Live data from Hacker News

Don't use third party auth to sign in

gurjeet.singh.im

61–70 of 544 posts

Re: Don't use third party auth to sign in

#61
Good point, but if Google suspends my account I've got bigger things to worry about than the dozens of sites I've used once or twice a year.

Paying for your own domain also comes with its own troubles. If you're not using Google (or some other service) as your mail forwarder, good luck being able to email anyone. Stealing you custom domain is also a real possibility, and negates your investment in Gmail 2FA.

Re: Don't use third party auth to sign in

#62
post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

For those that don't want to pay, Yandex allows you to set up a number of emails using your own domain for free.

Re: Don't use third party auth to sign in

#63
post #46

Earlier quoted context omitted.

Yeah. Reddit is especially really intrusive and annoying. I feel like they just don't want people to use their site anymore. Whenever I open new Reddit, my memory and CPU usage goes up so badly.

Same here, it's painfully slow and I click their search results only when I don't know where else to look. Given reddit's sheer size and popularity in quite a few countries, I wonder how many MWh and CO2e the new version uses and causes.

Also battery degradation.

Re: Don't use third party auth to sign in

#64

Good point, but if Google suspends my account I've got bigger things to worry about than the dozens of sites I've used once or twice a year. Paying for your own domain also comes with its own troubles. If you're not using Google (or some other service) as your mail forwarder, good luck being able to email anyone. Stealing you custom domain is also a real possibility, and negates your investment in Gmail 2FA.

How could my domain be stolen? :O

Re: Don't use third party auth to sign in

#65
post #5

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world. Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email acc…

For those that don't want to pay, Yandex allows you to set up a number of emails using your own domain for free.

The only thing worse I can think than having Google read your email is having Yandex read it.

Re: Don't use third party auth to sign in

#66
Remember OpenID? Yes, that's what it was for, OAuth wasn't never meant for signing in other websites who just want your mail or something... Of course, all these big tech corps quickly dropped OpenID, they don't want people to control their online credentials or identity...

Re: Don't use third party auth to sign in

#67
post #6

Has anyone else noticed random popups on 3rd party websites asking for google sign in? I even used firefox when it happened: https://imgur.com/a/JC52lBV (lequipe.fr) https://imgur.com/a/VSM3Uk9 (reddit.com) https://imgur.com/a/KpVCYBL (medium.com)

Yes, and it bothers me a lot, even if it's in an iframe, that it has my real name from my Gmail account inside the unrelated third party pages. I do not trust Javascript iframe policies from preventing the host sites of exfiltrating my name from the Google signin frame. Javascript and browser exploits have a long history.

This uBlock Origin rule blocks the popups at least:

##iframe[src*="accounts.google.com/gsi"]

Re: Don't use third party auth to sign in

#68

Earlier quoted context omitted.

$6/month doesn't sound like much... Till you realise you'll probably have this setup for 20 years, and suddenly it's $1200. That's a lot to protect against a thing that will probably not happen (account being banned)

I pay for gsuite for myself and a couple of my domains. Call it $12/month, because you'll want to setup two accounts: * The admin-user. * The daily/real-user. In my case I have my real account "steve@steve..", and "admin@steve" which is the gsuite administrator. I only login to make changes to the domain setup, never to send/receive email. It's annoying to have to pay for that second user, but I feel happier with the…

Are you actually the owner of steve.com? Because I've been ordering Dominos pizza with the email steve@steve.com for years.

Edit: nevermind. I see you own the .net tld. I've definitely used that to order pizza too. Sorry about that.

Re: Don't use third party auth to sign in

#69
post #24

Earlier quoted context omitted.

If they had built their own comment section with Google login, that would be weird indeed. But if you just like Disqus comments (they certainly were hot when I actively blogged in 2012) and one of their login options is Google... I don't see the issue there unless they're really pushing you to use it.

Author said "If a website offers you to sign-in using Google (or any third-party service, say Facebook, Github, etc.), don’t use that feature." But he has Disqus comment section which offers login through Facebook, Twitter and Google. I would say that's little bit hypocritical. The similar thing is when a politician says corruption is bad and next thing you know he or she is involved in corruption scandal.

Disqus offers you sign-in using one of aforementioned services but you don't have to use that feature. You can make an account normally and sign-in using email/passsword. The author says you should prefer the later, not boycott any service offering the former.

Re: Don't use third party auth to sign in

#70

Earlier quoted context omitted.

old.reddit.com.

Use a browser plugin like this to always use the old site: https://addons.mozilla.org/en-US/firefox/addon/old-reddit-re...

Doesn't work on Firefox Android. I never go to Reddit by typing URL; I go to Reddit because I follow a link to it.
Post reply on HN