Google Login will be mandatory for Firebase accounts | Hacker News Reader

Google Login will be mandatory for Firebase accounts

groups.google.com

73 pointsdinosaurs40 comments

A Google Login isn't as drastic as it used to be. From the FAQ:

> I don't have an existing Google account and I don't want to sign up for Gmail, Google+, or any other Google services. What should I do?

It is easy to create a Google account for any existing email address without tying it to any Google services. It will only be used for identification and login. You can sign up for this "slimmed down" Google account here. You can also create this type of Google account via the existing migration flow on firebase.com.

> A Google Login isn't as drastic as it used to be.

To be fair, it's been possible to create a Google account without Gmail for a long time now. I remember creating one ~7 years ago, back when I ran my own mail server.

although true now, Google has a bad history of trying to coerce you into other services. Youtube/Voice ?

How, specifically, are you "coerced" into those services? Voice and YouTube are owned by Google. I'd expect a Google account to just work on all Google properties, without me having to sign up for each individually.

If you don't want to use those services, just don't visit them. What's the issue?

You really don't remember what happened with the forced merging/conversion of YouTube accounts into G+ accounts, the forced use of 'real names' on YouTube and the changes to YouTube comments? Before the final forced conversion they spent months and months trying to trick people into agreeing to change their account against their will using a bunch of interface design dark patterns.

>If you don't want to use those services, just don't visit them. What's the issue?

A lot of people did leave YouTube because of it, but that means they lost all their playlists and favourites and comments. Also that can't ever repair things for the people who had aspects of their personal lives suddenly exposed by Google sticking their real life identity on their previously pseudonymous YouTube videos and comments.

the forced use of 'real names' on YouTube

How is that possible, considering I'm still called "icebraining" on YouTube, and I never had to associate a real name with my account?

They ended that effort now.

Are you sure your account is not linked to a Google+ account? Then you'd be part of the very small percentage that successfully blocked all the popup reminders and dialogues and thus never complied. For me, that was only possible by blocking the dialogues via adblock, and over times by not login in anymore.

You weren't forced to do anything. They asked you, do you want to combine your accounts? A lot of people just immediately clicked yes without realizing the consequences. To this day I still have my old YouTube account with a username.

I think you might have missed this part:

> Before the final forced conversion they spent months and months trying to trick people into agreeing to change their account against their will using a bunch of interface design dark patterns.

There was no way for me to say "no, I don't want it, stop asking me". And they kept changing the pop-up locations. And once linked, the accounts couldn't be unlinked.

So no, you weren't "forced", but there was some really shady coersion

Does this still have the nasty side-affect of meaning anyone using Google email services can't send you regular calendar invites by email any more?

When I made the mistake of creating a google account using an existing email address, they apparently created a google calendar account for me, and then any Gmail/Google Apps email invites sent to my email address, never reached me, because they would get diverted straight to this Google calendar account I had no knowledge of, or desire for.

Same kind of thing happened to me with google chat, years ago, when it was an xmpp service. They turned it into a gmail account and automatically inserted it into the address book of everyone I chatted with, and it was close to half a year of confusion before I worked out why certain people just couldn't seem to get in touch with me anymore.

It's rather difficult to keep a Google account without it growing Gmail, Google+ and so on over the years. My own Google account was forced to gain a Gmail address by Youtube one day (and doing so really screwed it up, as now all my Google-using friends see my Gmail address as my primary email address).

Context: Firebase was bought by Google in 2014[1]

[1] http://techcrunch.com/2014/10/21/google-acquires-firebase-to...

This only means that the developers have to login with a Google account? Firebase is a Google-owned product, so why would that be a surprise? It doesn't sound like your app's users have to login with Google.

Edit: if you don't want someone telling you how to login, maybe check out Kinto?

http://kinto.readthedocs.org/en/latest/overview.html

I didn't know about this: https://accounts.google.com/SignUpWithoutGmail

Sadly HN's URL trimmer buries the lede here: /SignUpWithoutGmail (see my other comment for where this came from James's FAQ).

Are you on a phone? I don't see any trimming, either logged in or from an incognito window.

Ha, yes sorry about that (I've gotten so used to the new responsive thing I didn't even think twice about it).

Is this the same as Google Apps accounts? I can't sign up to a google account without gmail from an address I previously used for a Google Apps account.

Sure, don't mind.

Firebase has stagnated for quite some time now. Months ago I mailed them about Twitter now allowing email addresses in their Auth but Firebase has yet to catch up. This means you cannot get email addresses of users signing up via Twitter. They suggested I manually ask the user to type it in, which obviously defeats the purpose of OAuth.

A request has been pending for over a year to add the client IP in their ServerValue response which is a common security ask but the boilerplate response of we're working on it has got no traction.

They still don't have a password reset email template so you must use the forgot pass template.

Even so, their forgot password mail adds the username in the URL. If like me, you use the email address as the username this won't work. That's because they don't encode the email address in the URL. I brought this up months ago, they acknowledged the bug and then suggested I manually ask the user to type it in. This still doesn't work.

There were some other issues but I gave up on the service.

I really hope that the next generation of companies founded and run by people who grew up being on the other side will refrain from making this kind of decisions.

Straight from the link:

I don't have an existing Google account and I don't want to sign up for Gmail, Google+, or any other Google services. What should I do?

Why do you object to this decision?

If I'm building a service that needs an account system with 2FA, detection of automated attacks, and some decent amount of internal security, I am surely not going to build it myself. It is just like rolling my own crypto in all the wrong ways.

There are a couple of providers that will do this for me, for free: Google, Facebook, Twitter, Amazon, and GitHub come to mind. Each has some tradeoffs of public perception, losing audience members who refuse to have an X account, etc., but it's mostly a tossup. For a technical service like this I might have gone with GitHub, but if they're owned by Google, having only Google logins seems like the right choice. (Among other things, you already have a Google account in a sense when using Firebase, it's just run by a separate team at Google.)

Sandstorm, a project that encourages you to self-host all your web services, came to the same conclusion:

https://github.com/sandstorm-io/sandstorm/issues/150#issueco...

Is there a better third-party alternative here, or a way to do this securely and easily yourself that I'm missing?

I already have a Firebase account setup with my work email address. So you are implying that having a Google account is required for 2FA?

To be fair, that issue is really old and Sandstorm now supports other forms of login. :)

This announcement is about the developer login, not the user login.

Firebase apps can keep on logging users in via github, facebook, many others, and yes also google. It's up to the firebase dev to config that.

There are numerous existing authentication and authorisation layers/tools available that already support things like rate limiting, locking on X failed attempts, etc.

There are also numerous existing open source TOTP/HOTP 2FA systems.

Yes, you will likely need to do a little work to make things work together - but you are a software developer.

Using these existing systems is not like rolling your own crypto, it's like building your app on top of an open source crypto library.

Why should a company use a disparate number of login systems for their various products? Having a login system for each and every product is a huge liability, as you then have to either roll out code amongst several different systems, or you have to continuously audit several different codebases, all of which function in the same exact way.

I was gonna write a long post about how Google just doesn't get it, but I think I give up.

The 4th most valuable company in the world after only 17 years "doesn't get it"? Yes, you should give up.

I would have much rather you written the long post than this useless short post.

I think it is pretty fucked up that google is bundling their free email, storage and suite of office products with their free/low cost nosql database.

There just aren't any noSQL options out there right now.

> If your team does not already use Google products, you can create a "slimmed down" Google account using any existing email address here. This Google account won't be tied to any Gmail, Google+, or other Google products.

> that google is bundling their free email, storage and suite of office products with their free/low cost nosql database.

They aren't.

Next time you should read the article before posting.

I think it is pretty fucked up that people expect Google to continue to give away free hosted databases and complain about having to use Google's account system to login.

I think this is facetious but I don't really get it.

I think it's pretty fucked up you didn't read TFA.

"I don't have an existing Google account and I don't want to sign up for Gmail, Google+, or any other Google services. What should I do?

"whoosh"

[hint for ESL folks: the adjective "free" used twice]

Haha and people ask why I use satire tags when it is "obvious". Also, a good hint was the lack of noSQL options in the marketplace....

Reply on news.ycombinator.com