Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't use third party auth to sign in

gurjeet.singh.im

Post reply on HN
Print view View original

161–170 of 544 posts

Re: Don't use third party auth to sign in

#161

Post by nottorp »

_odey wrote: post #59
jsilence wrote: post #37

If Google blocks your account you clearly have done something wrong and rightfully so deserve to be deprived of any web service. /sarcasm

This might sound like sarcasm to us but I've honestly heard people claim this with a serious face, as well as: "I'm not doing anything bad, so they'll never block me". Guess it's not a problem until it actually happens to them.

There were pieces of news about google accounts being blocked for being "associated" with an account that did bad things.

I think most were contractors using both their own accounts and the customer's accounts to put apps in the play store... which will associate you with random people that pay you to make an app, maybe forever?

Re: Don't use third party auth to sign in

#162

Post by daniellarusso »

unnouinceput wrote: post #149
aboringusername wrote: post #144

Earlier quoted context omitted.

Do you not see this as a problem? With the amount of services Google offer, losing them can be devastating; photos, emails, Android backups, contacts and so so much more. This pandemic has been reliant on emails to access services; it's how I get my payslips, talk to my employer, get current information, engage with legal services, and essentially maintain my access to society. Losing my emails would be devastating (…

No, it's not a problem. It's your problem if you become entrenched in their (or Apple's / FB / whatever) services. I have a google account to test my devices / emulators. Never logged in gmail with that account, never will. If they cut it off, I can make another. Same with Apple. I have an Apple free ID for running virtual machines with MacOS / iOS and that's all. I tell my customers to create their own Apple ID and…

I do not have a FB account, but the test accounts I create d got banned fairly quickly.

This was to work on an API integration.

Re: Don't use third party auth to sign in

#163

Post by judge2020 »

IceWreck wrote: post #48
ukoki wrote: post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

You can do this without paying as well. If your DNS provider supports email forwarding you can use that (if it doesnt you can use improvmx free tier) and use gmail's inbuilt smtp server to send emails using your own domain.

Only issue with not using GSuite is that you won’t be able to DKIM sign those emails, although just SPF might be sufficient.

Re: Don't use third party auth to sign in

#164

Post by ethbr0 »

riedel wrote: post #141
ThreeFx wrote: post #131

Earlier quoted context omitted.

Because there is no clear jurisdiction for the web. That's it.

It is already bad, that we need jurisdiction for such things in the web. I think we actually need such things to happen more often, so ppl can finally vote with their fest a long time ago for some freedom against a tiny bit of convenience. I think what we lack is a decent amount of social pressure.

What we need is the largest tech companies broken into smaller pieces.

The de facto monopoly of most of these players exists in their cross-border market share, making enforcement under traditional antitrust law in any one country difficult.

Unfortunately, it's also something of an international zero sum game due to efficiences of scale -- if the US breaks up Amazon, Alibaba gains world market share, and we're back in the same place.

The most effective remedy I can think of offhand is government involvement in a special, independent branch of the company, dedicated to increasing interoperability and exposing services, empowered by legislation.

If we're going to have monopolies, at least they can be open ones. E.g. 18F + Google Takeout, backed up by regulation

Re: Don't use third party auth to sign in

#165

Post by Ace777 »

aboringusername wrote: post #144
Ace777 wrote: post #132

Earlier quoted context omitted.

It's not removing your existence. It's removing your access to all of their services. At every point, google users are asked to acknowledge the EULA and TOS. They're being told that google can stop their service for any reason, including that service not being comercially viable. ( I.E. Any Reason ) Access to google services isn't a right. It never was, unlike the property rights you're drawing a false equivalency wi…

Do you not see this as a problem? With the amount of services Google offer, losing them can be devastating; photos, emails, Android backups, contacts and so so much more. This pandemic has been reliant on emails to access services; it's how I get my payslips, talk to my employer, get current information, engage with legal services, and essentially maintain my access to society. Losing my emails would be devastating (…

I do not. Becoming dependent on a large e-mail provider is only because of continued willful ignorance.

Better education for how digital services work and how to properly handle your digital identity is the right way to handle this. Implementing regulation and cementing the "major" e-mail providers who have the resources to comply will only deepen people's dependence on these corporations.

Re: Don't use third party auth to sign in

#166

Post by Semaphor »

sneak wrote: post #121
holigot wrote: post #117

Earlier quoted context omitted.

Thx for that. Great help for many of us. But why referring to Protonmail and using Fastmail for yourself?

I use different services for different things. I have 3 email accounts at FastMail and 6 at ProtonMail. Also, some of it is inertia: I've hosted the MX for sneak.berlin at FastMail for several years (and have prepaid some time into the future), and have only been using ProtonMail for about one year (and the HOWTO article is recent). The fact that FastMail might be subject to the new Australian crypto key escrow law[1…

> The fact that FastMail might be subject to the new Australian crypto key escrow law

FM is saying it doesn’t affect them, as they are not a secure provider and can already give any information out upon lawful requests.

Do you disagree with that?

Re: Don't use third party auth to sign in

#168

Post by judge2020 »

Jochim wrote: post #127
lovelearning wrote: post #52

Earlier quoted context omitted.

Won't the password reset link of a blocked Google user get emailed to their inaccessible gmail inbox?

I think it's to protect against the Identity Provider revoking access to the service you're dealing with rather than them blocking your account. We saw this recently with "Sign in with Apple" and Epic Games, where Apple denied access to Epic and the accounts that did not share their actual email were effectively lost.

Except that Apple didn’t go through with revoking it:

https://www.epicgames.com/help/en-US/epic-accounts-c74/conne...

> Apple previously stated they would terminate “Sign In with Apple” support for Epic Games accounts after September 11, 2020, but today provided an indefinite extension.

https://www.epicgames.com/id/login

Re: Don't use third party auth to sign in

#169

Post by loginatnine »

I agree with the general premise of this article that gmail/outlook/facebook owns too much power being able to lock you down with no due process.

However, for random sites, entering an email/password worries me because I have no idea how this password is handled server side, is it stored in plaintext or with a weak algorithm? The vast majority here don't care that much because they use a password manager but I'm worried about the ones that don't, they can be impacted if there is a database leak or if the site owner is shady and starts looking through its database for passwords that look reusable and try them on other important website. How easy would it be to set a nice honeypot website that requires a username/password?

A properly set up google sign in makes it impossible to do that at least. Thoughts?

Re: Don't use third party auth to sign in

#170

Post by paulryanrogers »

Technically email becomes the skeleton key regardless. And that is dependent upon at least one third party: domain registrars. And possibly email providers too.

Though the post does have a good point on that non-email auth providers add more risk to the equation.

Post reply on HN