Live data from Hacker News

Don't use third party auth to sign in

gurjeet.singh.im

301–310 of 544 posts

Re: Don't use third party auth to sign in

#301
> Every respectable service allows you to create accounts using your email address, so please use that method to create your accounts.

Sadly this isn't true. I can't register to download my electric bill without a google, facebook or twitter account. Electric companies are local monopolies so I can't switch to another supplier either.

My email account still belongs to google, so I can't claim that this makes any difference in my life. It's a bit disturbing nonetheless.

Re: Don't use third party auth to sign in

#302
post #286

Earlier quoted context omitted.

See also: Kindle books; movies "purchased" from Amazon, Apple, et al; Tesla upgrades you paid extra for; I could go on....

I have yet to hear about the first amazon account ban. I don’t think they’re really interested in that, since the accounts are almost by definition making them a bunch of money.

I'm having trouble understanding your point. Leaving aside simply googling it, surely you can't be saying that because you haven't heard of something, it doesn't exist or isn't a threat or isn't worth any concern.

Re: Don't use third party auth to sign in

#303

Who has changed the the title of the HN submission? It was "Never use Google to sign in" and it's still that when following the link. According to submission rules it should not redacted.

OP here. I certainly did not change the title, and would like to know who changed the title and why?

In the article I clearly call out that using any third-party is a risk, so I don't see a reason why the moderator felt the need to say that in the submission title as well.

Re: Don't use third party auth to sign in

#304
post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

As long as you don't want to use any Nest products, which now insist that you have a gmail.com address as apparently hosted domains are for business only.

Re: Don't use third party auth to sign in

#305
post #293

The risk of getting your account locked is just one of the reasons you shouldn't use Google (and the like) to sign in. But how did we end up in this horrible state of authentication? Why don't we have something as easy to use as the DNS, but for authentication? Imagine what authentication would look like, if we all started running is the same direction, instead of implementing our own authentication again and again.…

> which proves that this is possible. How does it prove that?

I've built Promise, to prove (to myself at least), that it would be technically possible to build authentication infrastructure, that can be used across sites, without having to store any data unencrypted, and furthermore, not storing any personal data at all.

And it works.

It's a bold choice of words, I acknowledge that. And the proof is only as strong as my abilities to write software.

This is yet another reason why Promise needs a movement behind it. To strengthen the proof. To strengthen security.

Re: Don't use third party auth to sign in

#306
post #287
post #190

Earlier quoted context omitted.

I don't want more accounts and passwords. The security seems strictly worse than just authenticating against my email provider directly.

There's no good reason not to use a password manager in 2020. I recommend this one: https://www.passwordstore.org/

No good reason until an exploit comes out that wreaks havoc.

Re: Don't use third party auth to sign in

#307
post #225

Earlier quoted context omitted.

Because a house is significantly more important than an email address. I get being extremely online but let's not be silly here. Plus that email/account is hardly even "yours" in a serious way. Anyone on the HN has a very simple fix for all these problems: get an email in your domain and a password manager for all the accounts. There, solved. You could even still use Gmail with their Google Apps, G Suite, Workplace o…

Put simply, one's house is literally on their own property, and one's Gmail account is literally on Google's property. If someone owned a vast amount of land, more than needed for everyone on earth to build a house, and the owner told people they could freely build structures but you lose it if you break the rules and the rules can change any time...

Land is a weak analogy here, because land is scarce.

Re: Don't use third party auth to sign in

#309

Earlier quoted context omitted.

> I'm honestly not sure where we went so wrong as a society so as to reach this point... Why? The answer is actually very simple: spam. AFAIK pretty much all disabled Google accounts come from Google believing they are part of a spam-sending (or malware-spreading) network. The ability to sign up for free Google accounts means this is a prime target for spammers to use and abuse -- signing up for free Gmail/Drive acco…

it's incredibly rare to personally know someone it happened to I don't know anyone who has a degree in History but that doesn't mean historians are especially unusual. All it means is that my network is quite small. The same is true here. The fact few people know someone who has been affected by this problem doesn't mean the problem is unusual. It just means there are hundreds of millions of people who use Google and…

According to the Bureau of Labor Statistics, the number of historian jobs in 2019 was 3500 - that's in the entire US.

So... incredibly rare, really.

Post reply on HN