11 ms·

Sign in with Google in Chrome

563 points by frizlab 1y ago

nomercy400 1y ago
I always thought drawing over the content area is a no-no, because then anybody can fake that dialog via html/css and make it do something completely different.
hnuser123456 1y ago
I actually needed that button the other day. I have an account on Etsy, but wasn't sure if it was sign in with google or an etsy account using my gmail. Signing in to the website's own "login with google" button was a redirect loop. Requesting password reset sent me no email. At some point Chrome offered to sign-in for me, and that worked.
- yoavm 1y ago
  I'm never confused about what I've used to sign in because I only use randomly generated passwords using my password manager (Bitwarden), and it offers to use them automatically when I go to a website. Another advantage is that Google cannot cut my access to all of my accounts on the internet.
  - bitpush 1y ago
    HN userbase is not representative of the large majority of the users of a service. Most of are fully capable of using a password manager, some even self-hosted that we expose via Tailscale, but for a lot of users, they are using a service to get things done and authentication is a necessary hurdle. Sign in with Google/Apple/Github solves that.
    - o11c 1y ago
      Counterpoint: my parents managed to lock each other out of their shared Amazon account after being coerced into "upgrading" their login method. Thankfully they managed to reset it somehow and go back to saved passwords, which Just Work™.
  - tracker1 1y ago
    Aside: annoying when a site, specifically a govt website URL changes... I get REALLY skeptical if I land on a page my password manager (also Bitwarden) doesn't recognize with my credentials. My local city utilities switched to some kind of google based auth from their previous separate user/password account login. Had to create a new login/account tied to my billing account.
  - linhns 1y ago
    If Bitwarden can come up with something similar, I'd gladly welcome it, even though it's awesome already.
- soraminazuki 1y ago
  You didn't need that button, but rather Etsy needed to test their own website.
cosmotic 1y ago
This popup should be criminal. Ive misclicked the signin button multiple times, causing PII to be sent to a third party I dont trust without my authorization.
- breadwinner 1y ago
  You can create multiple profiles in Chrome. You shouldn't sign into Google in your main profile. That should be reserved for just one profile reserved for Gmail.
  - hundchenkatze 1y ago
    Yes blame the victim
  - autoexec 1y ago
    You can also just not use chrome. It's still a problem that shouldn't exist and the blame for that falls entirely on Google and the websites that push google's crap on users
    - breadwinner 1y ago
      Edge has its own shenanigans. Solution: When signing into Gmail use Edge. When signing int Outlook use Chrome. That way Google/Microsoft can't use your credentials to sign into the browser itself.
      - SlightlyLeftPad 1y ago
        Better: Use browsers not owned by search companies
    - signal11 1y ago
      Safari seems to have this too, now — especially with the latest iOS 18. Any workarounds would be massively appreciated.
josteink 1y ago
Another annoying, possibly less known thing about this popup is that you as a user can disable it. But only if you log in to Google and set a preference for your Google account. No more nagging popups! Sounds great, right? Except Google can now track you, with a confirmed ID and session cookie across all these sites. It’s blackmail, plain and simple.
- frizlab 1y ago
  I never see this popup in my main browser thanks to proper content blockers, but it should not exist in the first place, indeed.
lucb1e 1y ago
Does nobody find this intrusive when it appears on sites like pornhub? Of all places where I'd sign in with a Google account... holy heck, I was very surprised they chose to let Google do that nearly-fullscreen popup on their site upon every visit (since you visit in private tab, it's a fresh session every time) Even on reddit it annoys the heck out of me and I was very surprised they let this third party ruin the experience (when they don't even do it as first party). What if they all start doing it, facebook and github and the lot, you need to click away four banners? But maybe not enough people have privacy extensions installed and reddit can just track them forever and thus store a one-time dismissal. Anyone here in the know whether this doesn't show a measurable drop in returning users?
- justsomehnguy 1y ago
  It sells. But yes, I chuckled the first two time but it quickly got boring. And BTW this clearly indicates what the people who are responsible for this behaviour not only don't bother with this 'use case' but also never use the 'porn mode' themselves.
- w4rh4wk5 1y ago
  Of course! That's why I even added this to my uBlock filter list on mobile: accounts.google.com/gsi/client
  - hammock 1y ago
    How do you get ublock to work in chrome after the update? I tried a fix I found here but it resets every time I restart the browser
    - _nickwhite 1y ago
      Use ungoogled-chromium (or Firefox).
      - godelski 1y ago
        > or Firefox Or just use Firefox because even using chromium is empowering Google to keep playing these games. Maybe you have a problem with Firefox (most people won't notice the difference) but is that problem worse that the problem you have with Google?
codedokode 1y ago
That Google popups are so annoying, they often cover the content, I wonder does Google pay websites for this or they annoy users for free? Also I don't understand who registers Google Accounts these days because every time I try to do this, they show a QR code and require to scan it with a mobile device, and I don't have time now to set up a virtual machine and research what it does to a mobile device and how one can bypass the check. Also if you buy a Google Account it eventually requires linking a phone number, and doesn't accept most of the Russian numbers I buy. So I don't understand how do other people sign up when there are so many obstacles. It is easier just to register email account elsewhere.
- sofixa 1y ago
  You don't sound like the average user. They either already have a gmail, or sign up for one my scanning the QR code you mention. I don't recall if a phone number is mandatory, but the average user probably has one, doesn't mind giving it to Google (to not lose access to their account if they forget their password is a perfectly valid reason for most people). And they'll probably not provide one from a sanctioned terrorist state with a reputation of nefarious cyber activities. Like buying Google Accounts, but much worse too.
- esseph 1y ago
  Well, Android is the largest phone ecosystem in the world. Most of those phones ask you to sign in with your Google account when it first starts.
eddythompson80 1y ago
||accounts.google.com/gsi/*$xhr,script,3p UBO rule to block that. Or enable the “annoyances” list. It hides annoying cookie bs too. Add noscript too.
- HelloUsername 1y ago
  > Add noscript too The Noscript extension becomes redundant with the uBlock Origin extension https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-dont-bother https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don...
  - eddythompson80 1y ago
    Only if you set UBO to block scripts as well. Though I prefer noscript’s UI personally. Edit: To elaborate, you need to turn on “hard mode”[0] for UBO to replace noscript. Then you need to manage it through UBO interface which I don’t like[1] [0] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m... [1] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-quick-guide https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...
signal11 1y ago
“Sign in with Google” is annoying, but at least you can turn it off with chrome://settings/content/federatedIdentityApi Does anyone know how to switch this off on Safari please, especially Mobile Safari. I’ve noticed these sign-in popups on iOS 18.
- pnw 1y ago
  A generic way to stop this across all devices would be great. I don't suppose something can be done with DNS via Pi-hole?
  - eddythompson80 1y ago
    You could block account.google.com (or google.com) if you don’t use any google services or expect anyone on your network to use any google services*. * I think search still works without an account, but I don’t think anything else works that way these days. The last I know was YouTube and I get a “sign in to confirm your age” on YouTube on most videos I try to watch without being logged in.
    - pnw 1y ago
      As much as I'd love to do that, it might be a bridge too far...
- lapcat 1y ago
  There is no switch in Safari. As the blog post mentions, you'd have to use a Safari extension such as StopTheMadness Pro.
- nikisweeting 1y ago
  This option never worked for me, I also tried the options under myaccount.google.com with no luck, I kept getting the popups and ended up having to switch to Brave and Safari to get rid of them.
righthand 1y ago
I save this rule in my pastebox (bitwarden) to add to all my Ublock Origin configs: ||accounts.google.com/gsi/*$xhr,script,3p
promiseofbeans 1y ago
I think this is referring to the FedCM api [1] It works with providers other than Google, just no one else has implemented it yet. Google's One Tap library tries to use the new api, and falls back to the classic One Tap popup when using a browser that doesn't yet implement FedCM (notice how the chrome built-in one says "sign in with google.com" rather than "sign in with Google" like One Tap normally shows) Mozilla are working on implementing it, but it's a pretty complex system so it'll take time. I presume Safari will as well if it gets popular enough [1]: https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API
- mooreds 1y ago
  Yeah, I attend the FedCM meetings. Firefox has one dev working on it who attends regularly. I have found some posts where the safari team has said "seems like a good idea, we'll consider implementing" but have not seen further action. Edge supports it, and it should be relatively easy for the other Chromium based browsers.
  - captn3m0 1y ago
    - https://github.com/WebKit/standards-positions/issues/309 https://github.com/WebKit/standards-positions/issues/309 - https://github.com/mozilla/standards-positions/issues/618 https://github.com/mozilla/standards-positions/issues/618
- kro 1y ago
  What is there to fallback to I wonder - 3rd party cookies should be deprecated/blocked by now, so how can the gsi script retrieve google session information?
deleted 1y ago
[deleted]
mooreds 1y ago
The Chrome experience is actually part of a new standard, Federated Credential Management (or FedCM for short). The idea is to create a browser mediated login experience that gives the identity provider and web app what they need without being able to correlate requests across the Internet. I am working on an article on this topic. If you are interested in learning more, here's a video from a recent auth focused conference (full disclosure: my company put it on and I emceed): https://m.youtube.com/watch?v=FBAD4x7MWdI https://m.youtube.com/watch?v=FBAD4x7MWdI They are actively working on the standard and Firefox has committed to it. Edge already supports it. They are looking for identity provider feedback. More here: https://github.com/w3c-fedid/FedCM https://github.com/w3c-fedid/FedCM (we meet weekly on Tuesdays).
- michaelt 1y ago
  I'm curious - how does the standard make "to continue, google.com will share your name, e-mail address and profile picture" compatible with "a modern, privacy-preserving standard for federated identity on the web" ?? I mean, that doesn't sound privacy-preserving at all?
  - benlivengood 1y ago
    Why would you share your real name with Google when making a gmail account, or use your real picture? It's fine to be pseudonymous on the Internet if you are in control of your pseudonyms, which Google accounts actually does allow with some extra work (don't mix your chrome profiles and Google accounts, etc.) Or, like me, you can roll the dice on real names on the Internet (for professional things mostly)
    - oefrha 1y ago
      > Why would you share your real name with Google when making a gmail account, or use your real picture? Google made a big push in that direction starting in the Google+ era. IIRC at some point my fake names were rejected by Google and I had to change to more plausible fake names. You can't fault regular people for falling into Big Tech's traps.
  - 1y ago
1a527dd5 1y ago
You can turn this off 1. https://myaccount.google.com/connections/settings https://myaccount.google.com/connections/settings for mobile 2. same link, sidebar help, for Chrome on Desktop settings.
- mmsc 1y ago
  this requires being signed in (obviously), which doesn't help with the limit tracking part of hating these things
- avel 1y ago
  That does not completely turn off the federated sign-in popup you see on the top right in various websites. The solution is actually already mentioned in the article.
ashvardanian 1y ago
First, “Accept all cookies”, and now this. The competition for the worst web UX is heating up.
- reddalo 1y ago
  Firefox + uBlock Origin is the only sane way to browse the web in 2025.
tantalor 1y ago
> ... example of Google advantaging ... Way to bury the lead. Anyway, what's the advantage? Please elaborate.
- lapcat 1y ago
  The blog post elaborates. But to summarize: 1) The annoying Sign in with Google banners appear in Firefox and Safari with no toggle to disable them, even if you aren't logged in with Google, even if you don't have a Google account. 2) Those banners do not appear at all in Chrome. 3) There is a Chrome-specific sign-in UI, but it appears only if you're already signed in to your Google account in Chrome. 4) You can disable the Chrome-specific sign-in UI in Chrome settings. So Chrome users have control, whereas Firefox and Safari users are inundated with annoyance.
- jdiff 1y ago
  Being able to shut the damn thing off.
- supportengineer 1y ago
  https://www.merriam-webster.com/wordplay/bury-the-lede-versus-lead https://www.merriam-webster.com/wordplay/bury-the-lede-versu...
theggiveth 1y ago
As others mentioned, this is backed by the "open" standard FedCM. While this seems like an open play on the surface (and the standard is open), in practice this is a highly anti-competitive and will just lead to Google being in even more control of the web. The vast majority of users will chose the default for identity. On Chrome this is Google. On Android this is Google. Even on iOS this may be Google because identity is often tied to email and Apple does not have a strong email story. Identity is huge. It gives you moat that outlives platforms. And all the while, Google gets to claim this standard is open, while in practice this is clearly intended as a monopolistic move to increase their share of identity on the web. If they were forced to show a randomized list of identity providers a user needs to choose from (similar to search engines on iOS), I bet you they would reconsider this whole approach. But by the time regulators figure out what's going on, they will have already cemented their lead.
- WorldMaker 1y ago
  This "standard" also seems interestingly timed with respect to Passkey adoption, too. If one were feeling pessimistic enough, it almost seems too easy to suggest some interests exist here that want to muddy the sign-in waters to capture users considering switching to Passkeys before they actually switch to Passkeys.
  - JambalayaJimbo 1y ago
    These are orthogonal concerns. Passkeys don't meaningfully simplify the account creation process.
    - WorldMaker 1y ago
      Having implemented Passkey-only account creation (and management) I would absolutely disagree. I think that Passkeys can greatly streamline the process. The iOS Passkey flow especially feels as simple by default as the "Sign in with Apple" flow (with the ability to customize it with smart password managers in a way you'd never be able to with "Sign in with Apple"). That's partly because Apple sees it their job to migrate people away from OIDC-style signups, for privacy reasons if nothing else, and towards Passkeys, so their UX team is doing a remarkable job trying to reduce friction. What's Google's interests here? Are there intentional reasons the Android and Chrome Passkey flows don't "simplify" the account creation process enough? It's easy to be cynical here, and seeing them as orthogonal concerns also feels like muddying waters that shouldn't be muddied right now.
mattigames 1y ago
Not only that, on Chrome this popup shows up on TOP of the search dialog and no way to push it behind it (screenshot and write up at https://ivanca.tumblr.com/post/790352779945410560/on-chrome-the-google-login-dialog-shows-up-on-top https://ivanca.tumblr.com/post/790352779945410560/on-chrome-... )
andrei_says_ 1y ago
Adding img { max-width: 100%;} To this site’s css will fix the layout on mobile.
coffeecoders 1y ago
uBlock is great for this. Settings > Filter lists and Enable Annoyances.
chrsw 1y ago
It's not just a Google annoyance, these types of things are all over the web. I have uBlock Origin settings to limit these types of things, like others in this thread have explained. But there's a bigger issue with the modern web. Here's my message to any web developer, company, organization, anyone who has control over content on the public web: if I visit your page and I have to click away something in order to do what I came to do, you have failed miserably.
rtpg 1y ago
Kinda related to this: I _really_ wish that SSO providers would be better about telling me when my account was already used to log into a service. When I hit "sign in with Google", see my 4 accounts, and have to guess which one I used to sign into the service... Maybe I'm missing some security detail here
- _2d30 1y ago
  The problem is that at that point in the flow, it's owned by the SSO provider. The SSO provider can't know with certainty what account has an active account with the website.
  - ehsankia 1y ago
    And I don't think it makes sense for the SSO provider to leak a list of all your accounts to the website either. That being said, I think the SSO provider could maybe track that information maybe?
  - armen52 1y ago
    I don't think that's true though? The OAuth provider knows which third parties you have authorized to have access to your account(s) as well as what information or privileges you've approved for each. And when you land on that screen, they know which third party referred you to them. In other words, they could definitely highlight or otherwise hint to you which of the Google accounts you've already approved/used via one or more of your authenticated Google accounts.
    - _2d30 1y ago
      The provider knows you have given those privileges _at some point_ but it doesn't know if that account still exists or anything about the state of the account. So, yes, they could do more to highlight _potential_ accounts but it's not the case that they have any visibility into the actual state of accounts.
  - rtpg 1y ago
    They could thought right? because if you login to a website (that's passed along an ID) then you would have that bit set. I don't need to know for certain the account on the receiving side exists, just that I have signed in before with it. Facebook does this at least! Like "has an account" isn't possible without leakage, but "has logged in through this flow before" (hell, stick timestamps in there too!) does. One thought though: your SSO provider has that account list, but often prompts a re-login. So it could be that your SSO provider account picker _doesn't have access to your account information fully either_.
cebert 1y ago
I get why Google finds this advantageous, but I don’t understand why so many brands want to willingly diminish the impression and reputation of their web properties by adding “Sign in with Google.”
- Barrin92 1y ago
  >want to willingly diminish the impression and reputation of their web properties because that's not what happening. The average Chrome user finds that feature useful, and personally I have to agree because having a sign-in option through the browser chrome (the non-content portion of the application, bad name in this case) is significantly more sane from a security standpoint than trusting the webpage operator. why are these threads always full of performative indignation by people who know perfectly well that 99% of people aren't going to be upset
  - edg5000 1y ago
    > The average Chrome user finds that feature useful I don´t know about that. It displays on so many sites where I was not intending to login at all. If I want to login, I would have clicked on the websites' login button. This popup really blatantly shows that Google is everywhere, even if that was already the case. It's possible that this actually reflects badly on Google as a whole.
  - soraminazuki 1y ago
    Poor Google, they have to screw over the entire online population for their own sake. The masses love being screwed over, which is why Google uses dark patterns instead of having people make informed decisions. That this helps make Google even richer is just a happy accident. Shame on technologists who question Google's morality! Yep, that logic makes total sense. /s
nikisweeting 1y ago
The crazy part is that the popup is not part of the DOM, it's injected by the browser *over the page content*. If it were in a browser toolbar I woudln't mind, but obscuring page content is just asking for an antitrust suit. I left chrome and switched to Brave 6mo ago because I couldn't get these "Sign in with Google" popups to stop. I tried both the chrome://settings/content/federatedIdentityApi option and the option under https://myaccount.google.com/ https://myaccount.google.com/ and neither one worked, I just kept getting them.
- ChadNauseam 1y ago
  > just asking for an antitrust suit According to other commenters in here [0], it's an open standard and other identity providers are allowed, not just google [0]: https://news.ycombinator.com/item?id=44715875 https://news.ycombinator.com/item?id=44715875
  - nikisweeting 1y ago
    Still an unforgivable violation of trust to have a floating popup over the content that's not part of the DOM and not part of the browser's normal native UI. I never want my browser to inject unblockable overlays over sites I'm trying to browse.
chenzhekl 1y ago
I hate this banner. It made my Vimium addon unable to work unless I pressed Esc first.
ankurdhama 1y ago
This stupid pop-up (being a "window" of its own and not a DOM popup) also steal focus back to the chrome window. For example: open reddit.com in chrome (without logged in to reddit) and before the page loads switch to another app window, when the popup is ready the chrome window will get focused again.
fitsumbelay 1y ago
that federated id api setting was crucial. danke shoen OP
aorth 1y ago
> This is what Google calls the One Tap user experience. Fortunately, my web browser extension StopTheMadness Pro hides “Sign in with Google” banners. This sounds awesome. I like the author's classification of this and other anti-user website behaviors as "madness". Are there any similar add-ons for Firefox?
- AnonC 1y ago
  StopTheMadness provides browser extensions for Safari, Firefox and Chrome. But it’s a paid product AFAIK. I don’t know of similar Firefox extensions that do everything that this one does or allows one to do.
  - aorth 1y ago
    I have used the Don't Fuck With Paste extension https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi... in Firefox for a few years. Seems to work well when I need it (and when I remember to try it, as it needs enabling on a per-site basis). For removing tracking query parameters from the URL I've used ClearURLs https://addons.mozilla.org/en-US/firefox/addon/clearurls/ https://addons.mozilla.org/en-US/firefox/addon/clearurls/ for a few years. uBlock Origin is still fully functional in Firefox as well so I guess I could find a way to block the "Sign in with Google" prompts somehow with a custom rule.
- weberer 1y ago
  I use uMatrix to block all third-party requests by default.
Lavia21 1y ago
[flagged]
- karel-3d 1y ago
  Is this scam still available?
omnifischer 1y ago
https://issuetracker.google.com/issues/343584523 https://issuetracker.google.com/issues/343584523 Nobody cares.
londons_explore 1y ago
Am I the only one who likes this? Every other sign in solution seems to involve multiple clicks and loads of redirects and loading time. It seems to even beat a password manager because there is no need to wait for a login form to load and be prefilled. Googles solution frequently has you signed in within 1 second and 1 click.
- barbs 1y ago
  Not sure if it's a result of multiple privacy extensions or whatever but it's about a coin-flip on whether Google login actually works for me.
Razengan 1y ago
Those obnoxious Sign In With Google overlays on so many sites like Reddit, or any other "Sign In With ETC" should be outlawed honestly.
qwertox 1y ago
I hate this popup so much. This is on the same level as adblockers displaying "premium" ads.
eadmund 1y ago
I absolutely hate the ‘Sign in with Google’ prompt and I am very concerned that I will either accidentally or absent-mindedly tap on it and share my email address and identity with some random untrustworthy website. The idea of identity managed by one’s browser is a pretty decent one, but the implementation which ties it to other information such as email address and which makes it so easy to accidentally use is user-hostile.
mikelinsi 1y ago
It's odd how these browser popups—especially ones like the notification permission dialog—essentially hijack the Mac interface. I can't swipe to go back using the trackpad until I manually close the popup.
auscompgeek 1y ago
> Indeed, while Chrome is displaying the dialog, it blocks all Chrome extension popup windows from appearing. We discovered this one the hard way at work. I keep learning this the hard way myself because I've been working on browser extension dev lately. I don't understand how this could possibly be an intended feature.
Pesthuf 1y ago
On today's episode of "Addicted to the AdTech browser": Our protagonist face yet another case of being fucked over by their favorite advertisement and surveillance vehicle disguised as a web browser. How will they gaslight themselves into keeping their toxic relationship with Chrome alive rather than switching to a browser that respects their privacy and sanity this time?! > Just one more extension, just one more chrome://flags tweak... He loves me, he respects me, he just has a ... unique way of showing it... I'll just tell my friends I fell and that's why my eye is black... Chrome, I'm sorry I'm not good enough, I probably deserve this...
Vinnl 1y ago
> What you may not realize if you use Safari or Firefox is that the banners are never displayed in Google Chrome! Ah, so that's why so many websites are OK with it - they probably just don't realise that it's there. > If the courts and antitrust regulators are reading—they probably won’t read my blog, but one can dream—this is yet another example of Google advantaging its own browser Chrome over other web browsers. And vice versa: how Google is advantaging its own SSO/data collection platform over others, through Chrome.
- nikisweeting 1y ago
  > the banners are never displayed in Google Chrome! this is demonstrably false, I can share dozens of screenshots of this popup appearing in Chrome despite all the options checked that are supposed to disable it.
  - nikisweeting 1y ago
    Here's the worst one I've seen so far, it's showing one for Quora on the Chrome settings page! https://x.com/thesquashSH/status/1788553660357915017 https://x.com/thesquashSH/status/1788553660357915017
  - Vinnl 1y ago
    Yeah the article mentions those, but those are inserted by Chrome, i.e. the website owner might not realise that they can prevent them from being shown themselves. But yes, I'm glad my browser doesn't add them, and that I can block them in uBO.
causality0 1y ago
"Sign in with Google" has become the new un-blockable popup for me. I fucking hate it.
jstummbillig 1y ago
Unpopular opinion (apparently): I like this a lot. Sign up flows are annoying, and rarely well designed. Getting around them is nice.
mort96 1y ago
I don't get why so many sites allow a Google pop-up to cover half their content.
bobbob1921 1y ago
While I agree with the 50+ comments I’ve read here, I think the point is being missed (or I just haven’t gotten to this comment yet) - these super annoying pop-ups should only be a thing AFTER you’ve clicked on login or register. In fact they shouldn’t appear and should instead just be a button the user can click if they wish to use their Google account as the login device for XYZ site. In other words there’s no reason for these to appear when you first visit a webpage, they should only be relevant when the user has taken action specifically to login, or is looking to register an account at xyz.com It’s as if someone at Google saw the whole cookie banner -> accept cookies fiasco and said wow this seems like a good idea let’s add our own
hombre_fatal 1y ago
What's crazy is that it trains users to trust a component that can be faked by the website. You can mimic the component and then redirect the button anywhere, and the user is primed to comply with whatever they see. Like a fake "Actually it seems like your Google account is compromised. Please verify that it's you by doing X." This kind of shit-tier feature should at the very least appear inside the browser chrome, not inset in/over the website. I'm so tired of amateur slop from megacorps that should know better.
- nikisweeting 1y ago
  100% the implementation is setting a terrible precedent to trust non-browser-native-looking UI for whats supposed to be a browser-level feature.
ls-a 1y ago
Thank you. I have been wanting to disable that popup forever
Friedduck 1y ago
Our Enterprise Chrome doesn't allow me to access the page to disable this behavior. Signing out of Chrome (but leaving extensions and bookmarks) is the only way I've found to stop the never-ending Google sign-in prompts. If someone's found a setting page that does what he describes please reply here. This makes me crazy and seems incredibly risky.

563 points by frizlab 1y ago

I always thought drawing over the content area is a no-no, because then anybody can fake that dialog via html/css and make it do something completely different.

hnuser123456 1y ago

I actually needed that button the other day. I have an account on Etsy, but wasn't sure if it was sign in with google or an etsy account using my gmail. Signing in to the website's own "login with google" button was a redirect loop. Requesting password reset sent me no email. At some point Chrome offered to sign-in for me, and that worked.

yoavm 1y ago
I'm never confused about what I've used to sign in because I only use randomly generated passwords using my password manager (Bitwarden), and it offers to use them automatically when I go to a website. Another advantage is that Google cannot cut my access to all of my accounts on the internet.
- bitpush 1y ago
  HN userbase is not representative of the large majority of the users of a service. Most of are fully capable of using a password manager, some even self-hosted that we expose via Tailscale, but for a lot of users, they are using a service to get things done and authentication is a necessary hurdle. Sign in with Google/Apple/Github solves that.
  - o11c 1y ago
    Counterpoint: my parents managed to lock each other out of their shared Amazon account after being coerced into "upgrading" their login method. Thankfully they managed to reset it somehow and go back to saved passwords, which Just Work™.
- tracker1 1y ago
  Aside: annoying when a site, specifically a govt website URL changes... I get REALLY skeptical if I land on a page my password manager (also Bitwarden) doesn't recognize with my credentials. My local city utilities switched to some kind of google based auth from their previous separate user/password account login. Had to create a new login/account tied to my billing account.
- linhns 1y ago
  If Bitwarden can come up with something similar, I'd gladly welcome it, even though it's awesome already.
soraminazuki 1y ago
You didn't need that button, but rather Etsy needed to test their own website.

cosmotic 1y ago

This popup should be criminal. Ive misclicked the signin button multiple times, causing PII to be sent to a third party I dont trust without my authorization.

breadwinner 1y ago
You can create multiple profiles in Chrome. You shouldn't sign into Google in your main profile. That should be reserved for just one profile reserved for Gmail.
- hundchenkatze 1y ago
  Yes blame the victim
- autoexec 1y ago
  You can also just not use chrome. It's still a problem that shouldn't exist and the blame for that falls entirely on Google and the websites that push google's crap on users
  - breadwinner 1y ago
    Edge has its own shenanigans. Solution: When signing into Gmail use Edge. When signing int Outlook use Chrome. That way Google/Microsoft can't use your credentials to sign into the browser itself.
    - SlightlyLeftPad 1y ago
      Better: Use browsers not owned by search companies
  - signal11 1y ago
    Safari seems to have this too, now — especially with the latest iOS 18. Any workarounds would be massively appreciated.

josteink 1y ago

Another annoying, possibly less known thing about this popup is that you as a user can disable it. But only if you log in to Google and set a preference for your Google account. No more nagging popups! Sounds great, right? Except Google can now track you, with a confirmed ID and session cookie across all these sites. It’s blackmail, plain and simple.

frizlab 1y ago
I never see this popup in my main browser thanks to proper content blockers, but it should not exist in the first place, indeed.

lucb1e 1y ago

Does nobody find this intrusive when it appears on sites like pornhub? Of all places where I'd sign in with a Google account... holy heck, I was very surprised they chose to let Google do that nearly-fullscreen popup on their site upon every visit (since you visit in private tab, it's a fresh session every time) Even on reddit it annoys the heck out of me and I was very surprised they let this third party ruin the experience (when they don't even do it as first party). What if they all start doing it, facebook and github and the lot, you need to click away four banners? But maybe not enough people have privacy extensions installed and reddit can just track them forever and thus store a one-time dismissal. Anyone here in the know whether this doesn't show a measurable drop in returning users?

justsomehnguy 1y ago
It sells. But yes, I chuckled the first two time but it quickly got boring. And BTW this clearly indicates what the people who are responsible for this behaviour not only don't bother with this 'use case' but also never use the 'porn mode' themselves.
w4rh4wk5 1y ago
Of course! That's why I even added this to my uBlock filter list on mobile: accounts.google.com/gsi/client
- hammock 1y ago
  How do you get ublock to work in chrome after the update? I tried a fix I found here but it resets every time I restart the browser
  - _nickwhite 1y ago
    Use ungoogled-chromium (or Firefox).
    - godelski 1y ago
      > or Firefox Or just use Firefox because even using chromium is empowering Google to keep playing these games. Maybe you have a problem with Firefox (most people won't notice the difference) but is that problem worse that the problem you have with Google?

codedokode 1y ago

That Google popups are so annoying, they often cover the content, I wonder does Google pay websites for this or they annoy users for free? Also I don't understand who registers Google Accounts these days because every time I try to do this, they show a QR code and require to scan it with a mobile device, and I don't have time now to set up a virtual machine and research what it does to a mobile device and how one can bypass the check. Also if you buy a Google Account it eventually requires linking a phone number, and doesn't accept most of the Russian numbers I buy. So I don't understand how do other people sign up when there are so many obstacles. It is easier just to register email account elsewhere.

sofixa 1y ago
You don't sound like the average user. They either already have a gmail, or sign up for one my scanning the QR code you mention. I don't recall if a phone number is mandatory, but the average user probably has one, doesn't mind giving it to Google (to not lose access to their account if they forget their password is a perfectly valid reason for most people). And they'll probably not provide one from a sanctioned terrorist state with a reputation of nefarious cyber activities. Like buying Google Accounts, but much worse too.
esseph 1y ago
Well, Android is the largest phone ecosystem in the world. Most of those phones ask you to sign in with your Google account when it first starts.

eddythompson80 1y ago

||accounts.google.com/gsi/*$xhr,script,3p UBO rule to block that. Or enable the “annoyances” list. It hides annoying cookie bs too. Add noscript too.

HelloUsername 1y ago
> Add noscript too The Noscript extension becomes redundant with the uBlock Origin extension https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-dont-bother https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don...
- eddythompson80 1y ago
  Only if you set UBO to block scripts as well. Though I prefer noscript’s UI personally. Edit: To elaborate, you need to turn on “hard mode”[0] for UBO to replace noscript. Then you need to manage it through UBO interface which I don’t like[1] [0] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m... [1] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-quick-guide https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...

signal11 1y ago

“Sign in with Google” is annoying, but at least you can turn it off with chrome://settings/content/federatedIdentityApi Does anyone know how to switch this off on Safari please, especially Mobile Safari. I’ve noticed these sign-in popups on iOS 18.

pnw 1y ago
A generic way to stop this across all devices would be great. I don't suppose something can be done with DNS via Pi-hole?
- eddythompson80 1y ago
  You could block account.google.com (or google.com) if you don’t use any google services or expect anyone on your network to use any google services*. * I think search still works without an account, but I don’t think anything else works that way these days. The last I know was YouTube and I get a “sign in to confirm your age” on YouTube on most videos I try to watch without being logged in.
  - pnw 1y ago
    As much as I'd love to do that, it might be a bridge too far...
lapcat 1y ago
There is no switch in Safari. As the blog post mentions, you'd have to use a Safari extension such as StopTheMadness Pro.
nikisweeting 1y ago
This option never worked for me, I also tried the options under myaccount.google.com with no luck, I kept getting the popups and ended up having to switch to Brave and Safari to get rid of them.

righthand 1y ago

I save this rule in my pastebox (bitwarden) to add to all my Ublock Origin configs: ||accounts.google.com/gsi/*$xhr,script,3p

promiseofbeans 1y ago

I think this is referring to the FedCM api [1] It works with providers other than Google, just no one else has implemented it yet. Google's One Tap library tries to use the new api, and falls back to the classic One Tap popup when using a browser that doesn't yet implement FedCM (notice how the chrome built-in one says "sign in with google.com" rather than "sign in with Google" like One Tap normally shows) Mozilla are working on implementing it, but it's a pretty complex system so it'll take time. I presume Safari will as well if it gets popular enough [1]: https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API

mooreds 1y ago
Yeah, I attend the FedCM meetings. Firefox has one dev working on it who attends regularly. I have found some posts where the safari team has said "seems like a good idea, we'll consider implementing" but have not seen further action. Edge supports it, and it should be relatively easy for the other Chromium based browsers.
- captn3m0 1y ago
  - https://github.com/WebKit/standards-positions/issues/309 https://github.com/WebKit/standards-positions/issues/309 - https://github.com/mozilla/standards-positions/issues/618 https://github.com/mozilla/standards-positions/issues/618
kro 1y ago
What is there to fallback to I wonder - 3rd party cookies should be deprecated/blocked by now, so how can the gsi script retrieve google session information?

deleted 1y ago

[deleted]

mooreds 1y ago

The Chrome experience is actually part of a new standard, Federated Credential Management (or FedCM for short). The idea is to create a browser mediated login experience that gives the identity provider and web app what they need without being able to correlate requests across the Internet. I am working on an article on this topic. If you are interested in learning more, here's a video from a recent auth focused conference (full disclosure: my company put it on and I emceed): https://m.youtube.com/watch?v=FBAD4x7MWdI https://m.youtube.com/watch?v=FBAD4x7MWdI They are actively working on the standard and Firefox has committed to it. Edge already supports it. They are looking for identity provider feedback. More here: https://github.com/w3c-fedid/FedCM https://github.com/w3c-fedid/FedCM (we meet weekly on Tuesdays).

michaelt 1y ago
I'm curious - how does the standard make "to continue, google.com will share your name, e-mail address and profile picture" compatible with "a modern, privacy-preserving standard for federated identity on the web" ?? I mean, that doesn't sound privacy-preserving at all?
- benlivengood 1y ago
  Why would you share your real name with Google when making a gmail account, or use your real picture? It's fine to be pseudonymous on the Internet if you are in control of your pseudonyms, which Google accounts actually does allow with some extra work (don't mix your chrome profiles and Google accounts, etc.) Or, like me, you can roll the dice on real names on the Internet (for professional things mostly)
  - oefrha 1y ago
    > Why would you share your real name with Google when making a gmail account, or use your real picture? Google made a big push in that direction starting in the Google+ era. IIRC at some point my fake names were rejected by Google and I had to change to more plausible fake names. You can't fault regular people for falling into Big Tech's traps.
- 1y ago

1a527dd5 1y ago

You can turn this off 1. https://myaccount.google.com/connections/settings https://myaccount.google.com/connections/settings for mobile 2. same link, sidebar help, for Chrome on Desktop settings.

mmsc 1y ago
this requires being signed in (obviously), which doesn't help with the limit tracking part of hating these things
avel 1y ago
That does not completely turn off the federated sign-in popup you see on the top right in various websites. The solution is actually already mentioned in the article.

ashvardanian 1y ago

First, “Accept all cookies”, and now this. The competition for the worst web UX is heating up.

reddalo 1y ago
Firefox + uBlock Origin is the only sane way to browse the web in 2025.

tantalor 1y ago

> ... example of Google advantaging ... Way to bury the lead. Anyway, what's the advantage? Please elaborate.

lapcat 1y ago
The blog post elaborates. But to summarize: 1) The annoying Sign in with Google banners appear in Firefox and Safari with no toggle to disable them, even if you aren't logged in with Google, even if you don't have a Google account. 2) Those banners do not appear at all in Chrome. 3) There is a Chrome-specific sign-in UI, but it appears only if you're already signed in to your Google account in Chrome. 4) You can disable the Chrome-specific sign-in UI in Chrome settings. So Chrome users have control, whereas Firefox and Safari users are inundated with annoyance.
jdiff 1y ago
Being able to shut the damn thing off.
supportengineer 1y ago
https://www.merriam-webster.com/wordplay/bury-the-lede-versus-lead https://www.merriam-webster.com/wordplay/bury-the-lede-versu...

theggiveth 1y ago

As others mentioned, this is backed by the "open" standard FedCM. While this seems like an open play on the surface (and the standard is open), in practice this is a highly anti-competitive and will just lead to Google being in even more control of the web. The vast majority of users will chose the default for identity. On Chrome this is Google. On Android this is Google. Even on iOS this may be Google because identity is often tied to email and Apple does not have a strong email story. Identity is huge. It gives you moat that outlives platforms. And all the while, Google gets to claim this standard is open, while in practice this is clearly intended as a monopolistic move to increase their share of identity on the web. If they were forced to show a randomized list of identity providers a user needs to choose from (similar to search engines on iOS), I bet you they would reconsider this whole approach. But by the time regulators figure out what's going on, they will have already cemented their lead.

WorldMaker 1y ago
This "standard" also seems interestingly timed with respect to Passkey adoption, too. If one were feeling pessimistic enough, it almost seems too easy to suggest some interests exist here that want to muddy the sign-in waters to capture users considering switching to Passkeys before they actually switch to Passkeys.
- JambalayaJimbo 1y ago
  These are orthogonal concerns. Passkeys don't meaningfully simplify the account creation process.
  - WorldMaker 1y ago
    Having implemented Passkey-only account creation (and management) I would absolutely disagree. I think that Passkeys can greatly streamline the process. The iOS Passkey flow especially feels as simple by default as the "Sign in with Apple" flow (with the ability to customize it with smart password managers in a way you'd never be able to with "Sign in with Apple"). That's partly because Apple sees it their job to migrate people away from OIDC-style signups, for privacy reasons if nothing else, and towards Passkeys, so their UX team is doing a remarkable job trying to reduce friction. What's Google's interests here? Are there intentional reasons the Android and Chrome Passkey flows don't "simplify" the account creation process enough? It's easy to be cynical here, and seeing them as orthogonal concerns also feels like muddying waters that shouldn't be muddied right now.

mattigames 1y ago

Not only that, on Chrome this popup shows up on TOP of the search dialog and no way to push it behind it (screenshot and write up at https://ivanca.tumblr.com/post/790352779945410560/on-chrome-the-google-login-dialog-shows-up-on-top https://ivanca.tumblr.com/post/790352779945410560/on-chrome-... )

andrei_says_ 1y ago

Adding img { max-width: 100%;} To this site’s css will fix the layout on mobile.

coffeecoders 1y ago

uBlock is great for this. Settings > Filter lists and Enable Annoyances.

chrsw 1y ago

It's not just a Google annoyance, these types of things are all over the web. I have uBlock Origin settings to limit these types of things, like others in this thread have explained. But there's a bigger issue with the modern web. Here's my message to any web developer, company, organization, anyone who has control over content on the public web: if I visit your page and I have to click away something in order to do what I came to do, you have failed miserably.

rtpg 1y ago

Kinda related to this: I _really_ wish that SSO providers would be better about telling me when my account was already used to log into a service. When I hit "sign in with Google", see my 4 accounts, and have to guess which one I used to sign into the service... Maybe I'm missing some security detail here

_2d30 1y ago
The problem is that at that point in the flow, it's owned by the SSO provider. The SSO provider can't know with certainty what account has an active account with the website.
- ehsankia 1y ago
  And I don't think it makes sense for the SSO provider to leak a list of all your accounts to the website either. That being said, I think the SSO provider could maybe track that information maybe?
- armen52 1y ago
  I don't think that's true though? The OAuth provider knows which third parties you have authorized to have access to your account(s) as well as what information or privileges you've approved for each. And when you land on that screen, they know which third party referred you to them. In other words, they could definitely highlight or otherwise hint to you which of the Google accounts you've already approved/used via one or more of your authenticated Google accounts.
  - _2d30 1y ago
    The provider knows you have given those privileges _at some point_ but it doesn't know if that account still exists or anything about the state of the account. So, yes, they could do more to highlight _potential_ accounts but it's not the case that they have any visibility into the actual state of accounts.
- rtpg 1y ago
  They could thought right? because if you login to a website (that's passed along an ID) then you would have that bit set. I don't need to know for certain the account on the receiving side exists, just that I have signed in before with it. Facebook does this at least! Like "has an account" isn't possible without leakage, but "has logged in through this flow before" (hell, stick timestamps in there too!) does. One thought though: your SSO provider has that account list, but often prompts a re-login. So it could be that your SSO provider account picker _doesn't have access to your account information fully either_.

cebert 1y ago

I get why Google finds this advantageous, but I don’t understand why so many brands want to willingly diminish the impression and reputation of their web properties by adding “Sign in with Google.”

Barrin92 1y ago
>want to willingly diminish the impression and reputation of their web properties because that's not what happening. The average Chrome user finds that feature useful, and personally I have to agree because having a sign-in option through the browser chrome (the non-content portion of the application, bad name in this case) is significantly more sane from a security standpoint than trusting the webpage operator. why are these threads always full of performative indignation by people who know perfectly well that 99% of people aren't going to be upset
- edg5000 1y ago
  > The average Chrome user finds that feature useful I don´t know about that. It displays on so many sites where I was not intending to login at all. If I want to login, I would have clicked on the websites' login button. This popup really blatantly shows that Google is everywhere, even if that was already the case. It's possible that this actually reflects badly on Google as a whole.
- soraminazuki 1y ago
  Poor Google, they have to screw over the entire online population for their own sake. The masses love being screwed over, which is why Google uses dark patterns instead of having people make informed decisions. That this helps make Google even richer is just a happy accident. Shame on technologists who question Google's morality! Yep, that logic makes total sense. /s

nikisweeting 1y ago

The crazy part is that the popup is not part of the DOM, it's injected by the browser *over the page content*. If it were in a browser toolbar I woudln't mind, but obscuring page content is just asking for an antitrust suit. I left chrome and switched to Brave 6mo ago because I couldn't get these "Sign in with Google" popups to stop. I tried both the chrome://settings/content/federatedIdentityApi option and the option under https://myaccount.google.com/ https://myaccount.google.com/ and neither one worked, I just kept getting them.

ChadNauseam 1y ago
> just asking for an antitrust suit According to other commenters in here [0], it's an open standard and other identity providers are allowed, not just google [0]: https://news.ycombinator.com/item?id=44715875 https://news.ycombinator.com/item?id=44715875
- nikisweeting 1y ago
  Still an unforgivable violation of trust to have a floating popup over the content that's not part of the DOM and not part of the browser's normal native UI. I never want my browser to inject unblockable overlays over sites I'm trying to browse.

chenzhekl 1y ago

I hate this banner. It made my Vimium addon unable to work unless I pressed Esc first.

ankurdhama 1y ago

This stupid pop-up (being a "window" of its own and not a DOM popup) also steal focus back to the chrome window. For example: open reddit.com in chrome (without logged in to reddit) and before the page loads switch to another app window, when the popup is ready the chrome window will get focused again.

fitsumbelay 1y ago

that federated id api setting was crucial. danke shoen OP

aorth 1y ago

> This is what Google calls the One Tap user experience. Fortunately, my web browser extension StopTheMadness Pro hides “Sign in with Google” banners. This sounds awesome. I like the author's classification of this and other anti-user website behaviors as "madness". Are there any similar add-ons for Firefox?

AnonC 1y ago
StopTheMadness provides browser extensions for Safari, Firefox and Chrome. But it’s a paid product AFAIK. I don’t know of similar Firefox extensions that do everything that this one does or allows one to do.
- aorth 1y ago
  I have used the Don't Fuck With Paste extension https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi... in Firefox for a few years. Seems to work well when I need it (and when I remember to try it, as it needs enabling on a per-site basis). For removing tracking query parameters from the URL I've used ClearURLs https://addons.mozilla.org/en-US/firefox/addon/clearurls/ https://addons.mozilla.org/en-US/firefox/addon/clearurls/ for a few years. uBlock Origin is still fully functional in Firefox as well so I guess I could find a way to block the "Sign in with Google" prompts somehow with a custom rule.
weberer 1y ago
I use uMatrix to block all third-party requests by default.

Lavia21 1y ago

[flagged]

karel-3d 1y ago
Is this scam still available?

omnifischer 1y ago

https://issuetracker.google.com/issues/343584523 https://issuetracker.google.com/issues/343584523 Nobody cares.

londons_explore 1y ago

Am I the only one who likes this? Every other sign in solution seems to involve multiple clicks and loads of redirects and loading time. It seems to even beat a password manager because there is no need to wait for a login form to load and be prefilled. Googles solution frequently has you signed in within 1 second and 1 click.

barbs 1y ago
Not sure if it's a result of multiple privacy extensions or whatever but it's about a coin-flip on whether Google login actually works for me.

Razengan 1y ago

Those obnoxious Sign In With Google overlays on so many sites like Reddit, or any other "Sign In With ETC" should be outlawed honestly.

qwertox 1y ago

I hate this popup so much. This is on the same level as adblockers displaying "premium" ads.

eadmund 1y ago

I absolutely hate the ‘Sign in with Google’ prompt and I am very concerned that I will either accidentally or absent-mindedly tap on it and share my email address and identity with some random untrustworthy website. The idea of identity managed by one’s browser is a pretty decent one, but the implementation which ties it to other information such as email address and which makes it so easy to accidentally use is user-hostile.

mikelinsi 1y ago

It's odd how these browser popups—especially ones like the notification permission dialog—essentially hijack the Mac interface. I can't swipe to go back using the trackpad until I manually close the popup.

auscompgeek 1y ago

> Indeed, while Chrome is displaying the dialog, it blocks all Chrome extension popup windows from appearing. We discovered this one the hard way at work. I keep learning this the hard way myself because I've been working on browser extension dev lately. I don't understand how this could possibly be an intended feature.

Pesthuf 1y ago

On today's episode of "Addicted to the AdTech browser": Our protagonist face yet another case of being fucked over by their favorite advertisement and surveillance vehicle disguised as a web browser. How will they gaslight themselves into keeping their toxic relationship with Chrome alive rather than switching to a browser that respects their privacy and sanity this time?! > Just one more extension, just one more chrome://flags tweak... He loves me, he respects me, he just has a ... unique way of showing it... I'll just tell my friends I fell and that's why my eye is black... Chrome, I'm sorry I'm not good enough, I probably deserve this...

Vinnl 1y ago

> What you may not realize if you use Safari or Firefox is that the banners are never displayed in Google Chrome! Ah, so that's why so many websites are OK with it - they probably just don't realise that it's there. > If the courts and antitrust regulators are reading—they probably won’t read my blog, but one can dream—this is yet another example of Google advantaging its own browser Chrome over other web browsers. And vice versa: how Google is advantaging its own SSO/data collection platform over others, through Chrome.

nikisweeting 1y ago
> the banners are never displayed in Google Chrome! this is demonstrably false, I can share dozens of screenshots of this popup appearing in Chrome despite all the options checked that are supposed to disable it.
- nikisweeting 1y ago
  Here's the worst one I've seen so far, it's showing one for Quora on the Chrome settings page! https://x.com/thesquashSH/status/1788553660357915017 https://x.com/thesquashSH/status/1788553660357915017
- Vinnl 1y ago
  Yeah the article mentions those, but those are inserted by Chrome, i.e. the website owner might not realise that they can prevent them from being shown themselves. But yes, I'm glad my browser doesn't add them, and that I can block them in uBO.

causality0 1y ago

"Sign in with Google" has become the new un-blockable popup for me. I fucking hate it.

jstummbillig 1y ago

Unpopular opinion (apparently): I like this a lot. Sign up flows are annoying, and rarely well designed. Getting around them is nice.

mort96 1y ago

I don't get why so many sites allow a Google pop-up to cover half their content.

bobbob1921 1y ago

While I agree with the 50+ comments I’ve read here, I think the point is being missed (or I just haven’t gotten to this comment yet) - these super annoying pop-ups should only be a thing AFTER you’ve clicked on login or register. In fact they shouldn’t appear and should instead just be a button the user can click if they wish to use their Google account as the login device for XYZ site. In other words there’s no reason for these to appear when you first visit a webpage, they should only be relevant when the user has taken action specifically to login, or is looking to register an account at xyz.com It’s as if someone at Google saw the whole cookie banner -> accept cookies fiasco and said wow this seems like a good idea let’s add our own

hombre_fatal 1y ago

What's crazy is that it trains users to trust a component that can be faked by the website. You can mimic the component and then redirect the button anywhere, and the user is primed to comply with whatever they see. Like a fake "Actually it seems like your Google account is compromised. Please verify that it's you by doing X." This kind of shit-tier feature should at the very least appear inside the browser chrome, not inset in/over the website. I'm so tired of amateur slop from megacorps that should know better.

nikisweeting 1y ago
100% the implementation is setting a terrible precedent to trust non-browser-native-looking UI for whats supposed to be a browser-level feature.

ls-a 1y ago

Thank you. I have been wanting to disable that popup forever

Friedduck 1y ago

Our Enterprise Chrome doesn't allow me to access the page to disable this behavior. Signing out of Chrome (but leaving extensions and bookmarks) is the only way I've found to stop the never-ending Google sign-in prompts. If someone's found a setting page that does what he describes please reply here. This makes me crazy and seems incredibly risky.