3

I've been thinking - let's say a user signs up for your site in the "standard" way. That is, they enter an e-mail address, maybe a user name, and a password, and complete the sign-up process. Is it then, security-wise, reasonable to later allow them to log in using Google authentication?

For example, consider the following flow:

  1. Usidore signs up with his e-mail address, usidore@puppies.supplies
  2. Usidore signs out, and forgets about the site for a while.
  3. Usidore, not recalling which sign-up method he used, tries to sign in with his Google account that has the e-mail usidore@puppies.supplies, and is signed in to his original account.

My rationale is that the Google account is (as far as I know) guaranteed to be owned by the person who has access to the e-mail - the user. In case the one who has access to the e-mail is not the user, well... the hacker could perform a password reset anyway, so that shouldn't introduce any additional holes. It might even be more secure than that, thanks to Google's fuzzy anti-hacking logic.

Now, this would probably make it impossible to have +-es in your e-mail address, as Google uses them for a special purpose while other sites don't. Correct me if I'm wrong, though, and there could be a way to make that work.

In any case - would this be secure? Is there something I'm not considering, and it would not be? Would it perhaps only be secure for Gmail addresses for some reason? Maybe it'd only be secure if the user explicitly links the Google account to the site account (but then again, maybe not; I have no idea). I'd love to know.

  • How do you check that Google controls the domain puppies.suplies? If it's an @gmail.com address I'd say it's a good a idea. For other domains maybe not so much. – GnP Dec 18 '16 at 23:16
  • @GnP Well, if the e-mail address is the login address for the Google account, it has to be an address the user has access to, right? I'm certain Google doesn't allow signing up with an outside e-mail without verification. – obskyr Dec 19 '16 at 1:19
1

Yes, many websites do allow this by allowing you to link a local account with the Google Account. You should send email to the old account's email address, requiring a confirmation click/code from that email, rather than requiring/assuming the same email. Security wise, this is no different than a password reset via email.

Next is that you can allow user to optionally disable local authentication and just use Google Account authentication. Give the user the option, as some users may want to sign in to your site using shared/public machines without having to authenticate to their email account so local authentication can still be useful in this case.

When a user is signing up for a new account, you can notify the user that that there is already an account with the same email with a different authentication method. You can then prompt them to sign in or reset the password on the old account to link the account to the new authentication method. For new users, they should also be allowed to create an account with just Google Account authentication, without creating local authentication.

  • I don't think this answers the question. I already know linking with a Google account is secure, as I've seen it in other places - the question isn't just about having multiple sign-in methods, but rather this implicit connection when trying a Google sign-in after creating an account normally. – obskyr Dec 19 '16 at 1:25
  • @obskyr I believe the "send a confirmation email" part does address your question. – GnP Dec 19 '16 at 1:38
  • @GnP Well, it only says "you should" - I don't see any rationale for why, really. Which is why I'm asking. – obskyr Dec 19 '16 at 1:40
  • @obskyr fair enough. I just took it as "this is a change to the login settings and should require special confirmation" but hopefully Lie can elaborate on that. – GnP Dec 19 '16 at 2:00
  • 2
    @obskyr: If you don't send confirmation email, it would be possible for the Auth provider, in this case Google, to lie that usidore@puppies.supplies address as being under their care, and this would allow them to take over any accounts in your system, not just those who used Gmail and Google Apps email. – Lie Ryan Dec 19 '16 at 9:42
-2

I think the more login options, more hacking possibilities. If the user only has one way for login, it can be hacked, but if has two possibilites of login, now there are two possibilities to be hacked, the normal way and the google account which has another different password.

You are right to think that Google has good anti-hacking mechanisms... but you never know. Maybe the user can be hacked on LAN, sniffed or sslstripped or who knows.

In my opinion, login with standard user/password validated by mail is enough. But to put the Google login option maybe is more because other reasons different than security.

  • For most websites, implementing Google Account authentication is likely more secure than local authentication, with much less work. – Lie Ryan Dec 19 '16 at 0:46
  • Well, this is very general... Saying "the more login options, more hacking possibilities" doesn't really help me, sorry - the reason I'm asking is to settle that doubt with logical consideration of the factors at play. – obskyr Dec 19 '16 at 1:21
  • Maybe is not the answer you are looking for... ok, but believe me... the more stuff, more hacking possibilites... that's a real f***ng truth. :) – OscarAkaElvis Dec 19 '16 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.