Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't use third party auth to sign in

gurjeet.singh.im

Post reply on HN
Print view View original

311–320 of 544 posts

Re: Don't use third party auth to sign in

#311

Post by hombre_fatal »

grezql wrote: post #6

Has anyone else noticed random popups on 3rd party websites asking for google sign in? I even used firefox when it happened: https://imgur.com/a/JC52lBV (lequipe.fr) https://imgur.com/a/VSM3Uk9 (reddit.com) https://imgur.com/a/KpVCYBL (medium.com)

Really the dumbest, most confusing design I've ever seen to make a website seem like it knows who you are when you visit as a guest.

When I first saw it on Pinterest, it took me a moment to figure out what I was looking at as a web developer of 20 years. My girlfriend still didn't get it after I was explaining it to her. How does anyone else have a shot at arriving at "oh, so the site doesn't actually have access to this information that's being displayed on the site."

When I was younger, I thought good UX design was obvious, something all of us had intuition for as users ourselves. All you do is put yourself in the user's shoes and ask basic questions and use basic empathy. Of course, now being in software for so long, I realize it's one of the rarest and most unrecognized skills.

Re: Don't use third party auth to sign in

#312

Post by intricatedetail »

intricatedetail wrote: post #195

This is what happens when you combine greed with lack of regulation. Google should be split into separate independent companies. When company is above the law and too big to fail it means we failed to address it. Write to your local representative and ask them to raise this problem.

Just want to add, this is not capitalism if you have one rule for big guys and one rule for small shops. Small companies cannot afford creative accounting which then finances an army of lawyers and grease for politicians. If a small company pays e.g. 30% of tax it is unacceptable that big boys can wiggle out if it through offshore contraptions. If a company suddenly is in position to game the system and obtain unfair competitive advantage it is when it should be split. Every business should have equal chances and we let companies like Google, Facebook or Amazon abuse their position. It's time to stop it. They need to be split and pay the right tax.

Re: Don't use third party auth to sign in

#313

Post by cle »

bcrl wrote: post #290
blfr wrote: post #225

Earlier quoted context omitted.

Because a house is significantly more important than an email address. I get being extremely online but let's not be silly here. Plus that email/account is hardly even "yours" in a serious way. Anyone on the HN has a very simple fix for all these problems: get an email in your domain and a password manager for all the accounts. There, solved. You could even still use Gmail with their Google Apps, G Suite, Workplace o…

Telecom regulators see fit to make sure phone numbers can be ported from one carrier to another. I fail to understand why the same mandate is not required for email addresses and authentication services. They might not look to be as important as a house, but their loss can still have quite a significant impact on someone's livelihood.

The technical mechanisms for maintaining a stable identity already exist. Why aren't people using them?

Re: Don't use third party auth to sign in

#314

Post by throwanem »

bookofjoe wrote: post #242
anvandare wrote: post #143

Earlier quoted context omitted.

The speed of technological development is faster than the speed of societal or legal development. So yes, right now we've woken up in a world that is not so much cyberpunk as it is techno-feudalism: more and more do you need a presence on the Internet to do things in meatspace... And that presence is by the grace of several feudal lords (Google foremost) - woe betide you should you ever displease them. You do not rea…

See also: Kindle books; movies "purchased" from Amazon, Apple, et al; Tesla upgrades you paid extra for; I could go on....

Kindle books were actually pretty good, back when they could reliably be liberated. Unfortunately, that's no longer the case.

In general, I think that's also a point we can draw from the cyberpunk genre, or maybe from Harry Harrison's old-school prefiguration of it in the Stainless Steel Rat series - the eponymous creature being one well suited to thrive "within the walls" of a society increasingly sclerotized with technocratic bureaucracy, but perhaps equally suited to a life of gnawing through the circumscriptions imposed by competing technofeudalist fiefdoms.

Re: Don't use third party auth to sign in

#315

Post by charles_f »

londons_explore wrote: post #8
ukoki wrote: post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

$6/month doesn't sound like much... Till you realise you'll probably have this setup for 20 years, and suddenly it's $1200. That's a lot to protect against a thing that will probably not happen (account being banned)

Tbh the biggest benefit I see in such setup is the freedom of directing your email wherever you want. I wanted to quit Google 4 or 5 years ago and just having to redirect my domain to a private host rather than having to change my email address entirely is the one thing that made it possible

Re: Don't use third party auth to sign in

#316

Post by gorhill »

greggman3 wrote: post #93
grezql wrote: post #6

Has anyone else noticed random popups on 3rd party websites asking for google sign in? I even used firefox when it happened: https://imgur.com/a/JC52lBV (lequipe.fr) https://imgur.com/a/VSM3Uk9 (reddit.com) https://imgur.com/a/KpVCYBL (medium.com)

Yes and it pissed me off because on mobile it pops up like 0.5-2 seconds late so if you're unlucky you go to click on something and it popups up under your finger and you've suddenly signed up and shared your info with a company you had no intention of ever signing up with. I complained to Google. I have a GSuites domain and I don't want my users to be able to sign up via Google. No resolution. I suggest you all comp…

> I semi worked around it by adding accounts.google.com to my ublock origin block list but about once a month I have to turn it off to allow me to log into Google.

This is where uBO's dynamic filtering[1] is useful, as it allows you to globally block `accounts.google.com`, and then unblock it only for specific sites by overriding the global block rule with a local noop rule.

* * *

[1] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...

Re: Don't use third party auth to sign in

#317

Post by riku_iki »

beagle3 wrote: post #265
pbronez wrote: post #235

Perhaps the courts could be helpful here. A long-established Google account has significant value to the user. If Google terminates such an account, value is destroyed and damages are incurred. You should be able to demonstrate the value of the lost account to a court and demand restitution from the host. If successful, this would impose a cost to Google for shutting down accounts capriciously and incentivize them to…

If successful, google will terminate all free accounts, as will every other free provider (... which will not necessarily be a bad thing)

Free accounts is an efficient way to trace users for their Ads business. No way they will terminate it.

Re: Don't use third party auth to sign in

#318

Post by t0astbread »

Aeolun wrote: post #286
bookofjoe wrote: post #242

Earlier quoted context omitted.

See also: Kindle books; movies "purchased" from Amazon, Apple, et al; Tesla upgrades you paid extra for; I could go on....

I have yet to hear about the first amazon account ban. I don’t think they’re really interested in that, since the accounts are almost by definition making them a bunch of money.

It doesn't have to be an account ban. I've recently started playing games on my old Nintendo 3DS again and discovered that I've lost my Nintendo Network ID password and closed the associated email account. That leaves me in a state where I can't log out of the account on the console without losing the associated digital software licenses.

Not that that's Nintendo's fault but I think something like this will be the fate of every account that's not used, closed or deleted for a long time and owning your data and software possessions would protect against it.

Re: Don't use third party auth to sign in

#319

Post by mistermann »

hombre_fatal wrote: post #302
Aeolun wrote: post #286

Earlier quoted context omitted.

I have yet to hear about the first amazon account ban. I don’t think they’re really interested in that, since the accounts are almost by definition making them a bunch of money.

I'm having trouble understanding your point. Leaving aside simply googling it, surely you can't be saying that because you haven't heard of something, it doesn't exist or isn't a threat or isn't worth any concern.

That exact "logic" is extremely common in journalism, as well as on most social media platforms including this one.

If you think about it, this shouldn't be all that surprising - after all, this is exactly how intuition works, and the human mind runs very much on intuition, people just don't realize it (at the object level).

Re: Don't use third party auth to sign in

#320

Post by okr »

When you use Google or FB or others to sign in, you just get some data, that you can trust.

Internally, on my website, i may have an account, that i then link to this Google or FB account.

1) If Google shuts down an account, authorization might still work for the purpose of logging in somewhere else. Your email might not work anymore, like any other services within Google. But authorization does. That it does not, is an implementation detail.

2) Since internally i have created an account, that is only linked to your Google account, i can always allow you to also login via any other method. Maybe with your facebook account.

3) I think, things will become better. You use your devices to authorize yourself. And i then trust your device. Then there is no 3rd party involved anymore.

Post reply on HN