News for hackers. Stuff that matters.
Re:Only Persistent LogIn by kelnos on Monday September 26, 2022 @09:52PM (#32990827)
I don't know that all that really makes sense to me.

1) Most people do not have multiple accounts, or at least do not care about those accounts being linked. And if you are in that situation, then you are (hopefully!) already being methodical about signing out and clearing cookies (or using a separate browser profile, private browsing, whatever). And if you aren't being methodical about this, eventually you are going to screw up anyway, no matter what the login flow or session timeout is.

2) Again, if you are worried about this attack vector (and, also again, most people probably are not), then you should be methodical about immediately signing out and clearing cookies when you are finished doing whatever you are doing. Also again, if you are not doing this, eventually you are going to forget, and succumb to an attacker.

3) Absolutely agree, but I don't see what this has to do with the persistent login issue.

4) It is indeed your computer and your data, but it is not "your" account. It is access to a remote computer system that someone else has granted you, and it is perfectly within their rights to decide how that access works. You may not like it, and that's fine: you are perfectly free to use a different service[0]. I think there are many reasons to claim that Google is a monopoly in some area or another, and that opting out of Google isn't feasible for some people, but "I don't like the login flow" is certainly not one of those reasons.

[0] Earlier this year I dropped GMail and moved my mail elsewhere, and I stopped using Google search several years ago. I've also stopped using Google's OAuth service to sign into other third-party websites, and have switched to regular email+password for any sites where I'd already signed up for an account using my Google Account. I'm working on weaning myself off of some of Google's other services, but I will admit this takes time and effort, and I'm not always up for the work involved. But that's on me, not on Google.

Re:Only Persistent LogIn by godelski on Tuesday September 27, 2022 @12:31AM (#32991570)
1) So why force it upon people? Moreso, best privacy policies means you should minimize the amount that the user needs to do. People make mistakes. You're supposed to make mistakes harder to make, not easier. The more methodical you have to be, the less privacy preserving your product is. I'm apologize, but this sounds like gymnastics to justify the outcome. Maybe you don't care about privacy? Maybe you think us privacy concerned people are nuts? But welcome to HN and welcome to the world where data privacy advocates are starting to make wins. But your argument comes off as "well sucks for you, you should have done better." A victim's actions may contribute to the danger they are in, but at the end of the day that's not the issue. The issue is that they are a victim and why this kind of discourse comes off as victim blaming.

2) Again, security practices should simplify not complexify. More complexity less security. Why force this on people? Why victim blame? Try to make fewer victims, not more.

3) Because Google (and others) are using this login method as a means of centralization and standardization. As you are breaking away from Google you're probably seeing that it isn't trivial and that there are a lot of things you lose because of it (despite HN users often saying roll your own email or saying that email is very decentralized). I would argue that Google has some blame for the difficulties to wean yourself off of them. They created a platform with the explicit intent to make it burdensome to leave. That's not ensuring competition is abundant within our communities. (3 is all big picture stuff but this does matter. I have examples if you care)

4) I get your point, but I think there's a middle ground. The bigger problem is that it is difficult to use other services. There are also websites that don't allow me to log in through any other means. (I only use the Google sign-on for a singular website which does this).

I do not feel it is okay to just dismiss these issues outright. I have the right to criticize the framework. You have the right to disagree. Google has the right to ignore my complaints/critiques. But you're not really disagreeing with my comments so much as dismissing them. Effective communication does require us to discuss in good faith with one another.