5 ms·

Great. There's nothing I hate more than an app or game asking to login with Google and redirecting me to a non Google domain. Of course I have a separate email

Great. There's nothing I hate more than an app or game asking to login with Google and redirecting me to a non Google domain. Of course I have a separate email for those cases

Cthulhu_ 5y ago
I've got great distrust for these pop-up "sign in with Google" or whichever SSO provider you have you find in a lot of apps (or even Apple's accounts thing on macos); how can I verify it is in fact Google and not a 3rd party lookalike?
- shadowgovt 5y ago
  Check the URL and check the lock icon. If you're feeling extra paranoid, you can also click the log to get more information on the security certificate to confirm it's the certificate belonging to the provider.
  - mortehu 5y ago
    If it's in an app you don't necessarily get full browser functionality. You just have to trust the app.
    - shadowgovt 5y ago
      Good point. Although in general, if it's an app, it's gone through the vetting process to arrive on its app store and such password-thieving shenanigans would have been caught during that process. (Ensuring the integrity of that process is one of the reasons the app stores constrain so heavily apps that allow for some flavor of self-modification, via embedding a programming language, running downloaded code, etc.).
    - jsnell 5y ago
      Google does not allow oauth from embedded webviews: https://developers.googleblog.com/2021/06/upcoming-security-changes-to-googles-oauth-2.0-authorization-endpoint.html https://developers.googleblog.com/2021/06/upcoming-security-... So you should never need to trust the app.
      - jsmith99 5y ago
        Ironically this is more of a problem now on desktop, where eg a website (such as eBay) in Firefox pops up a PayPal login window without an address bar and there is no way to verify the domain without using developer tools
        tialaramex 5y ago
        Really PayPal should get with the times and offer WebAuthn, where upon it isn't a problem (WebAuthn credentials are domain bound, so, if that window isn't PayPal then it can't have PayPal credentials) Asking humans, who often don't even notice when they wrote an entire word twice in a sentence, to "verify the domain" is nonsense, machines are good at this problem, let the machines do it.
        dcow 5y ago
        Ebay supports WebAuthn, does PayPal not?
        tialaramex 5y ago
        If it does, that's be great, as I do have a PayPal account to solve a problem I had with one payment platform, but when I last looked it only offered TOTP
        tialaramex 5y ago
        I just went to the bother of logging in to my PayPal, it shows only TOTP and some sort of SMS nonsense I won't touch, so, TOTP it is until either PayPal implements WebAuthn or somebody else in this space takes my business (by offering WebAuthn).
- xmodem 5y ago
  On iOS, you get a system-level modal promopt that confirms what domain you're going to, and the domain should be in the title bar of the web view. It's not totally foolproof, of course, an app could bundle its own HTML engine or fake the UI some other way.
- Terr_ 5y ago
  My strategy--which is more browser-centric--is that I open another tab and proactively log in to the identity-provider (Google, Steam, etc.) and only after that do I go to the third-party site. If the flow asks me for my password again, something has gone wrong.
TheJoeMan 5y ago
I wrote a small python script that uses the smtp lib. I don’t want to screw around with Google’s python library for a small script that will surely break every 3 months because google changes something about their auth. So I have a dedicated email and explicitly toggle a switch and they’ll still toggle it back forcibly over time, and now are getting rid of it?

Great. There's nothing I hate more than an app or game asking to login with Google and redirecting me to a non Google domain. Of course I have a separate email for those cases

Cthulhu_ 5y ago

I've got great distrust for these pop-up "sign in with Google" or whichever SSO provider you have you find in a lot of apps (or even Apple's accounts thing on macos); how can I verify it is in fact Google and not a 3rd party lookalike?

shadowgovt 5y ago
Check the URL and check the lock icon. If you're feeling extra paranoid, you can also click the log to get more information on the security certificate to confirm it's the certificate belonging to the provider.
- mortehu 5y ago
  If it's in an app you don't necessarily get full browser functionality. You just have to trust the app.
  - shadowgovt 5y ago
    Good point. Although in general, if it's an app, it's gone through the vetting process to arrive on its app store and such password-thieving shenanigans would have been caught during that process. (Ensuring the integrity of that process is one of the reasons the app stores constrain so heavily apps that allow for some flavor of self-modification, via embedding a programming language, running downloaded code, etc.).
  - jsnell 5y ago
    Google does not allow oauth from embedded webviews: https://developers.googleblog.com/2021/06/upcoming-security-changes-to-googles-oauth-2.0-authorization-endpoint.html https://developers.googleblog.com/2021/06/upcoming-security-... So you should never need to trust the app.
    - jsmith99 5y ago
      Ironically this is more of a problem now on desktop, where eg a website (such as eBay) in Firefox pops up a PayPal login window without an address bar and there is no way to verify the domain without using developer tools
      - tialaramex 5y ago
        Really PayPal should get with the times and offer WebAuthn, where upon it isn't a problem (WebAuthn credentials are domain bound, so, if that window isn't PayPal then it can't have PayPal credentials) Asking humans, who often don't even notice when they wrote an entire word twice in a sentence, to "verify the domain" is nonsense, machines are good at this problem, let the machines do it.
        dcow 5y ago
        Ebay supports WebAuthn, does PayPal not?
        tialaramex 5y ago
        If it does, that's be great, as I do have a PayPal account to solve a problem I had with one payment platform, but when I last looked it only offered TOTP
        tialaramex 5y ago
        I just went to the bother of logging in to my PayPal, it shows only TOTP and some sort of SMS nonsense I won't touch, so, TOTP it is until either PayPal implements WebAuthn or somebody else in this space takes my business (by offering WebAuthn).
xmodem 5y ago
On iOS, you get a system-level modal promopt that confirms what domain you're going to, and the domain should be in the title bar of the web view. It's not totally foolproof, of course, an app could bundle its own HTML engine or fake the UI some other way.
Terr_ 5y ago
My strategy--which is more browser-centric--is that I open another tab and proactively log in to the identity-provider (Google, Steam, etc.) and only after that do I go to the third-party site. If the flow asks me for my password again, something has gone wrong.

TheJoeMan 5y ago

I wrote a small python script that uses the smtp lib. I don’t want to screw around with Google’s python library for a small script that will surely break every 3 months because google changes something about their auth. So I have a dedicated email and explicitly toggle a switch and they’ll still toggle it back forcibly over time, and now are getting rid of it?