I would like to secure my accounts better, and after reading many articles I still struggle with one decision.
Context Gmail account, with long and strong password + 2fa with security key (Yubikey).
And now, for other websites (shops, social media, etc) is it better to?: 1. Use Google SSO if available 2. Use email/password login stored in the password manager (password manager secured with Yubikey too).
What do you suggest? Why?
Now, as far as Google vs. Password manager on sites that do support it: Google can be convenient, but there is the infrequent, but apparently very real risk of Google locking your account, and through that also locking these other accounts. I'm not very concerned about that risk personally, but I also would be very reluctant to put important accounts like banks and bills on a Google SSO.
To be clear: I'm not a big "google is evil" guy, but "I'm locked out of google" seems to be a regularly recurring story, but it clearly is low frequency. I do know that when things go wrong, Google is often a black box with little recourse or even any way to contact someone there, especially, I imagine, if your account is locked.
I, personally, almost always use a password manager rather than a Google SSO, just because I have it set up an it's almost as easy as the SSO.
Or the very real scenario where you've been using a free Google Workspace account (is that what it's called these days) with a custom domain, and suddenly Google wants to start charging you for it. Meanwhile you've "logged in with Google" using that account across many, many sites and Google hasn't offered anyway to migrate away from that. So you either pay up or lose access to any of those accounts.
2. For accounts on large websites (big targets) use a unique email address that is only used on that website. Obviously passwords should never be reused, which leads to:
3. Password manager. Just do it.
4. Use the highest security options available at each website. If it's just 2FA, do it. Yubikey is great if they offer it.
And if you give up your domain then someone just have to buy it and use the "forgot password" option :D
After that, I was much more careful about where my domain registration emails go.
Leave the automated charge for a backup, but do the important stuff yourself.
Funny thing is that I had a domain with a different registrar about 9 years ago and I couldn't get them to stop mailing me expiration reminders. They kept coming well after I intentionally let the domain expire.
So it is possible that if Google shuts your account, and you migrate your email to a different provider - you will still lose access to your service account.
If your Google account gets suspended for some reason, that will likely take you down for all other Google systems.
You don't want to have your entire universe shut down just because one person out there decided that they didn't like you and complained to Google that you were spamming them.
This kind of thing has happened before, and will happen again. Do you want to take the risk it will happen to you?
SSO to me exists for the sole purpose of keeping you locked into their platform. I have a "professional" email that I previously hosted on google with gsuite. I used that account a few times as SSO.
Now even though I have moved that email off of google, I continue to pay gsuite just so I don't loose access to that account and anything I logged in with it.
I have made every effort to remove google from my life as much as possible, but that account remains thanks to SSO.
Some SSO services don't give you an easy way to change how you login so you could be stuck.
https://www.reddit.com/r/gsuite/comments/s7t45q/g_suite_lega...
https://news.ycombinator.com/item?id=22294159 https://news.ycombinator.com/item?id=2033474 https://news.ycombinator.com/item?id=17745761
You can dig through the rest: https://hn.algolia.com/?q=lost%20access%20to%20gmail
https://news.ycombinator.com/item?id=30401241
https://news.ycombinator.com/item?id=30345201
https://news.ycombinator.com/item?id=29428922
https://news.ycombinator.com/item?id=26061935
https://news.ycombinator.com/item?id=23183821
https://news.ycombinator.com/item?id=22294159
I don't have a google account tied to my android-based phone.
The only drawback I'm aware of is that playstore doesn't work. So I download the apks directly and install that way, for things I can't install via one of the alternate app stores.
* Use your own domain, but don't use Google Domains as the registrar. If Google locks you out, you use everything.
* Don't use Gmail as the admin account of your domain registrar. If Google locks you out, you lose everything. But don't use your own domain email as the admin account of your domain either. It's ok to forward to your Gmail account, as long as you can access the other email account when Google locks you out.
* Don't use Gmail as the contact address of your credit card on your domain registrar. If Google locks you out, you will miss notifications of payment problems.
* Backup your Gmail, Google Drive, Photos, Calendar, Contacts, etc. to somewhere else. I recently purchased a Microsoft 365 account for this purpose, $70/year for 1 TB of storage. Ironically Google is making me spend money on other providers because of Google's complete lack of customer support and their rapidly degrading level of trust.
This isn't quite true. Many sites will allow you to recover your account via email. So even if your Google account is closed there would be a recovery route.
Of course some sites do require the same Google account ID, and once that is closed you are screwed. Oh, and I hope you aren't using a GMail account. Then you are really screwed.
With Google SSO you will always be dependent on their services, if they get down, they get hacked (which is very unlikely at the moment, but things might change) or someone compromises your google account you will be lost.
I'm a very happy 1Password customer, but put in the place of answering what you should really do: self-hosted BitWarden. Geo- and vendor-redundancy, local hard backup.
Whatever you do, don't use the Chrome password manager.
I advise to
- get your own domain for cheap. I have <lastname>.contact for a few $ and I'm happy with it.
- find a trusted email service provider (e.g Fastmail) to host your emails. This allows you to change providers at any time, without the need to inform all your contacts. I just switched from Protonmail to Fastmail and the move took me a minute or two, and I had to do nothing except change the domain configuration and use the Import tool to transfer the messages, calendars and contacts.
- Choose a good open-source synchronizing tool such as Syncthing (fabulous!) and if non suits your needs, fall back onto a reliable cloud service (e.g Dropbox).
- Pick a good, open-source password manager (I use KeePassXC) and sync it across your devices with the tool you just chose. Syncthing is perfect for me because KeePassXC can easily merge any conflict in a single click and I have all my databases available on my devices. You can save them in separate folder if you don't want to have your passwords available on, say, your personal and work devices. Tip: KeePassXC can open and unlock multiple databases at once: https://keepassxc.org/docs/KeePassXC_UserGuide.html#_automat...
The benefit of a password manager is that you can
- track all your account in one place, e.g which address is associated with which service
- audit your passwords (strength, uniqueness…)
- review each entries history (revert to old password, recall old logins…)
- store data related to your accounts (member ID, personal notes…)
- attach files (I'm saving some QR code in my databases, for loyalty card for instance)
- keep misc confidential info such as digicodes, credit card details, Wifi passwords…
I don't know any of my passwords except those of my devices and of my passwords databases. I let the manager generate them for me and make sure I have multiple backups of my databases.
I also use andOTP for 2FA codes, to separate them from the passwords. But andOTP support auto backups so I can quickly restore everything if I ever lose my smartphone (backup secured with OpenPGP, whose password is stored in KeepassXC of course).
2FA is also something I keep thinking about. What if I lose access to my phone? Does it really make logins more secure, considering that all my passwords are uniquely generated for a service? Do I want to do the extra step?
Not just google, do not use any third party authentication (Google, Apple, Facebook, etc) on any account you want to retain. (Apple is perhaps a bit less bad than Google & Faceboook, but you can find horror stories of locked Apple accounts on HN as well.)
When you do that, the account on the other site is tied to your google(apple/facebook/etc) account. If google(apple/facebook/etc) randomly decides to block your account one day for no reason then suddenly you're locked out not just from your google(apple/facebook/etc) account but from all unrelated accounts where you used their login.
So password manager all the way, with unique accounts on every site (and strong long unique passwords of course).
You'll also want to use an email address in a domain that you own, so you can't be locked out of that either.
Main motivation is, that when I switch job I can't accidentally keep access to any tool since my access to the Google work account is revoked.
- Independent user accounts (with a password manager) for personal stuff.
That said, I don't see why you shouldn't do both.
For high-value targets, create a stand-alone account, put password in password manager (preferably offline) and enable MFA. If MFA isn't supported, I would choose another provider if it is really high-value.
There is after all a reason that it’s called 1Password!
I also would enable MFA for any high value targets, so that a password leak alone wouldn't ruin you.
Those people are wrong.
If your email address ends in @gmail.com, then you don't control it, and have committed to tying your identity to Google's whims. And that's okay!
There are certainly some issues with Google unilaterally blocking access to accounts, but (1) this is extremely rare and (2) honestly, you're screwed even if you're using a password manager in that case.
Why? Because "password reset" is effectively SSO tied to your email address. It's just less secure and harder to use.
Seriously – under the covers, OAuth and other SSO flows are virtually the same as the process of opening an email and clicking on the link, except that they've been vetted by security researchers where "reset password" emails are almost never actually secure.
Password managers, for the vast majority of people, are confusing, unreliable, and even dangerous. Backups are hard to manage, and people often get it wrong. Forget your GMail password? Google will accept government ID and get you back in. Forget your password manager's password? Too bad, you're out of luck. The latter is vastly more common than Google blocking people and refusing to let them back in.
To be fair to HN, there are a few good points in the responses here:
- @linsomniac does raise the good point that you're likely to need a password manager in any event, since some sites don't support SSO.
- @jaywalk points out that if you have an email address on a domain that you own, you're not dependent on Google in case they refuse you service. It's worth noting that in this scenario, using Google's SSO is still fine – if they lock you out, you can still access any accounts you used SSO to sign in to by using password reset. I have yet to see a site that doesn't allow switching from SSO to using a password.
One thing to add is that you should never use Twitter or Facebook SSO; if you do, and get locked out of (or want to delete) your account on either service, there's no recourse whatsoever, and there's no way to switch to a password because your account often isn't tied to an email address if you go with Sign-in with Facebook. Same goes for LinkedIn and other similar "Social Sign In" systems.
Some sites don't store passwords very well.
So SSO is a good choice when offered and gives you the ability to revoke sites.