Hacker News Reader

Hacker News

Comment by vtesucks | Hacker News Reader

Full thread

vtesucks

Quora logs you in automatically if you're logged in to google.

Also makes it extremely hard to log out.

Not to mention they have no respect for users.

View on HN

I don't know how you think this is actually possible. It sounds to me like you just logged in using oauth…

Edit: Hey, downvoters, it's not possible to just use Google's login mechanism without prompting an initial OAuth flow at some point in time. If it is, instead of proving me wrong here, tell Google how and you can make some good money out of it.

As was said below, if you want, you can revoke tokens here: https://myaccount.google.com/permissions

I did, once. But after that one entirely new sessions, they automatically "click" the sign in to google button behind the scenes and log me in with the token.

Very creepy

I don't like Quora, but... that's just how OAuth is meant to work.

I will say I appreciate Facebook's approach to this - after 60-90 days, you have to affirmatively reconfirm your initial authorization when they send you through the OAuth flow.

Revoke the auth with google and clear any cookies you have with Quora. Worse that will happen if they redirect you to google to login.

The first time you logged in with Google, you were presented with a User Consent screen that said "this website wants access to this information, do you agree?" and you clicked yes.

To break the link, go into Google and see what sites, apps, etc you granted access to. That's a good thing to do regularly anyway with every social provider.

I wrote about the implications of poorly implemented and abusive social authentication practices last month: https://www.scmagazine.com/home/security-news/using-social-a...

You can revoke OAuth tokens at https://accounts.google.com/b/0/IssuedAuthSubTokens?hl=en

When a service typically uses an external identity provider, they usually still have local accounts that are created and linked to that form of authentication. Of course the user will always need to authenticate using that same external identity provider ,but it can be forced by the application server by initiating oauth without provocation in the backend.

What this seems like is after the user initially logged in and consented with Google, Quora went ahead and decided that they would initiate the oauth flow whenever the user visits the page regardless of whether the user explicitly hits the login button or not.

Reply on news.ycombinator.com