Creating a persistent public online identity on an untrusted service at the click of a misleading button? What could possibly go wrong?
What Do You Think about This Seamless “Registering/Login” User Experience?
21–30 of 54 posts
Re: What Do You Think about This Seamless “Registering/Login” User Experience?
#22Something marginally less seamless: try to sign-in to google play console with a user that is not the one currently "syncing" in chrome.
Re: What Do You Think about This Seamless “Registering/Login” User Experience?
#23interesting ... I wonder how this is secured from attacks from the website itself redressing it and/or clickjacking attacks
Re: What Do You Think about This Seamless “Registering/Login” User Experience?
#24I saw this on Zillow and I tracked it down to https://github.com/openid/OpenYOLO-Web or some similar implementation of that protocol. I haven't looked into it yet but I've been intending to figure out how it works and I was surprised I haven't read about it yet anywhere.
Re: What Do You Think about This Seamless “Registering/Login” User Experience?
#25I find it to be intrusive and disturbing. Medium.com does this and I've always hated it. Mediums usage of it actually caused me to switch, on my work computer, from always being logged into Google, to never being logged into my Google account. Now if I have to use one of my companies apps that requires a Google login, I do it incognito. At home, I never browse while logged in, so I didn't ever notice it that much. Us…
God, Medium has the worst login experience of any site I use. What makes them think they are too clever to be usable with a password manager like the rest of the damn internet? I usually just reopen the article in an incognito tab instead of going through their stupid “send me an email!” bullshit login.
Notion.so does the same thing. You can log in with Google or get a magic link.
User/password is an inconvenient method of logging in. True. But it's so common that we have password managers making it convenient again. And supposedly better solution don't have the benefit of that tooling.
Re: What Do You Think about This Seamless “Registering/Login” User Experience?
#26I find it to be intrusive and disturbing. Medium.com does this and I've always hated it. Mediums usage of it actually caused me to switch, on my work computer, from always being logged into Google, to never being logged into my Google account. Now if I have to use one of my companies apps that requires a Google login, I do it incognito. At home, I never browse while logged in, so I didn't ever notice it that much. Us…
Serious question:
Why can't you use CSS to collect the user's email address? Can't CSS blend modes allow you to capture anything that's rendered on the page? Or is that not possible anymore?
Re: What Do You Think about This Seamless “Registering/Login” User Experience?
#27I find it to be intrusive and disturbing. Medium.com does this and I've always hated it. Mediums usage of it actually caused me to switch, on my work computer, from always being logged into Google, to never being logged into my Google account. Now if I have to use one of my companies apps that requires a Google login, I do it incognito. At home, I never browse while logged in, so I didn't ever notice it that much. Us…
Serious question: Why can't you use CSS to collect the user's email address? Can't CSS blend modes allow you to capture anything that's rendered on the page? Or is that not possible anymore?
Looks like it's an iframe if I try by going to medium.com. I imagine getting the contents of an iframe would be a vulnerability and patched if it was a thing (I can't recall this being possible).
Re: What Do You Think about This Seamless “Registering/Login” User Experience?
#28I saw this on Zillow and I tracked it down to https://github.com/openid/OpenYOLO-Web or some similar implementation of that protocol. I haven't looked into it yet but I've been intending to figure out how it works and I was surprised I haven't read about it yet anywhere.
Yes -
https://github.com/zapier/google-yolo-inline
But it seems the page for one tap - https://developers.google.com/identity/one-tap/web/ - is no longer a thing; the the only solution for "web" experiences is the "sign in/continue with google" javascript client that does the pop-up, eg. https://doodle.com/login.
Re: What Do You Think about This Seamless “Registering/Login” User Experience?
#29Earlier quoted context omitted.
God, Medium has the worst login experience of any site I use. What makes them think they are too clever to be usable with a password manager like the rest of the damn internet? I usually just reopen the article in an incognito tab instead of going through their stupid “send me an email!” bullshit login.
Notion.so does the same thing. You can log in with Google or get a magic link. User/password is an inconvenient method of logging in. True. But it's so common that we have password managers making it convenient again. And supposedly better solution don't have the benefit of that tooling.
I feel the same way you do. Although I'm just a sample size of one, but I've had zero success in convincing any friends or relatives to use a password manager.
They either don't trust password managers, or don't want to change their current workflow.
They don't seem to care that using a password manger is probably a better solution then using the same password everywhere or writing all their passwords in a little black book.
I suspect that you and I aren't representative of typical users, and that Medium and Notion might actually be acting rationally, trying to act in accordance with the ways the majority of their users want the login experience to be.
Re: What Do You Think about This Seamless “Registering/Login” User Experience?
#30Given that this is a website for medical use, I'm surprised they are allowing account creation with google oauth. I'm 95% sure it's not HIPAA compliant.
https://cloud.google.com/security/compliance/hipaa/identity-... - looks like, at least for Cloud Identity (for employees accessing the internal records and databases themselves) - it's HIPPA compliant when the people implementing it do their DD. Since GSuite and Gmail logins are fairly tightly integrated, I would bet the regular auth system and oauth system for Google accounts is HIPPA-complaint.