Don't use third party auth to sign in • Hacker News Board

Re: Don't use third party auth to sign in

#481

Post by anderslemke » Sat, Nov 14, 2020, 10:14 PM UTC

quicklime wrote: post #456

mawise wrote: post #443

Earlier quoted context omitted.

It's a step in the right direction, but it's still centralized. A lot of the work done by the Indie Web community around IndieAuth[1] is really attractive. Your identity is your domain, and you can change how your domain says you're allowed to authenticate. Now you can even use sign-in with google without getting locked out should you loose your google account. Aligns really well with using your own domain for email…

I hadn't heard of either Promise or IndieAuth before reading this thread, so apologies if this is a dumb question. But one of the benefits of Promise is that it's pseudonymous: > You will get a unique identity pr. service you use. This ensures that relying parties have no way to profile you across services. For me, this is actually the biggest reason that I stopped using social sign-ins. It's not that Google might di…

Being pseudonymous is one of the main selling points of Promise.

Only by being pseudonymous can it provide the level of privacy that should be expected from the global authentication infrastructure that Promise wants to be.

Re: Don't use third party auth to sign in

#482

Post by glokk » Sat, Nov 14, 2020, 10:24 PM UTC

anderslemke wrote: post #275

The risk of getting your account locked is just one of the reasons you shouldn't use Google (and the like) to sign in. But how did we end up in this horrible state of authentication? Why don't we have something as easy to use as the DNS, but for authentication? Imagine what authentication would look like, if we all started running is the same direction, instead of implementing our own authentication again and again.…

There's another privacy-focused SSO solution from SimpleLogin that creates a different email address for each relying party.

Re: Don't use third party auth to sign in

#483

Post by figassis » Sat, Nov 14, 2020, 10:25 PM UTC

xbar wrote: post #262

figassis wrote: post #130

Isn’t this grounds for a class action lawsuit? Google and friends have the right to lock you from use of their services, but when such services encroach in your use of other services unrelated to google, that you may even have paid for, should google have the right to blanket block? Is it technically difficult to exempt google signin from account locks? Can we maybe also legally claim that if a company hosts your ide…

You were dumb. Then you were dumber. Then you were even dumber. Then you sued Google because a lot of other folks were like you. Ok.

So name calling...bc why not?

Re: Don't use third party auth to sign in

#484

Post by glokk » Sat, Nov 14, 2020, 10:25 PM UTC

ukoki wrote: post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

Once you have your domain, you can use Zoho create emails for your domain for free. They don't offer IMAP/POP3 access in the free tier though.

Re: Don't use third party auth to sign in

#485

Post by no_wizard » Sat, Nov 14, 2020, 10:27 PM UTC

RonanTheGrey wrote: post #474

no_wizard wrote: post #452

Earlier quoted context omitted.

Counter point, I’ve been told by recruiting that my email makes me stand out because it’s not the norm domain name and it’s a little “fun” in the sense that it conveys a little light personality.

I'm 100% certain that a number of opportunities I've been offered have been because I proved a certain level of competence by maintaining my own email and domain; this certainty is largely due to the incidence of comments like the ones you note. It's definitely a way to stand out.

I got a call from a recruiter from a large company that simply “had to reach out” because my email was so unique. So, there’s that too!

Maybe it has hurt me somehow but...I wouldn’t want to work somewhere that would hold my email domain against me

Re: Don't use third party auth to sign in

#486

Post by glokk » Sat, Nov 14, 2020, 10:28 PM UTC

Apart from the kick-out risk, using SSO from Google/Facebook isn't good for your privacy neither. They usually have an iframe in their SDK that can track you even when you don't click on the login button.

Re: Don't use third party auth to sign in

#487

Post by anderslemke » Sat, Nov 14, 2020, 10:33 PM UTC

glokk wrote: post #482

anderslemke wrote: post #275

The risk of getting your account locked is just one of the reasons you shouldn't use Google (and the like) to sign in. But how did we end up in this horrible state of authentication? Why don't we have something as easy to use as the DNS, but for authentication? Imagine what authentication would look like, if we all started running is the same direction, instead of implementing our own authentication again and again.…

There's another privacy-focused SSO solution from SimpleLogin that creates a different email address for each relying party.

I didn't know SimpleLogin. It seems really nice. Kind of what Apple does with their "Sign In with Apple".

It's not exactly a SSO, though.

Re: Don't use third party auth to sign in

#488

Post by krzrak » Sat, Nov 14, 2020, 10:34 PM UTC

judge2020 wrote: post #163

IceWreck wrote: post #48

Earlier quoted context omitted.

You can do this without paying as well. If your DNS provider supports email forwarding you can use that (if it doesnt you can use improvmx free tier) and use gmail's inbuilt smtp server to send emails using your own domain.

Only issue with not using GSuite is that you won’t be able to DKIM sign those emails, although just SPF might be sufficient.

You can also use Gmail as POP3/SMTP client for your e-mail account at other provider.

Re: Don't use third party auth to sign in

#489

Post by TedDoesntTalk » Sat, Nov 14, 2020, 10:36 PM UTC

anderslemke wrote: post #275

The risk of getting your account locked is just one of the reasons you shouldn't use Google (and the like) to sign in. But how did we end up in this horrible state of authentication? Why don't we have something as easy to use as the DNS, but for authentication? Imagine what authentication would look like, if we all started running is the same direction, instead of implementing our own authentication again and again.…

There is so much fragmentation in authorization and authentication that it is hard to see how we can “run in the same direction”. Facebook, google, etc have zero incentive to change anything.

Re: Don't use third party auth to sign in

#490

Post by anderslemke » Sat, Nov 14, 2020, 10:49 PM UTC

TedDoesntTalk wrote: post #489

anderslemke wrote: post #275

The risk of getting your account locked is just one of the reasons you shouldn't use Google (and the like) to sign in. But how did we end up in this horrible state of authentication? Why don't we have something as easy to use as the DNS, but for authentication? Imagine what authentication would look like, if we all started running is the same direction, instead of implementing our own authentication again and again.…

There is so much fragmentation in authorization and authentication that it is hard to see how we can “run in the same direction”. Facebook, google, etc have zero incentive to change anything.

Yes. The fragmentation is part of what makes authentication a horrible experience.

But most of all, what I'm missing is at least one good option on the sign-in screen. And using a password manager is not it.