Introducing Google+ Sign-In: simple and secure, minus the social spam
googleplusplatform.blogspot.com
googleplusplatform.blogspot.com
One apps for domain account is tied to my job, another my personal domain, a third to a former job/personal domain that I registered services with. I used my gmail account to access services that google doesn't make available on google apps for domains.
It seems that no matter which google service I'm using, I'm logged into the wrong account. I frequently can't log out from the other account properly on the login page so I have to go back to a mail interface. It is an utter mess. I don't care about google connecting the dots and realizing that I'm the same person in all the places. They make it so frustratingly hard to use and depend on their services that I'm actively looking for alternatives.
Linkedin handles it fine, when someone tries to friend me on my professional email address with linkedin, they know that I'm the same person. Google+ doesn't. I don't have a Google+ account on my preferred email account because I can't figure out how to enable it for that domain. I get Google+ friend requests regularly on every email address I have.
I found this back in 2009, maybe 2010, when I was still "on the inside" and shared it around internally. Some people got a real kick out of it.
Now consider this: every single employee has a corp account, and I would think nearly every employee has a personal account, too. That means problems stemming from being in the right account have probably popped up in every single person's face for years now.
It didn't help when they changed from having the u@h up to just a name. Great. I know my name. I need to know which account I'm in.
Sorry.
The google voice integration is by far the worst. I have to log into google voice, which then calls my gmail, which then calls whoever I want to.
Go to the Chrome settings page, and under the "Users" heading, choose "Add New User." Then you can pick an icon, that appears up in the browser's title bar. That icon helps you remember what user you're browsing under.
It might ask you if you want to setup sync after creating a user, but you can just close that window and it won't ask you again.
Click the icon in the top right corner of the title bar, and you can change what user you're browsing as at the moment.
My company uses Google Apps for Business, but that basically means web services, because no actual software works. GChat, Chrome, etc all fail to recognize the account.
Yep just tried again: Invalid user name and password. Exact same entry as when logging into email except Chrome fails where gmail.com works. It simply will not accept the name/password of my Google Apps account on any Google software.
What a bummer, was hoping this was a fix for having multiple accounts.
To do so, have them visit:
www.google.com/a/cpanel/<your domain>/CPanelHome?pli=1#Organization/subtab=services
...and Ctrl-F "Google Chrome Sync"
Didn't realize there was anything more than possible.
It's also a matter of privacy. It has happened to me more than once that I did something like watching YouTube videos in the privacy of my own home, only to find out I was still logged into my company Google Apps account, which of course records my history.
If you're on Firefox... seems like they only really care if you use their Profile Manager, which is a horrible alternative, but it does work reliably across all versions as long as you never ever ever launch the browser directly.
Or if you don't mind rewinding time a bit, and using OSX, http://www.stainlessapp.com/ (assuming it still works) has a brilliant idea: bookmarks can be associated with sessions. Have one for each account, run them all side-by-side in tabs, and it works great. I wish every browser would do this.
That said, there's a lot that could be done to make multiple accounts easier to use. Personally, I use multiple Chrome profiles with one account per, just to minimize the "surprise" (and to keep, e.g., my corp account separate from my personal ones).
Linux makes it very easy to display apps from another user (which you authorize) on your graphical session. AFAICT this is just plain hell to do on OS X and on Windows (but blablabla X Window System is outdated, OS X rendering rocks, gnagnagna etc. Meanwhile I'm trivially surfing using different user accounts and this provides both conveniency and added security [any browser exploit now need also a local root exploit to be able to access sensitive data in the "real" user accounts]).
My professional email is using a SSH tunnel / transparent Squid proxy : anyone doing a reverse shall find my company through the IP (on purpose). I'm launching Chrome from my "professional" user account using the proxy setting (from the command line).
Then I've got another Chrome for my personal stuff.
And a throwaway VM with yet another Chrome.
Can you give an example of a series of actions that leads to this? I'm logged into two separate Google accounts at pretty much all times, and I never run into trouble. I'm curious as to what the difference is between our two usage patterns.
Scenario 1) I have both open, and log out of my gmail account. It redirects to my school's "goodbye" page. I just reproduced this. Not a huge problem, but indicative of a bigger issue.
Scenario 2) Now log out of the school account. I am greeted with a login for my gmail account. This is pretty close to the problem in Scenario 3, below.
Scenario 3) The real issue. The problem is not so much that it has happened, it's that there is no way to recover if you don't have the password. The other week I logged into my wife's laptop to grab a document from gmail to print, since it was hooked up to the printer. She didn't use it for the next few days. When she went to her work email's address (a .gov domain), it prompted her for my gmail password. There was no way to 'change account' at that point. No way to log out. Go to the .gov domain, get a prompt to login as <me>@gmail.com. No way to authenticate. I couldn't figure it out, and finally just logged in as myself then logged out, after which I was redirected to the .gov boodbye page, but it allowed her to log in after that.
Edit: Scenario 4) Go to www.gmail.com/a/umbc.edu, which the google help pages say is the correct way to go to the school's site. I just tried this, and it sent me to my gmail.com inbox. It is pretty much a crap shoot which mailbox I get when I first load the page. Sometimes it's aware I'm signed in under different IDs, sometimes not, so I can't always change accounts, and must go through login/logout hell to get them clear. Perhaps I could just clear my cookies but I don't like doing this en masse.
Whichever one says /u/0 is the first one you logged in as, and that will be the default if you, say, open a new tab and paste in a bare link (without /u/ in it).
If you want that to be your personal account, you can make that your /u/0 account by doing this:
1. Log out of all your Google accounts
2. Log into your personal account
3. Click the picture in the upper-right
4. Click "add account"
5. Log into your work account
Regarding your second: Citation needed. There's this persistent rumor that if you make a G+ account with a fake-sounding name, Google will lock you out of your GMail and erase all your Google Docs, but as far as I've seen, those rumors have never checked out.
...until two or three days ago.
GMail flat-out refused to let me log into two accounts (it would end up in endless redirect when I tried the second one - I quit Chrome, fully cleared cookies, history, everything... it just would not work)
It seemed to have cleared up by the following day.
These types of things are what I think about when people tell me how great the Google programmers are, but that's another topic.
I still have problems with Google Wallet (aka Checkout) and Analytics seems to have it's own multi-account sign-in system.
This all started when I decided to try Lively, of all things. It prompted me for a username, but I never would have entered what I did if I knew that that username would become the permanent name of my Google account.
I did this when I first started using Apps and the process went very smoothly.
As an entrepreneur you are always up against the very real probability of Google shutting down your account due to unknown violations. This topic has been discussed on HN before. I have seen it and experienced it first hand with clients. You account is auto-magically tagged and permanently suspended and you are screwed. Say goodbye to your docs, email, storage, adwords, adsense, plus and now logins.
I would really like to hear from someone at Google on the reasons why your company will not come out and offer:
(a) A solid guarantee of non-termination of services
(b) Real customer service
(c) A sensible mechanism through which honest users of your services can deal with TOS violations (and learn how to fix problems) without risking loosing it all.
There's more, but I'm busy. The point is that Google offers a lot of neat stuff but the risk is too great. It's like jumping off a plane with a parachute while someone retains control of a "deploy disable" mechanism. You don't know if you are going to crater yourself on the fifth, the hundredth or the nth jump. You just know that it could happen and you will never know why.
If they terminate your account, it's because they had a reasonable suspicion that the account violated their TOS. So I guess this one is actually related to not knowing what the violation was, and accordingly assuming it was for no good reason. I didn't work on the Policy team - I was a dev - but I seriously doubt anyone there could terminate peoples' accounts without reasonable suspicion of a violation and get away with it. The checks and balances are too tight.
> Real customer service
Google does have "real customer service". However, as far as I know, it's reserved for the people who are paying Google money for whatever reason. In general, any of Google's free services have so many tens of millions of users that it would be ludicrous to guarantee any level of service for every single one of them.
As to the general complaint about the very real possibility of being cut off from your data, that's a risk wherever you go. Drives fail, servers get hacked, someone accidentally hits "delete everything" instead of "refresh monitoring dashboard"... etc. At least with Google Take-Out, they make it incredibly easy to download whatever data you have on there periodically for the purpose of doing backups.
We were working on a client's medical information site. A reputable MD. He happened to own about 250 domains parked at GoDaddy. We were going to use AdSense on his one site once it was up. He went ahead and setup an account with Google to use both AdSense and AdWords. During this process he saw that Google offered a product called "AdSense for Domains". The premise being that you park your Domains with Google and they auto-magically place ads on them.
The domains were already parked with GoDaddy's "Cash Parking" service for over a year. It didn't take long for him to realize that this was an intermediates version of Google's AdSense for Domains. He decided to cut out the middle man and park the domains directly with Google.
He transferred all the domains. They had to be approved by Google. That happened overnight. All was well. Two days later he gets the dreaded notice and his entire account is permanently suspended without recourse, without a way to learn what the problem may have been and without a way to speak to a real person. Horrible. Particularly when you realize that he had already been using this service through GoDaddy as a middle-man.
That is the kind of thing a shit company who cares not for their customers would do, not a company who clims to live by this "Do no evil" ethos.
Based on that experience I can't see ever trusting them with anything at all. Great search. Absolute lack of respect and consideration for their customers, which is an absolutely shitty way to behave in my book.
My standing recommendation is to not use Google for anything other than search.
Because there's zero feedback all we could figure out is that some of the domain names (he had a couple that were politically charged) may have hit a filter. What's weird is that they went through their approval process, started showing ads for a day and then the account was closed.
This is one account. Search for "Google closed my account" to read more horror stories, all with different threads. Their process and approach is absolute crap. Not to be trusted with anything.
Of course these people were using AdWords for their business. They were NOT using it to vector people to the parked domains.
Only a moron would do that. Spend dollars to make sub-pennies?
As a consultant I had two clients who had their accounts disabled for no reason, and who I am absolutely positive were not breaking and rules. I've seen google steal the balance from adsense customers, without offering any recourse or even a human to talk to. Whatever those checks and balances are, they are no where near enough.
The customers who have received no feedback as to what they apparently did wrong, and were abruptly cut-off? They are "absolutely positive" they are in the right, as they have no idea which rules, if any, they broke, and have no chance to fix the issues.
Or Google, who provided a business service and then took it away with no explanation or ability to rectify? They may believe the customer broke some rules, but have not provided any meaningful customer interaction mechanism to allow for errors. There will always be errors with populations this large.
Three ideas: 1: Charge people/businesses for making a complaint about termination. If the termination was done in error, then refund them the fee (at least). Use the fees to pay for customer service staff.
2: Charge people for account reactivation, regardless of (almost all) causes. Steadily (exponentially) increase the fee, but allow for 1: as well.
3: Be extraordinarily explicit when telling customers why their account was terminated/suspended. Stop the guessing game and show the evidence you have. That will both for Google to make sure the evidence is sufficient to be public, and make the customer aware of just what went wrong. Allow them to fix the issue and reapply.
Above all the current aproach is placing the customer's concerns last, not first. That needs to change before we will trust Google with our important business or personal data.
At Google, as a dev, gaining access to personally identifiable information (that was hashed, anonymized like crazy, and scrubbed in every possible way to make damn sure there's no way the dev using the data could possibly track down any of the users) required jumping through so many hoops and getting so many different approvals and reviews it felt almost paranoid.
At Facebook, for years, they had a master password that could access all information on anyone's profile. They would just flat-out give this password to every single new hire, even people who weren't working with the data directly.
1. As a user, not an employee of the respective corporations, I have no idea about that. Nor do I care, really.
2. Furthermore, that's only the current state of affair, I have neither idea nor control over how it will change over time.
A lot of users don't realize that Facebook can 'see' their messages, never mind the rest of the data that they have "privately" shared on the site.
Chances are your users won't have it already, but it's the only single sign-on solution I would use without calculating how much privacy I'm willing to "sell" for not having to register yet another time and remember yet another password.
1. By the end of March, we'll turn on a Persona <-> Yahoo (OpenID) bridge, followed by one for Google (OpenID) and Hotmail (OAuth). Net win: A billion+ users can fully complete a first-time login with Persona using just three clicks. (Try it today! Use a Yahoo address at http://beta.123done.org/)
2. A subset of the team is working on a Persona-backed replacement for Firefox Sync. Net win: tens or hundreds of millions of additional users added to the "Persona-ready" camp.
3. The upcoming FirefoxOS phones all have Persona baked into the default Marketplace. Net win: time will only tell.
The above projects just streamline the initial onboarding experience: anyone can use Persona right now with any email address. FWIW, last time I checked, Persona's is averaging > 13,000 daily login transactions over a rolling 7-day window.
I don't want to derail, but if you have questions or need help getting Persona set up on your site, please free to email me.
I hope it becomes the universal single sign on of the Web.
It seems they're even offering analytics with it: https://developers.google.com/+/features/play-installs
[0] https://developers.google.com/+/web/signin/android-app-insta...
But until g+ allows linking of multiple gmail accounts to one g+ account i will never be using it.
Ever tried switching email address on g+, nightmare...
Then, I heard about Data Portability and the ability to migrate G+ accounts. "Finally, someone at Google understands that people have multiple accounts!" I ran their app, had my account frozen for a week for the 'migration', and created a new G+ for my personal domain. Bizarrely, they didn't delete my old G+ account.
I used to have a G+ account tied to the wrong e-mail address. Then, I tried Google's roundabout solution. Now, I have two G+ accounts. =\
What im referring to is when contacting other people through g+ it uses w/e email address is associated with g+. This is not always idea, I don't want everyone to know about my email address. Even if u have another email address it is impossible to contact other users using anything but the one email address associated with the account.
Also afaik you can link other NON google email addres, just not other google accounts...
Are they just using different scopes and can you authenticate with both in one go or are they really separate APIs?
If they were serious about it, they'd put it in a non-changeable clause in their TOS. Otherwise it's just marketing fluff.
Somehow I find that hilarious.
You've clearly never seen the google ones.
It's a GIGANTIC POPUP full of Click here! Join now! Follow ME! (Or like today, a new full page of Do Not Want: "Never miss another post Get notifications whenever important people in your life share something new on Google+" <-- how about you just let me into the site ok? Come on...)
Facebook is spammy, but G+ is just beyond a joke.
What the hell happened to the Google we knew?
It never existed, and people were pointing that out this whole time.
NOPE NOPE NOPE.
What the hell. "Are you sure?" Well, yes I am. None of buttons answer that question.
I just wanted to watch the damn video link someone sent me. Jesus. I'll be sure to logout next time.
Instead I was assaulted with this UI atrocity forcing me to evaluate some complicated modal dialog before I could even view the damn video. I mean, look at it: it's a pretty clear yes/no question with three confusing answer buttons and none of the labels answer the question posed at the top.
I could tolerate it if it happened when I tried to upload, comment, like, report or favorite something, but just to watch? If I had been logged out I wouldn't have been hassled by this. Apparently my sin is having bothered to create an account at some point in the past when I just wanted to click the like button as feedback to some poster. Why is it so unreasonable to like things without endorsing them? I guess the answer it to delete my youtube account and lurk moar. Fine. This is exactly what wil warned about.
[1] "Since the beginning, we’ve focused on providing the best user experience possible. Whether we’re designing a new Internet browser or a new tweak to the look of the homepage, we take great care to ensure that they will ultimately serve you, rather than our own internal goal or bottom line."
http://www.google.com/about/company/philosophy/
(they really should change the language in that page now)
The same cannot be said for Windows. Especially when Windows held an overwhelming monopoly on desktops, unlike Android.
Persona uses cryptographic tokens so that identity providers can't spy on what sites you're using, and can't selectively deny service to various sites.
I think that people should resolutely refuse to use any identity service that doesn't have at least those properties.
The complaint usually goes if I wanted to use your #@#%@# app I would be using it, I'm using your web site.
Seems spammy to me and also android only. Really getting skeptical of the "gadgetification fanboism" of the web.
In such a flow, I'd rather that the intent be spawned from a click on my computer than from me having to go to Google Play online/on the phone and search for it, etc.
(Google can install anything on your phone at any time, in theory, because of the way Play works. So if you're worried about "all of a sudden it's installed on your phone" you probably don't want an Android device.)
I'll continue to use my Google (Gmail) account for authentication to StackExchange and a few other sites, because it doesn't make me use anything but Gmail. But, if Google starts forcing me to use Google+ actively, I'm going to stop using it for authentication.
https://developers.google.com/accounts/docs/OAuth2WebServer
According to these new docs, I need to use the Google+ JS to do client-side authentication, then pass the token to my server:
https://developers.google.com/+/web/signin/server-side-flow
I have no interest in building a new code path to support Google login, when I can use the OAuth setup I'm already using for 3 providers (inc. Google). It would be nice if you'd just post the CSS or PNGs you're branding as Google Login and let me use the backend I've already plumbed.
Here are the design guidelines, PSDs, and PNGs:
Unauthorized request.
Error 400
In addition: Google+ doesn’t let apps spray “frictionless” updates all over the stream, so app activity will only appear when it’s relevant (like when you’re actually looking for it).
edit: referring specifically to how Facebook markets it's sharing options as "frictionless": http://en.wikipedia.org/wiki/Frictionless_sharing
1) To keep consistency across every service (search, analytics, maps, etc)
2) Because it's what users like, according to in-house studies
3) Because...why change it?
Not all the Google blogs use Arial (http://chrome.blogspot.com/ uses Open Sans). I'm not trying to be completely snarky here...If it is indeed a best practice, then that's good to know. The width of the Google blogs do conform to showing 80-or-so characters a line, though at 16px, the characters-per-line is about 70, which isn't bad either.
(yes, I know HN is at 13px too...but a discussion board with variable length of text and a higher value in being able to see more entries at once is different than the narrative paragraph form)
Joking aside, it's a 62.5% x 1.2em font size which is rendered as 12px (at least with my chromium/ff defaults). Probably too small for most readers nowadays (some would certainly agree cf. http://informationarchitects.net/blog/the-web-is-all-about-t...).
In fact, I've checked all the sites listed in the article - none of them have Google+ sign-in.
Also, they say you sign-in via Google account, but I suspect it also requires a Google+ profile in order to use this feature.
If you guys wanna see the future of this project, just try to create an account and upload a video in Youtube. Youtube is a Google company, and they fuck Youtube's membership system up.
* http://www.tuaw.com/2013/02/26/apple-rejecting-ios-apps-for-...
Also, what Apple was trying to combat was persistent tracking without user knowledge (done originally using iOS's exposure of device ID, which was deprecated, and now with these "cookie" tracking implementations). Allowing a user to initiate sign in to an app is a far, far cry from that (and it would be preposterous for iOS to disable the ability to log in to apps).
At least that's what apple's reviewers told me when my app was rejected.
Apparently; the "Moments" API which supports this (which has, I think, been in limited, trusted-tester use for something like 6 months) appears to now be general availability as of the API documentation update today.
Deleted comment