News for hackers. Stuff that matters.
Re:Why Not to Use Quora by vtesucks on Sunday December 09, 2018 @10:25PM (#18644946)
I did, once. But after that one entirely new sessions, they automatically "click" the sign in to google button behind the scenes and log me in with the token.

Very creepy

Re:Why Not to Use Quora by caseysoftware on Sunday December 09, 2018 @10:35PM (#18644986)
The first time you logged in with Google, you were presented with a User Consent screen that said "this website wants access to this information, do you agree?" and you clicked yes.

To break the link, go into Google and see what sites, apps, etc you granted access to. That's a good thing to do regularly anyway with every social provider.

I wrote about the implications of poorly implemented and abusive social authentication practices last month: https://www.scmagazine.com/home/security-news/using-social-a...

Re:Why Not to Use Quora by Crosseye_Jack on Sunday December 09, 2018 @10:34PM (#18644982)
Revoke the auth with google and clear any cookies you have with Quora. Worse that will happen if they redirect you to google to login.
Re:Why Not to Use Quora by AYBABTME on Sunday December 09, 2018 @10:33PM (#18644978)
I don't like Quora, but... that's just how OAuth is meant to work.
Re:Why Not to Use Quora by ceejayoz on Sunday December 09, 2018 @10:56PM (#18645069)
I will say I appreciate Facebook's approach to this - after 60-90 days, you have to affirmatively reconfirm your initial authorization when they send you through the OAuth flow.
Re:Why Not to Use Quora by wallnuss on Sunday December 09, 2018 @10:37PM (#18644995)