164
Why? (quokk.au)
submitted 4 months ago by to c/programmer_humor@programming.dev
36 comments fedilink hide all child comments
 

cross-posted from: https://quokk.au/c/mildlyinfuriating/p/990534/why

How hard is it to implement email verification?

all 36 comments

sorted by: hot top controversial new old
[–] 38 points 4 months ago (1 child)

Because big players (other than StackExchange) never adopted OpenID where you could paste in an arbitrary URL for your identity provider.

Also, OpenID probably shot itself in the foot by using a URL instead of something shaped like an email address, which would have allowed a zero-effort upgrade for the user if an email provider also wanted to offer OpenID.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 2 points 4 months ago*

    Oh that's actually a standard? Scale model website eduard.com (relatively big from Czech republic) have openID and I never really thought to look into what that is. Shame it didn't take off I guess.

    e: I'm not sure if they still support it but it used to be there for sure.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 34 points 4 months ago (1 child)

    I hate this. I don't want to remember which provider I use for each site and I don't want accidentally give too many permissions while logging in. Just give me email and password inputs, don't block password managers and don't force any magick link nonsense and I'm happy. I don't even need passkey support

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 65 points 4 months ago (16 children)

    Google and youtube are the same login though...

    Honestly i like these buttons from a user/security POV as oauth only passes back a "login successful" reply and an identifier to associate an account with. Less PII to spread around the internet.

  • permalink
  • fedilink
  • source
  • hideshow 16 child comments
    •
  • [–] 48 points 4 months ago (8 children)

    This is fine for stuff I don't care that much about, like an account with your hairdresser or a pizza place, but if you tie all your actually important stuff to the same account and you get locked out for whatever reason, now you're locked out of your whole life.

    I prefer unique passwords and a password manager. But you do have to back up the password manager data as well as any data you have with cloud providers.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 42 points 4 months ago (6 children)

    For me the bigger issue is privacy. If you're using Google to log into everything, Google gets to add all of that activity to their profile on you, and track you as you use every website you go to. No thanks. Google doesn't need to know I'm buying a pizza tonight.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 14 points 4 months ago (5 children)

    That is also a concern and why I always default to a separate account even for those things, but I wouldn't assume that data doesn't get sold to Google regardless.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 3 points 4 months ago (2 children)

    I prefer to use different email aliases for everything to mitigate that

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 4 months ago (1 child)

    from what i've read, ALL email ( possible 0.000something tolerance/error ) goes through google's mail-transfer-agents.

    If they want a copy of every email that goes across the internet, they've got the saturation-of-core-servers to have that.

    There simply isn't any way to bypass that.

    on an irrelated note, i wish public key encryption had been normalized, & worked right..

    ( Snowden got stung by a misconfiguration, 1 time, & if geeks get stung, then it isn't ready for normals )

    🙏

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 8 points 4 months ago

    I hate it when it afterwards still prompts me to create a full account, on some badly made sites. Why even allow oauth login if I still have to give you all my personal data...

  • permalink
  • fedilink
  • source
  • parent
  • [–] 7 points 4 months ago* (4 children)

    Are you sure about that? I had my Google account since before they acquired YouTube. During their acquisition and merger, so as to not corrupt or pollute their merging databases I presume, I was forced to pick a different username for YouTube than my Google account, and that still stands to this day, even though both are indeed effectively the same account.. 🤦‍♂️☹️

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 7 points 4 months ago (3 children)

    Google's official MFA app is YouTube, so I assume so. (Every time I login to gmail or google docs, the MFA ping opens YouTube on my phone to approve the login.)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 4 months ago (2 children)

    Uh, okay. My account isn't even registered to a phone number, never has been, and my mobile devices aren't registered with Google.

    I'm currently only signed into Google on my laptop, and if I do happen to sign into another device (which has happened before), Google just drops me an email something along these lines..

    'A new device has logged into your account. If this wasn't you, click here, but if it was you, there's nothing you need to do'

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 4 months ago (1 child)

    check your permissions, & then check, on google, what those perms allow..

    IF you're in Android, not iPhone, THEN there is nothing you can do to block google from knowing your phone-number.

    Whether iPhone users truly have privacy from google..

    i wouldn't bet much on that..

    As former mafia man ( Firenzese, or something ) said:

    once they've got enough all-pervading leverage on you, then you cannot win: the leverage locks.

    I'm misphrasing it, and he was speaking about the mob, but the principle is true, globally not only in the context he was speaking.

    All of surveillance-capitalism is rooted in putting the subjects/serfs in a panopticon, & never letting them out, squeezing them all until the individuals die, being replaced by new inmates, but the population-as-a-whole never would be tolerated to escape..

    Perfect industrialized parasitism.

    sorry about the bitterness: i'm an old geek & had some idea of what good could be done, world-wide, with tech..

    DarkTriad's incorporated-feudalism proved it won, totally, easily.

    🙏

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 4 months ago*

    My Android devices have never been logged into Google, and the tablet I'm posting from has no SIM card, so it has no phone number.

    They have no record of a phone number for me, because I've never signed into Google on any active Android device.

    Edit: I also have Google Play and Services, and most other Google apps disabled. FOSS for the win! They really don't have any phone number for me.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 4 months ago

    oauth only passes back a "login successful" reply and an identifier to associate an account with

    Right, it's a unique login token the website or app uses to ID you, and it keeps you logged in as long as you don't delete the associated cookie. In addition, it can be revoked by you at any time, essentially logging you out (including anyone who may have stolen your cookie and is using it to impersonate you).

    It's better than using the same password everywhere, but not as good as using a password manager with unique passwords for every app and website.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 28 points 4 months ago (1 child)

    No Pornhub option?

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 18 points 4 months ago

    Where humour?

  • permalink
  • fedilink
  • source
    •
    [–] 16 points 4 months ago

    Just one more third party auth bro I promise you'll capture 100% demographic bro

  • permalink
  • fedilink
  • source
    •
    [–] 11 points 4 months ago

    What do they mean YouTube and google are seperate, are they covering the people who haven't migrated their 2005 YouTube account to a google account?

  • permalink
  • fedilink
  • source
    •
    [–] 18 points 4 months ago

  • permalink
  • fedilink
  • source
    •
    [–] 12 points 4 months ago (3 children)

    If you host your own DB of users and passwords you are a target. Offloading it to as many wide-spread oauth providers as possible is a smart move.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 17 points 4 months ago (2 children)

    Tell that to all the people whose google accounts of 20+ years got locked out with zero recourse or warning.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 4 months ago (1 child)

    Um, wait what? I'm in the 20+ year Google category...

    I very rarely use Google anymore, but I do have a Google and YouTube account, plus my EBay account is also tied to my Google account, and I haven't had any such issues..

    So what the hell happened to others? Do you have a brief breakdown, and perhaps an article link or something?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 4 months ago
  • permalink
  • fedilink
  • source
  • parent
    • [–] 4 points 4 months ago

    Nothing could compel me to sign up for shit like this 🤣

    On a serious note, I just recently made some progress in my C skills, which inspired me to for the first time search for "how to make a GUI". No. Just, no. 😵‍💫 I'm glad there's backend and frontend, and those that do fullstack are not of this world. 🥹

  • permalink
  • fedilink
  • source
    •
    [–] 0 points 4 months ago

    Login with vk 💀, already make me think i shouldn't use this service

  • permalink
  • fedilink
  • source
    •
    [–] -1 points 4 months ago* (2 children)

    I like this. I want to be able to quickly test the product and if I like it, I make an account afterwards with my email. So I've recently been trying a lot of API services for various things and being able to test it quickly and then just delete my account. I see that as a win. Should have email also

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 5 points 4 months ago (1 child)

    Why not use a temporary email provider for testing? Click the email verification link, try it out...

    If happy re-register with real email account Else Close the browser tab Endif

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • 123 comments in c/mildlyinfuriating@lemmy.world view that post