Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Google OAuth consent screen issue could be costing you signups

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#61

Post by stephenr »

dewey wrote: post #60
stephenr wrote: post #57

Earlier quoted context omitted.

> dealing with SSO is probably easier than handling passwords, reset flows, etc. It's really not that difficult. Yes you need to be aware of risks, and be more careful with the data. But it's not exactly rocket science, and you're never going to end up in a scenario where your users can't login because the login flow is out of your hands, as per the topic of this thread.

> you're never going to end up in a scenario where your users can't login because the login flow is out of your hands It's more likely that the person re-implementing the SSO flow is making a mistake and the login behaviour is getting messed up than the default Google/Apple SSO implementation that's deployed to billions of users and business critical for many companies that use that kind of SSO internally too.

> It's more likely that the person re-implementing the SSO flow is making a mistake

The thread has other people confirming the same behaviour - and the description of the issue (preventing a double-submit of a non-idempotent action) is something most web-focused developers learn in their first year.

I don't understand why people assume that the people working at Google/etc are inherently incapable of producing bugs. Go literally invented a new programming language to make their staff less likely to fuck up because they don't have much real world experience: https://www.youtube.com/watch?v=uwajp0g-bY4

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#62

Post by dewey »

stephenr wrote: post #61
dewey wrote: post #60

Earlier quoted context omitted.

> you're never going to end up in a scenario where your users can't login because the login flow is out of your hands It's more likely that the person re-implementing the SSO flow is making a mistake and the login behaviour is getting messed up than the default Google/Apple SSO implementation that's deployed to billions of users and business critical for many companies that use that kind of SSO internally too.

> It's more likely that the person re-implementing the SSO flow is making a mistake The thread has other people confirming the same behaviour - and the description of the issue (preventing a double-submit of a non-idempotent action) is something most web-focused developers learn in their first year. I don't understand why people assume that the people working at Google/etc are inherently incapable of producing bugs.…

Taking HN thread replies or users as a sample for anything is almost never a good idea.

Even in this thread there's a split between people who can replicate it and people who can't, so it's more likely an edge case and not a global issue affecting all Google SSO implementations.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#63

Post by stephenr »

dewey wrote: post #62
stephenr wrote: post #61

Earlier quoted context omitted.

> It's more likely that the person re-implementing the SSO flow is making a mistake The thread has other people confirming the same behaviour - and the description of the issue (preventing a double-submit of a non-idempotent action) is something most web-focused developers learn in their first year. I don't understand why people assume that the people working at Google/etc are inherently incapable of producing bugs.…

Taking HN thread replies or users as a sample for anything is almost never a good idea. Even in this thread there's a split between people who can replicate it and people who can't, so it's more likely an edge case and not a global issue affecting all Google SSO implementations.

> Even in this thread there's a split between people who can replicate it and people who can't

I don't think "even the buggy behaviour is not reliably reproducible" is really the selling point you should be touting, if your claim is that Google "does it better".

I can't reply below yours, so I'll add this:

> The point is that globally rolled out solution that billions of users use every day and companies depend on is obviously better tested, better monitored, fixed quicker, more accessible than a one-off handcrafted solution for most use cases and companies where that is not their core competency.

None of those things are obvious, and the original topic of this is from the context of a software developer, that also offers their own direct "email + password" sign in option, so clearly the monumental task of storing a password, and offering password resets is not too much for them.

Your claim that large companies do things "better, obviously" is honestly laughable.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#64

Post by dewey »

stephenr wrote: post #63
dewey wrote: post #62

Earlier quoted context omitted.

Taking HN thread replies or users as a sample for anything is almost never a good idea. Even in this thread there's a split between people who can replicate it and people who can't, so it's more likely an edge case and not a global issue affecting all Google SSO implementations.

> Even in this thread there's a split between people who can replicate it and people who can't I don't think "even the buggy behaviour is not reliably reproducible" is really the selling point you should be touting, if your claim is that Google "does it better". I can't reply below yours, so I'll add this: > The point is that globally rolled out solution that billions of users use every day and companies depend on is…

You are missing the point.

The point is that globally rolled out solution that billions of users use every day and companies depend on is obviously better tested, better monitored, fixed quicker, more accessible than a one-off handcrafted solution for most use cases and companies where that is not their core competency.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#65

Post by pappeyrome »

mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

Go to

chrome://settings/content/federatedIdentityApi

enable: Block sign-in prompts from identity services

See: https://issues.chromium.org/issues/343584523

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#66

Post by joquarky »

afandian wrote: post #39
mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

+1. I find it bizarre that so many web designers values their site so low as to sacrifice a quarter of the screen on the off chance of a signup. Stop a minute and think of the UX for people who aren’t Google customers.

It's probably not the designers. In my experience, the pushback is something like

"I know it doesn't make sense, but the VP wants this so just make it happen"

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#67

Post by extraduder_ire »

mnw21cam wrote: post #26

Just a PSA - I (and probably others) find the "Sign in with Google" pop-over extremely annoying. It annoys me both because it's over the top of stuff I might want to read, and also because it's Google threatening to tell this web site who I am even though I have no desire whatsoever to do that. Please hide it behind a login button or otherwise only show it when the visitor has actually demonstrated a desire to log in…

It's especially annoying how it shows your profile pic, name, and email address on screen.

I've seen the gmail addresses of so many twitch streamers who were capturing their screen without knowing that would happen. Most of them with addresses they'd rather not be public.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#68

Post by previousjs »

GermanJablo wrote: post #55

I use authjs (aka next-auth) and recently documented that Google login requests additional access every time the user logs in[1]. I created an issue with a repro, although the maintainers moved it to discussions. It seems that the problem is with Google, but in that case I don't understand why the next-auth example works fine[2]. There are other users affected. If anyone knows how to solve this problem, I would appre…

These kinds of Next issues are why I stopped using it.

It is not bugs per-se as every framework has them.

It is that you are utterly stuck when they do and even 100s of thumbs up on issues don't get things fixed.

Case in point: can't defer chunk scripts anymore. Hard to get good performance scores as this is untenable.

Fetch cache limit is 2Mb or something like that and enforced by Verel. You need to fork NextJS and self host it to fix.

Probably 2 or 3 other such issues I forgot as well

Any over opinionated "batteries welded" frameworks will have this issue.

Use any of the usual MVC suspects like Rails for example and you avoid being stuck. You can find fixes or swap libraries. They tend to have battle tested out such issues anyway.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#69

Post by seabass-labrax »

mattzito wrote: post #53
rollcat wrote: post #47

Earlier quoted context omitted.

Staying logged out off Google at all times is slowly becoming basic web browsing hygiene. Picture a situation: - You interact with a bot in a mostly-idle, public chatroom (such as !commands on Twitch) - Bot pastes a url-shortened link that redirects you to a Google doc - Anyone who had that document already open can now link your Twitch identity to your Google identity (which may include real name+photo) Granted this…

How would they be able to link that? Document owners can't see non-domain users who viewed a particular document (and even for domain users, that can be disabled).

My recollection is that, at the top-right corner of the screen, you can see the email addresses of the other people who are currently editing the document (but not those who did in the past). If they aren't logged in, you'll see them as names like 'Anonymous Aardvark' instead.

Re: Tell HN: Google OAuth consent screen issue could be costing you signups

#70

Post by mattzito »

seabass-labrax wrote: post #69
mattzito wrote: post #53

Earlier quoted context omitted.

How would they be able to link that? Document owners can't see non-domain users who viewed a particular document (and even for domain users, that can be disabled).

My recollection is that, at the top-right corner of the screen, you can see the email addresses of the other people who are currently editing the document (but not those who did in the past). If they aren't logged in, you'll see them as names like 'Anonymous Aardvark' instead.

That is inaccurate. You only see individuals with whom you have directly shared the document with and/or people in your domain (if a business/enterprise customer). For anything link shared, you see the anonymous animal names.
Post reply on HN