Ask HN: Google SSO or Password Manager?

Bitwarden self-hosted on Digital Ocean is pretty easy to set up. Then you have an open source password manager that you can still sync across multiple devices without having to worry about adding another tool like Syncthing to the mix. Since you're hosting it, it's a much smaller target although it's up to you to keep it up to date.

I use a password manager and would recommend you to do so too. Depending on a SSO provider just seems to risky to me right now, considering how easily you might lose access to your account. Of course, you also need to use your own domain for your email address.

2FA is also something I keep thinking about. What if I lose access to my phone? Does it really make logins more secure, considering that all my passwords are uniquely generated for a service? Do I want to do the extra step?

#2 is always fun when you're dealing with humans directly. "Yes my email is @.com. No I don't work for the company, it's so I can track where emails come from. Yes I work in tech."

You aren't going to have all your accounts able to use Google, not everyone offers it. So you are going to need to use a password manager in any case. I use Bitwarden and like it, my wife uses it but is only ok about it.

Now, as far as Google vs. Password manager on sites that do support it: Google can be convenient, but there is the infrequent, but apparently very real risk of Google locking your account, and through that also locking these other accounts. I'm not very concerned about that risk personally, but I also would be very reluctant to put important accounts like banks and bills on a Google SSO.

To be clear: I'm not a big "google is evil" guy, but "I'm locked out of google" seems to be a regularly recurring story, but it clearly is low frequency. I do know that when things go wrong, Google is often a black box with little recourse or even any way to contact someone there, especially, I imagine, if your account is locked.

I, personally, almost always use a password manager rather than a Google SSO, just because I have it set up an it's almost as easy as the SSO.

* Never ever use Google SSO. If Google locks you out, there is no recourse and you lose everything.

* Use your own domain, but don't use Google Domains as the registrar. If Google locks you out, you use everything.

* Don't use Gmail as the admin account of your domain registrar. If Google locks you out, you lose everything. But don't use your own domain email as the admin account of your domain either. It's ok to forward to your Gmail account, as long as you can access the other email account when Google locks you out.

* Don't use Gmail as the contact address of your credit card on your domain registrar. If Google locks you out, you will miss notifications of payment problems.

* Backup your Gmail, Google Drive, Photos, Calendar, Contacts, etc. to somewhere else. I recently purchased a Microsoft 365 account for this purpose, $70/year for 1 TB of storage. Ironically Google is making me spend money on other providers because of Google's complete lack of customer support and their rapidly degrading level of trust.