Hacker News Reader

Comment by frereubu | Hacker News Reader

I wonder if this is linked to something I noticed, where logging in to Google Sheets seemed to involved a redirection via a YouTube domain that was something like auth.youtube.com

Edit: As someone else has pointed out, it was accounts.youtube.com. Feels really weird that they're authenticating a Google Workspace service via YouTube, even if they're both Google properties.

View on HN

Same thing with Microsoft. When you sign in on one Microsoft property, you get redirected through a whole bunch of Microsoft properties, including www.bing.com, login.live.com, outlook.live.com and www.office.com, setting cookies everywhere.

gee it's almost like all of those properties can then track you forever and maybe have like some sort of argument as to why they were tracking you - well of course we set cookies, they hit our domain!

When you log in to a Google account, as the 2LD is a cookie boundary, it has to do this redirect if it's to cookie/log you in across all Google things that run on other 2LDs, such as YouTube.

Seeing as YouTube doesn't have a separate auth db, and people would be confused if they logged in to google.com then weren't logged in to YouTube, this is sort of expected behavior.

It looks like Google uses the youtube.com domain for their auth process. I notice that they redirect to accounts.youtube.com everytime I use Google as my SSO.

Same thing happens when you use Google's platform.js[1] lib some of the time but not always.

1: https://developers.google.com/identity/sign-in/web/sign-in

Similar happened to me when accessing maps.google.com: I was redirected to consent.youtube.com for the privacy statement.

Reply on news.ycombinator.com