4 ms·

I was logged into my gmail account and after visiting this site, without signing up for anything I get a welcome email, WTF?

by lazyant 16y ago

theli0nheart 16y ago
Same thing for me. Whatever you're doing, you need to stop it, or else you'll have worse things to worry about than complaining HN users ;).
- savrajsingh 16y ago
  Yes, we hear you, please see my comments above.
cnlwsu 16y ago
ish, same here. Marked as spam...
savrajsingh 16y ago
That's not the expected behavior. We use Google Accounts for Sign In, but it should present you with a window that says "sign in to wattvision" and ask you for your password again, even if you are already logged in to Gmail. We'll confirm / try to repro on our end. Any other info you have is appreciated. UPDATE: We definitely want to fix this, we do not want to surprise or inadvertently sign up users. That's not our intention and we're not that kind of company! UPDATE 2: Ok it looks like Google has updated their "federated login" http://code.google.com/apis/accounts/docs/OpenID.html http://code.google.com/apis/accounts/docs/OpenID.html since we implemented our login system, so we'll check against that and see what's up? If anyone from Google is reading this and can comment/help, please email us at founders@wattvision.com. Thanks!
- timmaah 16y ago
  Thats not how it is working. I clicked "Sign In" and was immediately logged into your site.
  - tomsaffell 16y ago
    Same for me.
  - ryanwaggoner 16y ago
    Same here.
    - deleted 16y ago
      [deleted]
  - mootothemax 16y ago
    Just tried it now and it's exactly as described. Seriously guys how have you managed to get around Google's protections here? ;)
- lazyant 16y ago
  My navigation was: - home page - /house - /info/sensors - /house/add I went to the last page because I was curious that you had to register _before_ buying. At this last page I saw my gmail username pre-populated in the form automatically which freaked me out (I didn't even know grabbing a visitor's google account name was possible) and I closed the page, I did not submit (voluntarily) any info. Then within a couple of minutes I got in my gmail account a welcome email. I think this is way worse than spam, fix asap.
  - pingswept 16y ago
    Confirmed: I just replicated this behavior.
  - bhavin 16y ago
    +1
  - trafficlight 16y ago
    And me as well.
  - Confusion 16y ago
    (I didn't even know grabbing a visitor's google account name was possible) I didn't either, but it seems you can simply use Google's API to allow a user to sign in, where the user name of the user that signs in (or is already signed in!), is reported to the user of the API via a callback. The request after you sign in has a 'continue' HTTP header that says something like: continue=http%3A%2F%2Fwww.wattvision.com%2F_ah%2Flogin%3Fcontinue%3Dhttp%3A%2F%2F www.wattvision.com%2Fhouse&service=ah&dsh=2844188452075813479&timeStmp=&secTok=&GALX= DTEVMCX16p4&Email=<your gmail address>&Passwd=<your_password>
  - SriniK 16y ago
    same here.. Are you using appengine? There is a recommended way to get the login implemented from appengine. http://code.google.com/appengine/docs/python/users/overview.html http://code.google.com/appengine/docs/python/users/overview.... I am not sure if you wanna do federated login on appengine.
- mike-cardwell 16y ago
  Why do you require a Google account to sign up?
  - biafra 16y ago
    Because its the easiest way on GAE I suppose?
- sean_lynch 16y ago
  Email sent. Google here, confirming this is an issue with the Users API on App Engine. On-call team is working on the fix now. Edit: As of 12:30PM PST, we are now rolling out the fix. This should be relatively instantaneous.
mistermann 16y ago
How is that even possible? So if I'm signed into my gmail, a site can detect my email address? This seems like a huge privacy bug on googles behalf if this is actually happening.
- savrajsingh 16y ago
  We're investigating, its certainly not our intention. See my comments above.
leftnode 16y ago
This looks like a nice tool to have (if a bit expensive), but seriously, a bug like that is a real deal killer. Having my house appear after clicking a link freaked me out.
- ryanwaggoner 16y ago
  Having your house appear? Did they somehow pull your physical address info?
  - savrajsingh 16y ago
    Ha. If only we were that good. ;) We try to figure out the city you're from using Geo IP (maxmind.com, for example) and then draw a Google Map. Down the line, we want to use the city you're from to compare use with other users from the same city/region. We're not interested in your exact street address.
  - newman314 16y ago
    Are there privacy settings available?
azymnis 16y ago
I think that they are just using oauth and not doing anything nasty. In my case it asked me for my google account password.
latortuga 16y ago
To add to this info, clicking your Sign Out link logs me out of my Google account.

I was logged into my gmail account and after visiting this site, without signing up for anything I get a welcome email, WTF?

by lazyant 16y ago

I was logged into my gmail account and after visiting this site, without signing up for anything I get a welcome email, WTF?

theli0nheart 16y ago

Same thing for me. Whatever you're doing, you need to stop it, or else you'll have worse things to worry about than complaining HN users ;).

savrajsingh 16y ago
Yes, we hear you, please see my comments above.

cnlwsu 16y ago

ish, same here. Marked as spam...

savrajsingh 16y ago

That's not the expected behavior. We use Google Accounts for Sign In, but it should present you with a window that says "sign in to wattvision" and ask you for your password again, even if you are already logged in to Gmail. We'll confirm / try to repro on our end. Any other info you have is appreciated. UPDATE: We definitely want to fix this, we do not want to surprise or inadvertently sign up users. That's not our intention and we're not that kind of company! UPDATE 2: Ok it looks like Google has updated their "federated login" http://code.google.com/apis/accounts/docs/OpenID.html http://code.google.com/apis/accounts/docs/OpenID.html since we implemented our login system, so we'll check against that and see what's up? If anyone from Google is reading this and can comment/help, please email us at founders@wattvision.com. Thanks!

timmaah 16y ago
Thats not how it is working. I clicked "Sign In" and was immediately logged into your site.
- tomsaffell 16y ago
  Same for me.
- ryanwaggoner 16y ago
  Same here.
  - deleted 16y ago
    [deleted]
- mootothemax 16y ago
  Just tried it now and it's exactly as described. Seriously guys how have you managed to get around Google's protections here? ;)
lazyant 16y ago
My navigation was: - home page - /house - /info/sensors - /house/add I went to the last page because I was curious that you had to register _before_ buying. At this last page I saw my gmail username pre-populated in the form automatically which freaked me out (I didn't even know grabbing a visitor's google account name was possible) and I closed the page, I did not submit (voluntarily) any info. Then within a couple of minutes I got in my gmail account a welcome email. I think this is way worse than spam, fix asap.
- pingswept 16y ago
  Confirmed: I just replicated this behavior.
- bhavin 16y ago
  +1
- trafficlight 16y ago
  And me as well.
- Confusion 16y ago
  (I didn't even know grabbing a visitor's google account name was possible) I didn't either, but it seems you can simply use Google's API to allow a user to sign in, where the user name of the user that signs in (or is already signed in!), is reported to the user of the API via a callback. The request after you sign in has a 'continue' HTTP header that says something like: continue=http%3A%2F%2Fwww.wattvision.com%2F_ah%2Flogin%3Fcontinue%3Dhttp%3A%2F%2F www.wattvision.com%2Fhouse&service=ah&dsh=2844188452075813479&timeStmp=&secTok=&GALX= DTEVMCX16p4&Email=<your gmail address>&Passwd=<your_password>
- SriniK 16y ago
  same here.. Are you using appengine? There is a recommended way to get the login implemented from appengine. http://code.google.com/appengine/docs/python/users/overview.html http://code.google.com/appengine/docs/python/users/overview.... I am not sure if you wanna do federated login on appengine.
mike-cardwell 16y ago
Why do you require a Google account to sign up?
- biafra 16y ago
  Because its the easiest way on GAE I suppose?
sean_lynch 16y ago
Email sent. Google here, confirming this is an issue with the Users API on App Engine. On-call team is working on the fix now. Edit: As of 12:30PM PST, we are now rolling out the fix. This should be relatively instantaneous.

mistermann 16y ago

How is that even possible? So if I'm signed into my gmail, a site can detect my email address? This seems like a huge privacy bug on googles behalf if this is actually happening.

savrajsingh 16y ago
We're investigating, its certainly not our intention. See my comments above.

leftnode 16y ago

This looks like a nice tool to have (if a bit expensive), but seriously, a bug like that is a real deal killer. Having my house appear after clicking a link freaked me out.

ryanwaggoner 16y ago
Having your house appear? Did they somehow pull your physical address info?
- savrajsingh 16y ago
  Ha. If only we were that good. ;) We try to figure out the city you're from using Geo IP (maxmind.com, for example) and then draw a Google Map. Down the line, we want to use the city you're from to compare use with other users from the same city/region. We're not interested in your exact street address.
- newman314 16y ago
  Are there privacy settings available?

azymnis 16y ago

I think that they are just using oauth and not doing anything nasty. In my case it asked me for my google account password.

latortuga 16y ago

To add to this info, clicking your Sign Out link logs me out of my Google account.