A few years back, large cloud services like Google and Facebook, began allowing other websites and services to authenticate new users through their websites. OAuth, which stands for Open Authorization allows signing in to services such as Zoom, without setting up a new account; instead, it uses Google ID or Facebook login information.
Many find this convenient, as it helps them avoid creating yet another new account username and password. But is it a good practice, or does it leave you more susceptible to an account breach?
How Does a Single Solution Log-in Work?
When you choose to create an account on a 3rd party website using your Facebook or Google ID, your basic account information (name, email, etc.) is shared with that website to create your account.
Choosing to use a single “log-in with” option will direct you to a login prompt where you log in to your Facebook, Google, Apple, or other social media account (if not already logged in) rather than using the site’s login page.
This authenticates you as a valid member of that website and then redirects you to your account on the 3rd party service.
Let’s go through the pros and cons of using the “log-in with” option below, so you can make an informed decision about whether this is a good alternative for you or your company’s employees.
Pros of Using Login With Facebook/Google
One Less New Password to Remember
People now juggle an average of 100 passwords for various personal and work accounts. A big benefit of using an already existing account to gain access to a 3rd party site is that you don’t have to make another password.
You can streamline your logins and reduce the need to create and manage another account login.
Faster New Account Setup
You can skip certain account setup questions when you choose to log in with an existing account. For example, you don’t have to spend time putting in your name, email address, or uploading a profile picture.
If you’re already signed in to any of your accounts, the setup is even faster. You can gain access in seconds as soon as you log in, avoiding the hassle of doing this for every website you encounter.
Information Syncs Between Accounts
We all get new profile pictures from time to time and want to update our photos on all our cloud accounts. When you connect a 3rd party service to your Facebook or Google profile, a benefit is that your profile picture and other data sync automatically.
Cons of Using Open Authorization
Breaks an Important Rule of Password Security
One of the cardinal rules of password security is to create unique passwords for each account that you have. This helps prevent several accounts from being compromised if just one password is breached.
When you connect other 3rd party accounts to your cloud service accounts, they are sharing that same password. This can leave you more susceptible to having your account compromised.
If a hacker gains access to any of your various accounts, they can look in your settings to see what other apps are connected. This gives them a roadmap as to other accounts they now can easily get into.
You Set Up a Single Point of Failure
In the Fall of 2021, there was a major outage that shook the internet. Facebook was down for nearly 6 hours and users were unable to access their information.
When you create accounts through your Apple ID or Gmail, it leaves a risk of being locked out of those connected websites in the event of an outage.
Because it relies on the main service being up to authenticate your login, if that service isn’t available, then the 3rd party service can’t authenticate you as a user and grant you access.
As we’ve seen from the Facebook outage, large cloud service providers can and do have extended outages leaving you open to a single point of failure if you connect 3rd party accounts to Facebook, Google, or Apple.
Your Data May Be Shared in Ways You Don’t Realize
When you connect other services to your various accounts, there is personal data that can be shared.
The more data that is shared between services, the more at risk you are of that data ending up in the wrong hands.
Here are a few examples of the kinds of data that can be used by 3rd party services you connect to your personal accounts:
- Uber can access your Google Wallet
- Trip Advisor can access your Facebook Friends list
- Doodle can access your Google Calendar
Get Help with Password & Data Security to Reduce Risk
Twin State Technical Services can help your Quad Cities area business with cyber security solutions to keep your passwords and data secured and mitigate the risk of a breach.
