Hacker News Reader

Comment by lazyant | Hacker News Reader

I was logged into my gmail account and after visiting this site, without signing up for anything I get a welcome email, WTF?

View on HN

That's not the expected behavior. We use Google Accounts for Sign In, but it should present you with a window that says "sign in to wattvision" and ask you for your password again, even if you are already logged in to Gmail. We'll confirm / try to repro on our end. Any other info you have is appreciated.

UPDATE: We definitely want to fix this, we do not want to surprise or inadvertently sign up users. That's not our intention and we're not that kind of company!

UPDATE 2: Ok it looks like Google has updated their "federated login" http://code.google.com/apis/accounts/docs/OpenID.html since we implemented our login system, so we'll check against that and see what's up?

If anyone from Google is reading this and can comment/help, please email us at founders@wattvision.com.

Thanks!

Thats not how it is working. I clicked "Sign In" and was immediately logged into your site.

Same for me.

Same here.

Just tried it now and it's exactly as described.

Seriously guys how have you managed to get around Google's protections here? ;)

My navigation was:

- home page - /house - /info/sensors - /house/add

I went to the last page because I was curious that you had to register _before_ buying.

At this last page I saw my gmail username pre-populated in the form automatically which freaked me out (I didn't even know grabbing a visitor's google account name was possible) and I closed the page, I did not submit (voluntarily) any info. Then within a couple of minutes I got in my gmail account a welcome email.

I think this is way worse than spam, fix asap.

Confirmed: I just replicated this behavior.

And me as well.

  (I didn't even know grabbing a visitor's google account
   name was possible)

I didn't either, but it seems you can simply use Google's API to allow a user to sign in, where the user name of the user that signs in (or is already signed in!), is reported to the user of the API via a callback. The request after you sign in has a 'continue' HTTP header that says something like:

  continue=http%3A%2F%2Fwww.wattvision.com%2F_ah%2Flogin%3Fcontinue%3Dhttp%3A%2F%2F
  www.wattvision.com%2Fhouse&service=ah&dsh=2844188452075813479&timeStmp=&secTok=&GALX=
  DTEVMCX16p4&Email=<your gmail address>&Passwd=<your_password>

same here.. Are you using appengine? There is a recommended way to get the login implemented from appengine.

http://code.google.com/appengine/docs/python/users/overview....

I am not sure if you wanna do federated login on appengine.

Why do you require a Google account to sign up?

Because its the easiest way on GAE I suppose?

Email sent. Google here, confirming this is an issue with the Users API on App Engine. On-call team is working on the fix now.

Edit: As of 12:30PM PST, we are now rolling out the fix. This should be relatively instantaneous.

How is that even possible? So if I'm signed into my gmail, a site can detect my email address? This seems like a huge privacy bug on googles behalf if this is actually happening.

We're investigating, its certainly not our intention. See my comments above.

Same thing for me. Whatever you're doing, you need to stop it, or else you'll have worse things to worry about than complaining HN users ;).

Yes, we hear you, please see my comments above.

I think that they are just using oauth and not doing anything nasty. In my case it asked me for my google account password.

This looks like a nice tool to have (if a bit expensive), but seriously, a bug like that is a real deal killer. Having my house appear after clicking a link freaked me out.

Having your house appear? Did they somehow pull your physical address info?

Ha. If only we were that good. ;) We try to figure out the city you're from using Geo IP (maxmind.com, for example) and then draw a Google Map. Down the line, we want to use the city you're from to compare use with other users from the same city/region. We're not interested in your exact street address.

Are there privacy settings available?

To add to this info, clicking your Sign Out link logs me out of my Google account.

ish, same here. Marked as spam...

Reply on news.ycombinator.com