News for hackers. Stuff that matters.
Re:Ask HN: Developer abused “sign in with GitHub”? by Krisjohn on Friday December 09, 2022 @02:20AM (#33918590)
"Sign in with X" buttons all suck anyway. Why lose access to just one account when you can lose access to dozens? Use a password manager.
Re:Ask HN: Developer abused “sign in with GitHub”? by heleninboodler on Friday December 09, 2022 @03:41AM (#33919072)
Agreed wholeheartedly. It has been a long time since I've run into a site that doesn't have an "or sign up with your email address" option, but whenever I do, I just decide not to bother. I don't really want any of my accounts tied to each other if I can help it.
Re:Ask HN: Developer abused “sign in with GitHub”? by SamBam on Friday December 09, 2022 @09:42AM (#33921669)
If you use gmail, is "Sign in with Google" tying accounts together any more than "or sign up with your email address"? Don't they both mean you're relying on your google account/gmail address existing?
Re:Ask HN: Developer abused “sign in with GitHub”? by heleninboodler on Friday December 09, 2022 @02:22PM (#33925424)
I use my own email domain.

I do wonder if it would be useful to use my Auth0 personal account for this type of thing on sites that support it instead of using email login. I think a dedicated identity provider might be less risky in terms of random account freezing. Google, Microsoft and Github probably have a zillion ways (valid and invalid, accidental or not) you can violate TOS because they all own platforms for publishing content. A dedicated identity provider might be safer in that regard.

Re:Ask HN: Developer abused “sign in with GitHub”? by mcv on Friday December 09, 2022 @03:26AM (#33918974)
And more importantly: sites shouldn't require an account for things that don't require an account. I don't want to make an account just to read free content, download free software, or buy something.

Accounts are only necessary if I actually have to maintain content on the site, or specific permissions are tied to my account.

Re:Ask HN: Developer abused “sign in with GitHub”? by yreg on Friday December 09, 2022 @03:44AM (#33919095)
Mostly agreed, but I like to use them in cases when I'm fairly convinced that I'm using the service as a one-time thing to throw away anyway.

What makes me unhappy are the services that don't support non-oauth accounts at all, e.g. ProductHunt.

Re:Ask HN: Developer abused “sign in with GitHub”? by hardware2win on Friday December 09, 2022 @05:21AM (#33919732)
Uh?

You have one account with stronger sec. Like 2fa instead of 10 random accounts without 2fa cuz you dont want to give ya phone number to untrusted ppl

Re:Ask HN: Developer abused “sign in with GitHub”? by ThunderSizzle on Friday December 09, 2022 @07:42AM (#33920603)
2FA isn't the end all be all if it can lock me out by losing a device or an arbitrary number I dont actually own (e.g. sms 2fa)
Re:Ask HN: Developer abused “sign in with GitHub”? by _Algernon_ on Friday December 09, 2022 @06:47AM (#33920260)
With a password manager, keeping track of 10 passwords is barely any more effort than one user account. Same thing is true for 2fa secrets.
Re:Ask HN: Developer abused “sign in with GitHub”? by itsacomment on Friday December 09, 2022 @07:21AM (#33920462)
Use authenticator apps or things like yubikeys for 2fa, using your phone number is not a security benefit but an exploit waiting to happen at this point.
Re:Ask HN: Developer abused “sign in with GitHub”? by lzaaz on Friday December 09, 2022 @05:37AM (#33919834)
And the day the "master" account gets suspended or compromised you lose access to 10 other accounts. No thanks.
Re:Ask HN: Developer abused “sign in with GitHub”? by aftbit on Friday December 09, 2022 @10:46AM (#33922555)
Literally impossible on the given website. It only supports "Sign in with Google" (now). I won't be testing it out for exactly that reason.