Hacker News Reader

By using the really, really, really badly designed listener auth flow... which just allows javascript to grab your google creds.

https://developers.google.com/identity/sign-in/web/listeners

View on HN

Doesn't this "bad" design allow Reddit to show a higher DAU? Isn't DAU correlated with ad prices? Sounds like a winning design to me, especially if it only appears that the design is bad, and not the intent behind it.

Oh without a doubt this makes Reddit look like it has way more users than it actually does. 2/3rds of them single visits or visitors with no posts, no comments, no engagement, just someone following a google result.

I guess this never worked on browsers that disables third party cookies by default, like Safari and Firefox?

incorrect. This works on all browsers, on all platforms. It's a hook into their exposed OAuth2.0 flow. You'd have to disable javascript to stop it. signIn action can be a fetch and you're f$&ked. You'll get the "Sign In With Google" popup (with you're username already snatched).

I've always wondered how on earth this is compliant with GDPR, you do not consent to anything of it.

Reply on news.ycombinator.com