4 ms·

I find it to be intrusive and disturbing. Medium.com does this and I've always hated it. Mediums usage of it actually caused me to switch, on my work computer,

I find it to be intrusive and disturbing. Medium.com does this and I've always hated it. Mediums usage of it actually caused me to switch, on my work computer, from always being logged into Google, to never being logged into my Google account. Now if I have to use one of my companies apps that requires a Google login, I do it incognito. At home, I never browse while logged in, so I didn't ever notice it that much. Using my Google account for logging into a third party web application is never my first choice. I'll take separate email / passwords for everybody please and thank you.

0-_-0 7y ago
If you use Firefox, you might want to look into multi-account containers or first party isolation. Basically, you can log into Gmail in one tab without being logged into Google in all tabs.
mlthoughts2018 7y ago
Your approach is very reasonable, but the option I really like is just never visiting Medium period.
lazyasciiart 7y ago
God, Medium has the worst login experience of any site I use. What makes them think they are too clever to be usable with a password manager like the rest of the damn internet? I usually just reopen the article in an incognito tab instead of going through their stupid “send me an email!” bullshit login.
- blfr 7y ago
  Notion.so does the same thing. You can log in with Google or get a magic link. User/password is an inconvenient method of logging in. True. But it's so common that we have password managers making it convenient again. And supposedly better solution don't have the benefit of that tooling.
  - rpeden 7y ago
    I feel the same way you do. Although I'm just a sample size of one, but I've had zero success in convincing any friends or relatives to use a password manager. They either don't trust password managers, or don't want to change their current workflow. They don't seem to care that using a password manger is probably a better solution then using the same password everywhere or writing all their passwords in a little black book. I suspect that you and I aren't representative of typical users, and that Medium and Notion might actually be acting rationally, trying to act in accordance with the ways the majority of their users want the login experience to be.
    - the_pwner224 7y ago
      > Although I'm just a sample size of one, but I've had zero success in convincing any friends or relatives to use a password manager. > They either don't trust password managers, or don't want to change their current workflow. I used to memorize all my passwords but now I just use my browser's 'remember password' feature. In both Firefox & Chrome it syncs between devices, and is usable on both the desktop and mobile applications. There's no extra setup required, which was the big selling point (or I would still be memorizing them) - one day I reset the browser. FF e2e encrypts it too. The only drawback is if you need to login on a foreign device - but that's a pretty rare circumstance, and if I can't remember the password I just reset it. I generate passwords with a pattern but I am saved the hassle of typing them in, and having to remember the exceptions that differ from the usual pattern. Firefox even offers to generate a random secure password when you are creating a new account! It's a built-in solution which provides most of the benefits of a full password manager with 0 setup or switching cost.
      - garyng 7y ago
        Firefox has a separate password manager app - Lockwise[1]. [1]: https://www.mozilla.org/en-US/firefox/lockwise/ https://www.mozilla.org/en-US/firefox/lockwise/
        the_pwner224 7y ago
- osdiab 7y ago
  For every user like you who is using unique, securely generated passwords in a manager, there’s 10,000 people who are using the same, easily compromised password on every website they’re registered on. You’re not the target audience for these features - not only are you the tiny minority, but no matter what system they give you, you’ll find a way to interact with it safely, so for that interaction you simply don’t matter. And choosing to do this kind of login pushes blame for authentication issues away from that company, and onto the federated provider, who presumably has legions of security researchers to make sure they’re doing things safely.
  - netsharc 7y ago
    Huh, new idea, Google already prompts me on my phone when I log in to Google on a new device, why isn't there a service where instead of having to open my email and find that darned Medium email, it can push a question to one of my devices (also on PC) and I can just press "Yes that was me, let me in"? It can be some third party so I don't need a different software for each site..
    - Spivak 7y ago
      Isn’t that basically logging in with Google? I mean Google isn’t asking you if you logged into Medium with a push but by the time you’re doing that Google already knows it’s you and pushed you a notification to log you in initially.
      - netsharc 7y ago
        Almost, but what if I'm uncomfortable with Medium having my real name and profile pic (which Google's SSO will share)? I'd imagine Medium would offer "authentication through X", and I can either enter my id for X, or go to the X app and generate a new ID for use for Medium, and paste it on Medium. So next time I want to login to Medium, after entering my username, Medium's backend talks to X's backend (saying user with this ID wishes to login) X can prompt me on one of my devices. Medium can display a unique number on their page for me, and I can compare that to the number my X app is showing me to confirm it's me I'm letting myself in. This is a 1 minute concept without considering creative ways it can be attacked. But I guess there wouldn't be any money to be made...
onlyrealcuzzo 7y ago
Serious question: Why can't you use CSS to collect the user's email address? Can't CSS blend modes allow you to capture anything that's rendered on the page? Or is that not possible anymore?
- judge2020 7y ago
  Looks like it's an iframe if I try by going to medium.com. I imagine getting the contents of an iframe would be a vulnerability and patched if it was a thing (I can't recall this being possible).

0-_-0 7y ago

If you use Firefox, you might want to look into multi-account containers or first party isolation. Basically, you can log into Gmail in one tab without being logged into Google in all tabs.

mlthoughts2018 7y ago

Your approach is very reasonable, but the option I really like is just never visiting Medium period.

lazyasciiart 7y ago

God, Medium has the worst login experience of any site I use. What makes them think they are too clever to be usable with a password manager like the rest of the damn internet? I usually just reopen the article in an incognito tab instead of going through their stupid “send me an email!” bullshit login.

blfr 7y ago
Notion.so does the same thing. You can log in with Google or get a magic link. User/password is an inconvenient method of logging in. True. But it's so common that we have password managers making it convenient again. And supposedly better solution don't have the benefit of that tooling.
- rpeden 7y ago
  I feel the same way you do. Although I'm just a sample size of one, but I've had zero success in convincing any friends or relatives to use a password manager. They either don't trust password managers, or don't want to change their current workflow. They don't seem to care that using a password manger is probably a better solution then using the same password everywhere or writing all their passwords in a little black book. I suspect that you and I aren't representative of typical users, and that Medium and Notion might actually be acting rationally, trying to act in accordance with the ways the majority of their users want the login experience to be.
  - the_pwner224 7y ago
    > Although I'm just a sample size of one, but I've had zero success in convincing any friends or relatives to use a password manager. > They either don't trust password managers, or don't want to change their current workflow. I used to memorize all my passwords but now I just use my browser's 'remember password' feature. In both Firefox & Chrome it syncs between devices, and is usable on both the desktop and mobile applications. There's no extra setup required, which was the big selling point (or I would still be memorizing them) - one day I reset the browser. FF e2e encrypts it too. The only drawback is if you need to login on a foreign device - but that's a pretty rare circumstance, and if I can't remember the password I just reset it. I generate passwords with a pattern but I am saved the hassle of typing them in, and having to remember the exceptions that differ from the usual pattern. Firefox even offers to generate a random secure password when you are creating a new account! It's a built-in solution which provides most of the benefits of a full password manager with 0 setup or switching cost.
    - garyng 7y ago
      Firefox has a separate password manager app - Lockwise[1]. [1]: https://www.mozilla.org/en-US/firefox/lockwise/ https://www.mozilla.org/en-US/firefox/lockwise/
      - the_pwner224 7y ago
osdiab 7y ago
For every user like you who is using unique, securely generated passwords in a manager, there’s 10,000 people who are using the same, easily compromised password on every website they’re registered on. You’re not the target audience for these features - not only are you the tiny minority, but no matter what system they give you, you’ll find a way to interact with it safely, so for that interaction you simply don’t matter. And choosing to do this kind of login pushes blame for authentication issues away from that company, and onto the federated provider, who presumably has legions of security researchers to make sure they’re doing things safely.
- netsharc 7y ago
  Huh, new idea, Google already prompts me on my phone when I log in to Google on a new device, why isn't there a service where instead of having to open my email and find that darned Medium email, it can push a question to one of my devices (also on PC) and I can just press "Yes that was me, let me in"? It can be some third party so I don't need a different software for each site..
  - Spivak 7y ago
    Isn’t that basically logging in with Google? I mean Google isn’t asking you if you logged into Medium with a push but by the time you’re doing that Google already knows it’s you and pushed you a notification to log you in initially.
    - netsharc 7y ago
      Almost, but what if I'm uncomfortable with Medium having my real name and profile pic (which Google's SSO will share)? I'd imagine Medium would offer "authentication through X", and I can either enter my id for X, or go to the X app and generate a new ID for use for Medium, and paste it on Medium. So next time I want to login to Medium, after entering my username, Medium's backend talks to X's backend (saying user with this ID wishes to login) X can prompt me on one of my devices. Medium can display a unique number on their page for me, and I can compare that to the number my X app is showing me to confirm it's me I'm letting myself in. This is a 1 minute concept without considering creative ways it can be attacked. But I guess there wouldn't be any money to be made...

onlyrealcuzzo 7y ago

Serious question: Why can't you use CSS to collect the user's email address? Can't CSS blend modes allow you to capture anything that's rendered on the page? Or is that not possible anymore?

judge2020 7y ago
Looks like it's an iframe if I try by going to medium.com. I imagine getting the contents of an iframe would be a vulnerability and patched if it was a thing (I can't recall this being possible).