Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't use third party auth to sign in

gurjeet.singh.im

Post reply on HN
Print view View original

41–50 of 544 posts

Re: Don't use third party auth to sign in

#41

Post by lucb1e »

saagarjha wrote: post #12
0-_-0 wrote: post #9

Earlier quoted context omitted.

For that you have this: https://takeout.google.com/ You can export all your email in a single .mbox file. This might not work if your account is suspended, but if you set up email forwarding to an alternative address (e.g. to protonmail) that might still stay active so you can transition your addresses.

I wonder if Google lets you Takeout if they’ve locked your account…

Google doesn't let you Takeout when you don't allow Google to track your browser. It will give an error to "please use a device you regularly use" even if you can see in your account that there are no other active sessions that you could possibly make use of. I tried a few hours later with the session still open but no dice. Guess I'll have to find a human to talk to at Google in order to get my data pursuant article 15, GDPR.

I have very little hope indeed that they will let you do a takeout without finding a human to talk to when your account is locked.

For what it's worth, Facebook does let you do this. You login, get a message your account was banned for no apparent reason, and that you can download a copy of your data. Unfortunately it's broken (screenshot: https://dro.pm/a.png) but hey, there was an attempt.

Re: Don't use third party auth to sign in

#42

Post by alerighi »

Not really, in a lot of sites even if you sign up with Google you then can do a simple 'reset password' with the email associated with your Google account and set a password.

The real solution to the problem would be a standadized passwordless local authentication for sites, I mean the site uses an API of the browser to auth the user, that way you don't need third parties to authenticate and you have everything in your PC. The W3C is working on it.

Re: Don't use third party auth to sign in

#44

Post by mrkramer »

lucb1e wrote: post #24
mrkramer wrote: post #13

"Never Use Google to Sign-In" he says it as he offers Google Sign-In through Disqus comment section on his blog.

If they had built their own comment section with Google login, that would be weird indeed. But if you just like Disqus comments (they certainly were hot when I actively blogged in 2012) and one of their login options is Google... I don't see the issue there unless they're really pushing you to use it.

Author said "If a website offers you to sign-in using Google (or any third-party service, say Facebook, Github, etc.), don’t use that feature." But he has Disqus comment section which offers login through Facebook, Twitter and Google. I would say that's little bit hypocritical.

The similar thing is when a politician says corruption is bad and next thing you know he or she is involved in corruption scandal.

Re: Don't use third party auth to sign in

#45

Post by lucb1e »

londons_explore wrote: post #21
demadog wrote: post #2

I realized that recently after Gmail locked my account for using email outreach software. I restored it but automatically had to start thinking about a backup plan where I’d have to point my MX records away from Gmail to something else immediately in order to prevent email downtime.

> for using email outreach software. I hope they ban people sending bulk email too... You should send that stuff from your own server or MailChimp etc.

Why is it okay to send bulk mail from service X or Y but not from service Z?

Re: Don't use third party auth to sign in

#46

Post by lucb1e »

damnencryption wrote: post #14
grezql wrote: post #6

Has anyone else noticed random popups on 3rd party websites asking for google sign in? I even used firefox when it happened: https://imgur.com/a/JC52lBV (lequipe.fr) https://imgur.com/a/VSM3Uk9 (reddit.com) https://imgur.com/a/KpVCYBL (medium.com)

Yeah. Reddit is especially really intrusive and annoying. I feel like they just don't want people to use their site anymore. Whenever I open new Reddit, my memory and CPU usage goes up so badly.

Same here, it's painfully slow and I click their search results only when I don't know where else to look. Given reddit's sheer size and popularity in quite a few countries, I wonder how many MWh and CO2e the new version uses and causes.

Re: Don't use third party auth to sign in

#47

Post by robjan »

londons_explore wrote: post #8
ukoki wrote: post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

$6/month doesn't sound like much... Till you realise you'll probably have this setup for 20 years, and suddenly it's $1200. That's a lot to protect against a thing that will probably not happen (account being banned)

There are other options available. I personally don't use it, but Zoho Mail is free with paid plans starting at $1/mo.

Re: Don't use third party auth to sign in

#48

Post by IceWreck »

ukoki wrote: post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

You can do this without paying as well. If your DNS provider supports email forwarding you can use that (if it doesnt you can use improvmx free tier) and use gmail's inbuilt smtp server to send emails using your own domain.

Re: Don't use third party auth to sign in

#49

Post by sneak »

ThePhysicist wrote: post #35

We also offer multiple third-party signup solutions for our service in addition to "traditional" e-mail based signup. For every service we retrieve and store the users' e-mail address on our server (we also need that to e.g. send out invoices) and enable e-mail based login and password reset/generation by default (you can disable it or add 2FA), so your account will not be lost just because your OAuth provider blocks…

That's great, but I'd wager that a majority of users that use Google login are doing so @gmail.com, so their email address is also toast if their Google account is suspended.

I suppose you, as a site operator, are doing all you can do, though.

Re: Don't use third party auth to sign in

#50

Post by vanburen »

stevekemp wrote: post #17
londons_explore wrote: post #8

Earlier quoted context omitted.

$6/month doesn't sound like much... Till you realise you'll probably have this setup for 20 years, and suddenly it's $1200. That's a lot to protect against a thing that will probably not happen (account being banned)

I pay for gsuite for myself and a couple of my domains. Call it $12/month, because you'll want to setup two accounts: * The admin-user. * The daily/real-user. In my case I have my real account "steve@steve..", and "admin@steve" which is the gsuite administrator. I only login to make changes to the domain setup, never to send/receive email. It's annoying to have to pay for that second user, but I feel happier with the…

It should be possible to enable Cloud Identity Free on your gsuite tenant. So you can use a free identity account for your admin account and only pay for gsuite on your main email account.

https://support.google.com/cloudidentity/answer/7384506?hl=e...

Post reply on HN