Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't use third party auth to sign in

gurjeet.singh.im

Post reply on HN
Print view View original

221–230 of 544 posts

Re: Don't use third party auth to sign in

#221

Post by dageshi »

aboringusername wrote: post #176
Ace777 wrote: post #165

Earlier quoted context omitted.

I do not. Becoming dependent on a large e-mail provider is only because of continued willful ignorance. Better education for how digital services work and how to properly handle your digital identity is the right way to handle this. Implementing regulation and cementing the "major" e-mail providers who have the resources to comply will only deepen people's dependence on these corporations.

So what do you propose then? How do you "properly handle your digital identity is the right way"? Do I have 15 emails addresses with 15 different providers? When a form asks for my email address I can only give one, what happens if that provider goes away? What if a government doesn't like $provider and seizes the business? Now I can't get a reset link/change my password/prove my identity...Many government online ser…

Register your own domain and point it at your preferred service, if you lose access to that service you still retain the domain and you still have your email address.

If you want to solve this problem you have to spend some money somewhere otherwise you are simply demanding providers give you services, for free, forever, not something that seems realistic?

Re: Don't use third party auth to sign in

#222

Post by giobox »

anvandare wrote: post #143
aboringusername wrote: post #125

I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…

The speed of technological development is faster than the speed of societal or legal development. So yes, right now we've woken up in a world that is not so much cyberpunk as it is techno-feudalism: more and more do you need a presence on the Internet to do things in meatspace... And that presence is by the grace of several feudal lords (Google foremost) - woe betide you should you ever displease them. You do not rea…

I like the term "techno-feudalism" - captures the increasing nationalism over things like technology sales to China by the US etc too, the Tik Tok situation...

Re: Don't use third party auth to sign in

#223

Post by kevincox »

coder543 wrote: post #123
progval wrote: post #113

Earlier quoted context omitted.

> Did you actually self host OpenID? If so, that’s a lot to ask of each person in the world. You could pay someone to host it with reasonable guarantees they won't delete your account on a whim and no recourse. Or you can use a free service that you somewhat trust with your own domain, so you can point the domain to another provider if you need to. Almost no technical knowledge required for that. > If you didn’t self…

> You could pay someone to host it with reasonable guarantees they won't delete your account on a whim. Each user having to find a hosting provider and pay them... it seems like a non-starter. Think about the non-technical people in your life. That solution would only help the very few people who both understand the details of OpenID, and care about the possibility of losing account access at a deep level. Most peopl…

That is why basically every implementation provided a big "Log in with Google" button. It was basically no effort to implement (it just fills in the Google OpenID URL) and solves the problem of the people who don't have enough distrust in Google to self-host.

Re: Don't use third party auth to sign in

#224

Post by [deleted] »

IanCal wrote: post #190
ekianjo wrote: post #182

Earlier quoted context omitted.

> Yet here it is. Google can offer their services and the legal system seemingly doesn't want to be involved. Why ? The real question is why do people use Google to sign in to other services? It never even crossed my mind no matter how long I have had a Google account.

I don't want more accounts and passwords. The security seems strictly worse than just authenticating against my email provider directly.

[deleted]

Re: Don't use third party auth to sign in

#225

Post by blfr »

aboringusername wrote: post #125

I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…

Because a house is significantly more important than an email address. I get being extremely online but let's not be silly here.

Plus that email/account is hardly even "yours" in a serious way. Anyone on the HN has a very simple fix for all these problems: get an email in your domain and a password manager for all the accounts. There, solved. You could even still use Gmail with their Google Apps, G Suite, Workplace or whatever it's called this month.

Normies are way out of luck but sadly that is true almost everywhere and they are getting fleeced much worse by banks, employers, and even cable companies than Google ever could hope.

Re: Don't use third party auth to sign in

#226

Post by ipqk »

reidrac wrote: post #91
grezql wrote: post #6

Has anyone else noticed random popups on 3rd party websites asking for google sign in? I even used firefox when it happened: https://imgur.com/a/JC52lBV (lequipe.fr) https://imgur.com/a/VSM3Uk9 (reddit.com) https://imgur.com/a/KpVCYBL (medium.com)

I use Firefox containers at work but I was postponing doing the same at home because it takes a bit of work to create the containers, assign sites, troubleshoot some minimal issues, etc; and THIS made me finally do it. I knew that I was being tracked, but that was a bit too "in my face" to ignore it.

I tried to create my own Google container, but could never get it work with Google Drive which caused an endless redirect so I had to give up.

Re: Don't use third party auth to sign in

#227

Post by SteveNuts »

eznzt wrote: post #188
aboringusername wrote: post #125

I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…

So what do you propose, make it impossible for Google to ban accounts?

Not OP but I think companies should have to inform you of the specific reason you were banned, and have a formal appeals process.

The stakes are quite high for losing access to your primary email.

Re: Don't use third party auth to sign in

#228

Post by kevincox »

ayende wrote: post #103
Multicomp wrote: post #94

I was forced to use sign in with google for dnd beyond as they don't support byo-email address (!), only google, twitch, apple, and yahoo. We need a name and shame site for websites that can't be bothered to write a back end database for the 3 columns needed to store emails, salts, and hashes.

2FA, reset your password, making sure that password emails gets through, preventing login enumeration, preventing dictionary attacks, etc. Those are just the things off the top of my head, it's not just three columns

Rate limiting is also a big one.

Re: Don't use third party auth to sign in

#229

Post by Multicomp »

ayende wrote: post #103
Multicomp wrote: post #94

I was forced to use sign in with google for dnd beyond as they don't support byo-email address (!), only google, twitch, apple, and yahoo. We need a name and shame site for websites that can't be bothered to write a back end database for the 3 columns needed to store emails, salts, and hashes.

2FA, reset your password, making sure that password emails gets through, preventing login enumeration, preventing dictionary attacks, etc. Those are just the things off the top of my head, it's not just three columns

That reinforces the point of the article, but is semi-orthogonal to my point.

Convenience strikes again. They use the google third party sign in since a big company like dnd can't be bothered to implement 3 columns plus your nice to haves.

And they are nice to haves, arguably obvious and easily upgraded to required table stakes, but not _required_ to implement email-based sign in. The first three of your listed iftems are also effectively mitigated with a password manager.

Re: Don't use third party auth to sign in

#230

Post by FpUser »

crazygringo wrote: post #220
aboringusername wrote: post #125

I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…

> I'm honestly not sure where we went so wrong as a society so as to reach this point... Why? The answer is actually very simple: spam. AFAIK pretty much all disabled Google accounts come from Google believing they are part of a spam-sending (or malware-spreading) network. The ability to sign up for free Google accounts means this is a prime target for spammers to use and abuse -- signing up for free Gmail/Drive acco…

>"It's like worrying about being struck by lightning."

If lightning strikes there is not much to be done. Google however can and must have reasonable process to restore the status.

Post reply on HN