Ask HN: Google SSO or Password Manager?

#1

Post by enigma20 » Thu, Feb 24, 2022, 1:48 PM UTC

Hello!

I would like to secure my accounts better, and after reading many articles I still struggle with one decision.

Context Gmail account, with long and strong password + 2fa with security key (Yubikey).

And now, for other websites (shops, social media, etc) is it better to?: 1. Use Google SSO if available 2. Use email/password login stored in the password manager (password manager secured with Yubikey too).

What do you suggest? Why?

Re: Ask HN: Google SSO or Password Manager?

#2

Post by catfishx » Thu, Feb 24, 2022, 1:52 PM UTC

I would choose a password manager.

With Google SSO you will always be dependent on their services, if they get down, they get hacked (which is very unlikely at the moment, but things might change) or someone compromises your google account you will be lost.

Re: Ask HN: Google SSO or Password Manager?

#3

Post by decrypt » Thu, Feb 24, 2022, 1:55 PM UTC

catfishx wrote: post #2

I would choose a password manager. With Google SSO you will always be dependent on their services, if they get down, they get hacked (which is very unlikely at the moment, but things might change) or someone compromises your google account you will be lost.

Very much this. I see users getting locked out of Google account often, or Google changing their policies (like the recent change of free G Suite accounts to premium ones) which would mean you'd be locked out of most accounts.

Re: Ask HN: Google SSO or Password Manager?

#4

Post by boraalparat » Thu, Feb 24, 2022, 1:57 PM UTC

catfishx wrote: post #2

I would choose a password manager. With Google SSO you will always be dependent on their services, if they get down, they get hacked (which is very unlikely at the moment, but things might change) or someone compromises your google account you will be lost.

If they just block your account due to an automated process run by bots/ai. No customer support, no one to tell your story.

Re: Ask HN: Google SSO or Password Manager?

#5

Post by llampx » Thu, Feb 24, 2022, 1:59 PM UTC

I try to keep my online life as decentralized as possible. Thus, multiple emails on multiple providers, and never use SSO unless it is at work.

Re: Ask HN: Google SSO or Password Manager?

#6

Post by valdask » Thu, Feb 24, 2022, 2:05 PM UTC

Remember that one wrong action (or even none) might get your google account permanently blocked without any recovery options.

Re: Ask HN: Google SSO or Password Manager?

#7

Post by tofro » Thu, Feb 24, 2022, 2:06 PM UTC

I think a combination is good: - Browser remembers passwords to sites I don't care about - Google SSO for work-related when possible - Yubikey-backed password store for all important passwords

Main motivation is, that when I switch job I can't accidentally keep access to any tool since my access to the Google work account is revoked.

Re: Ask HN: Google SSO or Password Manager?

#8

Post by samfather » Thu, Feb 24, 2022, 2:09 PM UTC

SSO is good for enterprise use, but manage your own credentials in your personal life so you're not dependent on unreliable Google.

Re: Ask HN: Google SSO or Password Manager?

#9

Post by jaywalk » Thu, Feb 24, 2022, 2:10 PM UTC

1. Email on your own domain. You can still use Google (or any other service) for this, but having your own domain means you're not dead in the water if your provider decides they don't like you.

2. For accounts on large websites (big targets) use a unique email address that is only used on that website. Obviously passwords should never be reused, which leads to:

3. Password manager. Just do it.

4. Use the highest security options available at each website. If it's just 2FA, do it. Yubikey is great if they offer it.

Re: Ask HN: Google SSO or Password Manager?

#10

Post by theandrewbailey » Thu, Feb 24, 2022, 2:10 PM UTC

You can have many copies of your password manager database in many places, but you have only one Google. If you lose one thing, what would you rather lose? If you lose a password database, restore a backup. If you lose access to Google, what then? You can't restore a backup of Google. Stick around HN long enough, and within a week, you'll read stories of people losing access to their Google accounts for unexplained reasons (aside from a robot not liking them).