Live data from Hacker News

Don't use third party auth to sign in

gurjeet.singh.im

131–140 of 544 posts

Re: Don't use third party auth to sign in

#131

I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…

Because there is no clear jurisdiction for the web. That's it.

Re: Don't use third party auth to sign in

#132

I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…

It's not removing your existence. It's removing your access to all of their services.

At every point, google users are asked to acknowledge the EULA and TOS. They're being told that google can stop their service for any reason, including that service not being comercially viable. ( I.E. Any Reason )

Access to google services isn't a right. It never was, unlike the property rights you're drawing a false equivalency with.

Re: Don't use third party auth to sign in

#133

I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…

Legal services can get involved just fine if you file suit. You'll just have to establish that Google owed a duty to you (by contract or otherwise) and that you were harmed by their breach of that duty.

(Roughly. I am not a lawyer.)

Re: Don't use third party auth to sign in

#134
post #67

Earlier quoted context omitted.

Yes, and it bothers me a lot, even if it's in an iframe, that it has my real name from my Gmail account inside the unrelated third party pages. I do not trust Javascript iframe policies from preventing the host sites of exfiltrating my name from the Google signin frame. Javascript and browser exploits have a long history. This uBlock Origin rule blocks the popups at least: ##iframe[src*="accounts.google.com/gsi"]

If there was a bug that let websites read from unrelated iframes then they could just open the iframes themselves.

X-Frame-Options and cookie access rules would help protect against that a layer beneath Javascript. I get your point that ultimately any security breach can escalate to full-on compromise of all personal data. I still find it playing with fire to have completely unrelated sites having my name inside an iframe.

Re: Don't use third party auth to sign in

#136

I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…

One aspect might be that the part of the legal system that would deal with this is assuming that the parts that deal with fighting with monopolies, lobbying and regulatory capture are working just fine ?

Re: Don't use third party auth to sign in

#137
post #64

Good point, but if Google suspends my account I've got bigger things to worry about than the dozens of sites I've used once or twice a year. Paying for your own domain also comes with its own troubles. If you're not using Google (or some other service) as your mail forwarder, good luck being able to email anyone. Stealing you custom domain is also a real possibility, and negates your investment in Gmail 2FA.

How could my domain be stolen? :O

So many different ways domains are stolen. Or you lose your domain: UDRP, social engineering at the registrar, hack into the account at registrar, the email you use on whois record isn’t valid anymore, you have auto renew turned off and it doesn’t renew.

Re: Don't use third party auth to sign in

#138

I'm honestly not sure where we went so wrong as a society so as to reach this point. Whether it's overzealous AI or the AMPification of the web. Google act with impunity and without remorse, every action designed to further their goals and agendas without respect to humans caught in the crossfire. If Google can, without due process and fair warning, remove your existence then this is a power that should be delegated…

Legal services can get involved just fine if you file suit. You'll just have to establish that Google owed a duty to you (by contract or otherwise) and that you were harmed by their breach of that duty. (Roughly. I am not a lawyer.)

Has this ever been done successfully in this situation?

Re: Don't use third party auth to sign in

#139
post #110

> Every respectable service allows you to create accounts using your email address This way I should maintain my own email server, because I can be locked out of my email by any of cloud providers as easy.

Would(n't) just having your own domain and pointing it at an email server one doesn't directly manage work?

True, but then again you never really have "your own" domain, you have use of it as long as the leasing corporation grants it.

Re: Don't use third party auth to sign in

#140
post #119

There does seem to be a need for Google to clarify their rules for "banning" an email used for sign-in. It seems like things should be more granular, such that being banned on YouTube doesn't make your thermostat quit working, ruin your phone contacts/photos/etc, or cut you off from your unspent AdWords funds.

It's worse than that : considering the importance that YouTube has taken, for some people being banned from YouTube might be considered to be akin to be banned from exercising their profession, or even just be able to be a full-fledged citizen.
Post reply on HN