Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you keep track of “Log in with” accounts

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 50 posts

Re: Ask HN: How do you keep track of “Log in with” accounts

#11

Post by kazinator »

Regarding Google, you are wrong, luckily. There is a page in Google where you can view the associations you made with third party sites and you can cancel them.

Where you find this is:

1. Go to your Google Account (e.g. www.google.com, click on your avatar, then on Manage Google Account in the popup that appears.)

2. Click on Security in the left navigation pane.

3. Scroll down, and find a box "Your connections to third-party apps & services".

That reminds me, I did a "continue with Google" on the Scribd website the other day, only to be told I had to also give them a credit card so they would let me start the free trial to view someone else's copyrighted PDF that they have no right to sell, and that I can find somewhere else. I have to revoke the association to these scumbags.

Re: Ask HN: How do you keep track of “Log in with” accounts

#13

Post by mrala »

JohnFen wrote: post #5

I don't use SSO services, so I don't have to keep track of that sort of thing. For everything else, I use a password manager (UPM, because it operates entirely offline).

I don’t understand why people bother replying to a question asking “how do you do x” with “I don’t do x.” That adds essentially nothing to the conversation. I don’t mean to call you out specifically, apologies if it comes across that way.

More examples: https://news.ycombinator.com/item?id=41335286 https://news.ycombinator.com/item?id=41335369

Re: Ask HN: How do you keep track of “Log in with” accounts

#14

Post by noman-land »

To the people using a password manager to store the fact that they used third party login, this is some of the most perplexing behavior I've seen in a while.

It's like storing a photo of gold bars inside your basement safe.

With almost zero extra effort, you could be in control of your own keys. You already have the entire infrastructure set up to do this and all you use it for is a glorified log book?

Can someone explain this?

Re: Ask HN: How do you keep track of “Log in with” accounts

#15

Post by snowwrestler »

woleium wrote: post #9
markx2 wrote: post #2

I use Bitwarden but have used LastPass and 1Password before. I always, without exception, will sign up with a username & password. I would never use a"Log in with". To me, if I am logging in through a different company then it is that company who has control, not me. There are tales here and elsewhere when Google has nuked someone's account. That's bad, but if you logged in with Google on other sites then you are com…

surely you can just reset your password with the same email and regain access to your account?

If I log into Acme Widgets website via “login with Google,” then I don’t necessarily have an email or password with Acme, I have a delegated (SSO) account. In many auth systems you cannot use “forgot password” to convert SSO access to username and password. You have to actually log in and change it there. But of course if Google has locked you out, you can’t log in with Google.

And anyway… if Google has locked you out, you can’t access your Gmail to reset your password, even if Acme auth lets you.

In contrast: if you log into Acme with username and password, you can authenticate with Acme at any time, even if Google has locked you out. Acme does not need to check with Google to log you in… even if your username is a Gmail address.

If you’re going to use a password manager anyway, just do a fresh username / password whenever possible for each new service. It’s the most resilient and future-proof way to go.

Re: Ask HN: How do you keep track of “Log in with” accounts

#16

Post by firecall »

pwg wrote: post #12

> Do you just use a password manager Yes. > Log in with Google, Apple I simply don't, ever, use those options.

Same here.

At least, not anymore.

I have a few legacy logins.

And a few where I’ve connected my accounts - GitHib for instance to get Jetbrains Student Discounts.

But where possible, I avoid!

Also, the obnoxious login with Google prompt in Chrome actually costs businesses money!

I’ve had multiple clients run up paid support because they thought they’d lost their account because they clicked the login with Google option and all their account info seemed to have vanished! (Not my services, just ones I was supporting them using).

Re: Ask HN: How do you keep track of “Log in with” accounts

#17

Post by mrala »

noman-land wrote: post #14

To the people using a password manager to store the fact that they used third party login, this is some of the most perplexing behavior I've seen in a while. It's like storing a photo of gold bars inside your basement safe. With almost zero extra effort, you could be in control of your own keys. You already have the entire infrastructure set up to do this and all you use it for is a glorified log book? Can someone ex…

The point is that it allows you to remember which provider you used to sign in with and you’re not having to guess whether you logged in with Google or GitHub or whatever else.

Re: Ask HN: How do you keep track of “Log in with” accounts

#18

Post by joeyhage »

dbg31415 wrote: post #10

I like Bitwarden. Tried all the rest. Bitwarden is really great. Plus... I'm a huge fan of how it generates passwords. Celtic-Twisted-Endowment-Petal4-Anybody I try and avoid SSO for the most part. I like being able to use Gmail modifiers so I can create filters if I need to block certain accounts from being spammy. first.last+serviceURL@gmail.com is usually what I use. So like first.last+news.ycombinator.com@gmail.c…

I think this works in practice but I still prefer to have an anonymous/hidden/random email for each service. If one of your Gmail alias emails is sold, isn’t it trivial to write a script and figure out the real Gmail addresses?

Re: Ask HN: How do you keep track of “Log in with” accounts

#19

Post by jeffbee »

kazinator wrote: post #11

Regarding Google, you are wrong, luckily. There is a page in Google where you can view the associations you made with third party sites and you can cancel them. Where you find this is: 1. Go to your Google Account (e.g. www.google.com, click on your avatar, then on Manage Google Account in the popup that appears.) 2. Click on Security in the left navigation pane. 3. Scroll down, and find a box "Your connections to th…

There are also sites that send you through Google signin, then they still want you to make a username and password. So you shared your email address for nothing.

Re: Ask HN: How do you keep track of “Log in with” accounts

#20

Post by cuu508 »

mrala wrote: post #17
noman-land wrote: post #14

To the people using a password manager to store the fact that they used third party login, this is some of the most perplexing behavior I've seen in a while. It's like storing a photo of gold bars inside your basement safe. With almost zero extra effort, you could be in control of your own keys. You already have the entire infrastructure set up to do this and all you use it for is a glorified log book? Can someone ex…

The point is that it allows you to remember which provider you used to sign in with and you’re not having to guess whether you logged in with Google or GitHub or whatever else.

If you are already using a password manager, why not login using password? No 3rd party dependency and risk, and no need to remember how you signed in.
Post reply on HN