Ask HN: Google SSO or Password Manager?

This isn't quite true. Many sites will allow you to recover your account via email. So even if your Google account is closed there would be a recovery route.

Of course some sites do require the same Google account ID, and once that is closed you are screwed. Oh, and I hope you aren't using a GMail account. Then you are really screwed.

Funny thing is that I had a domain with a different registrar about 9 years ago and I couldn't get them to stop mailing me expiration reminders. They kept coming well after I intentionally let the domain expire.

Those people are wrong.

If your email address ends in @gmail.com, then you don't control it, and have committed to tying your identity to Google's whims. And that's okay!

There are certainly some issues with Google unilaterally blocking access to accounts, but (1) this is extremely rare and (2) honestly, you're screwed even if you're using a password manager in that case.

Why? Because "password reset" is effectively SSO tied to your email address. It's just less secure and harder to use.

Seriously – under the covers, OAuth and other SSO flows are virtually the same as the process of opening an email and clicking on the link, except that they've been vetted by security researchers where "reset password" emails are almost never actually secure.

Password managers, for the vast majority of people, are confusing, unreliable, and even dangerous. Backups are hard to manage, and people often get it wrong. Forget your GMail password? Google will accept government ID and get you back in. Forget your password manager's password? Too bad, you're out of luck. The latter is vastly more common than Google blocking people and refusing to let them back in.

To be fair to HN, there are a few good points in the responses here:

- @linsomniac does raise the good point that you're likely to need a password manager in any event, since some sites don't support SSO.

- @jaywalk points out that if you have an email address on a domain that you own, you're not dependent on Google in case they refuse you service. It's worth noting that in this scenario, using Google's SSO is still fine – if they lock you out, you can still access any accounts you used SSO to sign in to by using password reset. I have yet to see a site that doesn't allow switching from SSO to using a password.

One thing to add is that you should never use Twitter or Facebook SSO; if you do, and get locked out of (or want to delete) your account on either service, there's no recourse whatsoever, and there's no way to switch to a password because your account often isn't tied to an email address if you go with Sign-in with Facebook. Same goes for LinkedIn and other similar "Social Sign In" systems.

I don't have a google account tied to my android-based phone.

The only drawback I'm aware of is that playstore doesn't work. So I download the apks directly and install that way, for things I can't install via one of the alternate app stores.