Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Google OAuth consent screen issue could be costing you signups

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#41

Post by kccqzy »

xyst wrote: post #28

In your “What can I do” section, should add: “do not add google/apple/facebook(meta)/github sign on in the first place” Not only are we centralizing identity to entities known to shutdown accounts for vague reasons. It can introduce painful debugging issues, increased support costs, and loss of sales. Personally, dealt with an issue where a user signed up with “Sign in with Apple” but forgot whether they provided App…

The most painful is when a user first logs in using "sign in with Google" and then subsequently using "sign in with Apple" without understanding that they now have two separate accounts. People don't understand that these two accounts are completely separate when they see that their Apple ID email is a Gmail, or when they have a Google account using their iCloud email.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#42

Post by modeless »

loa_in_ wrote: post #36
modeless wrote: post #32

I know they call it a nonce but how important is it to invalidate it instantly on first use? It's important for it to be unguessable, of course. But what security property does the invalidation serve? If an attacker can get the nonce they can just as easily get the access tokens after authentication, can't they?

The nonce is unique to the request-reply pair. Holding onto it beyond first use is useless, so it's discarded. If not that it would have to be time based otherwise (time-to-live) because server can't hold on to infinite of those. And if the time is too short it will cause problems, if it's too long it'll cause problems. It just always causes problems. > If an attacker can get the nonce they can just as easily get the…

It's my understanding that the OAuth "state" parameter nonce is generated and stored and validated on the client, not the server.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#43

Post by ndriscoll »

saurik wrote: post #38
ndriscoll wrote: post #23

Earlier quoted context omitted.

IIRC a basic oauth social login implementation is ~40 lines of code (assuming you already have things like json parsing). You need to understand what you're doing to make sure you do the necessary validation (e.g. including the nonce from OP), but the part auth0 is doing for you is pretty trivial.

I agree with you, but I think the comment is about replacing Google, not replacing Auth0.

How so? Google is an IdP. It provides the user's identity. Auth0 is a middle layer that (in this case) transforms oauth responses into oauth responses.

The thing you'd replace Google with would be something like oauth client auto-registration so people can use their own oauth server on their domain.

Edit: Oh, I see what you/they mean. That's probably fair, but SSO is actually convenient for people, so it's fair to offer both oauth and user/password login. And dealing with SSO is probably easier than handling passwords, reset flows, etc. Passkeys would also work well here if they weren't so user-hostile.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#44

Post by ewoodrich »

xyst wrote: post #28

In your “What can I do” section, should add: “do not add google/apple/facebook(meta)/github sign on in the first place” Not only are we centralizing identity to entities known to shutdown accounts for vague reasons. It can introduce painful debugging issues, increased support costs, and loss of sales. Personally, dealt with an issue where a user signed up with “Sign in with Apple” but forgot whether they provided App…

As a developer I can sympathize having dealt with frustration implementing SSO but as a user (and I'm aware I may be in the minority on HN) I've bailed out of trying quite a few webapps that don't offer Sign in With Google or Sign in With Apple.

There is a psychological effect where I dread the image of whatever half broken bespoke registration flow or inane password requirements someone came up with when I only see a "Create Account" button.

That may not make a difference for signing up for an account at like a bank or something I truly need but for say a Show HN for Yet Another Thin Layer Over GPT #372 the odds are high I'll just click back and move on with my life.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#45

Post by cma »

rrauenza wrote: post #31
mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

There's a way to disable this! I found this out recently (I've only checked with Chrome, but it's a google setting not a Chrome one): https://support.google.com/accounts/thread/219332922/how-to-...

Will setting that other than default default give the site one more bit to fingerprint you?

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#46

Post by afandian »

rrauenza wrote: post #31
mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

There's a way to disable this! I found this out recently (I've only checked with Chrome, but it's a google setting not a Chrome one): https://support.google.com/accounts/thread/219332922/how-to-...

Looks like that only works if you’re a Google customer?

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#47

Post by rollcat »

mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

Staying logged out off Google at all times is slowly becoming basic web browsing hygiene. Picture a situation:

- You interact with a bot in a mostly-idle, public chatroom (such as !commands on Twitch)

- Bot pastes a url-shortened link that redirects you to a Google doc

- Anyone who had that document already open can now link your Twitch identity to your Google identity (which may include real name+photo)

Granted this particular vector has been open for well over a decade, it may just catch you off guard sooner or later.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#48

Post by WarOnPrivacy »

mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

This uBlock Origin custom filter suppresses the popup.

    ||accounts.google.com/gsi/*$xhr,script,3p
It's always the 1st one I install.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#49

Post by loa_in_ »

modeless wrote: post #42
loa_in_ wrote: post #36

Earlier quoted context omitted.

The nonce is unique to the request-reply pair. Holding onto it beyond first use is useless, so it's discarded. If not that it would have to be time based otherwise (time-to-live) because server can't hold on to infinite of those. And if the time is too short it will cause problems, if it's too long it'll cause problems. It just always causes problems. > If an attacker can get the nonce they can just as easily get the…

It's my understanding that the OAuth "state" parameter nonce is generated and stored and validated on the client, not the server.

You're right. sorry. There goes me not refreshing my memory about the flow.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#50

Post by Suppafly »

mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

>Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying.

So much this, it's 100% and antipattern. It often causes me to just close out of page unless the content is actually something I really want to see. I have several google accounts associated with my gmail, so the box is often kinda big and I'm afraid I'm going to accidentally subscribe one of them to something.

Post reply on HN