My recent YouTube "support" experience was eye-opening. I take what I believe to be reasonable steps to protect my online identities. And none are as important as the one that's tied to the YouTube channel I almost lost because of Google's incompetence. So I can't say I learned anything per se, it's not like I could have done something better that might have prevented this. Instead, this episode undermined my trust of Google, perhaps irreparably. And this has me questioning everything.
Of course, "everything" is a big topic. So I will focus here on a single question, one we've not really discussed before. It's tied to a feature called Sign in with Google. And I'm not sure whether it's smart to use it.
That may be the most important point I can make. I'm not sure. But I'm trying to find out. And I'm curious what others think about this.
First, a bit of context.
Online accounts are unavoidable. Everyone reading this probably has hundreds of online accounts, including many they've forgotten about. But some online accounts are more important than others. Some online accounts are online identities that store or provide access to private data, payment methods, and other sensitive information. For example, Amazon, Apple, Google, and Microsoft accounts.
These are all important, and they need to be secured properly. They often aren't, of course, because many people choose convenience over security. But in my case, I do what I can. I use various forms of multifactor authentication with all of them, preferably passkeys or some other passwordless authentication type.
Google is semi-unique in this space, however, because of the pervasive nature of Sign in with Google. Yes, it's possible in some cases to sign in to third-party sites and services with an Amazon, Apple, or Microsoft account. But Google is far more common. It's all over the web.
And for all my research and learning about security best practices, I'm human, and can be lazy, and I often select the "Sign in with Google" option when it comes to accessing some third-party site or service, especially if it's something new. In my defense, my Google account is well-secured, so I'm balancing my laziness with the understanding that the passkey authentication I use is solid.
But there is a less well-understood benefit to my Google account that many do not share. My (primary) Google account is part of a custom domain, Thurrott.com, that I manage with a paid Google Workspace subscription. So I "own" the email address in the sense that I could recreate it elsewhere if I needed or wanted to. You can't do that with a (your-name at) gmail.com account. If Google pulls the plug on that, it's over.
Owning the domain is good for my identity, but it doesn't solve all the problems such a change might create. For example, I sign in to whatever number of third-party sites and services using Sign in with Google. If I were forced to move Thurrott.com to some other identity service, what would happen to all...
With technology shaping our everyday lives, how could we not dig deeper?
Thurrott Premium delivers an honest and thorough perspective about the technologies we use and rely on everyday. Discover deeper content as a Premium member.