account(source: two weeks ago they accused me of being a bot, still waiting for a response to my appeal but meanwhile i've been able to download my stuff)
- raxxorraxor 3y ago
  I still think this is a bad idea. I never use oauth logins and believe the convenience isn't worth the dependence and security risk at all. Exception are my work accounts. Here I am public anyway, so what gives. I think there still is a huge risk of industrial espionage, but anyway...
CamelRocketFish 3y ago
Agreed, enough horror stories have kept me away from using Google as OAuth. The only value I see in it is as part of SSO for employee accounts. Employee leaves and revoke access to everything.
ThatPlayer 3y ago
Not even banned, one of the games I play just put out an announcement that Twitter login support might be dropped soon because of Twitter's API changes, so you better associate your account with email soon.
magicalhippo 3y ago
Similar, around 290 personal accounts. In addition comes the logins and such for various internal services like Home Assistant, PiHole etc. Total over 400 in my password manager. I keep wishing for something better. A great start would be to reduce friction, by having some standardized interop between browsers and a password manager. Like, my browser shouldn't know or care about passwords, it should just mediate the authentication request to my chosen password manager through some standardized means.
- philsnow 3y ago
  > some standardized interop between browsers and a password manager. Like, my browser shouldn't know or care about passwords, it should just mediate the authentication request to my chosen password manager through some standardized means. This way lies dragons. Browsers are among the most complicated software that most people run on their machines these days, and the number of bugs lurking in them is probably large. I don't use any browser plugins for password managers, choosing instead either to copy/paste them by hand from my password manager, or using xdotool or hammerspoon to type them in.
  - magicalhippo 3y ago
    Well, the alternatives you mention are all prone to keyloggers or similar. If you take say OAuth/OIDC, the only thing the browser needs is the token. It doesn't have to be involved in the authentication at all really, it just needs a token it can send as part of the requests. Of course this requires that the site uses OAuth/OIDC, but hopefully that's where things are headed.
    - philsnow 3y ago
      I don't disagree.. but I stopped really using oauth when realizing that I could lose access to all those services if the whim of an algorithm closes my (oauth) account.
      - magicalhippo 3y ago

Froedlich 3y ago

I have about 150 accounts, though some of them are logins for vendors I dealt with once, a decade or more ago. > I guess the next step would be to have usernames, phone numbers and even payment methods (apparently virtual credit cards sometimes work) also be more randomized and more compartmentalized, though something tells me it'd be a pain to do that. --- I do that. It's no trouble. I use various usernames to 'fuzz' tracking. Yes, anyone who really cared could track me by my IP address, but trackers are like whales sieving krill; they get so much, they don't bother to look very hard.

xp84 3y ago

> people getting banned … with no ways of getting in contact with the support This is the most out-of-whack part in my humble opinion. Most of us have a tremendous amount of data and things like auth tokens tied up in Google, and Apple, and due to their scale and the fact that at least for GOOG it’s a “free service,” they’ve set the expectation up that “support” should be limited to searching an FAQ, and also that any account they ban must be some kind of troll account that shouldn’t be listened to. God forbid they give you a phone number where you could bother a person until your problem was solved. Using ad-supported services for vital stuff is risky. But I know even Apple isn’t very helpful, even for those of their iCloud users who pay.

eastbound 3y ago
Google cornered themselves: I’d never give my credit card to Google. I switched to Apple precisely because I have my emails in Google. Even if both had non-support, it’s better to at least not have to report credit card fraud against the company who also has my emails…
str3wer 3y ago
at least they now let download all datas when they ban an account(source: two weeks ago they accused me of being a bot, still waiting for a response to my appeal but meanwhile i've been able to download my stuff)
raxxorraxor 3y ago
I still think this is a bad idea. I never use oauth logins and believe the convenience isn't worth the dependence and security risk at all. Exception are my work accounts. Here I am public anyway, so what gives. I think there still is a huge risk of industrial espionage, but anyway...

CamelRocketFish 3y ago

Agreed, enough horror stories have kept me away from using Google as OAuth. The only value I see in it is as part of SSO for employee accounts. Employee leaves and revoke access to everything.

ThatPlayer 3y ago

Not even banned, one of the games I play just put out an announcement that Twitter login support might be dropped soon because of Twitter's API changes, so you better associate your account with email soon.

magicalhippo 3y ago

Similar, around 290 personal accounts. In addition comes the logins and such for various internal services like Home Assistant, PiHole etc. Total over 400 in my password manager. I keep wishing for something better. A great start would be to reduce friction, by having some standardized interop between browsers and a password manager. Like, my browser shouldn't know or care about passwords, it should just mediate the authentication request to my chosen password manager through some standardized means.

philsnow 3y ago
> some standardized interop between browsers and a password manager. Like, my browser shouldn't know or care about passwords, it should just mediate the authentication request to my chosen password manager through some standardized means. This way lies dragons. Browsers are among the most complicated software that most people run on their machines these days, and the number of bugs lurking in them is probably large. I don't use any browser plugins for password managers, choosing instead either to copy/paste them by hand from my password manager, or using xdotool or hammerspoon to type them in.
- magicalhippo 3y ago
  Well, the alternatives you mention are all prone to keyloggers or similar. If you take say OAuth/OIDC, the only thing the browser needs is the token. It doesn't have to be involved in the authentication at all really, it just needs a token it can send as part of the requests. Of course this requires that the site uses OAuth/OIDC, but hopefully that's where things are headed.
  - philsnow 3y ago
    I don't disagree.. but I stopped really using oauth when realizing that I could lose access to all those services if the whim of an algorithm closes my (oauth) account.
    - magicalhippo 3y ago