Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sign in with Google in Chrome

underpassapp.com

Post reply on HN
Print view View original

101–110 of 313 posts

Re: Sign in with Google in Chrome

#101

Post by nikisweeting »

The crazy part is that the popup is not part of the DOM, it's injected by the browser *over the page content*. If it were in a browser toolbar I woudln't mind, but obscuring page content is just asking for an antitrust suit.

I left chrome and switched to Brave 6mo ago because I couldn't get these "Sign in with Google" popups to stop. I tried both the chrome://settings/content/federatedIdentityApi option and the option under https://myaccount.google.com/ and neither one worked, I just kept getting them.

Re: Sign in with Google in Chrome

#102

Post by skydhash »

patrickscoleman wrote: post #93
lucb1e wrote: post #12

Does nobody find this intrusive when it appears on sites like pornhub? Of all places where I'd sign in with a Google account... holy heck, I was very surprised they chose to let Google do that nearly-fullscreen popup on their site upon every visit (since you visit in private tab, it's a fresh session every time) Even on reddit it annoys the heck out of me and I was very surprised they let this third party ruin the ex…

their "private" is not private. about a month ago, i searched for some health-related stuff in a chrome incognito window and then immediately afterwards got related sponsored product ads on amazon in a logged in normal window.

I was trying Chrome on a work computer (because why not, I'm only doing work stuff on it). That incognito (but not really) mode made me download Firefox in an hurry.

Re: Sign in with Google in Chrome

#104

Post by MiddleEndian »

ajross wrote: post #81
cosmotic wrote: post #38

Earlier quoted context omitted.

> Name and Email Yes, both are PII, which is highly regulated in EU and CA (among others I'm sure). If these knowingly "leaked" in a data breach, the company which leaked them would be legally obligated to notify me. Sounds pretty serious to me.

[flagged]

But it's a similar concept. If someone accidentally gives some website their name + email, they could be part of a leak for some service they don't even use. People probably care less about Tea in particular because they've never heard about it before the data leaks.

Re: Sign in with Google in Chrome

#105

Post by MiddleEndian »

signal11 wrote: post #19
autoexec wrote: post #8

Earlier quoted context omitted.

You can also just not use chrome. It's still a problem that shouldn't exist and the blame for that falls entirely on Google and the websites that push google's crap on users

Safari seems to have this too, now — especially with the latest iOS 18. Any workarounds would be massively appreciated.

Firefox?

Re: Sign in with Google in Chrome

#106

Post by ajross »

MiddleEndian wrote: post #104
ajross wrote: post #81

Earlier quoted context omitted.

[flagged]

But it's a similar concept. If someone accidentally gives some website their name + email, they could be part of a leak for some service they don't even use. People probably care less about Tea in particular because they've never heard about it before the data leaks.

"So-and-so used Tea" is clearly not the focus of the coverage of the Tea app leak. Again, let's be explicit about impacts here. You can deploy hyperbole and hypothesis to make anyone a horrifying villain. But if you do that at least be honest about it.

Edit to note: the Tea story has now fallen off the front page while this one is still going strong.

Re: Sign in with Google in Chrome

#107

Post by debazel »

ajross wrote: post #81
cosmotic wrote: post #38

Earlier quoted context omitted.

> Name and Email Yes, both are PII, which is highly regulated in EU and CA (among others I'm sure). If these knowingly "leaked" in a data breach, the company which leaked them would be legally obligated to notify me. Sounds pretty serious to me.

[flagged]

The only one arguing in bad faith here is clearly you.

First, you say that a full name or email is somehow not a big deal, even though these are some of the most critical pieces of PII, either one would obviously be enough to unmask exactly who the person is.

And now, because there is some random HN post about a hack that affects a significantly smaller user base than Google's and Chrome's invasive practices and it doesn't have as many upvotes that somehow means this topic isn't serious and that everyone is arguing in bad faith.

You either have absolutely no understanding of PII or privacy, and I seriously hope you never work on anything related to it. Or you're just arguing in bad faith, I’m not sure which is worse, to be honest.

Re: Sign in with Google in Chrome

#108

Post by naniwaduni »

patrickscoleman wrote: post #93
lucb1e wrote: post #12

Does nobody find this intrusive when it appears on sites like pornhub? Of all places where I'd sign in with a Google account... holy heck, I was very surprised they chose to let Google do that nearly-fullscreen popup on their site upon every visit (since you visit in private tab, it's a fresh session every time) Even on reddit it annoys the heck out of me and I was very surprised they let this third party ruin the ex…

their "private" is not private. about a month ago, i searched for some health-related stuff in a chrome incognito window and then immediately afterwards got related sponsored product ads on amazon in a logged in normal window.

"Private" and "incognito" mode are fundamentally misnamed. They provide almost no real privacy wrt counterparties over the network, just to other people using the same computer after you.

Amnesiac mode, if you will.

Re: Sign in with Google in Chrome

#110

Post by _2d30 »

armen52 wrote: post #91
_2d30 wrote: post #80

Earlier quoted context omitted.

The problem is that at that point in the flow, it's owned by the SSO provider. The SSO provider can't know with certainty what account has an active account with the website.

I don't think that's true though? The OAuth provider knows which third parties you have authorized to have access to your account(s) as well as what information or privileges you've approved for each. And when you land on that screen, they know which third party referred you to them. In other words, they could definitely highlight or otherwise hint to you which of the Google accounts you've already approved/used via…

The provider knows you have given those privileges _at some point_ but it doesn't know if that account still exists or anything about the state of the account.

So, yes, they could do more to highlight _potential_ accounts but it's not the case that they have any visibility into the actual state of accounts.

Post reply on HN