Hacker News Reader

Comment by calrain | Hacker News Reader

This is why I never use any OAuth/SAML authentication from places like Google, Microsoft, or Facebook when registering with a site.

Always use email address and password (with 2FA where possible) to ensure you have ultimate control over your base account.

If Google chose to just ban my account, the downstream ramifications of me losing access to linked sites that use that account for auth would be very damaging.

View on HN

Wouldn't any sane SSO implementation let you recover and switch to a password simply by proving ownership of the email address via a challenge email?

>If Google chose to just ban my account

This assumes you're using a consumer Gmail account, I guess? If so, yeah, you're SOL. But I think as long as you have your owns domain you should be fine, even if you hook it up to Google Workspace for email, since you can always switch it to another provider. (And yeah, I realize this is not something civilians are likely to be able to figure out / do...)

For the people who know how to do that, they are just not going to use SSO in the first place. They will just use email+password+OTP.

Not necessarily. Speaking for myself, I like the convenience of SSO, and I generally trust Google to keep my account secured more than a random web site (if they even offer OTP!). As long as I know there's an escape hatch.

Same here. I have my own domain set as the main email address of my personal Google account (I have in fact deleted the Gmail one altogether, as I noticed that otherwise some websites would still pick the Gmail address over the custom domain one when using SSO). Not many people seem to know you can do this without Google Workspace, or that you can have a Google account without a Gmail address.

If I ever lose access to my Google account I can just set a password through the "forgot my password" feature (I've noticed this is often also the only way to set a password if you create an account through SSO with some websites, but it does work). The convenience of SSO with an escape hatch as you say.

Depends whether they have an email-centric or SAML-account-centric auth model.

Reply on news.ycombinator.com