It’s such an obvious trap but it’s convenient and convenience is the only thing anyone cares about.
I’m gonna say I told you so in a few years. Nobody will care.
Identity is next. I think they'll start tying your Google, Apple, etc. account back to your real world ID. It'll be opt-in and they'll give some kind of sucker's reward for it like reduced captchas. It'll be sold to the public with the insinuation the "good guys" use verified IDs and the "bad guys" don't.
> I’m gonna say I told you so in a few years. Nobody will care.
Yep. Auth, identity, etc. are going to get sucked up by big tech and even after it happens we'll have people on HN telling us how awesome it is that we don't have any control over our digital lives because Google, Apple, etc. are "protecting" us. Case in point, the iOS app store.
Passwordless tied back to biometrics is their endgame IMO.
(I'm not even religious, but stuff like that really makes me wonder if Big Tech is taking inspiration from there, like they seem to be doing with 1984 and other dystopian fiction.)
The UK government were going to delegate their age ID system to the porn industry.
Can't say I have ever used Google, Microsoft or Apple ID beyond their own gardens it fills me with ick.
I recently stumbled upon this documentary[1] again, and it took me a while to realize I had seen it already a decade ago.
In 2023, the whole video serves as an "I told you so", and you're right, nobody cares.
[1] Panopticon (2012): https://www.youtube.com/watch?v=FUyB0Tsj6jE
You answered your own question. This is an issue with the app creator not supporting multiple providers, not with OIDC.
> there's nothing stopping me from automatically migrating every Google user to a local account pre-populated with their Google claims
I wonder your user retention would look like in that situation.
That's why you should always provide multiple method of authentication.
A simple way is fetching your user email from the OIDC provider, then use it for username/password authn. It's less convenient, but it prevents user from being locked out in case something's wrong with OIDC.
The original vision for OpenID was for users to own their identity. They could choose their identity provider (including self-hosted) by providing a URL. But it got distorted into Google/MS/FB/Apple owning your identity.
But logging in with a URL was unfamiliar to users and it was easier to click the Google button.
It is so sad that this vision got so distorted by corporate interests into delegating to MS/FB/Google/Apple.
Well really, the proper body to issue (digital) identity is the government, which already issues driver's licenses, passports, etc. Google and Microsoft aren't the best bodies to issue identity, they're just the ones that are picking up the ball when the public body best positioned to do so is inactive.
OIDC doesn't increase lock in.
Before, I had to (for example) generate AWS credentials, download them, and store them in GitHub Actions.
But now, I can have GitHub Actions be directly authorized to access resources in AWS.
The only "lock in" is that these two services support an open protocol that would be minorly annoying to give up.