Don't Sign in with Google(twitter.com) |
Don't Sign in with Google(twitter.com) |
Does make me think that there should be regulations about support to prevent this sort of thing though. Maybe at the very least there should be a mandated reason for banning/deleting an account and an appeal process with an actual person on the other end. Yes people might use it to figure out how to 'abuse' the system. But that's life. We don't hide the laws so the only way people know what's legal and what isn't is to get arrested for breaking them.
I do wonder what the solution to number 3 is though. Feels like an issue with services using Google login, not Google itself. If you registered with an email and that domain expired, someone could also reset the password for much the same effect. Short of Slack and the like asking you some sort of security question upon logging in each time, I'm not sure what a good solution would be to fix this sort of flaw.
And we definitely need to make it clear that there's no such thing as "too big to care about customers/obey the law". If your business is 'too big' to offer any customer support, then that's your problem to fix, not an excuse for not offering it at all.
I lost access to literally nothing! SSO binds your email address as the primary account idenitifier in all known to me services. Does not matter what IDP you use to “sign in with”.
I find this twitter thread misleading. Unless the affected account was using @gmail.com as their primary identity.
Buy a domain and set up email on custom domain. backup emails periodically outside of the provider to be able to switch easy if needed. Same applies to other data stored in SAAS of any kind. This is the rule of thumb if the risk of losing access to tour primary IDP is critical.
Assess the risk and act accordingly.
Do you mean that you're setting up SAML/OpenID for every service you use?
> Does not matter what IDP you use to “sign in with”.
I don't understand. The service provider needs to check the identity of the IdP, or IdP-B could impersonate user alice@foo belonging to IdP-A
sure i could buy a custom domain and host an email server on it, but now i have to care about server maintenance, SSL, and paying yearly for the domain. but that doesn't mean i get to keep it forever! just as Google can, the hosting provider can block my account, or even go down itself. then what? i'd be in the same situation where i'm locked out.
or suppose i don't have money to pay for the domain (which is a rare possibility, but it is not impossible). now someone buys my domain, and registers an email with the same address as mine. now what? i'm screwed!
i agree that having only one centralized login method for all of one's accounts is bad, but this article doesn't provide a safe alternative.
But also lots of negatives to start the sentence, usually with a reinforcement e.g.
your password didn't help. your 2fa didn't help. you were never asked to authenticate. you were asked to authorize. completely different mechanism