Even when some service allow registering using good 'ol email, some still refuses to accept any non gmail/outlook address. Met a service that wouldn't allow me to register using my own domain email address a week ago. Baffled me staring at the google, fb and twitter sso button with the form for email address giving error of "please use an email address from a reputable provider".
Don't use third party auth to sign in
361–370 of 544 posts
Re: Don't use third party auth to sign in
#362Where can I check which websites I looged in with google? I found https://myaccount.google.com/permissions?gar=1 but 26 apps is like 1/10 of what I have I think
OAuth apps don't necessarily appear there, only apps using additional scopes than basic profile verification and email address
Re: Don't use third party auth to sign in
#363Earlier quoted context omitted.
There are alternatives to GSuite -- for instance, Fastmail. Or even the old PObox.com service which has been around since the 90s and is really cheap (Fastmail have bought it now, I notice).
Fastmail is very good. The web client is pretty simple, but feels so darned responsive (as in fast) compared to what I was used to from GMail. And spam is so far a non-issue.
Or, host your own on your own metal, to avoid depending on any third party. Alternatively, if you are ok with semi-dependence on a third party, get a $5/mo Linux VPS, and host your E-mail there.
With your own Linux instance, you can host whatever you want, have full control, can host other services too like www, git, whatever, and have the assurance that you're not going to suddenly lose access because AI-BOT-204432 decided you violated some obscure terms of service. I've been doing this for close to a decade now (exim + dovecot for E-mail), and it works great. Back in the 90's, this used to be the default. How did we end up in this world where we so utterly rely on 3rd parties for such everyday critical Internet services?
Re: Don't use third party auth to sign in
#364I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…
The speed of technological development is faster than the speed of societal or legal development. So yes, right now we've woken up in a world that is not so much cyberpunk as it is techno-feudalism: more and more do you need a presence on the Internet to do things in meatspace... And that presence is by the grace of several feudal lords (Google foremost) - woe betide you should you ever displease them. You do not rea…
This isn't even a tech problem. It's a lack of regulation to give recourse for individuals and lack of ability for them to be treated fairly by businesses.
We need to treat companies that put themselves into a position like utilities as utilities. Give individuals actual transparency of why actions where taken, and an ability to appeal these decisions with transparency.
It will cost more, but that is ok. What we have now is that the actions have caused real harm and the companies are unwilling to justify them. That's an abuse that needs to be removed through law.
Re: Don't use third party auth to sign in
#365> Every respectable service allows you to create accounts using your email address, so please use that method to create your accounts.
This is a major take-away, too. I have used this as a litmus test for a while. If a service requires you to log in via one of these third parties, and doesn't offer a "create an E-mail based account" option, stay away! They're not a serious business.
Or, even better, favor services/stores that don't require you to create an account.
Re: Don't use third party auth to sign in
#366Earlier quoted context omitted.
Yes and it pissed me off because on mobile it pops up like 0.5-2 seconds late so if you're unlucky you go to click on something and it popups up under your finger and you've suddenly signed up and shared your info with a company you had no intention of ever signing up with. I complained to Google. I have a GSuites domain and I don't want my users to be able to sign up via Google. No resolution. I suggest you all comp…
> I semi worked around it by adding accounts.google.com to my ublock origin block list but about once a month I have to turn it off to allow me to log into Google. This is where uBO's dynamic filtering[1] is useful, as it allows you to globally block `accounts.google.com`, and then unblock it only for specific sites by overriding the global block rule with a local noop rule. * * * [1] https://github.com/gorhill/uBloc…
Thanks for your work! A true friend of the internet.
Re: Don't use third party auth to sign in
#367I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…
> If Google can, without due process and fair warning, remove your existence then...
... you have clearly not understood that you should not have trusted them in the first place.
Yes, I have a Google account myself, but I try to use it as little as possible. My main reason for using it is the Play Store and I agree that it is unjust, that Google can remove my access to products I have paid for without really justifying for it in the sense of most people.
So I agree that something should be done. I think the line should be where paid services are offered. So if you just use a free service, Google(or any Company) should be able to stop providing you with that service whenever they like (while still providing you with access to the data you have generated or used with the service).
However, as soon as they have charged you, they should be forced to pay you back the whole amount (or offer some other kind of mediation that is more meaningful than receiving answers like 'Computer says no').
Re: Don't use third party auth to sign in
#368_A plea to the moderators:_ Please change the title of the submission back to match the title of the blog post, "Never Use Google to Sign-In".
To be fair to Google I have clearly called out all third-parties in the blog post, some by name.
I used Google's name in the title because that name elicits reaction from almost 100% of the audience, since almost everyone has used Google services at some point. I myself am a happy user of Google services, except for one incident [1] a few years ago when I was locked out of my account for 20 days. I was able to recover it because I finally remembered my linked yahoo email's password; I had forgotten that, and never bothered to save it in password manager, because I hadn't used it for many years.
For the record, I was also blocked out of GitLab for 7 days [2] for no apparent reason. This was resolved after a few days of follow-up with their support folks. Upon account recovery, the reason given was that my account was accidentally caught by their spam filters.
Back on topic: Changing the title from "Google" to "Third Party Auth" significantly softens the impact and urgency I want the reader to feel upon reading the title, and the short article that follows.
[1]: https://support.google.com/mail/forum/AAAAK7un8RUAzmxJAkP8gU...
[2]: https://forum.gitlab.com/t/gitlab-com-account-blocked-need-h...
- OP
Re: Don't use third party auth to sign in
#369Earlier quoted context omitted.
Land is a weak analogy here, because land is scarce.
I've had a recruitment consultant suggest I use a gmail e-mail address on my CV, because it looks weird to have an address at a domain (my own, and not anything strange btw) that people haven't heard of. Sounds crazy. But try dictating an e-mail address over the phone to a hotel or whatever and see that if you say 'Fred Bloggs seventy six at gmail dot com' or whatever, you never have to repeat yourself, whereas anyth…
I agree that it's not black-and-white. It's also not as dramatic as the land analogy suggests. There are plenty of other email providers that are perfectly socially acceptable to use.
Re: Don't use third party auth to sign in
#370> Every respectable service allows you to create accounts using your email address, so please use that method to create your accounts. This is a major take-away, too. I have used this as a litmus test for a while. If a service requires you to log in via one of these third parties, and doesn't offer a "create an E-mail based account" option, stay away! They're not a serious business. Or, even better, favor services/st…
I mean, the article is pretty lean. It basically says, "Don't use OAuth because if you're locked out of your account on the OAuth provider, you won't be able to sign in." I don't disagree with that.
I don't think it's fair to expect every website I sign up for to be able to safely store passwords. OAuth is a convenient and much safer way to allow users to authenticate to your website or service. I don't think it's fair to dismiss every service that doesn't provide this option.