7 ms·

Has anyone else noticed random popups on 3rd party websites asking for google sign in? I even used firefox when it happened: https://imgur.com/a/JC52lBV https:

• damnencryption 6y ago
  Yeah. Reddit is especially really intrusive and annoying. I feel like they just don't want people to use their site anymore. Whenever I open new Reddit, my memory and CPU usage goes up so badly.
  • MattGaiser 6y ago
    old.reddit.com.
    • lasagnaphil 6y ago
      Use a browser plugin like this to always use the old site: https://addons.mozilla.org/en-US/firefox/addon/old-reddit-redirect/ https://addons.mozilla.org/en-US/firefox/addon/old-reddit-re...
      • Fnoord 6y ago
        Doesn't work on Firefox Android. I never go to Reddit by typing URL; I go to Reddit because I follow a link to it.
        • mcjiggerlog 6y ago
          Creator of the extension here. It actually does work on Android, it's just not in the (very short) list of allowed extensions yet. There is a workaround to add custom addons, though: https://github.com/tom-james-watson/old-reddit-redirect/issues/42 https://github.com/tom-james-watson/old-reddit-redirect/issu...
          • ffpip 6y ago
            Thanks for making this. It's useful every time I click a new reddit link.
        • ripdog 6y ago
          There's a rich ecosystem of incredible third party reddit apps on android, as an alternative. Reddit is really unpleasant to use on the mobile web, even without the dark patterns.
        • smolder 6y ago
          The plug-in redirects to old Reddit automatically when following links, so if it worked for you that would not be an issue.
      • accurateappL 6y ago
        And if you're signed in you can opt out of the new site (Preferences > Opt out of the redesign)
      • snomad 6y ago
        Uniqueness of browser plugins creates unique signature specific to user.
    • diarrhea 6y ago
      This together with RES and Shine makes it really pleasant actually. In fact, I think you don't need to visit old.reddit.com for RES/Shine to work. CPU/MEM usage is off the charts though (has gotten much better).
  • lucb1e 6y ago
    Same here, it's painfully slow and I click their search results only when I don't know where else to look. Given reddit's sheer size and popularity in quite a few countries, I wonder how many MWh and CO2e the new version uses and causes.
    • andrepd 6y ago
      Also battery degradation.
  • BatteryMountain 6y ago
    Reddit website unusable on mobile, it cuts all images in half for me (Nokia 3.1 and Samsung A51), and it's just laggy. I use RedReader from F-Droid instead.
    • bonoboTP 6y ago
      Yes, it also loads forever, hides half the comments, constant pop-ups telling you to use the app instead, cannot read some (non-quarantined) subs without logging in, no NSFW without logging in, back button is broken, frequent error in loading pages... On the desktop it still usable with old.reddit.com. But honestly it's probably for the best, less time wasted.
    • ryandrake 6y ago
      They can't even manage to get their video player to work. Even your local news web sites, which ten years after YouTube still couldn't manage to consistently get a video to play in the browser, have figured it out by now. But Reddit? Nope. Requires me to hit the play button 3-4 times in order to start the video, stops randomly in the middle of the video, and "re-play" never works. I mean, we're almost in 2021! Developers, if you can't figure it out, just give up and embed YouTube.
      • goatsi 6y ago
        My favourite bit is when it starts replaying (with full volume) after I've scrolled halfway down into the comments.
• ur-whale 6y ago
  Yes, they've been showing up all over the place. Even on EBay. I suspect some bizdev people at Google just had a "great idea".
• eloisius 6y ago
  I assumed these were using some kind of iframe trickery.
• cirno 6y ago
  Yes, and it bothers me a lot, even if it's in an iframe, that it has my real name from my Gmail account inside the unrelated third party pages. I do not trust Javascript iframe policies from preventing the host sites of exfiltrating my name from the Google signin frame. Javascript and browser exploits have a long history. This uBlock Origin rule blocks the popups at least: ##iframe[src*="accounts.google.com/gsi"]
  • coddle-hark 6y ago
    If there was a bug that let websites read from unrelated iframes then they could just open the iframes themselves.
    • cirno 6y ago
      X-Frame-Options and cookie access rules would help protect against that a layer beneath Javascript. I get your point that ultimately any security breach can escalate to full-on compromise of all personal data. I still find it playing with fire to have completely unrelated sites having my name inside an iframe.
• bzb6 6y ago
  I never see these. I wonder if it’s because I have ublock properly configured or because I block third party cookies or because I never sign in to Google on my main browsing profile.
• reidrac 6y ago
  I use Firefox containers at work but I was postponing doing the same at home because it takes a bit of work to create the containers, assign sites, troubleshoot some minimal issues, etc; and THIS made me finally do it. I knew that I was being tracked, but that was a bit too "in my face" to ignore it.
  • paol 6y ago
    Same here. Seeing that popup on medium.com with my google login identity was what finally prompted me to start using containers. Now google's domains are safely kept in their little box where they belong. It's funny because there's nothing new about those login popups - I already knew conceptually that kind of thing was possible - but seeing your little avatar picture show up where it doesn't belong provokes a much more direct reaction than abstract knowledge.
  • nottorp 6y ago
    There's a ready made extension for Google. https://github.com/containers-everywhere/contain-google https://github.com/containers-everywhere/contain-google Installable from the Firefox extension "store".
  • ipqk 6y ago
    I tried to create my own Google container, but could never get it work with Google Drive which caused an endless redirect so I had to give up.
• dawnerd 6y ago
  It’s called onetap if anyone is interested.
• greggman3 6y ago
  Yes and it pissed me off because on mobile it pops up like 0.5-2 seconds late so if you're unlucky you go to click on something and it popups up under your finger and you've suddenly signed up and shared your info with a company you had no intention of ever signing up with. I complained to Google. I have a GSuites domain and I don't want my users to be able to sign up via Google. No resolution. I suggest you all complain too I semi worked around it by adding accounts.google.com to my ublock origin block list but about once a month I have to turn it off to allow me to log into Google. Note: I'm not against google. I am against this auto-popup. The logical conclusion is you'll go to a page and get 6 of those popups or more. One to sign up with Google, one to sign up with Apple. One to sign up with Facebook. One to sign up with Linkedin, etc... The design of that system by google is not a good design based on the idea that if everyone did it it would be bad. Google should top it. If I click "sign up" on the sight then let the site offer me "login with X" and don't contect X until I click "login with X"
  • seebetter 6y ago
    Also I reflexively clicked ok out of laziness and annoyance without knowing what it was. Not quite a dark pattern but you certainly aren’t completely aware what it’s asking within the first second of seeing it.
    • nitrogen 6y ago
      aren’t completely aware what it’s asking That is one example of a dark pattern.
  • joshuaissac 6y ago
    This filter did it for me: ||accounts.google.com/gsi/iframe/select$subdocument It blocks just the popups and not the login page itself. But Google may change their methods at any time to circumvent it, so your way is more robust.
  • gorhill 6y ago
    > I semi worked around it by adding accounts.google.com to my ublock origin block list but about once a month I have to turn it off to allow me to log into Google. This is where uBO's dynamic filtering[1] is useful, as it allows you to globally block `accounts.google.com`, and then unblock it only for specific sites by overriding the global block rule with a local noop rule. * * * [1] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-quick-guide https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...
• spians 6y ago
  You can disable these annoying prompts by going to https://myaccount.google.com/permissions https://myaccount.google.com/permissions and disabling "Google Account sign-in prompts". Ideally it should have been user opt in but Google followed dark pattern here.
  • huhtenberg 6y ago
    At the risk of stating the obvious - This implies that Google already knows that it's you when it shows the sign-in prompt on some 3rd party website and they are already tracking you there even though you are not signed in. Lovely. Not that you'd expected anything else from Google.
    • kroltan 6y ago
      Yes, the pop-up is for signing into the site with your already-signed-in Google account. If you're not logged in then you use the site's default login mechanism.
    • alisonkisk 6y ago
      Obviously Google knows that you are logged in to Google when you are logged in to Google.
      • speedgoose 6y ago
        And Google knows that you are not logged in to Google when you are not logged in Google on these web sites.
        • zo1 6y ago
          Of course they do. It uses an IFrame request to the Google.com domain (so that the "host" website doesn't see any details before you login). Google can however see who you are because your auth cookies and what-not will be sent along with that Iframe request on whatever host website decides to use this pattern. See: Medium A further issue with this is that Google knows you're on that website because the referrer and request headers will have that on the IFrame request. Edit. I think I replied on the wrong post here.
• usr1106 6y ago
  No I haven't. Because whenever I sign in to Google I do so in a container. And I sign out and destroy tye container as soon as I am done.
• sthm 6y ago
  This is a real problem. One would think that a respectable site would give us the option to recover via email, but that is not the case. I had this exact issue with Kobo yesterday, I'm forced to use Facebook login even though they have my email as a recovery option.
• hombre_fatal 6y ago
  Really the dumbest, most confusing design I've ever seen to make a website seem like it knows who you are when you visit as a guest. When I first saw it on Pinterest, it took me a moment to figure out what I was looking at as a web developer of 20 years. My girlfriend still didn't get it after I was explaining it to her. How does anyone else have a shot at arriving at "oh, so the site doesn't actually have access to this information that's being displayed on the site." When I was younger, I thought good UX design was obvious, something all of us had intuition for as users ourselves. All you do is put yourself in the user's shoes and ask basic questions and use basic empathy. Of course, now being in software for so long, I realize it's one of the rarest and most unrecognized skills.
  • bonoboTP 6y ago
    If you empathize with normal users, you realize they don't care the least about any of this. They want to use a convenient service to do things. To post pictures of themselves, to see what their friends and frenemies are up to, what's the new cool thing etc etc. Login should just work, nobody cares what is displayed where, and which site knows what. Normal people (outside the HN) bubble don't care about these things, like privacy and what data they share. It doesn't get them closer to the things they want to do online, that is post things and consume content.
    • hackmiester 6y ago
      The problem is that it doesn’t really work, because if next time they somehow log in with their email/Twitter/Facebook/Apple ID instead, it will make a new, totally unrelated account, and all their stuff will be mysteriously gone for no apparent reason.