Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Google SSO or Password Manager?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 64 posts

Re: Ask HN: Google SSO or Password Manager?

#21

Post by nerdjon »

Password manager without question (just make sure it is one with strong security)

SSO to me exists for the sole purpose of keeping you locked into their platform. I have a "professional" email that I previously hosted on google with gsuite. I used that account a few times as SSO.

Now even though I have moved that email off of google, I continue to pay gsuite just so I don't loose access to that account and anything I logged in with it.

I have made every effort to remove google from my life as much as possible, but that account remains thanks to SSO.

Some SSO services don't give you an easy way to change how you login so you could be stuck.

Re: Ask HN: Google SSO or Password Manager?

#22

Post by tnorthcutt »

gorjusborg wrote: post #20

Centralized authentication puts all your eggs in one basket, while password manager splits risk by not sharing passwords across use-cases. That said, I don't see why you shouldn't do both.

How would you do both, in this case? Either you create accounts per site, or use SSO, no?

Re: Ask HN: Google SSO or Password Manager?

#23

Post by aborsy »

gorjusborg wrote: post #20

Centralized authentication puts all your eggs in one basket, while password manager splits risk by not sharing passwords across use-cases. That said, I don't see why you shouldn't do both.

Password managers also put all your eggs in one basket: the master password to your PM!

There is after all a reason that it’s called 1Password!

Re: Ask HN: Google SSO or Password Manager?

#25

Post by smrtinsert »

jaywalk wrote: post #9

1. Email on your own domain. You can still use Google (or any other service) for this, but having your own domain means you're not dead in the water if your provider decides they don't like you. 2. For accounts on large websites (big targets) use a unique email address that is only used on that website. Obviously passwords should never be reused, which leads to: 3. Password manager. Just do it. 4. Use the highest sec…

Tying your own configuration to your identity is like the digital version of cash under the mattress but with more risk imo.

Re: Ask HN: Google SSO or Password Manager?

#26

Post by ziml77 »

jaywalk wrote: post #15
sodimel wrote: post #11

Earlier quoted context omitted.

> Email on your own domain. You can still use Google (or any other service) for this, but having your own domain means you're not dead in the water if your provider decides they don't like you. And if you give up your domain then someone just have to buy it and use the "forgot password" option :D

You do have some additional management overhead, but a good registrar will bug you well before your domain expires if they aren't able to auto renew it for some reason. You also have a 30 day grace period after it expires before someone else grabs it.

They need to bug me by mail and by phone. Last time my payment couldn't be processed, I lost email for a week (didn't notice because I was reading email in an email client that pulls from both my custom domain and gmail). Once I brought the domain back up, many of the missed emails did come through including ones from the registrar saying that I needed to fix my payment info...

Re: Ask HN: Google SSO or Password Manager?

#27

Post by smrtinsert »

theandrewbailey wrote: post #10

You can have many copies of your password manager database in many places, but you have only one Google. If you lose one thing, what would you rather lose? If you lose a password database, restore a backup. If you lose access to Google, what then? You can't restore a backup of Google. Stick around HN long enough, and within a week, you'll read stories of people losing access to their Google accounts for unexplained r…

Citations required. Are you referring to Android spam developers?

Re: Ask HN: Google SSO or Password Manager?

#28

Post by igetspam »

jaywalk wrote: post #9

1. Email on your own domain. You can still use Google (or any other service) for this, but having your own domain means you're not dead in the water if your provider decides they don't like you. 2. For accounts on large websites (big targets) use a unique email address that is only used on that website. Obviously passwords should never be reused, which leads to: 3. Password manager. Just do it. 4. Use the highest sec…

This is how I do everything. I have a *@domain.tld address that lands in a single account and I track spammers and breaches.

Re: Ask HN: Google SSO or Password Manager?

#30

Post by igetspam »

smrtinsert wrote: post #27
theandrewbailey wrote: post #10

You can have many copies of your password manager database in many places, but you have only one Google. If you lose one thing, what would you rather lose? If you lose a password database, restore a backup. If you lose access to Google, what then? You can't restore a backup of Google. Stick around HN long enough, and within a week, you'll read stories of people losing access to their Google accounts for unexplained r…

Citations required. Are you referring to Android spam developers?

There have been big deal stories of people losing access to their Gmail accounts and Google's response is basically "tough shit.". There are also a lot of them that don't get much traction.

https://news.ycombinator.com/item?id=22294159 https://news.ycombinator.com/item?id=2033474 https://news.ycombinator.com/item?id=17745761

You can dig through the rest: https://hn.algolia.com/?q=lost%20access%20to%20gmail

Post reply on HN