cross-posted from: https://quokk.au/c/mildlyinfuriating/p/990534/why
How hard is it to implement email verification?
Google and youtube are the same login though…
Honestly i like these buttons from a user/security POV as oauth only passes back a “login successful” reply and an identifier to associate an account with. Less PII to spread around the internet.
I hate it when it afterwards still prompts me to create a full account, on some badly made sites. Why even allow oauth login if I still have to give you all my personal data…
This is fine for stuff I don’t care that much about, like an account with your hairdresser or a pizza place, but if you tie all your actually important stuff to the same account and you get locked out for whatever reason, now you’re locked out of your whole life.
I prefer unique passwords and a password manager. But you do have to back up the password manager data as well as any data you have with cloud providers.
For me the bigger issue is privacy. If you’re using Google to log into everything, Google gets to add all of that activity to their profile on you, and track you as you use every website you go to. No thanks. Google doesn’t need to know I’m buying a pizza tonight.
That is also a concern and why I always default to a separate account even for those things, but I wouldn’t assume that data doesn’t get sold to Google regardless.
I prefer to use different email aliases for everything to mitigate that
Yeah, I don’t use this for banks and such.
If you host your own DB of users and passwords you are a target. Offloading it to as many wide-spread oauth providers as possible is a smart move.
Tell that to all the people whose google accounts of 20+ years got locked out with zero recourse or warning.
Where humour?
