4 ms·

If a service offers "Login with Google/Apple/Facebook/etc" you should never do that if they offer a username/password. It just increases the single point of fai

by Arcuru 6mo ago

If a service offers "Login with Google/Apple/Facebook/etc" you should never do that if they offer a username/password. It just increases the single point of failure. Avoid places that only offer the "Login with Foo" if at all possible (looking at you Tailscale). As an ex-googler, the only reason I was comfortable keeping even my personal email there was because I could reach out internally if there was a problem. I left Google, and left gmail behind too.

gib444 6mo ago
> Avoid places that only offer the "Login with Foo" if at all possible (looking at you Tailscale). Tailscale is the only serious company that I can ever recall offering /only/ third party login. It's bit bizarre on the face of it. Anyone know the reason?
- drcongo 6mo ago
  Curious isn't it, especially as it's such a bad fit for their product - authenticating with GitHub in order to ssh made the whole thing so much more painful than it needed to be. I subsequently tried switching to using a passkey when that became an option, but it's not possible to make the passkey user the owner of a tailnet created by a GitHub org user, so I'm stuck with two users in my Tailscale and can't delete the GitHub org user. It's the main thing that keeps me looking for a reliable alternative to Tailscale.
  - mijowi 6mo ago
    [dead]
  - mkl 6mo ago
    ZeroTier. It works well for me. I chose it over Tailscale because it doesn't require a third party for login.
- ratorx 6mo ago
  I think I read somewhere (but could be wrong) that it was because they didn’t want to own any “authentication” services. Their infrastructure was zero trust (as in they don’t hold any passwords or private keys), just a discovery server for different devices.
- FireBeyond 6mo ago
  My other annoyance lately is companies that don't let you set a password. It's either passkey only (which I'm not sold on, yet), or "we'll email you a login link". Great, now I have to wait for the email to show up, click the link, hope it doesn't expire if I get distracted while waiting, and then also delete your emails, sometimes multiple times a day? What a shit tier authentication mechanism.
  - drcongo 6mo ago
    I despise this. Slack keeps doing this even though I have a password and 2FA configured.
    - FireBeyond 6mo ago
      Vercel won't even let you set a password. "Sign-in methods: Email, passkey, Google account, Apple account, GitHub, GitLab, Bitbucket".
  - joks 6mo ago
    "Login via email code" is also a nightmare on Android. Android regularly kills any processes that are not in the foreground, so I recently went through a whole ordeal trying to login to the MLB app: it requires me to type in an email code, I switch to my email client, get the code, go back to the MLB app, and the page reloads (because it was killed in the background) requiring me to request a NEW email code. I tried this literally five times, going as fast as I could; it seems like it was just deciding to kill the browser process as soon as I switched to the email client, no matter what. This is mostly Android's fault but it's insane and I don't get why I don't hear people complain about this more often
- Kwpolska 6mo ago
  Perhaps they are not a serious company after all?
- antonvs 6mo ago
  Is Tailscale really a serious company?
- huslage 6mo ago
  I use my own OIDC connection to Tailscale. I don't use a third party for login. It's not hard to set up.
- benhurmarcel 6mo ago
  Spotify did this for years in the beginning too. I remember this was the reason I didn’t use them until they proposed email logins.
navigate8310 6mo ago
Tailscale offers custom SSO for free
- nottorp 6mo ago
  Shouldn't a service that may be the only way of remotely accessing your devices be ... independent of a 3rd party authentication service?
  - zrail 6mo ago
    Passkey auth is also available as a first-class option.
  - antonvs 6mo ago
    [flagged]
shakna 6mo ago
One of the other articles on HN's front page right now, is that Germany's implementation of eIDAS will require a Google or Apple account.
- Imustaskforhelp 6mo ago
  I genuinely feel like there is something happening where hackernews articles come in bunch/reference-to-each-other :] So one of the comments on one hackernews post on front-page almost somehow always refer to something within a hackernews post on the same front-page. I have seen this witnessed too many times that it might be time to name this phenomenon.
  - nektro 6mo ago
    people see one article reach the front page and it reminds them of another article and they post that one too. cycle repeats.
- Ey7NFZ3P0nzAe 6mo ago
  For those like who who've never heard of eIDAS: https://en.wikipedia.org/wiki/EIDAS https://en.wikipedia.org/wiki/EIDAS
- brokenmachine 6mo ago
  Wow, that's so amazingly terrible that I'm sure my Australian government is planning it right now.
suzzer99 6mo ago
We offer Login with Google and Login with Facebook on our apps. The fun part is both FB and Google started blocking Selenium and any other automated agents from logging in. So basically there's no way to run end to end tests that confirm the login flows using FB or Google, which have wrinkles that our normal login doesn't hit.
- drnick1 6mo ago
  > We offer Login with Google and Login with Facebook on our apps. This has the nefarious side effect of allowing Google or Facebook to track people across the Internet and apps. Webmasters like you are, often for no imperative reason, complicit of this by providing such login options.
  - thephyber 6mo ago
    “For no imperative reason” App developers have repeatedly stated that offering those options increases user account creation. There is lower friction to using “login with <big tech>” than to create username/password creation flow. My guess is that most of the world hasn’t figured out a password manager workflow that works for them (or they aren’t willing to pay for it).
    - deleted 6mo ago
      [deleted]
  - glenpierce 6mo ago
    This is an issue that regulators need to address. Asking small businesses to forego the significant impact on their business of not implementing common features that users demand is not a good solution to public policy failures. I don’t know what the exact revenue/growth difference is, but if my paycheque depended upon getting more users to sign up, I don’t think I could justify making it into a political stance when Google isn’t going to notice my tiny boycott.
  - suzzer99 6mo ago
    I work for a university. It came down as a requirement from above because our most important users are older (rich) donors who struggle with even basic login.

by Arcuru 6mo ago

gib444 6mo ago

> Avoid places that only offer the "Login with Foo" if at all possible (looking at you Tailscale). Tailscale is the only serious company that I can ever recall offering /only/ third party login. It's bit bizarre on the face of it. Anyone know the reason?

drcongo 6mo ago
Curious isn't it, especially as it's such a bad fit for their product - authenticating with GitHub in order to ssh made the whole thing so much more painful than it needed to be. I subsequently tried switching to using a passkey when that became an option, but it's not possible to make the passkey user the owner of a tailnet created by a GitHub org user, so I'm stuck with two users in my Tailscale and can't delete the GitHub org user. It's the main thing that keeps me looking for a reliable alternative to Tailscale.
- mijowi 6mo ago
  [dead]
- mkl 6mo ago
  ZeroTier. It works well for me. I chose it over Tailscale because it doesn't require a third party for login.
ratorx 6mo ago
I think I read somewhere (but could be wrong) that it was because they didn’t want to own any “authentication” services. Their infrastructure was zero trust (as in they don’t hold any passwords or private keys), just a discovery server for different devices.
FireBeyond 6mo ago
My other annoyance lately is companies that don't let you set a password. It's either passkey only (which I'm not sold on, yet), or "we'll email you a login link". Great, now I have to wait for the email to show up, click the link, hope it doesn't expire if I get distracted while waiting, and then also delete your emails, sometimes multiple times a day? What a shit tier authentication mechanism.
- drcongo 6mo ago
  I despise this. Slack keeps doing this even though I have a password and 2FA configured.
  - FireBeyond 6mo ago
    Vercel won't even let you set a password. "Sign-in methods: Email, passkey, Google account, Apple account, GitHub, GitLab, Bitbucket".
- joks 6mo ago
  "Login via email code" is also a nightmare on Android. Android regularly kills any processes that are not in the foreground, so I recently went through a whole ordeal trying to login to the MLB app: it requires me to type in an email code, I switch to my email client, get the code, go back to the MLB app, and the page reloads (because it was killed in the background) requiring me to request a NEW email code. I tried this literally five times, going as fast as I could; it seems like it was just deciding to kill the browser process as soon as I switched to the email client, no matter what. This is mostly Android's fault but it's insane and I don't get why I don't hear people complain about this more often
Kwpolska 6mo ago
Perhaps they are not a serious company after all?
antonvs 6mo ago
Is Tailscale really a serious company?
huslage 6mo ago
I use my own OIDC connection to Tailscale. I don't use a third party for login. It's not hard to set up.
benhurmarcel 6mo ago
Spotify did this for years in the beginning too. I remember this was the reason I didn’t use them until they proposed email logins.

navigate8310 6mo ago

Tailscale offers custom SSO for free

nottorp 6mo ago
Shouldn't a service that may be the only way of remotely accessing your devices be ... independent of a 3rd party authentication service?
- zrail 6mo ago
  Passkey auth is also available as a first-class option.
- antonvs 6mo ago
  [flagged]

shakna 6mo ago

One of the other articles on HN's front page right now, is that Germany's implementation of eIDAS will require a Google or Apple account.

Imustaskforhelp 6mo ago
I genuinely feel like there is something happening where hackernews articles come in bunch/reference-to-each-other :] So one of the comments on one hackernews post on front-page almost somehow always refer to something within a hackernews post on the same front-page. I have seen this witnessed too many times that it might be time to name this phenomenon.
- nektro 6mo ago
  people see one article reach the front page and it reminds them of another article and they post that one too. cycle repeats.
Ey7NFZ3P0nzAe 6mo ago
For those like who who've never heard of eIDAS: https://en.wikipedia.org/wiki/EIDAS https://en.wikipedia.org/wiki/EIDAS
brokenmachine 6mo ago
Wow, that's so amazingly terrible that I'm sure my Australian government is planning it right now.

suzzer99 6mo ago

We offer Login with Google and Login with Facebook on our apps. The fun part is both FB and Google started blocking Selenium and any other automated agents from logging in. So basically there's no way to run end to end tests that confirm the login flows using FB or Google, which have wrinkles that our normal login doesn't hit.

drnick1 6mo ago
> We offer Login with Google and Login with Facebook on our apps. This has the nefarious side effect of allowing Google or Facebook to track people across the Internet and apps. Webmasters like you are, often for no imperative reason, complicit of this by providing such login options.
- thephyber 6mo ago
  “For no imperative reason” App developers have repeatedly stated that offering those options increases user account creation. There is lower friction to using “login with <big tech>” than to create username/password creation flow. My guess is that most of the world hasn’t figured out a password manager workflow that works for them (or they aren’t willing to pay for it).
  - deleted 6mo ago
    [deleted]
- glenpierce 6mo ago
  This is an issue that regulators need to address. Asking small businesses to forego the significant impact on their business of not implementing common features that users demand is not a good solution to public policy failures. I don’t know what the exact revenue/growth difference is, but if my paycheque depended upon getting more users to sign up, I don’t think I could justify making it into a political stance when Google isn’t going to notice my tiny boycott.
- suzzer99 6mo ago
  I work for a university. It came down as a requirement from above because our most important users are older (rich) donors who struggle with even basic login.