I don’t use Google mail or search, and I avoid as much use of Google as possible due to their pervasive tracking and advertising. I have one Google account that I use for YouTube in a private window, and nothing else. I will not tie my non-Google email address to my Google account as I don’t want Google to create an association between them.
Can you please offer a login strategy that does not involve Google?
Hi jaded,
Thanks for the post. We’re absolutely interested in hearing about which login providers our community would be most interested in us supporting, as we do plan to add more options in the future. Are there any particular providers that you’d prefer we support, or you just looking for an option to register an account and log in with it?
We appreciate the feedback, and we certainly understand that alternatives are desired right now. I’ll make sure the need is heard internally.
@ShawnBoyle
I’m glad to see PurpleAir acknowledging that alternatives to Google authentication are needed. However, this issue goes considerably deeper than offering customers a choice of login providers.
I’ve owned and operated PurpleAir sensors since 2018, contributing environmental data to your public network for nearly eight years.
My sensors were registered using my personal domain email address, which I still own and actively use.
Following PurpleAir’s authentication changes, I can no longer access or manage my own sensor through the account and email identity I’ve used for years.
I received no notification warning me that this change would affect my access.
I even reluctantly attempted to accommodate your Google authentication requirement, but that still doesn’t give me access to my existing sensor.
This is equipment I purchased, installed, maintained, and contributed data from for years. Why should I now have to contact support to regain access to something I already own?
I contacted PurpleAir support requesting an ownership email change. Nearly two weeks later, I’ve received nothing beyond an automated acknowledgment.
Yet I see PurpleAir staff responding to public forum discussions within days.
That is extremely disappointing.
As for your question about alternatives, why not support email-based authentication using one-time verification codes, magic links, or passkeys? These are well-established, secure authentication methods that don’t require customers to associate their personal identities with Google.
More importantly, what is PurpleAir doing to restore access for existing customers who were effectively locked out by this transition?
I shouldn’t need to register my existing sensor again, reset hardware, or change my personal email identity to accommodate a decision PurpleAir made.
I have supported this community for years because I believe in the value of accessible air-quality information.
But that goodwill is rapidly disappearing.
I’d appreciate a substantive response addressing both the authentication alternatives and the immediate problem facing existing sensor owners.
@Yollennium, first and before anything else, thank you for being such an active and contributing member of the PurpleAir community since 2018. We’ve responded to your email, and we’re sorry it took us so long.
The short answer to your main concern:
Google sign-in has been around for quite some time, though it wasn’t our most commonly used feature. Before these recent features, it was mainly used to view private sensors on the map. You don’t need to sign in for that, though. The links in your registration confirmation email work without it.
Email sign-in was prototyped as part of our recent site changes, but we decided to give it a dedicated release so it gets the in-depth care it needs. We take security very seriously, and it matters even more now that AI tools help people find vulnerabilities faster than before. Your suggestions of one-time codes, magic links, and passkeys are the kinds of approaches we’ll be weighing as we build it.
Personally I only use local credentials. I broke that rule once and signed up for a Yahoo! account to use with Stack Overflow. That went exactly as one might expect after the massive Yahoo! credentials breach.
However I understand not everyone is comfortable taking on the security responsibilities of hosting their own solution, and might prefer to use a service.
Unfortunately all the inexpensive or free identity platforms available are tied to notorious data collecting companies. And no one hosting a service can afford a dedicated identity provider such as Okta without collecting subscription fees to cover the costs.