Hacker News Reader

Comment by blfr | Hacker News Reader

I loathe every login screen except for Google's. Why is it that only one company in the world (and sshd but there's no login screen when set up properly) can get it right? Is it really a piece of software that requires hundreds of millions of dollars to get right?

And people who try to fix it so often make things worse. I was very excited about notion.so until I learned I will have to keep clicking magic links for eternity. (Yeah, I know, they support logging in via Google which reinforces my point.)

View on HN

Odd. I dislike Google’s very much. Although I use Google’s with many accounts (personal/work/partner) sometimes URLs will just assume my identity is “logged in account index 0” and give me a permission denied, or pass me to a page which has no way of changing the active account. I found that most urls can have “u/1/“ pretty much anywhere to change accounts but if they have rewritten the url before I see the permission denied or black-hole then it’s useless.

There’s also the fact that google recently forced Javascript and specific browsers to be used in order to be able to login. So I was locked out of my account for a while until someone discovered that the “rules” are a little more lax for Firefox useragents.

To add to this: I’m certainly no Microsoft fanboy but the best login I have experienced (in my life I think) is AzureAD with SAML. It seems to use Kerberos silently in the background to do saml handshaking. It’s truly seamless and very fast.

Even if I’m logged in to outlook from office365 (from a non-enrolled computer) I won’t even be presented with another login screen. I’ll just be logged in like “magic”.

More context to the logging in with “unable to verify the security of the browser” issue: https://forum.manjaro.org/t/google-blocks-access-logging-fro...

I use Google’s with many accounts (personal/work/partner)

You don't mention your use case but it's almost always a bad idea to be logging in as someone else, not just at Google but everywhere. Some sort of access delegation would probably be much better.

As for a work account, I keep it in a separate Chrome profile. Not because of logging in but because you can sync everything without risking spillage.

Yeah, Google's SSO is fine unless the first logged-in account (/u/0) is one with a redirect to a company portal login. At which point you have to manipulate the URL to get to a different account.

When logging in to gmail (gsuite really) for work, I notice that I’m briefly redirected to accounts.youtube.com after putting in the otp even though the account has no youtube association. Any ideas why? I’ve tested blocking the domain and it still lets me through (after hitting back after falling to load). Is this just “because Firefox”?

From what I can tell, it's setting some kind of cookie for Youtube as part of the standard Google login flow. They probably have their cookies set up in such a way that authentication data is only accessible from first-party websites (like cookies).

I can see 11 cookies on the Youtube.com domain in my browser. Some of those seem to be purely for authentication reasons. I'm pretty sure that's why Google flows through Youtube when you log in.

As for why they always try to set Youtube cookies: I don't know, but it's probably because they don't feel like splitting up their authentication flow. Doing the redirect for accounts even when they don't have any Youtube-related is probably a no-op; leaving it like that doesn't cost anything close to the time and resources it would take to segregate their entire workflow + verify that the security is still sound.

> There’s also the fact that google recently forced Javascript and specific browsers to be used in order to be able to login. So I was locked out of my account for a while until someone discovered that the “rules” are a little more lax for Firefox useragents.

There's a ton of threat mitigation and detection of unusual activities going on behind the scenes. This is a big reason why my company uses GSuite SSO - it's basically impossible to achieve a similar level of security with a DIY SSO setup. Auth is very hard to get right with all corner cases considered.

JS trickery is key to detecting bots, and blocking super-outdated browsers like Konqueror that basically lack all modern security mitigations is a reasonable thing to do (and probably allows them to remove less strict fallbacks for those browsers that were previously abused by bad actors).

What exactly is the threat model in which blocking all Konqueror users is a reasonable thing to do?

> Auth is very hard to get right with all corner cases considered

What's wrong with an x509 client certificate?

> blocking super-outdated browsers like Konqueror that basically lack all modern security mitigations is a reasonable thing to do

Except they still allow browsers far more insecure, like IE. And they could do feature detection to see if the security features are implemented or not.

Blocking user-agents does nothing good for anyone.

IE has a much larger market share, so they probably spend a lot of extra time on IE special cases.

That means it doesn't have anything to do with security.

At this rate, software developers are going to get worse reputations than lawyers before too long.

One app I use every day at work, I have to provide my email address ever day, then log in. Then the app passes authentication for some unknown reason to Microsoft's federation service of some kind, using my email address which it asks for again + password.

Prior to their recent 'redesign' it was perfectly streamlined before they "refreshed" the app with a brand new bullshit UI that just made everything worse. I literally can't think of a positive that came out with the new version, it's worse in every conceivable way.

Personally I think someone scammed the company into redesigning something that didn't need it, subcontracted it out to the lowest bidder and pocketed a nice stack of cash for themselves.

I despise Google's login screens. Two separate forms, one for just an email address another for just a password. Why? Why should I have to invoke my password manager twice just to fill in two fields? I can't think of a single sane reason for doing this.

The reason why they do this is because of sso logins for other organizations.

For example, to log into my college gmail account, I type my email, get redirected to the schools sso page (retype my username and password), then get redirected to gmail.

>retype username

That's even worse than the non-sso sign in flow. It definitely doesn't have to be that bad.

Since I use a password manager, its not really an issue unless I have to login on some random lab computer.

At the place I work we use office 365. Their sso path is so much better. I never need to re-enter my username.

Both Chrome and Firefox handle that form just fine. In my case it's four steps: login, password, hardware key, and clickthrough. It is fast and painless though.

Plus if you have a bunch of tabs open (G Suite), it will log you in all of them once you log in on one.

> four steps

Oh god... How a human being can stand this humiliation? I image this inflating to eight steps in 2030: login, password, 2FA key, face scan, reCAPTCHA, ID scan, phone call, click checkbox in AI TOS no one reads, final click on “We’re done!”

I expect it to only be one, silent step involving your Titan X brain chip by 2030.

You two should write a Point Counterpoint article somewhere.

This is because certain email addresses have SSO enabled and don't use a password. The only way to know is to get the username first and then redirect to the right place.

Not only SSO, but also two-factor authentication. Without asking for the user identifier first, you don't know which authentication method to present, because this varies per user account.

The alternative is to let the user choose the authentication method right on the first screen, but that would mean showing all possible methods (some of which may be limited to certain groups of accounts) and getting a lot of users stuck because they chose the wrong method.

So leave the password field empty if you want to use SSO, but keep it for standard Google accounts, so at least people using those don’t have to deal with the madness?

That's how it used to be.

Notion recently added password login.

Oh, so good. My manager still doesn't fill in the address properly but better nonetheless. Thanks!

Reply on news.ycombinator.com