Sign in with Google in Chrome

https://underpassapp.com/news/2025/7/5.html

by frizlab • 12 months ago

563 290 12 months ago

I actually needed that button the other day. I have an account on Etsy, but wasn't sure if it was sign in with google or an etsy account using my gmail. Signing in to the website's own "login with google" button was a redirect loop. Requesting password reset sent me no email. At some point Chrome offered to sign-in for me, and that worked.

yoavm• 12 months ago

I'm never confused about what I've used to sign in because I only use randomly generated passwords using my password manager (Bitwarden), and it offers to use them automatically when I go to a website.

Another advantage is that Google cannot cut my access to all of my accounts on the internet.

bitpush• 12 months ago

HN userbase is not representative of the large majority of the users of a service.

Most of are fully capable of using a password manager, some even self-hosted that we expose via Tailscale, but for a lot of users, they are using a service to get things done and authentication is a necessary hurdle.

tracker1• 12 months ago

Aside: annoying when a site, specifically a govt website URL changes... I get REALLY skeptical if I land on a page my password manager (also Bitwarden) doesn't recognize with my credentials.

My local city utilities switched to some kind of google based auth from their previous separate user/password account login. Had to create a new login/account tied to my billing account.

linhns• 12 months ago

If Bitwarden can come up with something similar, I'd gladly welcome it, even though it's awesome already.

soraminazuki3• 12 months ago

You didn't need that button, but rather Etsy needed to test their own website.

cosmotic• 12 months ago

This popup should be criminal. Ive misclicked the signin button multiple times, causing PII to be sent to a third party I dont trust without my authorization.

breadwinner2• 12 months ago

You can create multiple profiles in Chrome. You shouldn't sign into Google in your main profile. That should be reserved for just one profile reserved for Gmail.

hundchenkatze• 12 months ago

Yes blame the victim

autoexec• 12 months ago

You can also just not use chrome. It's still a problem that shouldn't exist and the blame for that falls entirely on Google and the websites that push google's crap on users

bigthymer• 12 months ago

I agree that it is problematic. You can mostly block it with the uBlock extension.

TheMiddleMan• 12 months ago

Don't worry about misclicks, Google already tracked your visit when the webpage was loaded.

Google One Tap works via a script tag from Google servers: https://developers.google.com/identity/gsi/web/guides/displa...

jibe• 12 months ago

The bad thing is not sharing the info with Google (you are right, just by siing it, Google has your info), but the random third party website.

sneak2• 12 months ago

Delete your Google account and this won’t happen.

nuker2• 12 months ago

It happens a lot regardless of browser and accounts and incognito. It just pops up everywhere.

legends2k• 12 months ago

I haven't signed in to my Google account since browser install but I still see it in StackOveflow.

rs186• 12 months ago

Blocked this using uBlock since years ago.

montag• 12 months ago

I hope the PMs are reading this thread. They misjudged the tradeoffs

soraminazuki3• 12 months ago

If teaching ethics to big tech worked, this would've ceased to be a problem more than a decade ago.

qrobit• 12 months ago

FWIW, these uBlock Origin rules solve the ploblem:

    ||accounts.google.com/gsi/iframe
    ##iframe[src^="http://accounts.google.com/gsi/iframe"]
    ##iframe[src^="https://accounts.google.com/gsi/iframe"]
    ##iframe[src^="//accounts.google.com/gsi/iframe"]
    ###credential_picker_container

source: https://stackoverflow.com/a/78429389. Last rule is from me since popup was invisible but still blocked the content underneath.

avel2• 12 months ago

Good information, but you can already turn this off via the (quite hidden, I admit) setting that is mentioned in the article. That's a better way to turn this off completely, rather than patch it via a visual rule.

smileybarry• 12 months ago

The irony of getting that popup on Stack Overflow when I clicked that link

josteink• 12 months ago

Another annoying, possibly less known thing about this popup is that you as a user can disable it.

But only if you log in to Google and set a preference for your Google account.

No more nagging popups! Sounds great, right?

Except Google can now track you, with a confirmed ID and session cookie across all these sites.

It’s blackmail, plain and simple.

frizlab• 12 months ago

I never see this popup in my main browser thanks to proper content blockers, but it should not exist in the first place, indeed.

lucb1e9• 12 months ago

Does nobody find this intrusive when it appears on sites like pornhub? Of all places where I'd sign in with a Google account... holy heck, I was very surprised they chose to let Google do that nearly-fullscreen popup on their site upon every visit (since you visit in private tab, it's a fresh session every time)

Even on reddit it annoys the heck out of me and I was very surprised they let this third party ruin the experience (when they don't even do it as first party). What if they all start doing it, facebook and github and the lot, you need to click away four banners? But maybe not enough people have privacy extensions installed and reddit can just track them forever and thus store a one-time dismissal. Anyone here in the know whether this doesn't show a measurable drop in returning users?

justsomehnguy• 12 months ago

It sells.

But yes, I chuckled the first two time but it quickly got boring.

And BTW this clearly indicates what the people who are responsible for this behaviour not only don't bother with this 'use case' but also never use the 'porn mode' themselves.

w4rh4wk52• 12 months ago

Of course! That's why I even added this to my uBlock filter list on mobile:

accounts.google.com/gsi/client

hammock4• 12 months ago

How do you get ublock to work in chrome after the update? I tried a fix I found here but it resets every time I restart the browser

lucumo2• 12 months ago

I did too, until uBO got blocked. So I had to reevaluate.

Chrome now has a site setting that blocks this crap. For the browser-based popup at least. That's the one that pops up in the top-right and is not part of the DOM of the page.

You can go directly to chrome://settings/content/federatedIdentityApi to set "Block sign-in prompts from identity services" as the default behaviour for sites. You can also set exceptions for some sites if you want that.

If you need to go there manually, it is:

1. Settings 2. Privacy and security (in the menu on the left) 3. Site settings (at the bottom) 4. Expand Additional content settings (under Content) 5. Third-party sign-in

venusenvy47• 12 months ago

I've never added a custom filter. Do they sync to all my Firefox browsers that have uBO installed?

eastbound• 12 months ago

I’m super happy Google’s login with my name, appears on PornHub, especially since I’m using a separate browser, Firefox mobile, for this only, never used it for anything else, never logged in. Luckily Firefox mobile gives websites access to something on my phone about my identity. But I’m happy it does this.

Because it exposes how much websites know about us. It’s like Facebook showing face recognition in 2015. It’s creepy but it reminds you constantly how creepy it is.

BobbyTables22• 12 months ago

Just imagine how many sites collect all this info and DONT personalize what’s shown to you…

Of course, one day AI will probably automatically do realtime editing of porn videos so they will be customized for your name/location/job/background/interests.

StrandedKitty• 12 months ago

There's a big upside to Google One Tap. It makes users sign up for your product like crazy.

I recently added it to a SaaS web app I'm working on, and the number of new sign ups went up 8x overnight. You don't necessarily have to create an account to use the minimal functionalty of our app, but after signing up you do get some perks, and we get a way to communicate with the user through email. So I think it can be beneficial for both parties.

sneak2• 12 months ago

…until the user loses access to their Google account with no recourse and you have no secondary way to authenticate them.

BLKNSLVR• 12 months ago

Big upside to the provider, not necessarily the consumer.

Perplexity has a "sign in with Google" pop up that loads late, often when I've already started typing in my query, and thus blocks the rest of my typing, negatively affecting the UX of the service. So I looked up how to get the fuck rid of it and added that method to uBlock Origin, and now I'm a happy (freeloading) chappy.

buzzerbetrayed• 12 months ago

Beneficial to both parties

Ah yes, because who doesn’t want more emails from a sites they’ve visited one time

skydhash3• 12 months ago

Do they pay for anything? I'm all for reducing login friction. But that popup is like people that accost you in the street trying to enlist you into their cult.

Sophira• 12 months ago

You're assuming that the user actually wants to sign up. In reality, it's likely that they're just clicking "Continue" in order to get rid of the dialog and couldn't care less about a signup.

qwertox2• 12 months ago

So I think it can be beneficial for both parties.

No. Because those who don't want to sign up do get bothered by that popup which also reminds them of the fact that Google just tracked that visit and wants you to use Google to sign up on that page.

The chuzpe it takes to do that, from part of the website owner and Google...

forkerenok• 12 months ago

the number of new sign ups went up 8x overnight.

What's the number if you adjust for quality of signups? E.g. how many people convert and how many people stay on and convert later.

immibis4• 12 months ago

You're both right. If an account on your service is completely meaningless, I'd rather press one button than type my email, choose a password and go through a stupid email confirmation workflow. Also, it's very annoying that you need an account at all.

meindnoch2• 12 months ago

and we get a way to communicate with the user through email.

Don't call your spam "communication".

tsoukase• 12 months ago

Last month I subscribed to DAZN TV through Google in order to watch a FIFA world football semifinal match. I deleted the third party allowance a week later. The final was free globally.

varenc• 12 months ago

It does disrupt the user experience and clobber a site's own home page, but associating a persistent identity to a user is VERY valuable to sites, and normal sign up flows have a lot of friction. They probably figured it's worth the cost if it gets more users to login/create accounts. Its presence despite the drawbacks indicates a lot of people use this feature.

citizenpaul3• 12 months ago

associating a persistent identity to a user is VERY valuable

My fear is that this is the real "AI" endgame. Flood the world with bots then become the defacto authority of "real" users.

sans_souse• 12 months ago

that's the 300-million dollar button and it's not going anywhere

hammock4• 12 months ago

I find it like to pop up in an incognito Google search. Not all the time. Just when one searches the more questionable things

johnnyanmac• 12 months ago

I lived alone for years and don't even bother with incognito.

But if I cared, I on Firefox can make a separate container for that stuff and login that way. I get a burner account and Google (at least from PH) can't see anything other than other adult sites I put in that container.

TechDebtDevin• 12 months ago

Try visiting pornhub from Texas :)

lucb1e9• 12 months ago

I'm not that interested in visiting the USA right now gotta be honest

socalgal24• 12 months ago

I would never visit a site like pornhub in a profile that I was logged in to anything other than similar sites.

note: I'm not excusing the feature but come on! Have some common sense before visiting a site like that?

The place I hate the popup the most is mobile. It comes up moments (0.5 to 2 seconds) after the site loads (say tripadvisor) which means it's possible accept it by accident as it appears under your finger. Your info is immediately shared so there is no way to recover. You're effed.

I means sure, I hate it on desktop too, but on mobile it's directly on top of the content and so more likely to be accepted by accident. IIRC you can turn this off in your Google account (or maybe only Google Workspace?)

Note that I hate it for other reasons too. There's no reason Apple/Firefox/Microsoft/Meta and any other major id providers couldn't offer this too. But if they did, then you'd see 5 of these show up [Sign in with Google], [Sign in with Apple], [Sign in with Facebook], [Sign in with Microsoft], [Sign in with Firefox]. So in other words, this seems like a tragedy of the commons in progress.

To steelman the feature though, easily sign up and easy login would be super convenient if that's what I wanted. It might be nice for a Web API that made this more privacy focused (or maybe that already exists). But yes, I'd like to see Google's specific popup disappear - be banned.

afavour• 12 months ago

I'm not excusing the feature but come on! Have some common sense before visiting a site like that?

For sure… but there’s a self-fulfilling element there. If no one with common sense would ever use the feature… why add the feature?

bravesoul22• 12 months ago

I wouldn't visit it without tails at this point. But I go for the better option than tails. Just dont visit it!

shostack• 12 months ago

I would be shocked if that timing was not intentional and thoroughly tested for maximizing sign ups.

jorams• 12 months ago

I would never visit a site like pornhub in a profile that I was logged in to anything other than similar sites.

But that's not relevant. The popup appears whether you're logged into a google account or not. It's just an extremely annoying popup that appears all over the web.

lucb1e9• 12 months ago

note: I'm not excusing the feature but come on! Have some common sense before visiting a site like that?

I first read this as directed at the person you're replying to (me) but then saw a second possible reading: the site should know better as to expect you are logged into google with like one click

Idk which it is so I'll answer both: people are logged into their OS these days, call it Chrome (the browser, but it's close enough to an OS nowadays) or Android but either way it's a big trackfest and nobody besides a few nerds like us here bats an eye. And I indeed don't visit those sites with cookie states of other sites ^^

patrickscoleman• 12 months ago

their "private" is not private. about a month ago, i searched for some health-related stuff in a chrome incognito window and then immediately afterwards got related sponsored product ads on amazon in a logged in normal window.

skydhash3• 12 months ago

I was trying Chrome on a work computer (because why not, I'm only doing work stuff on it). That incognito (but not really) mode made me download Firefox in an hurry.

naniwaduni• 12 months ago

"Private" and "incognito" mode are fundamentally misnamed. They provide almost no real privacy wrt counterparties over the network, just to other people using the same computer after you.

Amnesiac mode, if you will.

Nathanba• 12 months ago

The firefox private window seems to work better than the chrome incognito mode. Maybe brave would be even better because I tested brave against fingerprinting libraries once and it was the best at avoiding any detection.

adzm• 12 months ago

One of my fav party tricks when I get on someone's Wi-Fi is to search for an obscure disease with an expensive treatment. Everyone in the geographical area seems to start getting ads for it for a while afterwards!

samtheprogram2• 12 months ago

This is not true of any web browser because of fingerprinting. That’s the point of fingerprinting for ad networks.

You can try using a different device but even then, I occasionally get recommending things that are definitely influenced by my roommates (i.e. on the same WiFi)

Using something that prevents fingerprinting helps, but only if you don’t use that browser all the time — otherwise it’s just another fingerprint — and still on the same network.

EbNar• 12 months ago

"Incognito", on ANY browser, is not meant for that. Is meant to not leave traces on your PC, so your son/daughter/wife/husband can't see you've been watching porn (for instance). You're still tracked by the sites you visit, unless you use some kind of blocker (and, even then, you may still be tracked server-side).

al_borland4• 12 months ago

Try Mullvad’s browser. It does a lot more to avoid user fingerprinting, even locking the resolution of the rendered content to various sizes. There are some things that make it less practical as a daily driver, but it seems good as a secondary browser for private mode.

dawnerd• 12 months ago

They also recently must have changed the container, I noticed my adblock wasn't catching it anymore. What I find annoying though is its often slow to load and conveniently the sign in button is right where you'd click

godelski7• 12 months ago

  > nearly-fullscreen popup on their site upon every visit

I did a bunch of trial and error awhile back instead of reading the docs but you can add a rule to ublock that will look something like this. Hopefully someone comments a better filter than this mess lol

  ||accounts.google.com/gsi/iframe/select?client_id=*

Fuck all these banners...

Fuck all these cookie popups...

I just want to browse

Seriously, how the fuck do people raw dog the web? It's unbearable. When are people going to move away from Chrome(ium)?

dijit• 12 months ago

Seriously, how the fuck do people raw dog the web? It's unbearable.

I agree, I got it to “work for me” by only using the sites I like, but there are times where I stray from my beaten path because I’m searching for something and it’s awful. I don’t think I would have fallen in love with computers if I was raised with the web being what it currently is.

I wonder if this is a driver of ChatGPT as a search engine, everything else is so bafflingly bad and all people really want is information.

chrismcb• 12 months ago

Do I find it intrusive? Yes, it doesn't matter what site it is on.

lucb1e9• 12 months ago

Agree it's intrusive on all sites, but that is like the last place where I want to make mental space for "hey btw big brother is tracking you here too ;)" reminder popups

motorest7• 12 months ago

Does nobody find this intrusive when it appears on sites like pornhub?

It's extremely intrusive, regardless of which site it shows up. It's a reminder that the likes of Google are collecting all the personal information they can get from you, and building up a personal profile that covers all aspects of your life, not only your online presence.

meindnoch2• 12 months ago

Does nobody find this intrusive when it appears on sites like pornhub?

Porn sites are a testament that no amount of popups, ads, clickjacking, etc. can deter users from your site if your product is compelling enough.

lucb1e9• 12 months ago

There's a reason pornhub and reddit won over other sites where there was more shit in your face (not meant to be read literally)

cm2187• 12 months ago

And google’s “do as I say, not as I do”. Doesn’t their search engine penalise websites with popups/overlays as it is meant to be user hostile?

lucb1e9• 12 months ago

I might consider switching back to Google Search if there were a "put any good results without tracking wall up top" setting

tpoacher• 12 months ago

"I have no idea what you're talking about and I have never experienced this myself and I don't even know this website you speak of."

(obligatory comment just in case the wife is watching ...)

RamblingCTO• 12 months ago

That's why I blocked it everywhere. Pornhub was the last straw for me as well: https://andinfinity.eu/post/2025-07-14-blocking-google-sso-p... works quite well. Using Orion and ublock origin.

al_borland4• 12 months ago

I find it intrusive on every single site it’s on. Every time I look at how to get rid of it, I’m pointed to a setting in my Google account to stop it, and it does absolutely nothing.

As far as I can tell, I’m more sensitive to this stuff than normal people, but I’m less likely to return to a site that annoys me like this. I’m also less likely to use Google as a result of them being behind this. While it’s not the only reason I use Kagi, it’s certainly an item in the pro/con list.

The same goes for all of Google’s pop-ups and nudges to switch to Chrome. It’s infuriating. Everyone not using Chrome knows Chrome exists and are choosing not to use it. They really need to stop with the heavy handed push and respect user defaults.

fHr• 12 months ago

I do and that is why I remain neutral/buy on their stock, Meta and Google are bad bad bad actors with to much power in the web.

melagonster• 12 months ago

Sometimes reddit will automatically log-in for you :(

abustamam2• 12 months ago

Reminds me of a tweet I saw a long time ago that went something like

"PornHub lets you share videos on Google+. That's disgusting! I don't want people to know I use Google+!"

That said, it is quite invasive.

lucb1e9• 12 months ago

(I laughed out loud.) Hey! I liked Google+ >:( Met some cool people on that site and I guess my thought was that anything is better than a facebook monopoly on social media and this has an actual chance

codedokode• 12 months ago

That Google popups are so annoying, they often cover the content, I wonder does Google pay websites for this or they annoy users for free?

Also I don't understand who registers Google Accounts these days because every time I try to do this, they show a QR code and require to scan it with a mobile device, and I don't have time now to set up a virtual machine and research what it does to a mobile device and how one can bypass the check.

Also if you buy a Google Account it eventually requires linking a phone number, and doesn't accept most of the Russian numbers I buy.

So I don't understand how do other people sign up when there are so many obstacles. It is easier just to register email account elsewhere.

sofixa• 12 months ago

You don't sound like the average user.

They either already have a gmail, or sign up for one my scanning the QR code you mention. I don't recall if a phone number is mandatory, but the average user probably has one, doesn't mind giving it to Google (to not lose access to their account if they forget their password is a perfectly valid reason for most people). And they'll probably not provide one from a sanctioned terrorist state with a reputation of nefarious cyber activities. Like buying Google Accounts, but much worse too.

esseph• 12 months ago

Well, Android is the largest phone ecosystem in the world. Most of those phones ask you to sign in with your Google account when it first starts.

eddythompson803• 12 months ago

     ||accounts.google.com/gsi/*$xhr,script,3p

UBO rule to block that. Or enable the “annoyances” list. It hides annoying cookie bs too. Add noscript too.

HelloUsername• 12 months ago

Add noscript too

The Noscript extension becomes redundant with the uBlock Origin extension

https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don...

eddythompson803• 12 months ago

Only if you set UBO to block scripts as well. Though I prefer noscript’s UI personally.

Edit: To elaborate, you need to turn on “hard mode”[0] for UBO to replace noscript. Then you need to manage it through UBO interface which I don’t like[1]

[0] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...

[1] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...

signal112• 12 months ago

“Sign in with Google” is annoying, but at least you can turn it off with chrome://settings/content/federatedIdentityApi

Does anyone know how to switch this off on Safari please, especially Mobile Safari. I’ve noticed these sign-in popups on iOS 18.

pnw2• 12 months ago

A generic way to stop this across all devices would be great. I don't suppose something can be done with DNS via Pi-hole?

eddythompson803• 12 months ago

You could block account.google.com (or google.com) if you don’t use any google services or expect anyone on your network to use any google services*.

* I think search still works without an account, but I don’t think anything else works that way these days. The last I know was YouTube and I get a “sign in to confirm your age” on YouTube on most videos I try to watch without being logged in.

lapcat2• 12 months ago

There is no switch in Safari. As the blog post mentions, you'd have to use a Safari extension such as StopTheMadness Pro.

nikisweeting6• 12 months ago

This option never worked for me, I also tried the options under myaccount.google.com with no luck, I kept getting the popups and ended up having to switch to Brave and Safari to get rid of them.

promiseofbeans• 12 months ago

I think this is referring to the FedCM api [1]

It works with providers other than Google, just no one else has implemented it yet. Google's One Tap library tries to use the new api, and falls back to the classic One Tap popup when using a browser that doesn't yet implement FedCM (notice how the chrome built-in one says "sign in with google.com" rather than "sign in with Google" like One Tap normally shows)

Mozilla are working on implementing it, but it's a pretty complex system so it'll take time. I presume Safari will as well if it gets popular enough

[1] https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API

mooreds7• 12 months ago

Yeah, I attend the FedCM meetings. Firefox has one dev working on it who attends regularly. I have found some posts where the safari team has said "seems like a good idea, we'll consider implementing" but have not seen further action.

Edge supports it, and it should be relatively easy for the other Chromium based browsers.

captn3m0• 12 months ago

- https://github.com/WebKit/standards-positions/issues/309

- https://github.com/mozilla/standards-positions/issues/618

kro• 12 months ago

What is there to fallback to I wonder - 3rd party cookies should be deprecated/blocked by now, so how can the gsi script retrieve google session information?

mooreds7• 12 months ago

The Chrome experience is actually part of a new standard, Federated Credential Management (or FedCM for short).

The idea is to create a browser mediated login experience that gives the identity provider and web app what they need without being able to correlate requests across the Internet.

I am working on an article on this topic. If you are interested in learning more, here's a video from a recent auth focused conference (full disclosure: my company put it on and I emceed): https://m.youtube.com/watch?v=FBAD4x7MWdI

They are actively working on the standard and Firefox has committed to it. Edge already supports it. They are looking for identity provider feedback.

More here: https://github.com/w3c-fedid/FedCM (we meet weekly on Tuesdays).

michaelt• 12 months ago

I'm curious - how does the standard make "to continue, google.com will share your name, e-mail address and profile picture" compatible with "a modern, privacy-preserving standard for federated identity on the web" ??

I mean, that doesn't sound privacy-preserving at all?

benlivengood• 12 months ago

Why would you share your real name with Google when making a gmail account, or use your real picture?

It's fine to be pseudonymous on the Internet if you are in control of your pseudonyms, which Google accounts actually does allow with some extra work (don't mix your chrome profiles and Google accounts, etc.)

Or, like me, you can roll the dice on real names on the Internet (for professional things mostly)

mooreds7• 12 months ago

I don't think they are trying to preserve privacy between you and the identity provider you are logging in with and the website you are logging into. (At least not now. There's talk about some of this with IDP delegation, I think. Here's more on that: https://github.com/w3c-fedid/delegation )

The first goal is to prevent data brokers from correlating data about users across the Internet using cookies and redirects. You can read more about the privacy focus here:

https://www.w3.org/TR/fedcm/#privacy

aaronpk• 12 months ago

It refers to the property of FedCM that means nothing about your account is revealed to the website until you click the "Continue As" button. In other words, alternatives to this that use third-party cookies enable tracking you between websites without any user interaction.

jazzyjackson• 12 months ago

That sounds really interesting, but is there any hope chrome would allow use of an identity provider other than google?

sgoto• 12 months ago

Yeah, websites can choose any other identity provider, and in fact, do.

gwbas1c• 12 months ago

Can we block sharing email addresses by default? It seems every time I sign in with Google the site / app starts SPAMming me without my consent.

It's pretty much why I don't use it: The SPAM.

whynotmaybe2• 12 months ago

And we should also do something about website that consider you a "customer" when you've only started an order and entered your email but you've never pressed submit to complete the order.

Cheer2171• 12 months ago

That's you/OAuth giving the provider your google account id, which is your @gmail.com email.

techjamie• 12 months ago

My gmail is quite old and well used, and it gets relatively little spam. I go through and aggressively unsubscribe link everything I don't want to see, and it surprisingly works. I get more spam on my @myname.tld address than my gmail even and I keep that one quieter.

Almost every site actually does unsubscribe, and those that don't get marked as junk.

BobbyTables22• 12 months ago

Sounds great in theory, but how does this square with Google/Facebook tracking pixels and such.

Seems like either way, they’re in control of a massive amount of tracking data…

KwanEsq• 12 months ago

Is this a successor to Mozilla's old Persona project, or similar in anyway?

mook• 12 months ago

If it's a new standard, it must have… some kind of cross-industry support right? I ask because it looks like https://github.com/w3c-fedid/FedCM/graphs/contributors is mostly people who work at Google (I gave up once I hit people with ten or fewer commits)…

alternatex• 12 months ago

Isn't that the case for half of modern browsers APIs? Google develops whatever it needs for its own products into Chrome and then pushes it to W3C. Other browsers perpetually behind. They've gotten quite good at this strategy.

pyrale• 12 months ago

As usual, the feature is being railroaded by google and other implementers are given the choice between following Chrome's de-facto choices or not implementing it, and breaking websites that will use it anyway.

mooreds7• 12 months ago

While most of the contributions I have seen are from Google on the browser side, they are trying to work through the standards process. Here's the first draft of the w3c standard: https://www.w3.org/TR/fedcm/

I know there's a later draft but can't find it right now. Will share when I do.

As mentioned in sibling comments I have seen are least on Firefox contributor and they are actively seeking input from identity providers.

JimDabell• 12 months ago

They are actively working on the standard and Firefox has committed to it.

Mozilla standards position says neutral:

https://mozilla.github.io/standards-positions/#fedcm

Their issue tracker on the subject shows they are interested but have a lot of reservations about the details:

However, some of our reservations on the initial positive position have not been addressed and some new issues have arisen.

— https://github.com/mozilla/standards-positions/issues/618

Apple had a vague “interested” position over three years ago, with no further detail:

https://github.com/WebKit/standards-positions/issues/309

Have these positions changed?

mooreds7• 12 months ago

I don't speak for Mozilla, but I did see a bug in bugzilla which showed the blocking bugs for FedCM. I don't have the link now, but can share it later. That's what I thought of when I stated Firefox has committed to it. But I could be wrong.

I do see a Mozilla employee engaging regularly. You can see some of the issues he has filed here: https://github.com/w3c-fedid/FedCM/issues?q=is%3Aissue%20sta...

otabdeveloper4• 12 months ago

The Chrome experience is actually part of a new Google non-standard

Fixed it for you.

WhyNotHugo• 12 months ago

Vaguely reminds me of the now defunct OpenID. But with browser-native integration.

mooreds7• 12 months ago

OpenID lives on for real in Steam ( https://partner.steamgames.com/doc/features/auth#website) and in the principles behind OpenID Connect! :)

righthand• 12 months ago

I save this rule in my pastebox (bitwarden) to add to all my Ublock Origin configs:

||accounts.google.com/gsi/*$xhr,script,3p

1a527dd5• 12 months ago

You can turn this off

1. https://myaccount.google.com/connections/settings for mobile

2. same link, sidebar help, for Chrome on Desktop settings.

mmsc• 12 months ago

this requires being signed in (obviously), which doesn't help with the limit tracking part of hating these things

avel2• 12 months ago

That does not completely turn off the federated sign-in popup you see on the top right in various websites. The solution is actually already mentioned in the article.

ashvardanian• 12 months ago

First, “Accept all cookies”, and now this. The competition for the worst web UX is heating up.

reddalo3• 12 months ago

Firefox + uBlock Origin is the only sane way to browse the web in 2025.

tantalor• 12 months ago

... example of Google advantaging ...

Way to bury the lead.

Anyway, what's the advantage? Please elaborate.

lapcat2• 12 months ago

The blog post elaborates. But to summarize:

1) The annoying Sign in with Google banners appear in Firefox and Safari with no toggle to disable them, even if you aren't logged in with Google, even if you don't have a Google account.

2) Those banners do not appear at all in Chrome.

3) There is a Chrome-specific sign-in UI, but it appears only if you're already signed in to your Google account in Chrome.

4) You can disable the Chrome-specific sign-in UI in Chrome settings.

So Chrome users have control, whereas Firefox and Safari users are inundated with annoyance.

jdiff• 12 months ago

Being able to shut the damn thing off.

supportengineer• 12 months ago

https://www.merriam-webster.com/wordplay/bury-the-lede-versu...

theggiveth• 12 months ago

As others mentioned, this is backed by the "open" standard FedCM. While this seems like an open play on the surface (and the standard is open), in practice this is a highly anti-competitive and will just lead to Google being in even more control of the web.

The vast majority of users will chose the default for identity. On Chrome this is Google. On Android this is Google. Even on iOS this may be Google because identity is often tied to email and Apple does not have a strong email story. Identity is huge. It gives you moat that outlives platforms.

And all the while, Google gets to claim this standard is open, while in practice this is clearly intended as a monopolistic move to increase their share of identity on the web.

If they were forced to show a randomized list of identity providers a user needs to choose from (similar to search engines on iOS), I bet you they would reconsider this whole approach. But by the time regulators figure out what's going on, they will have already cemented their lead.

WorldMaker2• 12 months ago

This "standard" also seems interestingly timed with respect to Passkey adoption, too. If one were feeling pessimistic enough, it almost seems too easy to suggest some interests exist here that want to muddy the sign-in waters to capture users considering switching to Passkeys before they actually switch to Passkeys.

JambalayaJimbo2• 12 months ago

These are orthogonal concerns. Passkeys don't meaningfully simplify the account creation process.

mattigames• 12 months ago

Not only that, on Chrome this popup shows up on TOP of the search dialog and no way to push it behind it (screenshot and write up at https://ivanca.tumblr.com/post/790352779945410560/on-chrome-... )

andrei_says_• 12 months ago

Adding

img { max-width: 100%;}

To this site’s css will fix the layout on mobile.

coffeecoders• 12 months ago

uBlock is great for this. Settings > Filter lists and Enable Annoyances.

chrsw• 12 months ago

It's not just a Google annoyance, these types of things are all over the web. I have uBlock Origin settings to limit these types of things, like others in this thread have explained.

But there's a bigger issue with the modern web. Here's my message to any web developer, company, organization, anyone who has control over content on the public web: if I visit your page and I have to click away something in order to do what I came to do, you have failed miserably.

rtpg2• 12 months ago

Kinda related to this: I _really_ wish that SSO providers would be better about telling me when my account was already used to log into a service. When I hit "sign in with Google", see my 4 accounts, and have to guess which one I used to sign into the service...

Maybe I'm missing some security detail here

_2d302• 12 months ago

The problem is that at that point in the flow, it's owned by the SSO provider. The SSO provider can't know with certainty what account has an active account with the website.

ehsankia• 12 months ago

And I don't think it makes sense for the SSO provider to leak a list of all your accounts to the website either. That being said, I think the SSO provider could maybe track that information maybe?

armen52• 12 months ago

I don't think that's true though? The OAuth provider knows which third parties you have authorized to have access to your account(s) as well as what information or privileges you've approved for each. And when you land on that screen, they know which third party referred you to them.

In other words, they could definitely highlight or otherwise hint to you which of the Google accounts you've already approved/used via one or more of your authenticated Google accounts.

rtpg2• 12 months ago

They could thought right? because if you login to a website (that's passed along an ID) then you would have that bit set.

I don't need to know for certain the account on the receiving side exists, just that I have signed in before with it. Facebook does this at least!

Like "has an account" isn't possible without leakage, but "has logged in through this flow before" (hell, stick timestamps in there too!) does.

One thought though: your SSO provider has that account list, but often prompts a re-login. So it could be that your SSO provider account picker _doesn't have access to your account information fully either_.

al_borland4• 12 months ago

This is my big issue too. There are some times where I think I have SSO for something, but don’t remember with who, so I spend 5 minutes logging into various providers and hunting down where they say what sites I’m using SSO with, so I can see what to use.

I started adding them to my password manager as a quick reference, but the irony is that this makes the SSO slower than a typical standard login. I almost never use these SSO options anymore as a result.

efreak2• 12 months ago

There's a website I use irregularly (I sign in maybe every other month) that doesn't use passwords, doesn't use sign in with X, etc. Instead, they have a form to enter an email address, and they send you a magic link to log in. Since it's a generic email field with no password prompt, my password manager doesn't offer to fill it in for me, and my browser helpfully offers every email address I've ever put into a form. I now have 7 accounts with this website; half of them were created to get a new API key, the other half were to submit feedback that I'll never get notified of responses to because I can't be signed into multiple accounts at once and they don't email me about comments.

I expect that by sometime next year I'll hit 10 accounts with them.

cebert• 12 months ago

I get why Google finds this advantageous, but I don’t understand why so many brands want to willingly diminish the impression and reputation of their web properties by adding “Sign in with Google.”

Barrin92• 12 months ago

want to willingly diminish the impression and reputation of their web properties

because that's not what happening. The average Chrome user finds that feature useful, and personally I have to agree because having a sign-in option through the browser chrome (the non-content portion of the application, bad name in this case) is significantly more sane from a security standpoint than trusting the webpage operator.

why are these threads always full of performative indignation by people who know perfectly well that 99% of people aren't going to be upset

edg5000• 12 months ago

The average Chrome user finds that feature useful I don´t know about that. It displays on so many sites where I was not intending to login at all. If I want to login, I would have clicked on the websites' login button. This popup really blatantly shows that Google is everywhere, even if that was already the case. It's possible that this actually reflects badly on Google as a whole.

soraminazuki3• 12 months ago

Poor Google, they have to screw over the entire online population for their own sake. The masses love being screwed over, which is why Google uses dark patterns instead of having people make informed decisions. That this helps make Google even richer is just a happy accident. Shame on technologists who question Google's morality!

Yep, that logic makes total sense. /s

nikisweeting6• 12 months ago

The crazy part is that the popup is not part of the DOM, it's injected by the browser *over the page content*. If it were in a browser toolbar I woudln't mind, but obscuring page content is just asking for an antitrust suit.

I left chrome and switched to Brave 6mo ago because I couldn't get these "Sign in with Google" popups to stop. I tried both the chrome://settings/content/federatedIdentityApi option and the option under https://myaccount.google.com/ and neither one worked, I just kept getting them.

ChadNauseam• 12 months ago

just asking for an antitrust suit

According to other commenters in here [0], it's an open standard and other identity providers are allowed, not just google

[0] https://news.ycombinator.com/item?id=44715875

nikisweeting6• 12 months ago

Still an unforgivable violation of trust to have a floating popup over the content that's not part of the DOM and not part of the browser's normal native UI. I never want my browser to inject unblockable overlays over sites I'm trying to browse.

chenzhekl• 12 months ago

I hate this banner. It made my Vimium addon unable to work unless I pressed Esc first.

ankurdhama• 12 months ago

This stupid pop-up (being a "window" of its own and not a DOM popup) also steal focus back to the chrome window. For example: open reddit.com in chrome (without logged in to reddit) and before the page loads switch to another app window, when the popup is ready the chrome window will get focused again.

fitsumbelay• 12 months ago

that federated id api setting was crucial. danke shoen OP

aorth2• 12 months ago

This is what Google calls the One Tap user experience. Fortunately, my web browser extension StopTheMadness Pro hides “Sign in with Google” banners.

This sounds awesome. I like the author's classification of this and other anti-user website behaviors as "madness". Are there any similar add-ons for Firefox?

AnonC• 12 months ago

StopTheMadness provides browser extensions for Safari, Firefox and Chrome. But it’s a paid product AFAIK. I don’t know of similar Firefox extensions that do everything that this one does or allows one to do.

aorth2• 12 months ago

I have used the Don't Fuck With Paste extension https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi... in Firefox for a few years. Seems to work well when I need it (and when I remember to try it, as it needs enabling on a per-site basis).

For removing tracking query parameters from the URL I've used ClearURLs https://addons.mozilla.org/en-US/firefox/addon/clearurls/ for a few years.

uBlock Origin is still fully functional in Firefox as well so I guess I could find a way to block the "Sign in with Google" prompts somehow with a custom rule.

weberer• 12 months ago

I use uMatrix to block all third-party requests by default.

omnifischer• 12 months ago

https://issuetracker.google.com/issues/343584523

Nobody cares.

londons_explore• 12 months ago

Am I the only one who likes this?

Every other sign in solution seems to involve multiple clicks and loads of redirects and loading time. It seems to even beat a password manager because there is no need to wait for a login form to load and be prefilled.

Googles solution frequently has you signed in within 1 second and 1 click.

barbs• 12 months ago

Not sure if it's a result of multiple privacy extensions or whatever but it's about a coin-flip on whether Google login actually works for me.

Razengan• 12 months ago

Those obnoxious Sign In With Google overlays on so many sites like Reddit, or any other "Sign In With ETC" should be outlawed honestly.

qwertox2• 12 months ago

I hate this popup so much. This is on the same level as adblockers displaying "premium" ads.

eadmund2• 12 months ago

I absolutely hate the ‘Sign in with Google’ prompt and I am very concerned that I will either accidentally or absent-mindedly tap on it and share my email address and identity with some random untrustworthy website.

The idea of identity managed by one’s browser is a pretty decent one, but the implementation which ties it to other information such as email address and which makes it so easy to accidentally use is user-hostile.

mikelinsi• 12 months ago

It's odd how these browser popups—especially ones like the notification permission dialog—essentially hijack the Mac interface. I can't swipe to go back using the trackpad until I manually close the popup.

auscompgeek• 12 months ago

Indeed, while Chrome is displaying the dialog, it blocks all Chrome extension popup windows from appearing.

We discovered this one the hard way at work. I keep learning this the hard way myself because I've been working on browser extension dev lately. I don't understand how this could possibly be an intended feature.

Pesthuf• 12 months ago

On today's episode of "Addicted to the AdTech browser": Our protagonist face yet another case of being fucked over by their favorite advertisement and surveillance vehicle disguised as a web browser. How will they gaslight themselves into keeping their toxic relationship with Chrome alive rather than switching to a browser that respects their privacy and sanity this time?!

Just one more extension, just one more chrome://flags tweak... He loves me, he respects me, he just has a ... unique way of showing it... I'll just tell my friends I fell and that's why my eye is black... Chrome, I'm sorry I'm not good enough, I probably deserve this...

nomercy400• 12 months ago

I always thought drawing over the content area is a no-no, because then anybody can fake that dialog via html/css and make it do something completely different.

Vinnl2• 12 months ago

What you may not realize if you use Safari or Firefox is that the banners are never displayed in Google Chrome!

Ah, so that's why so many websites are OK with it - they probably just don't realise that it's there.

If the courts and antitrust regulators are reading—they probably won’t read my blog, but one can dream—this is yet another example of Google advantaging its own browser Chrome over other web browsers.

And vice versa: how Google is advantaging its own SSO/data collection platform over others, through Chrome.

nikisweeting6• 12 months ago

the banners are never displayed in Google Chrome!

this is demonstrably false, I can share dozens of screenshots of this popup appearing in Chrome despite all the options checked that are supposed to disable it.

nikisweeting6• 12 months ago

Here's the worst one I've seen so far, it's showing one for Quora on the Chrome settings page! https://x.com/thesquashSH/status/1788553660357915017

Vinnl2• 12 months ago

Yeah the article mentions those, but those are inserted by Chrome, i.e. the website owner might not realise that they can prevent them from being shown themselves.

But yes, I'm glad my browser doesn't add them, and that I can block them in uBO.

causality0• 12 months ago

"Sign in with Google" has become the new un-blockable popup for me. I fucking hate it.

jstummbillig• 12 months ago

Unpopular opinion (apparently): I like this a lot. Sign up flows are annoying, and rarely well designed. Getting around them is nice.

mort96• 12 months ago

I don't get why so many sites allow a Google pop-up to cover half their content.

bobbob1921• 12 months ago

While I agree with the 50+ comments I’ve read here, I think the point is being missed (or I just haven’t gotten to this comment yet) - these super annoying pop-ups should only be a thing AFTER you’ve clicked on login or register. In fact they shouldn’t appear and should instead just be a button the user can click if they wish to use their Google account as the login device for XYZ site. In other words there’s no reason for these to appear when you first visit a webpage, they should only be relevant when the user has taken action specifically to login, or is looking to register an account at xyz.com

It’s as if someone at Google saw the whole cookie banner -> accept cookies fiasco and said wow this seems like a good idea let’s add our own

hombre_fatal• 12 months ago

What's crazy is that it trains users to trust a component that can be faked by the website.

You can mimic the component and then redirect the button anywhere, and the user is primed to comply with whatever they see.

Like a fake "Actually it seems like your Google account is compromised. Please verify that it's you by doing X."

This kind of shit-tier feature should at the very least appear inside the browser chrome, not inset in/over the website. I'm so tired of amateur slop from megacorps that should know better.

nikisweeting6• 12 months ago

100% the implementation is setting a terrible precedent to trust non-browser-native-looking UI for whats supposed to be a browser-level feature.

ls-a• 12 months ago

Thank you. I have been wanting to disable that popup forever

Friedduck• 12 months ago

Our Enterprise Chrome doesn't allow me to access the page to disable this behavior. Signing out of Chrome (but leaving extensions and bookmarks) is the only way I've found to stop the never-ending Google sign-in prompts.

If someone's found a setting page that does what he describes please reply here. This makes me crazy and seems incredibly risky.

Sign in with Google in Chrome

Related Stories