Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't Sign in with Google

twitter.com

Post reply on HN
Print view View original

11–16 of 16 posts

Re: Don't Sign in with Google

#11

Post by nrvn »

I am the one who had been using g suite before it became google workspace for more than a decade.. Last year I changed my email provider, cancelled workspace subscription and deleted the google account only to create a new one with the same email address as a normal user. Used google takeout to transfer all valuable assets out.

I lost access to literally nothing! SSO binds your email address as the primary account idenitifier in all known to me services. Does not matter what IDP you use to “sign in with”.

I find this twitter thread misleading. Unless the affected account was using @gmail.com as their primary identity.

Buy a domain and set up email on custom domain. backup emails periodically outside of the provider to be able to switch easy if needed. Same applies to other data stored in SAAS of any kind. This is the rule of thumb if the risk of losing access to tour primary IDP is critical.

Assess the risk and act accordingly.

Re: Don't Sign in with Google

#12

Post by martheen »

Alex4386 wrote: post #8
evanwolf wrote: post #7

Heh. Posted on X.

and the point of entire post was about any SSO is bad. At that point any password manager (including on-premise bitwarden, cause that is still single credential for everything) is bad, you should memorize randomly generated 64 digit password and never forget it.

Nah, then someone can still beat it out of you. Instead encode and tattoo it to a hamster with a cage that will auto open if you haven't check in in 24 hours. When the adversary is holding you, the hamster will escape and the neighbor's cat will take care of the rest.

Re: Don't Sign in with Google

#13

Post by CM30 »

hattmall wrote: post #5
CM30 wrote: post #2

Yeah, Google's lack of support is notorious at this point. It's why just about any YouTuber who gets their account hacked is reduced to begging for help on Twitter, since there seems to be no-one at the company able to help directly if contacted from the site itself. Does make me think that there should be regulations about support to prevent this sort of thing though. Maybe at the very least there should be a mandat…

We need to have an entirely different set of regulations and expectations for entities in excess of a certain size. I think 50-100 million in revenue would be a fairly reasonable starting point but even lower would be acceptable. Certainly at a billion dollars you should be able to speak to someone who can resolve or escalate any issue with in less than a working day.

Yeah if a company is big enough that they potentially have the level of control over your life that Google or Microsoft do, then there should be ways to appeal their decisions that might not need to apply to a random startup or small business.

And we definitely need to make it clear that there's no such thing as "too big to care about customers/obey the law". If your business is 'too big' to offer any customer support, then that's your problem to fix, not an excuse for not offering it at all.

Re: Don't Sign in with Google

#14

Post by pixel_popping »

sitzkrieg wrote: post #3

using google in 2026 is self imposed risk

I genuinely don't understand why (at least power users) users don't seem to understand this, they never "own" their account, thousand have lost everything due to a mistake, login once via anonymizing solution and so-on and bam, account ban, I've lost so much money in "crypto" (on some exchanges) because of 2-FA perma loss due to Gmail ban back in 2015, storing your business on Google and mixing-up with your personal life is just reckless at this point, it's not like people don't "know" that they can lose everything from 1 day to another, I hope this movement of moving out from Google will be much more generalized.

Re: Don't Sign in with Google

#15

Post by Cpoll »

nrvn wrote: post #11

I am the one who had been using g suite before it became google workspace for more than a decade.. Last year I changed my email provider, cancelled workspace subscription and deleted the google account only to create a new one with the same email address as a normal user. Used google takeout to transfer all valuable assets out. I lost access to literally nothing! SSO binds your email address as the primary account id…

> I lost access to literally nothing! SSO binds your email address as the primary account idenitifier in all known to me services.

Do you mean that you're setting up SAML/OpenID for every service you use?

> Does not matter what IDP you use to “sign in with”.

I don't understand. The service provider needs to check the identity of the IdP, or IdP-B could impersonate user alice@foo belonging to IdP-A

Re: Don't Sign in with Google

#16

Post by Jotalea »

alright, i'll take your point and say that Google is not a viable SSO provider. now what?

sure i could buy a custom domain and host an email server on it, but now i have to care about server maintenance, SSL, and paying yearly for the domain. but that doesn't mean i get to keep it forever! just as Google can, the hosting provider can block my account, or even go down itself. then what? i'd be in the same situation where i'm locked out.

or suppose i don't have money to pay for the domain (which is a rare possibility, but it is not impossible). now someone buys my domain, and registers an email with the same address as mine. now what? i'm screwed!

i agree that having only one centralized login method for all of one's accounts is bad, but this article doesn't provide a safe alternative.

Post reply on HN