Hacker News Reader

Comment by noman-land | Hacker News Reader

To the people using a password manager to store the fact that they used third party login, this is some of the most perplexing behavior I've seen in a while.

It's like storing a photo of gold bars inside your basement safe.

With almost zero extra effort, you could be in control of your own keys. You already have the entire infrastructure set up to do this and all you use it for is a glorified log book?

Can someone explain this?

View on HN

Some platforms only support SSO. There will be Google, Apple, Microsoft, Discord, and that's it.

The point is that it allows you to remember which provider you used to sign in with and you’re not having to guess whether you logged in with Google or GitHub or whatever else.

If you are already using a password manager, why not login using password? No 3rd party dependency and risk, and no need to remember how you signed in.

That is also my preference. However, that is not the question that is being asked.

I'm not responding to the question being asked, I'm responding to the people answering it.

When I used third party login the whole point was that if I saw it was available, I was sure I'd use it, so I didn't need to store or remember anything. If I tried and it didn't work, I knew I didn't have an account.

So to see these responses was very odd to me.

There are websites not supporting password login. I think there’s a trend of this.

I get that part, but by the time you've set up this reminder, why not go the extra millimeter and actually add a password?

You go from delegating some of the most important elements of your life to a third party who can take your account away at any moment with no recourse (an extremely vulnerable position), to having complete control over all those accounts, with zero extra effort.

It's very confusing.

I suppose there could be any number of reasons. Maybe they were already using SSO prior to using a password manager and it would take more effort than an extra millimeter to switch.

One benefit could be if the site only supports something like username/password with SMS/email 2FA compared to a sign in option using Google/Microsoft/etc that you can use a security key/passkey with.

Reply on news.ycombinator.com