Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Google OAuth consent screen issue could be costing you signups

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 70 posts

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#31

Post by rrauenza »

mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

There's a way to disable this! I found this out recently (I've only checked with Chrome, but it's a google setting not a Chrome one):

https://support.google.com/accounts/thread/219332922/how-to-...

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#32

Post by modeless »

I know they call it a nonce but how important is it to invalidate it instantly on first use? It's important for it to be unguessable, of course. But what security property does the invalidation serve? If an attacker can get the nonce they can just as easily get the access tokens after authentication, can't they?

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#33

Post by Aalk4308 »

yellow_lead wrote: post #21

Google redesigned this screen recently (in the past few months), if I remember correctly? I'm not sure if this is related though.

They redesigned the sign in / account selection page earlier this year, but I haven't been able to find any material indicating they changed the OAuth consent screen as part of it (such as before/after screenshots), though it's certainly possible.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#34

Post by varispeed »

mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

This and I also found that this pop up often sort of crashes and is displayed on all tabs and it's not possible to close it...

At least that's me on Chrome.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#36

Post by loa_in_ »

modeless wrote: post #32

I know they call it a nonce but how important is it to invalidate it instantly on first use? It's important for it to be unguessable, of course. But what security property does the invalidation serve? If an attacker can get the nonce they can just as easily get the access tokens after authentication, can't they?

The nonce is unique to the request-reply pair. Holding onto it beyond first use is useless, so it's discarded. If not that it would have to be time based otherwise (time-to-live) because server can't hold on to infinite of those. And if the time is too short it will cause problems, if it's too long it'll cause problems. It just always causes problems.

> If an attacker can get the nonce they can just as easily get the access tokens after authentication, can't they?

That's not the case. A js injection would usually lead to read access on the current page but not the next one.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#37

Post by flutas »

rrauenza wrote: post #31
mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

There's a way to disable this! I found this out recently (I've only checked with Chrome, but it's a google setting not a Chrome one): https://support.google.com/accounts/thread/219332922/how-to-...

On Firefox at least that flow says it's only for Android devices.

> Allow Google to display a sign-in prompt on Android. Learn more about sign-in prompts on Android[0]

with a section below saying Chrome itself has settings as well

> To manage third-party sign-ins on Chrome, go to Chrome Settings. Learn more about sign-in prompts on Chrome[1]

[0] links to https://support.google.com/accounts/answer/12849458?p=androi...

[1] links to https://support.google.com/accounts/answer/12849458?p=chrome...

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#38

Post by saurik »

ndriscoll wrote: post #23
dewey wrote: post #20

Earlier quoted context omitted.

Login is never "trival" to replace.

IIRC a basic oauth social login implementation is ~40 lines of code (assuming you already have things like json parsing). You need to understand what you're doing to make sure you do the necessary validation (e.g. including the nonce from OP), but the part auth0 is doing for you is pretty trivial.

I agree with you, but I think the comment is about replacing Google, not replacing Auth0.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#39

Post by afandian »

mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

+1. I find it bizarre that so many web designers values their site so low as to sacrifice a quarter of the screen on the off chance of a signup. Stop a minute and think of the UX for people who aren’t Google customers.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#40

Post by watermelon0 »

rrauenza wrote: post #31
mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

There's a way to disable this! I found this out recently (I've only checked with Chrome, but it's a google setting not a Chrome one): https://support.google.com/accounts/thread/219332922/how-to-...

I followed the above link, and it seems that it's a Chrome setting now: https://support.google.com/chrome/answer/14264742
Post reply on HN