4 ms·

Tell HN: Stop using email as the unique ID when using "Sign in with GitHub"

30 points by _lvbh 3y ago

I recently lost access to over 10 accounts after changing the primary email address of my GitHub account including DigitalOcean and Replit. I contacted support and they asked for my government ID. I cancelled the connected credit cards so I don’t get charged and have since moved everything off the cloud to local docker containers on my raspberry pi.

apothegm 3y ago
This also creates huge friction with domain-limited auth when using a GitHub account that has multiple email addresses on it.
- high_priest 3y ago
  > Domain-limited auth > GitHub account that has multiple email addresses tied to it I am sorry, but I am oblivious to the case you have described. You've experienced a Domain-limited auth to refuse accounts with e-mail with the required domain, plus secondary account with address outside the domain?
  - apothegm 3y ago
    You can have multiple emails attached to a GitHub account. Sometimes instead of creating a new GitHub account for work, someone on your team will just attach their work email to their main GitHub account. Then if you set up GitHub oauth on a SaaS, and configure it to allow anyone with an email on your domain, most of your team members will be able to sign up. But for the person with the multi-email GitHub account, it will usually fail. It gets even messier when there are invitations involved.
batch12 3y ago
Was temporarily changing it back a possibility?
- _lvbh 3y ago
  Unfortunately not. I got the amazing new years gift of my previous school disabling my alumni email which they promised that we were able to keep forever.
deleted 3y ago
[deleted]
gregmac 3y ago
Am I the only one that hates the "sign in with other_company" thing? I hadn't thought of the issue of changing your primary email, but what always worried me was tying everything together to other_company in case my account was ever compromised, shut down, or the sign-in or even entire service is discontinued. I also don't like that I'm forced to consider the security scope -- how much am I granting this service access to? What does the scope it's requesting actually mean to my privacy/security? I like when I go to a site and my password manager shows me the little "[1]" badge indicating I have an account, because I honestly wouldn't remember where I have accounts or what sign-in partner I previously used. It's especially neat when I stumble across something that seems new, but then realize I have an account that I created 8 years ago. When I'm forced to use a sign-in partner, I learned to make a password manager entry that just says "use provider_name", but since I'm doing that anyway it doesn't save me any time at all.
- high_priest 3y ago
  As all things in tech, it was born out of a grand vision of unified identity (in this case) & was squashed by corporate greed into using IDs of commercial tools for authentication into other commercial tools. I've dreamed many times about my Matrix or Nostr identity serving as the ultimate key to all the tools & services I access, but as the greed turns grand visions into their parodies, these grand visions can't exist without financial support & motivation in some sort of gain for some party. No one is going to implement a free, unified ID, not attached to a commercial product, which is going to get wide spread adoption. Many tried, and just as many have failed. Such is life.
  - high_priest 3y ago
    Now that I think about it, the government in my country has been experiencing a sudden boom in IT infra quality in recent years. The government tied authentication system works pretty well for all the government related tasks. Although quality of its implementation is still a bit factured & heavily reliant on fiat banking services, it is one ID system that comes to mind as 'widely & universally adopted' [among government related entities]
  - 3y ago
perlclutcher 3y ago
Tell HN: Stop using "Sign in with <site>". Both DO and Replit let you sign up with a plain old email address. And with a password manager, it's equally convenient, still just one click to sign in. Why would you rope in an unrelated point of failure to your relationships with online companies and give up sovereignty of your identity? It's only a matter of time before the leopards eat your face.
menotyou 3y ago
After Minecraft was acquired by Microsoft I had to create a Microsoft account for my 9 year old elementary school daughter so she could keep on playing her beloved Minecraft. After a few weeks later Microsoft blocked her account because of not further detailed "violation of terms". Unlocking this account was several week long encounter with a service process designed by Franz Kafka. As a result of this experience I now consider having any relevant data or system access behind Microsoft ID (or any other as Apple or Google) as risk which needs mitigation. I removed all my data from OneDrive and set up my O365 not storing data in the Microsoft cloud (I needed MS support to do so. Not using OneDrive does not do the job). I consider using my Microsoft/Google/Apple IDs on other sites as adding to the risk to be cut of my data or work at Microsofts mercy.
- sshine 3y ago
  I used Google as my primary authentication for over a decade, because I thought it's more likely that I will forget to pay my domain or my email service and lose access to my digital identity. But about five years ago, I asked myself: What if it's more likely that I will get locked out of my account on Google? I'm not paying them anything, and they're impossible to come into contact with. I also lost access to Minecraft because of the Microsoft acquisition.

30 points by _lvbh 3y ago

apothegm 3y ago

This also creates huge friction with domain-limited auth when using a GitHub account that has multiple email addresses on it.

high_priest 3y ago
> Domain-limited auth > GitHub account that has multiple email addresses tied to it I am sorry, but I am oblivious to the case you have described. You've experienced a Domain-limited auth to refuse accounts with e-mail with the required domain, plus secondary account with address outside the domain?
- apothegm 3y ago
  You can have multiple emails attached to a GitHub account. Sometimes instead of creating a new GitHub account for work, someone on your team will just attach their work email to their main GitHub account. Then if you set up GitHub oauth on a SaaS, and configure it to allow anyone with an email on your domain, most of your team members will be able to sign up. But for the person with the multi-email GitHub account, it will usually fail. It gets even messier when there are invitations involved.

batch12 3y ago

Was temporarily changing it back a possibility?

_lvbh 3y ago
Unfortunately not. I got the amazing new years gift of my previous school disabling my alumni email which they promised that we were able to keep forever.

deleted 3y ago

[deleted]

gregmac 3y ago

Am I the only one that hates the "sign in with other_company" thing? I hadn't thought of the issue of changing your primary email, but what always worried me was tying everything together to other_company in case my account was ever compromised, shut down, or the sign-in or even entire service is discontinued. I also don't like that I'm forced to consider the security scope -- how much am I granting this service access to? What does the scope it's requesting actually mean to my privacy/security? I like when I go to a site and my password manager shows me the little "[1]" badge indicating I have an account, because I honestly wouldn't remember where I have accounts or what sign-in partner I previously used. It's especially neat when I stumble across something that seems new, but then realize I have an account that I created 8 years ago. When I'm forced to use a sign-in partner, I learned to make a password manager entry that just says "use provider_name", but since I'm doing that anyway it doesn't save me any time at all.

high_priest 3y ago
As all things in tech, it was born out of a grand vision of unified identity (in this case) & was squashed by corporate greed into using IDs of commercial tools for authentication into other commercial tools. I've dreamed many times about my Matrix or Nostr identity serving as the ultimate key to all the tools & services I access, but as the greed turns grand visions into their parodies, these grand visions can't exist without financial support & motivation in some sort of gain for some party. No one is going to implement a free, unified ID, not attached to a commercial product, which is going to get wide spread adoption. Many tried, and just as many have failed. Such is life.
- high_priest 3y ago
  Now that I think about it, the government in my country has been experiencing a sudden boom in IT infra quality in recent years. The government tied authentication system works pretty well for all the government related tasks. Although quality of its implementation is still a bit factured & heavily reliant on fiat banking services, it is one ID system that comes to mind as 'widely & universally adopted' [among government related entities]
- 3y ago

perlclutcher 3y ago

Tell HN: Stop using "Sign in with <site>". Both DO and Replit let you sign up with a plain old email address. And with a password manager, it's equally convenient, still just one click to sign in. Why would you rope in an unrelated point of failure to your relationships with online companies and give up sovereignty of your identity? It's only a matter of time before the leopards eat your face.

menotyou 3y ago

After Minecraft was acquired by Microsoft I had to create a Microsoft account for my 9 year old elementary school daughter so she could keep on playing her beloved Minecraft. After a few weeks later Microsoft blocked her account because of not further detailed "violation of terms". Unlocking this account was several week long encounter with a service process designed by Franz Kafka. As a result of this experience I now consider having any relevant data or system access behind Microsoft ID (or any other as Apple or Google) as risk which needs mitigation. I removed all my data from OneDrive and set up my O365 not storing data in the Microsoft cloud (I needed MS support to do so. Not using OneDrive does not do the job). I consider using my Microsoft/Google/Apple IDs on other sites as adding to the risk to be cut of my data or work at Microsofts mercy.

sshine 3y ago
I used Google as my primary authentication for over a decade, because I thought it's more likely that I will forget to pay my domain or my email service and lose access to my digital identity. But about five years ago, I asked myself: What if it's more likely that I will get locked out of my account on Google? I'm not paying them anything, and they're impossible to come into contact with. I also lost access to Minecraft because of the Microsoft acquisition.