Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't use third party auth to sign in

gurjeet.singh.im

Post reply on HN
Print view View original

51–60 of 544 posts

Re: Don't use third party auth to sign in

#51

Post by sneak »

ukoki wrote: post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

This is such excellent advice that I wrote a detailed step-by-step instruction guide for people that don't know how to do precisely that:

https://sneak.berlin/20201029/stop-emailing-like-a-rube/

It even has special instructions about how to secure the domain registration and DNS accounts. :)

(Don't use G Suite, though.)

Re: Don't use third party auth to sign in

#52

Post by lovelearning »

ThePhysicist wrote: post #35

We also offer multiple third-party signup solutions for our service in addition to "traditional" e-mail based signup. For every service we retrieve and store the users' e-mail address on our server (we also need that to e.g. send out invoices) and enable e-mail based login and password reset/generation by default (you can disable it or add 2FA), so your account will not be lost just because your OAuth provider blocks…

Won't the password reset link of a blocked Google user get emailed to their inaccessible gmail inbox?

Re: Don't use third party auth to sign in

#53

Post by eloisius »

grezql wrote: post #6

Has anyone else noticed random popups on 3rd party websites asking for google sign in? I even used firefox when it happened: https://imgur.com/a/JC52lBV (lequipe.fr) https://imgur.com/a/VSM3Uk9 (reddit.com) https://imgur.com/a/KpVCYBL (medium.com)

I assumed these were using some kind of iframe trickery.

Re: Don't use third party auth to sign in

#54

Post by sneak »

londons_explore wrote: post #28
saagarjha wrote: post #12

Earlier quoted context omitted.

I wonder if Google lets you Takeout if they’ve locked your account…

They do now (although you only have 7 days to do so I think). It also depends on the reason for the block - if for example they suspect you of having illegal content (child porn) in your Gmail, you aren't allowed to takeout it.

That's great news. Facebook and Twitter don't (Facebook as of a few years ago, Twitter as of this year), as I learned the hard way.

Re: Don't use third party auth to sign in

#55

Post by stevekemp »

damnencryption wrote: post #27
stevekemp wrote: post #17

Earlier quoted context omitted.

I pay for gsuite for myself and a couple of my domains. Call it $12/month, because you'll want to setup two accounts: * The admin-user. * The daily/real-user. In my case I have my real account "steve@steve..", and "admin@steve" which is the gsuite administrator. I only login to make changes to the domain setup, never to send/receive email. It's annoying to have to pay for that second user, but I feel happier with the…

Why not me@steve, iam@steve, thisis@steve, thereal@steve or any of the other variants?

I've been using name@name.tld for a long time now, I realize the repetition reads a little oddly but I've never cared enough to switch to anything else.

I guess I should have started using forname@surname.tld to make it all nice and neat, but I've no desire to change now.

Re: Don't use third party auth to sign in

#56

Post by gzer0 »

occamrazor wrote: post #32
saagarjha wrote: post #12

Earlier quoted context omitted.

I wonder if Google lets you Takeout if they’ve locked your account…

If you are in the EU, GDPR says they have to.

The GDPR (in Article 15(4)) states that the right to obtain a copy of your personal data should not ‘adversely affect the rights or freedoms of others’. This means that when responding to an access request, the controller should consider the rights of third parties, such as their data protection rights, trade secrets, or intellectual property rights such as copyright. This could arise, for example, where your access request relates to a record containing both your personal data but also the personal data, trade secrets, or intellectual property of others.

A balancing of rights exercise would need to be conducted by the controller to balance your right of access your personal data as against the identified risk to the third party that may be brought about by the disclosure of the information. The GDPR notes that these considerations should not result simply in a refusal to provide all relevant information, but the controller should endeavour to comply with the request insofar as possible whilst also ensuring adequate protection for the rights and freedoms of others.

Re: Don't use third party auth to sign in

#58

Post by chpmrc »

It’s worth noting that you’ll get the same outcome if you register everywhere with a free Gmail/iCloud/whatever account. The only sure way you won’t lose access is to set up your own domain and use a decent email provider that allows to use it (Yes, ironically even Google Workspace/GSuite).

Re: Don't use third party auth to sign in

#59

Post by _odey »

jsilence wrote: post #37

If Google blocks your account you clearly have done something wrong and rightfully so deserve to be deprived of any web service. /sarcasm

This might sound like sarcasm to us but I've honestly heard people claim this with a serious face, as well as: "I'm not doing anything bad, so they'll never block me". Guess it's not a problem until it actually happens to them.
Post reply on HN