News for hackers. Stuff that matters.
Re:Quora now transparently logs you in if your Google accoun... by londons_explore on Thursday September 10, 2020 @08:11AM (#24431520)
Seems like a good idea... The whole idea of having to log into a computer, then into every single website just seems stupid.

SSO for the whole internet would be sweet. I don't care at this point if it's run by one company - federated login systems have failed to work for two decades, it's time to give up.

Re:Quora now transparently logs you in if your Google accoun... by as_ on Thursday September 10, 2020 @08:37AM (#24431709)
Good idea to automatically give your email, name, photo and other details to _every_ site your visit, really? Of course the login should be a voluntary action by the user.

Btw luckily what reported doesn't work for me, the site ask to login. It should not be even possibile, at least without exploting a bug/vulnerability.

Re:Quora now transparently logs you in if your Google accoun... by amjd on Thursday September 10, 2020 @10:52AM (#24432878)
Hmm, maybe it's an A/B test.

> It should not be even possibile, at least without exploting a bug/vulnerability.

This is actually very much possible. I just learned that it's implemented using Google One Tap for Web. [1] That's the web version of One Tap, which lets Android app developers add single-click login using a Google account.

Apparently one of the features of the SDK is automatic sign-in [2], without any user interaction, which Quora seems to be using. In contrast, LinkedIn and Medium also use the same SDK but only suggest logging in with Google in a pop-up. [3]

Edit:

There's a way to turn it off. Disable "Google Account sign-in prompts" setting in Google account permissions [4].

[1]: https://developers.google.com/identity/one-tap/web

[2]: https://developers.google.com/identity/one-tap/web/guides/au...

[3]: https://i.imgur.com/ntmxSe2.png

[4]: https://myaccount.google.com/permissions?pli=1

Re:Quora now transparently logs you in if your Google accoun... by Minor49er on Thursday September 10, 2020 @10:26AM (#24432655)
This sounds like a dream come true for any government, online marketer, or malicious hacker.