Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Building account systems

blog.plan99.net

Post reply on HN
Print view View original

21–30 of 58 posts

Re: Building account systems

#21

Post by twright0 »

ams6110 wrote: post #9
zie wrote: post #7

Another issue is what privacy are you losing by handing FB or Google all of your authentication? Offloading this is a huge privacy fail. It probably is a security win, but it's a huge privacy fail. Here Google/FB/etc, get MORE information for your giant catch-all, know-all database, thanks! Unfortunately better alternatives that are not a security win don't really exist yet.

What privacy are you losing? Real question. You're probably revealing to FB or Google that you're a user of web app X, but beyond that? Does using FB or Google auth enable any additional tracking of activities within the app or site? I would think only if the site developer was using Facebook or Google ads or tracking anyway. Asked another way -- if I sign into a website using FB auth, am I also signing into FB itsel…

I believe that sign-in-with-X implementations require actually authenticating with X in that context. So in order to sign in with Google to a website, I need to sign into Google itself in the same browser. So in that sense, you are enabling Google to track you in that browser - but no differently than if you just logged into gmail. You could sign back out of Google immediately afterwards.

But just the fact that an app uses Google authentication doesn't give Google any kind of privileged access to that app's data (beyond purely the data that they're logging in on this browser at this point in time) unless the app is pushing data actively back to Google (which they could do anyway for a gmail-managed email address, I guess) or you believe that Google will then subsequently forge authentication requests to that app and pull data out itself. Both of these things are hypothetical violations of your privacy enabled by using auth-with-Google, but for most use cases are rather unlikely, I would guess.

Re: Building account systems

#22

Post by zie »

ams6110 wrote: post #9
zie wrote: post #7

Another issue is what privacy are you losing by handing FB or Google all of your authentication? Offloading this is a huge privacy fail. It probably is a security win, but it's a huge privacy fail. Here Google/FB/etc, get MORE information for your giant catch-all, know-all database, thanks! Unfortunately better alternatives that are not a security win don't really exist yet.

What privacy are you losing? Real question. You're probably revealing to FB or Google that you're a user of web app X, but beyond that? Does using FB or Google auth enable any additional tracking of activities within the app or site? I would think only if the site developer was using Facebook or Google ads or tracking anyway. Asked another way -- if I sign into a website using FB auth, am I also signing into FB itsel…

Exactly, Google, FB, etc. They require you login to their website. They also now know you use web app X, the date/time, how often you use said website, etc.

For some applications, that privacy loss may not be a big deal. Except if you combine this information with the other 500 web apps the user also uses through 'Sign in with...' links, plus all the other information they gather, they suddenly get to know you really, really well.

Re: Building account systems

#23

Post by mimg »

> Users are always identified to you by email address, phone number or both...

An account system using phone numbers may have a negative impact to privacy. For some people a phone number is attached to a real name and address. Also it is not uncommon for a person to change their phone number from time to time.

Re: Building account systems

#24

Post by joshka »

mimg wrote: post #23

> Users are always identified to you by email address, phone number or both... An account system using phone numbers may have a negative impact to privacy. For some people a phone number is attached to a real name and address. Also it is not uncommon for a person to change their phone number from time to time.

For many people (most?) this is true for an email address as well

Re: Building account systems

#25

Post by homarp »

>Often web developers see adding a “sign in with Facebook” or “sign in with Google” button as a kind of optional nice-to-have, which comes only after building their own account system. If you’re reading this because you’re starting a new website from scratch, I argue that “Sign in with …” should be the only option you offer.

unless you have potential clients in China.

Re: Building account systems

#26

Post by legolassexyman »

am1988 wrote: post #11
programd wrote: post #4

Earlier quoted context omitted.

In fairness this is more then rehashing NIST 800-63. This is coming from a Google engineer who worked on their authentication systems. A lot of good advice here, starting with not building your own.

> Google engineer Oh, so basically scripture then.

Wait before you make rash judgments: he also worked on Bitcoin.

Re: Building account systems

#27

Post by jopsen »

noir_lord wrote: post #8
zie wrote: post #7

Another issue is what privacy are you losing by handing FB or Google all of your authentication? Offloading this is a huge privacy fail. It probably is a security win, but it's a huge privacy fail. Here Google/FB/etc, get MORE information for your giant catch-all, know-all database, thanks! Unfortunately better alternatives that are not a security win don't really exist yet.

Yep, side project I'm thinking of playing with in a month or two when the batteries are recharged pretty much completely rules out using either (health data). I wouldn't sign up to my own side project if I had to use either in that case.

I'll have to admit I prefer services that has a "sign up with" particularly google, github or facebook in that order :)

It's one less password to manage...

Re: Building account systems

#28

Post by zyb09 »

homarp wrote: post #25

>Often web developers see adding a “sign in with Facebook” or “sign in with Google” button as a kind of optional nice-to-have, which comes only after building their own account system. If you’re reading this because you’re starting a new website from scratch, I argue that “Sign in with …” should be the only option you offer. unless you have potential clients in China.

Anyone know if there is a good commonly used Chinese OAuth provider? Or Japanese and Korean for that matter?

Re: Building account systems

#29

Post by greenyoda »

ams6110 wrote: post #9
zie wrote: post #7

Another issue is what privacy are you losing by handing FB or Google all of your authentication? Offloading this is a huge privacy fail. It probably is a security win, but it's a huge privacy fail. Here Google/FB/etc, get MORE information for your giant catch-all, know-all database, thanks! Unfortunately better alternatives that are not a security win don't really exist yet.

What privacy are you losing? Real question. You're probably revealing to FB or Google that you're a user of web app X, but beyond that? Does using FB or Google auth enable any additional tracking of activities within the app or site? I would think only if the site developer was using Facebook or Google ads or tracking anyway. Asked another way -- if I sign into a website using FB auth, am I also signing into FB itsel…

"You're probably revealing to FB or Google that you're a user of web app X, but beyond that?"

That in itself could be giving away a lot of personal information. Merely knowing that someone visits a particular web site regularly could disclose their sexual orientation, health/mental issues, financial status, religious or political affiliation, etc.

If FB or Google then starts serving you ads that reflect these associations, it could publicly leak information about you that you don't want leaked. In some countries, having the "wrong" sexual orientation or political association could be deadly.

Re: Building account systems

#30

Post by zyb09 »

twright0 wrote: post #21
ams6110 wrote: post #9

Earlier quoted context omitted.

What privacy are you losing? Real question. You're probably revealing to FB or Google that you're a user of web app X, but beyond that? Does using FB or Google auth enable any additional tracking of activities within the app or site? I would think only if the site developer was using Facebook or Google ads or tracking anyway. Asked another way -- if I sign into a website using FB auth, am I also signing into FB itsel…

I believe that sign-in-with-X implementations require actually authenticating with X in that context. So in order to sign in with Google to a website, I need to sign into Google itself in the same browser. So in that sense, you are enabling Google to track you in that browser - but no differently than if you just logged into gmail. You could sign back out of Google immediately afterwards. But just the fact that an ap…

It's not that bad. The only thing Google/FB/Twitter gets to know is that a user Y is using app X. Nothing more, and not detailed usage stats, just the basic fact.

For that they handle the complete user registration, recovery & auth process for you, with all the work and pain attached to it.

Granted if your OAuth provider were really evil, they could log into the users App X account and access whatever data he has inside the app, so you have decide if that a concern or not.

Post reply on HN