3 ms·
How is this possible? A website cannot just magically cross-domain get your Google account details...
by madeofpalk 3y ago
How is this possible? A website cannot just magically cross-domain get your Google account details...
- reactordev 3y agoBy using the really, really, really badly designed listener auth flow... which just allows javascript to grab your google creds. https://developers.google.com/identity/sign-in/web/listeners https://developers.google.com/identity/sign-in/web/listeners
- madeofpalk 3y agoI guess this never worked on browsers that disables third party cookies by default, like Safari and Firefox?
- reactordev 3y agoincorrect. This works on all browsers, on all platforms. It's a hook into their exposed OAuth2.0 flow. You'd have to disable javascript to stop it. signIn action can be a fetch and you're f$&ked. You'll get the "Sign In With Google" popup (with you're username already snatched).
- bcye 3y agoI've always wondered how on earth this is compliant with GDPR, you do not consent to anything of it.
- HappySweeney 3y agoDoesn't this "bad" design allow Reddit to show a higher DAU? Isn't DAU correlated with ad prices? Sounds like a winning design to me, especially if it only appears that the design is bad, and not the intent behind it.
- reactordev 3y agoOh without a doubt this makes Reddit look like it has way more users than it actually does. 2/3rds of them single visits or visitors with no posts, no comments, no engagement, just someone following a google result.