Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't use third party auth to sign in

gurjeet.singh.im

Post reply on HN
Print view View original

111–120 of 544 posts

Re: Don't use third party auth to sign in

#111

Post by 205g0 »

Hijacking this thread for a simple price comparison: Since people recommend to buy a domain and connect this to some service. The problem is that this service will run for decades as a private plan, so let's do together a price and feature comparison since the lock-in is huge.

GSuite:

- pros: vast ecosystem of GMail extensions, eg mail merge

- con: just 30gb total storage

MS:

- pros: 50GB email, 1TB cloud, Office apps included (not that I like them but sometimes you still need them), dirt cheap family plan for $30+ you get 6tb

Yandex:

- free, but yeah all my serious stuff like bank accounts there, IDK

iCloud:

- super expensive

Dropbox:

- no email and ios camera upload broken/lags years behind for ages and super expensive

What do you think? Are there any better options out? Which would you take?

Re: Don't use third party auth to sign in

#112

Post by monkin »

205g0 wrote: post #111

Hijacking this thread for a simple price comparison: Since people recommend to buy a domain and connect this to some service. The problem is that this service will run for decades as a private plan, so let's do together a price and feature comparison since the lock-in is huge. GSuite: - pros: vast ecosystem of GMail extensions, eg mail merge - con: just 30gb total storage MS: - pros: 50GB email, 1TB cloud, Office app…

Yyy... what the hell?

Re: Don't use third party auth to sign in

#113

Post by progval »

coder543 wrote: post #105
throw_m239339 wrote: post #66

Remember OpenID? Yes, that's what it was for, OAuth wasn't never meant for signing in other websites who just want your mail or something... Of course, all these big tech corps quickly dropped OpenID, they don't want people to control their online credentials or identity...

Really, I think OpenID died because it didn’t see significant enough adoption. I remember the user flows being a bit clunky, which certainly didn’t help. With OpenID, basically everyone used a third party ID provider, and so you were just as dependent on that provider as with OAuth. Did you actually self host OpenID? If so, that’s a lot to ask of each person in the world. If you didn’t self host OpenID, I don’t think…

> Did you actually self host OpenID? If so, that’s a lot to ask of each person in the world.

You could pay someone to host it with reasonable guarantees they won't delete your account on a whim and no recourse.

Or you can use a free service that you somewhat trust with your own domain, so you can point the domain to another provider if you need to. Almost no technical knowledge required for that.

> If you didn’t self host OpenID, I don’t think you had much “control of your online credentials or identity.”

Same for email, which is what identity relies on instead of OpenID.

And self-hosting OpenID is much easier than email: you just need domain + LAMP (or equivalent), and don't have to deal with DKIM, SPF, being blacklisted from Gmail/Hotmail, ...

Re: Don't use third party auth to sign in

#114

Post by paol »

reidrac wrote: post #91
grezql wrote: post #6

Has anyone else noticed random popups on 3rd party websites asking for google sign in? I even used firefox when it happened: https://imgur.com/a/JC52lBV (lequipe.fr) https://imgur.com/a/VSM3Uk9 (reddit.com) https://imgur.com/a/KpVCYBL (medium.com)

I use Firefox containers at work but I was postponing doing the same at home because it takes a bit of work to create the containers, assign sites, troubleshoot some minimal issues, etc; and THIS made me finally do it. I knew that I was being tracked, but that was a bit too "in my face" to ignore it.

Same here. Seeing that popup on medium.com with my google login identity was what finally prompted me to start using containers. Now google's domains are safely kept in their little box where they belong.

It's funny because there's nothing new about those login popups - I already knew conceptually that kind of thing was possible - but seeing your little avatar picture show up where it doesn't belong provokes a much more direct reaction than abstract knowledge.

Re: Don't use third party auth to sign in

#115

Post by jackjeff »

Also. HOW do you know it’s a real Google sign-in instead of a fake password stealing form?

We’ve trained generations of users to accept it’s alright to give their Google/Facebook/Twitter credentials to any random site under the sun.

Re: Don't use third party auth to sign in

#116

Post by spians »

grezql wrote: post #6

Has anyone else noticed random popups on 3rd party websites asking for google sign in? I even used firefox when it happened: https://imgur.com/a/JC52lBV (lequipe.fr) https://imgur.com/a/VSM3Uk9 (reddit.com) https://imgur.com/a/KpVCYBL (medium.com)

You can disable these annoying prompts by going to https://myaccount.google.com/permissions and disabling "Google Account sign-in prompts". Ideally it should have been user opt in but Google followed dark pattern here.

Re: Don't use third party auth to sign in

#117

Post by holigot »

sneak wrote: post #51
ukoki wrote: post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

This is such excellent advice that I wrote a detailed step-by-step instruction guide for people that don't know how to do precisely that: https://sneak.berlin/20201029/stop-emailing-like-a-rube/ It even has special instructions about how to secure the domain registration and DNS accounts. :) (Don't use G Suite, though.)

Thx for that. Great help for many of us.

But why referring to Protonmail and using Fastmail for yourself?

Re: Don't use third party auth to sign in

#118

Post by mdpm »

throw_m239339 wrote: post #66

Remember OpenID? Yes, that's what it was for, OAuth wasn't never meant for signing in other websites who just want your mail or something... Of course, all these big tech corps quickly dropped OpenID, they don't want people to control their online credentials or identity...

OpenID hasn't died at all - it's just used in a different context. We implement this now for SSO in corporates to unify fragmented IAM scenarios.

Accepting any domain as an OpenID IdP is not likely to be a feature of publicly facing sites, as they still provide the ability to create / register / use these accounts for spam and other unwanted abusive purposes.

Re: Don't use third party auth to sign in

#119

Post by tyingq »

There does seem to be a need for Google to clarify their rules for "banning" an email used for sign-in.

It seems like things should be more granular, such that being banned on YouTube doesn't make your thermostat quit working, ruin your phone contacts/photos/etc, or cut you off from your unspent AdWords funds.

Re: Don't use third party auth to sign in

#120

Post by milkthefat »

ukoki wrote: post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

My problem with the get your own domain and DNS is its far more likely I become incapacitated and become unable to pay or manage it than getting locked out of gmail or outlook mailboxes.
Post reply on HN