Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by itomato | Hacker News Reader

Full thread

itomato·

They’re playing shenanigans with Google Accounts and auto login.

Log out of Reddit and revisit.

It may create an account for you and automatically log you in.

Cursed DAUs

Put?

View on HN

How is this possible? A website cannot just magically cross-domain get your Google account details...

By using the really, really, really badly designed listener auth flow... which just allows javascript to grab your google creds.

https://developers.google.com/identity/sign-in/web/listeners

I guess this never worked on browsers that disables third party cookies by default, like Safari and Firefox?

incorrect. This works on all browsers, on all platforms. It's a hook into their exposed OAuth2.0 flow. You'd have to disable javascript to stop it. signIn action can be a fetch and you're f$&ked. You'll get the "Sign In With Google" popup (with you're username already snatched).

I've always wondered how on earth this is compliant with GDPR, you do not consent to anything of it.

Doesn't this "bad" design allow Reddit to show a higher DAU? Isn't DAU correlated with ad prices? Sounds like a winning design to me, especially if it only appears that the design is bad, and not the intent behind it.

Oh without a doubt this makes Reddit look like it has way more users than it actually does. 2/3rds of them single visits or visitors with no posts, no comments, no engagement, just someone following a google result.

Reply on news.ycombinator.com