10 ms·

I loathe every login screen except for Google's. Why is it that only one company in the world (and sshd but there's no login screen when set up properly) can ge

by blfr 7y ago

I loathe every login screen except for Google's. Why is it that only one company in the world (and sshd but there's no login screen when set up properly) can get it right? Is it really a piece of software that requires hundreds of millions of dollars to get right? And people who try to fix it so often make things worse. I was very excited about notion.so until I learned I will have to keep clicking magic links for eternity. (Yeah, I know, they support logging in via Google which reinforces my point.)

scrollaway 7y ago
Notion recently added password login.
- blfr 7y ago
  Oh, so good. My manager still doesn't fill in the address properly but better nonetheless. Thanks!
dijit 7y ago
Odd. I dislike Google’s very much. Although I use Google’s with many accounts (personal/work/partner) sometimes URLs will just assume my identity is “logged in account index 0” and give me a permission denied, or pass me to a page which has no way of changing the active account. I found that most urls can have “u/1/“ pretty much anywhere to change accounts but if they have rewritten the url before I see the permission denied or black-hole then it’s useless. There’s also the fact that google recently forced Javascript and specific browsers to be used in order to be able to login. So I was locked out of my account for a while until someone discovered that the “rules” are a little more lax for Firefox useragents. To add to this: I’m certainly no Microsoft fanboy but the best login I have experienced (in my life I think) is AzureAD with SAML. It seems to use Kerberos silently in the background to do saml handshaking. It’s truly seamless and very fast. Even if I’m logged in to outlook from office365 (from a non-enrolled computer) I won’t even be presented with another login screen. I’ll just be logged in like “magic”.
- dijit 7y ago
  More context to the logging in with “unable to verify the security of the browser” issue: https://forum.manjaro.org/t/google-blocks-access-logging-from-linux-browsers-konqueror-falkon-and-qutebrowser-not-enough-secure/115120 https://forum.manjaro.org/t/google-blocks-access-logging-fro...
- blfr 7y ago
  I use Google’s with many accounts (personal/work/partner) You don't mention your use case but it's almost always a bad idea to be logging in as someone else, not just at Google but everywhere. Some sort of access delegation would probably be much better. As for a work account, I keep it in a separate Chrome profile. Not because of logging in but because you can sync everything without risking spillage.
- sofaofthedamned 7y ago
  Yeah, Google's SSO is fine unless the first logged-in account (/u/0) is one with a redirect to a company portal login. At which point you have to manipulate the URL to get to a different account.
- kylek 7y ago
  When logging in to gmail (gsuite really) for work, I notice that I’m briefly redirected to accounts.youtube.com after putting in the otp even though the account has no youtube association. Any ideas why? I’ve tested blocking the domain and it still lets me through (after hitting back after falling to load). Is this just “because Firefox”?
  - jeroenhd 7y ago
    From what I can tell, it's setting some kind of cookie for Youtube as part of the standard Google login flow. They probably have their cookies set up in such a way that authentication data is only accessible from first-party websites (like cookies). I can see 11 cookies on the Youtube.com domain in my browser. Some of those seem to be purely for authentication reasons. I'm pretty sure that's why Google flows through Youtube when you log in. As for why they always try to set Youtube cookies: I don't know, but it's probably because they don't feel like splitting up their authentication flow. Doing the redirect for accounts even when they don't have any Youtube-related is probably a no-op; leaving it like that doesn't cost anything close to the time and resources it would take to segregate their entire workflow + verify that the security is still sound.
drcongo 7y ago
I despise Google's login screens. Two separate forms, one for just an email address another for just a password. Why? Why should I have to invoke my password manager twice just to fill in two fields? I can't think of a single sane reason for doing this.
- gen3 7y ago
  The reason why they do this is because of sso logins for other organizations. For example, to log into my college gmail account, I type my email, get redirected to the schools sso page (retype my username and password), then get redirected to gmail.
  - wavefunction 7y ago
    >retype username That's even worse than the non-sso sign in flow. It definitely doesn't have to be that bad.
    - gen3 7y ago
      Since I use a password manager, its not really an issue unless I have to login on some random lab computer. At the place I work we use office 365. Their sso path is so much better. I never need to re-enter my username.
- blfr 7y ago
  Both Chrome and Firefox handle that form just fine. In my case it's four steps: login, password, hardware key, and clickthrough. It is fast and painless though. Plus if you have a bunch of tabs open (G Suite), it will log you in all of them once you log in on one.
  - ilammy 7y ago
    > four steps Oh god... How a human being can stand this humiliation? I image this inflating to eight steps in 2030: login, password, 2FA key, face scan, reCAPTCHA, ID scan, phone call, click checkbox in AI TOS no one reads, final click on “We’re done!”
RandomTisk 7y ago
At this rate, software developers are going to get worse reputations than lawyers before too long. One app I use every day at work, I have to provide my email address ever day, then log in. Then the app passes authentication for some unknown reason to Microsoft's federation service of some kind, using my email address which it asks for again + password. Prior to their recent 'redesign' it was perfectly streamlined before they "refreshed" the app with a brand new bullshit UI that just made everything worse. I literally can't think of a positive that came out with the new version, it's worse in every conceivable way. Personally I think someone scammed the company into redesigning something that didn't need it, subcontracted it out to the lowest bidder and pocketed a nice stack of cash for themselves.

by blfr 7y ago

scrollaway 7y ago

Notion recently added password login.

blfr 7y ago
Oh, so good. My manager still doesn't fill in the address properly but better nonetheless. Thanks!

dijit 7y ago

Odd. I dislike Google’s very much. Although I use Google’s with many accounts (personal/work/partner) sometimes URLs will just assume my identity is “logged in account index 0” and give me a permission denied, or pass me to a page which has no way of changing the active account. I found that most urls can have “u/1/“ pretty much anywhere to change accounts but if they have rewritten the url before I see the permission denied or black-hole then it’s useless. There’s also the fact that google recently forced Javascript and specific browsers to be used in order to be able to login. So I was locked out of my account for a while until someone discovered that the “rules” are a little more lax for Firefox useragents. To add to this: I’m certainly no Microsoft fanboy but the best login I have experienced (in my life I think) is AzureAD with SAML. It seems to use Kerberos silently in the background to do saml handshaking. It’s truly seamless and very fast. Even if I’m logged in to outlook from office365 (from a non-enrolled computer) I won’t even be presented with another login screen. I’ll just be logged in like “magic”.

dijit 7y ago
More context to the logging in with “unable to verify the security of the browser” issue: https://forum.manjaro.org/t/google-blocks-access-logging-from-linux-browsers-konqueror-falkon-and-qutebrowser-not-enough-secure/115120 https://forum.manjaro.org/t/google-blocks-access-logging-fro...
blfr 7y ago
I use Google’s with many accounts (personal/work/partner) You don't mention your use case but it's almost always a bad idea to be logging in as someone else, not just at Google but everywhere. Some sort of access delegation would probably be much better. As for a work account, I keep it in a separate Chrome profile. Not because of logging in but because you can sync everything without risking spillage.
sofaofthedamned 7y ago
Yeah, Google's SSO is fine unless the first logged-in account (/u/0) is one with a redirect to a company portal login. At which point you have to manipulate the URL to get to a different account.
kylek 7y ago
When logging in to gmail (gsuite really) for work, I notice that I’m briefly redirected to accounts.youtube.com after putting in the otp even though the account has no youtube association. Any ideas why? I’ve tested blocking the domain and it still lets me through (after hitting back after falling to load). Is this just “because Firefox”?
- jeroenhd 7y ago
  From what I can tell, it's setting some kind of cookie for Youtube as part of the standard Google login flow. They probably have their cookies set up in such a way that authentication data is only accessible from first-party websites (like cookies). I can see 11 cookies on the Youtube.com domain in my browser. Some of those seem to be purely for authentication reasons. I'm pretty sure that's why Google flows through Youtube when you log in. As for why they always try to set Youtube cookies: I don't know, but it's probably because they don't feel like splitting up their authentication flow. Doing the redirect for accounts even when they don't have any Youtube-related is probably a no-op; leaving it like that doesn't cost anything close to the time and resources it would take to segregate their entire workflow + verify that the security is still sound.

drcongo 7y ago

I despise Google's login screens. Two separate forms, one for just an email address another for just a password. Why? Why should I have to invoke my password manager twice just to fill in two fields? I can't think of a single sane reason for doing this.

gen3 7y ago
The reason why they do this is because of sso logins for other organizations. For example, to log into my college gmail account, I type my email, get redirected to the schools sso page (retype my username and password), then get redirected to gmail.
- wavefunction 7y ago
  >retype username That's even worse than the non-sso sign in flow. It definitely doesn't have to be that bad.
  - gen3 7y ago
    Since I use a password manager, its not really an issue unless I have to login on some random lab computer. At the place I work we use office 365. Their sso path is so much better. I never need to re-enter my username.
blfr 7y ago
Both Chrome and Firefox handle that form just fine. In my case it's four steps: login, password, hardware key, and clickthrough. It is fast and painless though. Plus if you have a bunch of tabs open (G Suite), it will log you in all of them once you log in on one.
- ilammy 7y ago
  > four steps Oh god... How a human being can stand this humiliation? I image this inflating to eight steps in 2030: login, password, 2FA key, face scan, reCAPTCHA, ID scan, phone call, click checkbox in AI TOS no one reads, final click on “We’re done!”

RandomTisk 7y ago

At this rate, software developers are going to get worse reputations than lawyers before too long. One app I use every day at work, I have to provide my email address ever day, then log in. Then the app passes authentication for some unknown reason to Microsoft's federation service of some kind, using my email address which it asks for again + password. Prior to their recent 'redesign' it was perfectly streamlined before they "refreshed" the app with a brand new bullshit UI that just made everything worse. I literally can't think of a positive that came out with the new version, it's worse in every conceivable way. Personally I think someone scammed the company into redesigning something that didn't need it, subcontracted it out to the lowest bidder and pocketed a nice stack of cash for themselves.