Comment by ridaj | Hacker News Reader

Comment by ridaj | Hacker News Reader

<Unpopular :penguin:>

You can get also locked out of your phone

You can get also locked out of the email that you actually use for signing in because you can never remember the password and they stupidly ask you to change it every 6 months with bizarre constraints

You can get locked out of your password manager

You can get hijacked

The business you're signing into can go under

The odds of these things happening are to be weighted against each other

Yes you shouldn't use third-party sign-in for the bank account that holds all your money (though most consumer bank 2-factor authentication mechanisms, sadly, rely on third parties such as phone and email provider)

Yes it's also ok to use third party sign-in for the odd website that you don't care about which somehow insists on asking you to create an account

There are no absolutes in security risk management </>

> The odds of these things happening are to be weighted against each other

Mmmmm not quite -- they have to be weighed against the consequences if they happen. For people who have had a Gmail account for over a decade (almost 2), they've probably got most of their life connected to it -- losing the account then is tantamount to a huge chunk of your life being erased. Photos. Conversations. Access to dozens or hundreds of other websites.

Basically all that'd be left is your physical ID, your bank account and you get to start over from scratch.

And while all of the above can happen, many things on that list are under your control: losing access to your Google account (usually) isn't.

You're quite correct there are no absolutes but the problem is, when the consequence of something happening is extreme, the level of effort you put in to protect yourself from it must be equally extreme: to the point that it's generally good advice simply not to use 3rd party auth at all.

I no longer do. I use email/password or OTP whenever possible. Sites that insist I use social login are sites I don't sign up with.

Reply on news.ycombinator.com