4 ms·

Doesn't OAuth and similar work by redirecting you to the login page? I don't recall ever seeing a version that opens a popup to get you to login. This would im

Doesn't OAuth and similar work by redirecting you to the login page? I don't recall ever seeing a version that opens a popup to get you to login. This would immediately raise my suspicions on this basis (popup windows can be controlled by the opening website to a large degree!).

majewsky 8y ago
At most 10% of the target audience (and that's a generous upper bound) are going to have the deep understanding of web technologies that is required to make those deductions. And even if they do, not all of them are going to realize this in that particular moment. (For instance, it didn't immediately occur to me while reading the article.)
- kilburn 8y ago
  Oh, I wasn't expecting people to make the deduction I made. There was a time when popups were considered malicious by nearly everyone (my mother would have seen this as suspicious during that time). Thanks to popup blockers this feeling seems to be fading, and I see no reason whastoever to not cultivate it again.: "Unless you are already logged in to a website you trust, any popup means that this website cannot be trusted. Contact someone you trust to check it if you really really need to use that site."
akvadrako 8y ago
OAuth flow can certainly open a popup (or new tab if that's how your browser is configured). After you login it will use a redirect but that might be hidden from the user. Pop-up blockers don't work when the user clicks "login". It's not suspicious at all and I would say best practice. In any case, you always need to make sure the domain is trusted. That's a lot easier if your browser puts all windows in tabs.
michaelt 8y ago
I don't recall ever seeing a version that opens a popup to get you to login. You'll often get a login pop-up if you pay with paypal - they call it the mini-browser in their documentation [1] - and I guess the intention is you don't have to leave the merchant's website in you main browser window. [1] https://developer.paypal.com/docs/classic/adaptive-payments/ht_ap-embeddedPayment-curl-etc/#step-4-test-the-html-form-1 https://developer.paypal.com/docs/classic/adaptive-payments/...
- kilburn 8y ago
  I think this was a bad option they offered in the past and now they are stuck with it. Notice the alert at the top of that page: > Important: Adaptive Payments is now a limited release product. It is restricted to select partners for approved use cases and should not be used for new integrations without guidance from PayPal. In other words, popup loading another website is just wrong and should be avoided by both website makers and their users.
megous 8y ago
Only if the opener is on the same domain. Anyway, this is where desktop uniformity hurts. Using i3wm it would be obvious to me what's happening, since window decorations would be different and new browser windows open in a stack, and not on top of other windows.
stordoff 8y ago
I see it all the time with PayPal (to the point where I wouldn't be suspicious of Steam doing it).

majewsky 8y ago

At most 10% of the target audience (and that's a generous upper bound) are going to have the deep understanding of web technologies that is required to make those deductions. And even if they do, not all of them are going to realize this in that particular moment. (For instance, it didn't immediately occur to me while reading the article.)

kilburn 8y ago
Oh, I wasn't expecting people to make the deduction I made. There was a time when popups were considered malicious by nearly everyone (my mother would have seen this as suspicious during that time). Thanks to popup blockers this feeling seems to be fading, and I see no reason whastoever to not cultivate it again.: "Unless you are already logged in to a website you trust, any popup means that this website cannot be trusted. Contact someone you trust to check it if you really really need to use that site."

akvadrako 8y ago

OAuth flow can certainly open a popup (or new tab if that's how your browser is configured). After you login it will use a redirect but that might be hidden from the user. Pop-up blockers don't work when the user clicks "login". It's not suspicious at all and I would say best practice. In any case, you always need to make sure the domain is trusted. That's a lot easier if your browser puts all windows in tabs.

michaelt 8y ago

I don't recall ever seeing a version that opens a popup to get you to login. You'll often get a login pop-up if you pay with paypal - they call it the mini-browser in their documentation [1] - and I guess the intention is you don't have to leave the merchant's website in you main browser window. [1] https://developer.paypal.com/docs/classic/adaptive-payments/ht_ap-embeddedPayment-curl-etc/#step-4-test-the-html-form-1 https://developer.paypal.com/docs/classic/adaptive-payments/...

kilburn 8y ago
I think this was a bad option they offered in the past and now they are stuck with it. Notice the alert at the top of that page: > Important: Adaptive Payments is now a limited release product. It is restricted to select partners for approved use cases and should not be used for new integrations without guidance from PayPal. In other words, popup loading another website is just wrong and should be avoided by both website makers and their users.

megous 8y ago

Only if the opener is on the same domain. Anyway, this is where desktop uniformity hurts. Using i3wm it would be obvious to me what's happening, since window decorations would be different and new browser windows open in a stack, and not on top of other windows.

stordoff 8y ago

I see it all the time with PayPal (to the point where I wouldn't be suspicious of Steam doing it).