Honestly i like these buttons from a user/security POV as oauth only passes back a “login successful” reply and an identifier to associate an account with. Less PII to spread around the internet.
This is fine for stuff I don’t care that much about, like an account with your hairdresser or a pizza place, but if you tie all your actually important stuff to the same account and you get locked out for whatever reason, now you’re locked out of your whole life.
I prefer unique passwords and a password manager. But you do have to back up the password manager data as well as any data you have with cloud providers.
For me the bigger issue is privacy. If you’re using Google to log into everything, Google gets to add all of that activity to their profile on you, and track you as you use every website you go to. No thanks. Google doesn’t need to know I’m buying a pizza tonight.
That is also a concern and why I always default to a separate account even for those things, but I wouldn’t assume that data doesn’t get sold to Google regardless.
Google knows when you use their services to sign in, and for what third party they’re authorizing the requests. The data doesn’t need to be sold back to Google.
I hate it when it afterwards still prompts me to create a full account, on some badly made sites. Why even allow oauth login if I still have to give you all my personal data…
oauth only passes back a “login successful” reply and an identifier to associate an account with
Right, it’s a unique login token the website or app uses to ID you, and it keeps you logged in as long as you don’t delete the associated cookie. In addition, it can be revoked by you at any time, essentially logging you out (including anyone who may have stolen your cookie and is using it to impersonate you).
It’s better than using the same password everywhere, but not as good as using a password manager with unique passwords for every app and website.
Are you sure about that? I had my Google account since before they acquired YouTube. During their acquisition and merger, so as to not corrupt or pollute their merging databases I presume, I was forced to pick a different username for YouTube than my Google account, and that still stands to this day, even though both are indeed effectively the same account… 🤦♂️☹️
Google and youtube are the same login though…
Honestly i like these buttons from a user/security POV as oauth only passes back a “login successful” reply and an identifier to associate an account with. Less PII to spread around the internet.
This is fine for stuff I don’t care that much about, like an account with your hairdresser or a pizza place, but if you tie all your actually important stuff to the same account and you get locked out for whatever reason, now you’re locked out of your whole life.
I prefer unique passwords and a password manager. But you do have to back up the password manager data as well as any data you have with cloud providers.
For me the bigger issue is privacy. If you’re using Google to log into everything, Google gets to add all of that activity to their profile on you, and track you as you use every website you go to. No thanks. Google doesn’t need to know I’m buying a pizza tonight.
That is also a concern and why I always default to a separate account even for those things, but I wouldn’t assume that data doesn’t get sold to Google regardless.
I prefer to use different email aliases for everything to mitigate that
from what i’ve read, ALL email ( possible 0.000something tolerance/error ) goes through google’s mail-transfer-agents.
If they want a copy of every email that goes across the internet, they’ve got the saturation-of-core-servers to have that.
There simply isn’t any way to bypass that.
on an irrelated note, i wish public key encryption had been normalized, & worked right…
( Snowden got stung by a misconfiguration, 1 time, & if geeks get stung, then it isn’t ready for normals )
🙏
Google knows when you use their services to sign in, and for what third party they’re authorizing the requests. The data doesn’t need to be sold back to Google.
I’m talking about when you don’t use Google to login.
Yeah, I don’t use this for banks and such.
I hate it when it afterwards still prompts me to create a full account, on some badly made sites. Why even allow oauth login if I still have to give you all my personal data…
Right, it’s a unique login token the website or app uses to ID you, and it keeps you logged in as long as you don’t delete the associated cookie. In addition, it can be revoked by you at any time, essentially logging you out (including anyone who may have stolen your cookie and is using it to impersonate you).
It’s better than using the same password everywhere, but not as good as using a password manager with unique passwords for every app and website.
Are you sure about that? I had my Google account since before they acquired YouTube. During their acquisition and merger, so as to not corrupt or pollute their merging databases I presume, I was forced to pick a different username for YouTube than my Google account, and that still stands to this day, even though both are indeed effectively the same account… 🤦♂️☹️