Hacker News Reader

Comment by savrajsingh | Hacker News Reader

That's not the expected behavior. We use Google Accounts for Sign In, but it should present you with a window that says "sign in to wattvision" and ask you for your password again, even if you are already logged in to Gmail. We'll confirm / try to repro on our end. Any other info you have is appreciated.

UPDATE: We definitely want to fix this, we do not want to surprise or inadvertently sign up users. That's not our intention and we're not that kind of company!

UPDATE 2: Ok it looks like Google has updated their "federated login" http://code.google.com/apis/accounts/docs/OpenID.html since we implemented our login system, so we'll check against that and see what's up?

If anyone from Google is reading this and can comment/help, please email us at founders@wattvision.com.

Thanks!

View on HN

My navigation was:

- home page - /house - /info/sensors - /house/add

I went to the last page because I was curious that you had to register _before_ buying.

At this last page I saw my gmail username pre-populated in the form automatically which freaked me out (I didn't even know grabbing a visitor's google account name was possible) and I closed the page, I did not submit (voluntarily) any info. Then within a couple of minutes I got in my gmail account a welcome email.

I think this is way worse than spam, fix asap.

Confirmed: I just replicated this behavior.

And me as well.

  (I didn't even know grabbing a visitor's google account
   name was possible)

I didn't either, but it seems you can simply use Google's API to allow a user to sign in, where the user name of the user that signs in (or is already signed in!), is reported to the user of the API via a callback. The request after you sign in has a 'continue' HTTP header that says something like:

  continue=http%3A%2F%2Fwww.wattvision.com%2F_ah%2Flogin%3Fcontinue%3Dhttp%3A%2F%2F
  www.wattvision.com%2Fhouse&service=ah&dsh=2844188452075813479&timeStmp=&secTok=&GALX=
  DTEVMCX16p4&Email=<your gmail address>&Passwd=<your_password>

same here.. Are you using appengine? There is a recommended way to get the login implemented from appengine.

http://code.google.com/appengine/docs/python/users/overview....

I am not sure if you wanna do federated login on appengine.

Email sent. Google here, confirming this is an issue with the Users API on App Engine. On-call team is working on the fix now.

Edit: As of 12:30PM PST, we are now rolling out the fix. This should be relatively instantaneous.

Thats not how it is working. I clicked "Sign In" and was immediately logged into your site.

Same for me.

Same here.

Just tried it now and it's exactly as described.

Seriously guys how have you managed to get around Google's protections here? ;)

Why do you require a Google account to sign up?

Because its the easiest way on GAE I suppose?

Reply on news.ycombinator.com