5 ms·

Blocking the "Sign in with Google" Prompt (2023)

129 points by Qision 2y ago

zo1 2y ago
How is this "feature" not a privacy/security issue? Why do I get the sense that the whole push towards single-sign-on, OAuth, etc was just to push for a single, ad-controlled login?
- j16sdiz 2y ago
  This depends on who your user are. If you are in corporate environment office, your user would literally expect every internal website seamlessly integrated with each other.
- arkh 2y ago
  > How is this "feature" not a privacy/security issue? Like every third party script this feature has been a privacy issue from day-1. Same as the "like / share on whatever social networks" buttons. Same as the google analytics scripts you use, the Google Tag Manager scripts. "Webmasters" decided that selling their users data for free service was worth it. For more than 2 decades it's been business as usual. A whole generation and now even less people will bat an eye about doing it, they'll even defend it because "there is no other way to keep the lights on". Maybe the lights should be off on most of the websites depending on this kind of practices.
  - AStonesThrow 2y ago
    Well, guess what, there is a simple fix to this that we could've implemented when Eternal September began. Don't use any free web services. Don't access anything for free on the Internet. Especially don't patronize an ad-supported company. Don't sign up for free email accounts. Don't visit websites that display ads. I mean, don't try to block the ads, just never go there in the first place! For God's sake, stop stealing audio and video streams, scholarly papers, and other objects of piracy. You're a net drain on the economy... literally. Stop using free (as in beer) software, or at least make donations for it. Stop complaining that you only get a license and not ownership. Rent your software and give the developers their due. All of you, especially those who cheat and block ads, you're all freeloaders who are responsible for the growth of ad-supported services on the Internet, and long before the Internet was a thing, you watched TV, you listened to the radio, you read newspapers and magazines, you've built expectations to get something for nothing, and ultimately you were influenced and manipulated by those ads enough to make them profitable. We've nobody to blame but ourselves for this proliferation of Google, Facebook and the rest. We are the ones who could've stopped it, but we built this Internet the way it is.
- thephyber 2y ago
  Google, Facebook, and Twitter certainly wanted to (1) be the central source of identity and (2) hook into many/most 3rd party site logins. But SSO/OAuth in general has far more tradeoffs. It outsources the difficult task of managing passwords (including hashing and storing), 2FA, password resets, etc. SSo allows the end-user to trust a few mega companies that have comparative advantage around security, and also benefit from having to maintain fewer credentials.
  - red_admiral 2y ago
    The "central source of identity" idea is not inherently bad, and for the majority of non-techie people, might actually be a net plus. I also trust google more to not have an SQL injection vulnerability on the login page than some random little shop. I just wish it didn't come bundled with tracking. And then there's the risk that if google's algorithms thinks you did something naughty, you get locked out of everything.
    - thephyber 2y ago
      I wholeheartedly agree with your last paragraph. The consequences of being banned/blocked by your IDP and the inability to contact customer service are both severe. Also, it seems like you have to choose wisely as it’s not clear that most websites support you changing your IDP.
homebrewer 2y ago
Just go into ublock origin settings -> Filter lists -> enable "Social widges" and "Annoyances" (you can experiment with only some of them, but I enabled everything years ago and never had major problems). It takes care of a lot of this stuff, including cookie banners and all sorts of popups. Buy a beer for list maintainers (some of them accept donations) since Raymond doesn't, and their work is equally valuable.
- Qision 2y ago
  These lists are marked as obsoletes in my version of ublock (v1.60.0).
  - lexicality 2y ago
    Do you need to do a list update perhaps? They're fine in mine (same version)
    - Qision 2y ago
      It works now, thanks for the trick!
- qwertox 2y ago
  Thank you for pointing this out. Those popups weren't achieving anything else but annoying me.
- seszett 2y ago
  More specifically, this Google popup is blocked by the "EasyList – Other Annoyances" filter list.
boesboes 2y ago
I wonder how anyone can think 'you know what, my website, that you don't even need to sign in to for 99% of the use cases, needs a big popup from google!' Aside from the security/privacy considerations, why the fuck would you do that to a website? SSO from a login page? sure, whatever. a f'ing popup on every page for a SINGLE provider? That is just brain-rot. Do they pay you to do this?
- zwog 2y ago
  > Do they pay you to do this? I don't sites get payed (with money) but it probably improves the ranking in the search results (or at least some SEO guide claims that, so everybody does it)
  - whstl 2y ago
    I worked in some companies that had this popup, and the most common goal was to harvest email addresses for newsletters. Setting this up has become an automatic request from marketing people, almost as common as asking us to setup Google Analytics and such. This is almost the equivalent to them to "have a CI/CD" for us devs: not having such things for them is strange, almost wrong. Of course the end goal is totally different.
    - zwog 2y ago
      > I worked in some companies that had this popup, and the most common goal was to harvest email addresses for newsletters. Ooh, I've never looked into it, but I would have thought that with this feature the website explicitly does NOT get my email address. Silly me, still believing some features are meant for the user.
      - bilekas 2y ago
        While I don't consider myself an apple fanboy by any means they really did do a good job with their apple sign in, I don't know the full process but they seem to use an email from a pool of apple IDs for emails that prevent the app/service ever getting your real email. It would be easy to assume that other oath providers are doing the same but absolutely not.
hapticmonkey 2y ago
The new “Hide Distracting Items” feature in iOS18 Safari has been a godsend for me. Just tap on the offending overlay/prompt and watch it disappear into the digital ether. Even with ad blockers, these sign in prompts are becoming increasingly common and annoying. Blocking Google and Reddit sign in popups especially have restored some of my sanity.
- bongobingo1 2y ago
  Curious how that behaves on https://how-i-experience-web-today.com/ https://how-i-experience-web-today.com/. I assume its blocking by origin, not behaviour? Or does that entire website just """break"""?
  - pcl 2y ago
    My uneducated assumption based on their docs is that it drops DOM elements or something, rather than network requests. The UI seems to be that you select things you want to be rid of, and the browser makes it so. They state that frequently-changing parts of the page, including ads, don’t get filtered, presumably because whatever they filter on is statically defined structure.
  - yunohn 2y ago
    > https://how-i-experience-web-today.com/ https://how-i-experience-web-today.com/ This is so incredibly accurate - I’m laughing and crying.
  - hapticmonkey 2y ago
    It allowed me to block the initial cookie overlay, which then allowed me to read the 'article'. Scrolling down the page triggered a popup which I could then block. Works pretty well!
- rlpb 2y ago
  1990s Google would then have used "distracting item" stats to adjust website ranks downwards had they done the same thing in Chrome (and had Chrome existed). Ironically, this article describes Google as now being the source of such a distracting item. I liked 1990s Google.
j16sdiz 2y ago
From the comment: > Note that the "disabling an option in the Google account" is not a possibility if you use firstparty-isolate or any other privacy features that prevent embeds like this from seeing your Google session cookie. This is another motivation to want a way to block it browser-side. I literally can't remember all sort of site isolation, cross site request or whatnot privacy feature and exceptions. If we can throw away all backward compatibility, can we have something simpler? Or is this just unsolvable because how complex the problem is?
- Semaphor 2y ago
  What do you want to throw away? This is literally what those features are supposed to do.
- pjc50 2y ago
  > If we can throw away all backward compatibility, can we have something simpler? Maybe, but how do you stop people gradually building it up again because they need/want it for something?
- nottorp 2y ago
  It's not unsolvable but it would shrink the "marketing industry" by a factor of 100 if the spyware friendly features were dropped out of browsers.
pixelesque 2y ago
With a nice example demo of how annoying it is from superuser.stackoverflow!
- butz 2y ago
  Who ever thought that half covering Sign up button with this monstrosity was a good UX?
jzellis 2y ago
Ironically, when I clicked on it I got one to sign into StackExchange.
mythz 2y ago
It's a dark pattern to trick users into handing over their email. Accidentally clicked on one these instead of the close button and then started immediately receiving incessant marketing spam from that website. Of course I wasn't able to unsubscribe from the mailing list without first creating an account with them and accepting their terms so ended up resorting to blocking their email.
ktosobcy 2y ago
> There are several tutorials on the Internet on how to avoid this, for example, this one on How-To Geek, which suggest disabling an option in the Google account. However, this doesn't work, since mine is not enabled and never was: I don't have google account (or better yet - I'm not logged in to it in any reasonable manner) yet the promp shows constantly :| f* google
- kemotep 2y ago
  That suggestion for a fix never made sense because you get it on every device and browser. How would that work if you aren’t signed into Google in the first place?
  - stvltvs 2y ago
    I have a different Firefox profile to sign into Google with. For normal, everday browsing, I use another profile where I never sign in.
archargelod 2y ago
> accounts.google.com/gsi/* This filter might break functionality on some sites, so it's better to use more specified version: ||accounts.google.com/gsi/*$xhr,3p Explanation of the relevant syntax: `[no prefix]`: Blocks resources that have this text string anywhere in its URL. `||`: Blocks resources that have a specific domain or subdomain. `$3p`: Ensures that resources from a domain are only blocked if you're not visiting the domain itself. `$xhr`: Prevents such resources from being downloaded through the titular JavaScript APIs. More Ad-filtering syntax explained: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/SyntaxMeaningsThatAreActuallyHumanReadable.md https://github.com/DandelionSprout/adfilt/blob/master/Wiki/S...
- red_admiral 2y ago
  Thanks. Added that besides ||google.*/complete/search$xmlhttprequest,important which is not for everyone, but turns off the autocomplete for me. Needs an "important" to override the override in on of the default filter lists. And then of course: - google is an ok search engine with the udm 14 trick. - bing is an ok search engine if you use it through duckduckgo.
  - paravz 2y ago
    had to google the trick to disable ai search results, now how to apply it to all searches
- dogtierstatus 2y ago
  Is there anyway to do this on Android mobile?
  - McGuffin 2y ago
    Yes, switch to a firefox based browser for android.
whywhywhywhy 2y ago
The fact this prompt seems to block the first click of input on the actual site usually is indefensible. Not including an easy to find and easy to understand option in Chrome to just disable it outright with a 100% success rate just adds to the evidence that giving Google any power on the internet was a mistake.
- jsnell 2y ago
  You understand that this isn't a browser feature, right? Chrome isn't creating the login prompts and doesn't have any kind of special support for them. It's just rendering the HTML / running the JavaScript on the page.
  - whywhywhywhy 2y ago
    Pedantry aside, same company same ecosystem.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
beretguy 2y ago
Also can probably use a custom DNS with De-Google filter.
deleted 2y ago
[deleted]
darajava 2y ago
I like this popping up. It makes it pretty clear that the site favours bloatware and tracking and is to generally be avoided.

129 points by Qision 2y ago

zo1 2y ago

How is this "feature" not a privacy/security issue? Why do I get the sense that the whole push towards single-sign-on, OAuth, etc was just to push for a single, ad-controlled login?

j16sdiz 2y ago
This depends on who your user are. If you are in corporate environment office, your user would literally expect every internal website seamlessly integrated with each other.
arkh 2y ago
> How is this "feature" not a privacy/security issue? Like every third party script this feature has been a privacy issue from day-1. Same as the "like / share on whatever social networks" buttons. Same as the google analytics scripts you use, the Google Tag Manager scripts. "Webmasters" decided that selling their users data for free service was worth it. For more than 2 decades it's been business as usual. A whole generation and now even less people will bat an eye about doing it, they'll even defend it because "there is no other way to keep the lights on". Maybe the lights should be off on most of the websites depending on this kind of practices.
- AStonesThrow 2y ago
  Well, guess what, there is a simple fix to this that we could've implemented when Eternal September began. Don't use any free web services. Don't access anything for free on the Internet. Especially don't patronize an ad-supported company. Don't sign up for free email accounts. Don't visit websites that display ads. I mean, don't try to block the ads, just never go there in the first place! For God's sake, stop stealing audio and video streams, scholarly papers, and other objects of piracy. You're a net drain on the economy... literally. Stop using free (as in beer) software, or at least make donations for it. Stop complaining that you only get a license and not ownership. Rent your software and give the developers their due. All of you, especially those who cheat and block ads, you're all freeloaders who are responsible for the growth of ad-supported services on the Internet, and long before the Internet was a thing, you watched TV, you listened to the radio, you read newspapers and magazines, you've built expectations to get something for nothing, and ultimately you were influenced and manipulated by those ads enough to make them profitable. We've nobody to blame but ourselves for this proliferation of Google, Facebook and the rest. We are the ones who could've stopped it, but we built this Internet the way it is.
thephyber 2y ago
Google, Facebook, and Twitter certainly wanted to (1) be the central source of identity and (2) hook into many/most 3rd party site logins. But SSO/OAuth in general has far more tradeoffs. It outsources the difficult task of managing passwords (including hashing and storing), 2FA, password resets, etc. SSo allows the end-user to trust a few mega companies that have comparative advantage around security, and also benefit from having to maintain fewer credentials.
- red_admiral 2y ago
  The "central source of identity" idea is not inherently bad, and for the majority of non-techie people, might actually be a net plus. I also trust google more to not have an SQL injection vulnerability on the login page than some random little shop. I just wish it didn't come bundled with tracking. And then there's the risk that if google's algorithms thinks you did something naughty, you get locked out of everything.
  - thephyber 2y ago
    I wholeheartedly agree with your last paragraph. The consequences of being banned/blocked by your IDP and the inability to contact customer service are both severe. Also, it seems like you have to choose wisely as it’s not clear that most websites support you changing your IDP.

homebrewer 2y ago

Just go into ublock origin settings -> Filter lists -> enable "Social widges" and "Annoyances" (you can experiment with only some of them, but I enabled everything years ago and never had major problems). It takes care of a lot of this stuff, including cookie banners and all sorts of popups. Buy a beer for list maintainers (some of them accept donations) since Raymond doesn't, and their work is equally valuable.

Qision 2y ago
These lists are marked as obsoletes in my version of ublock (v1.60.0).
- lexicality 2y ago
  Do you need to do a list update perhaps? They're fine in mine (same version)
  - Qision 2y ago
    It works now, thanks for the trick!
qwertox 2y ago
Thank you for pointing this out. Those popups weren't achieving anything else but annoying me.
seszett 2y ago
More specifically, this Google popup is blocked by the "EasyList – Other Annoyances" filter list.

boesboes 2y ago

I wonder how anyone can think 'you know what, my website, that you don't even need to sign in to for 99% of the use cases, needs a big popup from google!' Aside from the security/privacy considerations, why the fuck would you do that to a website? SSO from a login page? sure, whatever. a f'ing popup on every page for a SINGLE provider? That is just brain-rot. Do they pay you to do this?

zwog 2y ago
> Do they pay you to do this? I don't sites get payed (with money) but it probably improves the ranking in the search results (or at least some SEO guide claims that, so everybody does it)
- whstl 2y ago
  I worked in some companies that had this popup, and the most common goal was to harvest email addresses for newsletters. Setting this up has become an automatic request from marketing people, almost as common as asking us to setup Google Analytics and such. This is almost the equivalent to them to "have a CI/CD" for us devs: not having such things for them is strange, almost wrong. Of course the end goal is totally different.
  - zwog 2y ago
    > I worked in some companies that had this popup, and the most common goal was to harvest email addresses for newsletters. Ooh, I've never looked into it, but I would have thought that with this feature the website explicitly does NOT get my email address. Silly me, still believing some features are meant for the user.
    - bilekas 2y ago
      While I don't consider myself an apple fanboy by any means they really did do a good job with their apple sign in, I don't know the full process but they seem to use an email from a pool of apple IDs for emails that prevent the app/service ever getting your real email. It would be easy to assume that other oath providers are doing the same but absolutely not.

hapticmonkey 2y ago

The new “Hide Distracting Items” feature in iOS18 Safari has been a godsend for me. Just tap on the offending overlay/prompt and watch it disappear into the digital ether. Even with ad blockers, these sign in prompts are becoming increasingly common and annoying. Blocking Google and Reddit sign in popups especially have restored some of my sanity.

bongobingo1 2y ago
Curious how that behaves on https://how-i-experience-web-today.com/ https://how-i-experience-web-today.com/. I assume its blocking by origin, not behaviour? Or does that entire website just """break"""?
- pcl 2y ago
  My uneducated assumption based on their docs is that it drops DOM elements or something, rather than network requests. The UI seems to be that you select things you want to be rid of, and the browser makes it so. They state that frequently-changing parts of the page, including ads, don’t get filtered, presumably because whatever they filter on is statically defined structure.
- yunohn 2y ago
  > https://how-i-experience-web-today.com/ https://how-i-experience-web-today.com/ This is so incredibly accurate - I’m laughing and crying.
- hapticmonkey 2y ago
  It allowed me to block the initial cookie overlay, which then allowed me to read the 'article'. Scrolling down the page triggered a popup which I could then block. Works pretty well!
rlpb 2y ago
1990s Google would then have used "distracting item" stats to adjust website ranks downwards had they done the same thing in Chrome (and had Chrome existed). Ironically, this article describes Google as now being the source of such a distracting item. I liked 1990s Google.

j16sdiz 2y ago

From the comment: > Note that the "disabling an option in the Google account" is not a possibility if you use firstparty-isolate or any other privacy features that prevent embeds like this from seeing your Google session cookie. This is another motivation to want a way to block it browser-side. I literally can't remember all sort of site isolation, cross site request or whatnot privacy feature and exceptions. If we can throw away all backward compatibility, can we have something simpler? Or is this just unsolvable because how complex the problem is?

Semaphor 2y ago
What do you want to throw away? This is literally what those features are supposed to do.
pjc50 2y ago
> If we can throw away all backward compatibility, can we have something simpler? Maybe, but how do you stop people gradually building it up again because they need/want it for something?
nottorp 2y ago
It's not unsolvable but it would shrink the "marketing industry" by a factor of 100 if the spyware friendly features were dropped out of browsers.

pixelesque 2y ago

With a nice example demo of how annoying it is from superuser.stackoverflow!

butz 2y ago
Who ever thought that half covering Sign up button with this monstrosity was a good UX?

jzellis 2y ago

Ironically, when I clicked on it I got one to sign into StackExchange.

mythz 2y ago

It's a dark pattern to trick users into handing over their email. Accidentally clicked on one these instead of the close button and then started immediately receiving incessant marketing spam from that website. Of course I wasn't able to unsubscribe from the mailing list without first creating an account with them and accepting their terms so ended up resorting to blocking their email.

ktosobcy 2y ago

> There are several tutorials on the Internet on how to avoid this, for example, this one on How-To Geek, which suggest disabling an option in the Google account. However, this doesn't work, since mine is not enabled and never was: I don't have google account (or better yet - I'm not logged in to it in any reasonable manner) yet the promp shows constantly :| f* google

kemotep 2y ago
That suggestion for a fix never made sense because you get it on every device and browser. How would that work if you aren’t signed into Google in the first place?
- stvltvs 2y ago
  I have a different Firefox profile to sign into Google with. For normal, everday browsing, I use another profile where I never sign in.

archargelod 2y ago

> accounts.google.com/gsi/* This filter might break functionality on some sites, so it's better to use more specified version: ||accounts.google.com/gsi/*$xhr,3p Explanation of the relevant syntax: `[no prefix]`: Blocks resources that have this text string anywhere in its URL. `||`: Blocks resources that have a specific domain or subdomain. `$3p`: Ensures that resources from a domain are only blocked if you're not visiting the domain itself. `$xhr`: Prevents such resources from being downloaded through the titular JavaScript APIs. More Ad-filtering syntax explained: https://github.com/DandelionSprout/adfilt/blob/master/Wiki/SyntaxMeaningsThatAreActuallyHumanReadable.md https://github.com/DandelionSprout/adfilt/blob/master/Wiki/S...

red_admiral 2y ago
Thanks. Added that besides ||google.*/complete/search$xmlhttprequest,important which is not for everyone, but turns off the autocomplete for me. Needs an "important" to override the override in on of the default filter lists. And then of course: - google is an ok search engine with the udm 14 trick. - bing is an ok search engine if you use it through duckduckgo.
- paravz 2y ago
  had to google the trick to disable ai search results, now how to apply it to all searches
dogtierstatus 2y ago
Is there anyway to do this on Android mobile?
- McGuffin 2y ago
  Yes, switch to a firefox based browser for android.

whywhywhywhy 2y ago

The fact this prompt seems to block the first click of input on the actual site usually is indefensible. Not including an easy to find and easy to understand option in Chrome to just disable it outright with a 100% success rate just adds to the evidence that giving Google any power on the internet was a mistake.

jsnell 2y ago
You understand that this isn't a browser feature, right? Chrome isn't creating the login prompts and doesn't have any kind of special support for them. It's just rendering the HTML / running the JavaScript on the page.
- whywhywhywhy 2y ago
  Pedantry aside, same company same ecosystem.

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

beretguy 2y ago

Also can probably use a custom DNS with De-Google filter.

deleted 2y ago

[deleted]

darajava 2y ago

I like this popping up. It makes it pretty clear that the site favours bloatware and tracking and is to generally be avoided.