Hacker News Reader

Comment by jchw | Hacker News Reader

If you use SSO with the account you were going to use your e-mail address with, it makes little difference whether you used OAuth2 vs traditional e-mail based authentication. You're locked out.

If something happens, like OAuth2 stops working, most websites allow password reset to the e-mail address connected to the account, and then can log-in without OAuth2.

The concern here is probably related to some Log-in with Google scripts that run on the frontend, although if they were just using normal OAuth2, then I think they are wasting their time: whatever sensitive information Google gets via OAuth2 they also get via the unencrypted e-mails you're sending to them anyways...

View on HN

No. It makes a massive difference. Even if you're locked out from your email account, you can still login no problem to any website using your username/email and password.

Except those that make you click a link or copy a code from your email if your IP changes

Having goggles oauth doesn't preclude a secondary login method such as username/password.

They just didn't want to support it and found some reason to justify the removal, that's as much as you can get from the given facts

Yes, to be fair, that's still a marginal improvement, assuming you aren't forced to validate your email address at any point, which might be the case for lower security stuff. On the other hand, either way, you can often use an existing session to do the same thing without needing to reauthenticate.

I use a custom domain and forward all mail to a web based email provider for this reason. If my provider drops me, I can move to another and update my forwarding. There’s still a risk I could lose the domain somehow, but I don’t hear about that happening nearly as often.

I do this as well. I encourage people to own their own domain and use that for email; it is more complex to set up, but you have far more control long term.

I do this as well but with anonaddy.com which acts more like a proxy than forwarding. The yearly price is low (something like $12) to use your own domain and much lower than paid email plans.

I have a Gmail rule set up to forward all of my mail to a Protonmail account as a back up. So I can still perform password resets, etc

I'm pretty sure they reject incoming mail when your gmail gets locked. so those forwarding rules will stop working

source?

Whether they reject it or not, it’s less likely they would follow forwarding rules.

Based on what?

If you wanna gamble on this solution, that's definitely your prerogative. I think it's unreasonable to assume that any function of your account will continue to work if it becomes locked, inaccessible, or possibly compromised. A better backup is a custom domain. Which, of course, is not really great with Gmail.

There’s no reason to believe email delivery would stop working just because your account is locked. Such misinformation lol.

Let's flip it around: why exactly wouldn't email delivery stop if your account is suspended or locked?

Because a 3rd party could cause the lock?

Also I have a custom domain, so I don’t consider this a gamble—more of a backup.

Arguably if you can prove to the provider that the email is FUBAR and you own the account, it might be easier for them to change out the email on you. Maybe a good reason to support login via email and / or phone number. If you lose both, you're screwed.

Reply on news.ycombinator.com