- You interact with a bot in a mostly-idle, public chatroom (such as !commands on Twitch)
- Bot pastes a url-shortened link that redirects you to a Google doc
- Anyone who had that document already open can now link your Twitch identity to your Google identity (which may include real name+photo)
Granted this particular vector has been open for well over a decade, it may just catch you off guard sooner or later.
"I know it doesn't make sense, but the VP wants this so just make it happen"
https://support.google.com/accounts/thread/219332922/how-to-...
> Allow Google to display a sign-in prompt on Android. Learn more about sign-in prompts on Android[0]
with a section below saying Chrome itself has settings as well
> To manage third-party sign-ins on Chrome, go to Chrome Settings. Learn more about sign-in prompts on Chrome[1]
[0] links to https://support.google.com/accounts/answer/12849458?p=androi...
[1] links to https://support.google.com/accounts/answer/12849458?p=chrome...
||accounts.google.com/gsi/*$xhr,script,3p
It's always the 1st one I install.chrome://settings/content/federatedIdentityApi
enable: Block sign-in prompts from identity services
I've seen the gmail addresses of so many twitch streamers who were capturing their screen without knowing that would happen. Most of them with addresses they'd rather not be public.
So much this, it's 100% and antipattern. It often causes me to just close out of page unless the content is actually something I really want to see. I have several google accounts associated with my gmail, so the box is often kinda big and I'm afraid I'm going to accidentally subscribe one of them to something.
At least that's me on Chrome.