Google redesigned this screen recently (in the past few months), if I remember correctly? I'm not sure if this is related though.
Tell HN: Google OAuth consent screen issue could be costing you signups
21–30 of 70 posts
Re: Tell HN: Google OAuth consent screen issue could be costing you signups
#22Not to excuse the non-debouncing behavior, but I wonder how much of those 15% are an actual loss, since it’s limited to users who are not interested enough to try a second time. I’m not denying there’s an actual loss, but it may be significantly less than the nominal 15%, and it would be interesting by how much.
Theory of mind error here. If it doesn’t work I may assume their system is down or doesn’t support my browser. Thus there would be no point in trying again, even if I was interested in the product. If it were to work on the second try it’d still be a sour taste - bugs are not a good first impression. At least personally I would have suspected the SaaS company as opposed to Google.
If I was truly interested, I would try again in five minutes or an hour, or from a different browser/device. Errors are caused client-side often enough.
Re: Tell HN: Google OAuth consent screen issue could be costing you signups
#23It's madness to me that people (not OP specifically) will simultaneously say "you have to outsource login to a third party, storing passwords safely is too hard" and... also this. The answer to "what can I do" is "stop depending on a third party service that's critical for your business and essentially trivial to replace".
Login is never "trival" to replace.
IIRC a basic oauth social login implementation is ~40 lines of code (assuming you already have things like json parsing). You need to understand what you're doing to make sure you do the necessary validation (e.g. including the nonce from OP), but the part auth0 is doing for you is pretty trivial.
Re: Tell HN: Google OAuth consent screen issue could be costing you signups
#24It's madness to me that people (not OP specifically) will simultaneously say "you have to outsource login to a third party, storing passwords safely is too hard" and... also this. The answer to "what can I do" is "stop depending on a third party service that's critical for your business and essentially trivial to replace".
There are many reasons one might use a "login with X" flow that have nothing to do with storing passwords
Re: Tell HN: Google OAuth consent screen issue could be costing you signups
#25It's madness to me that people (not OP specifically) will simultaneously say "you have to outsource login to a third party, storing passwords safely is too hard" and... also this. The answer to "what can I do" is "stop depending on a third party service that's critical for your business and essentially trivial to replace".
[dead]
Re: Tell HN: Google OAuth consent screen issue could be costing you signups
#26Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in specifically using Google.
Re: Tell HN: Google OAuth consent screen issue could be costing you signups
#27We use Google OAuth to handle hundreds of registrations each day and haven't encountered this before. No errors, no customer reports. Following your instructions, I logged in to my own Google account, removed the connection to our app (via "Third-party apps & services") and then did the login again: after clicking "continue" the screen changes to "loading" instantly before redirecting after a few seconds. There's no…
Agreed that there's definitely something different in the behavior.
I looked through the HAR files I've captured comparing my company's app to Termly. After clicking "Continue", in both cases there's a redirect to a URL of the form https://accounts.google.com/signin/oauth/consent?as=redacted.... For my company's app, hitting that URL results in another redirect to my Auth0 tenant, whereas for Termly, hitting that URL results in HTML showing the loading indicator (no immediate redirect).
Why the difference? As you said, maybe it's something in the OAuth consent screen configuration (though there are no options I see that could explain it). Maybe it has to do with the age of the account.
Re: Tell HN: Google OAuth consent screen issue could be costing you signups
#28In your “What can I do” section, should add:
“do not add google/apple/facebook(meta)/github sign on in the first place”
Not only are we centralizing identity to entities known to shutdown accounts for vague reasons. It can introduce painful debugging issues, increased support costs, and loss of sales.
Personally, dealt with an issue where a user signed up with “Sign in with Apple” but forgot whether they provided Apple associated email address or the “ @privaterelay.appleid.com”
Also, emails sent to the private relay address would occasionally bounce… Very frustrating and time I will never get back lol
Re: Tell HN: Google OAuth consent screen issue could be costing you signups
#29It's madness to me that people (not OP specifically) will simultaneously say "you have to outsource login to a third party, storing passwords safely is too hard" and... also this. The answer to "what can I do" is "stop depending on a third party service that's critical for your business and essentially trivial to replace".
also as a consumer, don’t use big tech single sign on. If big tech 86s the account for whatever reason, then you lose access to the services you linked the account to.
Re: Tell HN: Google OAuth consent screen issue could be costing you signups
#30Earlier quoted context omitted.
Interesting! It's certainly possible there are additional factors at play beyond what I've found to this point. Curiously, in all other apps I tested and mentioned, I don't see the screen changing to "loading" on them. Do you? Meantime, I'm checking the OAuth consent screen settings to see if there's anything relevant.
After watching network requests, I think it's based on the use of the Javascript login functionality vs. the redirect functionality. If the "Login with Google" button opens in a new tab and the Google OAuth flow completes in the second tab, then the process will have the "loading" screen after clicking "continue" because "loading" indicates Google OAuth is communicating back to the original tab. If the "Login with Go…
The problem with this is it doesn't support OAuth scopes. So if you need any Google account permissions beyond a simple sign in you can't use it.