31–40 of 50 posts
So I default to always looking to create a login with an email address, rather that using another identity provider. And passwords are kept and sycned with bitwarden.
I don't use SSO services, so I don't have to keep track of that sort of thing. For everything else, I use a password manager (UPM, because it operates entirely offline).
I don’t understand why people bother replying to a question asking “how do you do x” with “I don’t do x.” That adds essentially nothing to the conversation. I don’t mean to call you out specifically, apologies if it comes across that way. More examples: https://news.ycombinator.com/item?id=41335286 https://news.ycombinator.com/item?id=41335369
It might be easier to understand if you substitute "x" here with, say, "encrypting passwords with MD5". It illustrates better why someone might think giving "I don't do it" style of responses instead of directly answering the literal question that was asked.
Back to OP's specific case, maybe they keep creating accounts with SSO login only due to inertia and haven't really thought about reevaluating this habit. Not saying this is the case, since we don't know the specific reason OP is using SSO (e.g. if it's convenience, what makes SSO more convenient than the password manager? maybe they are following the recommendations from some random blog post that assumed a different threat model?).
So, alternative points of view might still be useful, if only as food for thought. Maybe a more fitting solution might come out of such discussions.
If I'm using a third-party to log in then it's a burner account that I don't care about, and am basically using because I don't think whatever tool or site should need a log in to use.
Avoid.
I used it for one account, then realized that I would never be able to keep track of which account I used for which account. Ie Google for This. Apple for that. So I default to always looking to create a login with an email address, rather that using another identity provider. And passwords are kept and sycned with bitwarden.
Also remember that one day Google will eliminate Login With.
And if you do login with Apple you can never escape the Apple Tax even if it declines or gets broken up.
I've mostly stopped using third party identity providers. They have multiple problems, but the thing that finally drove me away was bad implementations locking me out of the accounts they were supposed to protect. The most recent example was a GitLab instance that was demanding my password before it would let me update the email address on my account. I didn't have a password, because I created the account by logging…
Also remember that one day Google will eliminate Login With.
And if you do login with Apple you can never escape the Apple Tax even if it declines or gets broken up.
I worked at a huge company with Login With. Only a fraction of people used it so we didn’t have time to support the hundreds of corner cases properly. So best bet was to rip it out.
Your best move is to always set a secure password and use a password manager.
Also remember that one day Google will eliminate Login With.
And if you do login with Apple you can never escape the Apple Tax even if it declines or gets broken up.
You probably won’t even be able to move your account to a password one you’ll just lose access (another unsupported “corner” case)
To everyone worried about Google closing and not being able to login via Google... what email provider do you use? Because if Google closes Login With they might as well close or lock you out of GMail and if that's your email provider you're screwed as well right?