| ▲ | mooreds 5 days ago |
| The Chrome experience is actually part of a new standard, Federated Credential Management (or FedCM for short). The idea is to create a browser mediated login experience that gives the identity provider and web app what they need without being able to correlate requests across the Internet. I am working on an article on this topic. If you are interested in learning more, here's a video from a recent auth focused conference (full disclosure: my company put it on and I emceed): https://m.youtube.com/watch?v=FBAD4x7MWdI They are actively working on the standard and Firefox has committed to it. Edge already supports it. They are looking for identity provider feedback. More here: https://github.com/w3c-fedid/FedCM (we meet weekly on Tuesdays). |
|
| ▲ | JimDabell 5 days ago | parent | next [-] |
| > They are actively working on the standard and Firefox has committed to it. Mozilla standards position says neutral: https://mozilla.github.io/standards-positions/#fedcm Their issue tracker on the subject shows they are interested but have a lot of reservations about the details: > However, some of our reservations on the initial positive position have not been addressed and some new issues have arisen. — https://github.com/mozilla/standards-positions/issues/618 Apple had a vague “interested” position over three years ago, with no further detail: https://github.com/WebKit/standards-positions/issues/309 Have these positions changed? |
| |
| ▲ | mooreds 4 days ago | parent [-] | | I don't speak for Mozilla, but I did see a bug in bugzilla which showed the blocking bugs for FedCM. I don't have the link now, but can share it later. That's what I thought of when I stated Firefox has committed to it. But I could be wrong. I do see a Mozilla employee engaging regularly. You can see some of the issues he has filed here: https://github.com/w3c-fedid/FedCM/issues?q=is%3Aissue%20sta... | | |
|
|
| ▲ | mook 5 days ago | parent | prev | next [-] |
| If it's a new standard, it must have… some kind of cross-industry support right? I ask because it looks like https://github.com/w3c-fedid/FedCM/graphs/contributors is mostly people who work at Google (I gave up once I hit people with ten or fewer commits)… |
| |
| ▲ | alternatex 5 days ago | parent | next [-] | | Isn't that the case for half of modern browsers APIs? Google develops whatever it needs for its own products into Chrome and then pushes it to W3C. Other browsers perpetually behind. They've gotten quite good at this strategy. | |
| ▲ | mooreds 4 days ago | parent | prev | next [-] | | While most of the contributions I have seen are from Google on the browser side, they are trying to work through the standards process. Here's the first draft of the w3c standard: https://www.w3.org/TR/fedcm/ I know there's a later draft but can't find it right now. Will share when I do. As mentioned in sibling comments I have seen are least on Firefox contributor and they are actively seeking input from identity providers. | |
| ▲ | pyrale 4 days ago | parent | prev [-] | | As usual, the feature is being railroaded by google and other implementers are given the choice between following Chrome's de-facto choices or not implementing it, and breaking websites that will use it anyway. |
|
|
| ▲ | gwbas1c 5 days ago | parent | prev | next [-] |
| Can we block sharing email addresses by default? It seems every time I sign in with Google the site / app starts SPAMming me without my consent. It's pretty much why I don't use it: The SPAM. |
| |
| ▲ | techjamie 5 days ago | parent | next [-] | | My gmail is quite old and well used, and it gets relatively little spam. I go through and aggressively unsubscribe link everything I don't want to see, and it surprisingly works. I get more spam on my @myname.tld address than my gmail even and I keep that one quieter. Almost every site actually does unsubscribe, and those that don't get marked as junk. | | |
| ▲ | B-Con 5 days ago | parent [-] | | I've maintained one vanity email for about 15 years. I use it for literally everything. I unsubscribe from everything. It gets some typical low effort spam that the spam filters easily screen out, other than that it's pretty quite. |
| |
| ▲ | whynotmaybe 5 days ago | parent | prev | next [-] | | And we should also do something about website that consider you a "customer" when you've only started an order and entered your email but you've never pressed submit to complete the order. | | |
| ▲ | dotancohen 4 days ago | parent [-] | | Does that happen to you often? | | |
| ▲ | mkipper 4 days ago | parent | next [-] | | I guess "often" is relative, but this happens to me pretty regularly. I live in Canada, and it's not always obvious if an American company ships here or not. If the answer isn't trivial to find, I'll do this: 1. Add something to the cart
2. Start the checkout process as a guest
3. Fill in the boxes that pop up during the checkout process
4. Close the tab when I see that the country dropdown only has USA available
On most websites these days, you're asked for your email before your mailing address. And after I abort the checkout, I'll get an annoying "Psst...you forgot something in your cart" email a few hours later even though I never made an account or placed an order with my email.Stores built with Shopify do this so consistently that I have to assume it's an out-of-the-box feature you need to opt out of. | |
| ▲ | whynotmaybe 4 days ago | parent | prev [-] | | Not often, but recently. And after giving it some thought, I guess that I'm also in the wrong to believe that I have to press submit somewhere to agree to their policies. This is a "nice" reminder that just entering my email in a text input is enough to send it to any website. | | |
|
| |
| ▲ | Cheer2171 5 days ago | parent | prev [-] | | That's you/OAuth giving the provider your google account id, which is your @gmail.com email. | | |
| ▲ | socalgal2 5 days ago | parent | next [-] | | I don't generally want any site to have anything they can use that associates me with other sites. If 2 sites get the same email for me or the same GAIA id, or the same anything then I won't use the id system. (with obvious exceptions - see below) This includes "privacy first" companies like Apple and their Apple Pay system where I went to a restaurant in SF. The bill was a QR code that took me to Toast with the option to pay via Apple Pay. The apple prompts told me my email address would be shared and there was no option to say "no" so I bailed out and paid the waiter directly. Sometimes I need my real name and address for shipping. In those cases that can't be helped. I also have to give my CC card for a purchase. But there are sites I want to sign up for for which I don't need to give that info. A "one click to sign up" option would be useful if I knew it was giving random data. An example might be medium.com or substack.com. They don't need my real name nor do they need my "real" email. If I was sure this "one click sign up" didn't share a common one I'd consider using it. Maybe even better, if it was managed similar to subscriptions in iOS where I could trivial revoke any membership at will from a central location, with the understanding that there'd be no recovery since signing up again would get random new data and so no way to associate the new with the old. | |
| ▲ | hammock 5 days ago | parent | prev [-] | | Google uses GAIA for ID though, which is not the same as gmail address |
|
|
|
| ▲ | michaelt 5 days ago | parent | prev | next [-] |
| I'm curious - how does the standard make "to continue, google.com will share your name, e-mail address and profile picture" compatible with "a modern, privacy-preserving standard for federated identity on the web" ?? I mean, that doesn't sound privacy-preserving at all? |
| |
| ▲ | aaronpk 2 days ago | parent | next [-] | | It refers to the property of FedCM that means nothing about your account is revealed to the website until you click the "Continue As" button. In other words, alternatives to this that use third-party cookies enable tracking you between websites without any user interaction. | |
| ▲ | mooreds 4 days ago | parent | prev | next [-] | | I don't think they are trying to preserve privacy between you and the identity provider you are logging in with and the website you are logging into. (At least not now. There's talk about some of this with IDP delegation, I think. Here's more on that: https://github.com/w3c-fedid/delegation ) The first goal is to prevent data brokers from correlating data about users across the Internet using cookies and redirects. You can read more about the privacy focus here: https://www.w3.org/TR/fedcm/#privacy | |
| ▲ | benlivengood 5 days ago | parent | prev [-] | | Why would you share your real name with Google when making a gmail account, or use your real picture? It's fine to be pseudonymous on the Internet if you are in control of your pseudonyms, which Google accounts actually does allow with some extra work (don't mix your chrome profiles and Google accounts, etc.) Or, like me, you can roll the dice on real names on the Internet (for professional things mostly) | | |
| ▲ | oefrha 5 days ago | parent [-] | | > Why would you share your real name with Google when making a gmail account, or use your real picture? Google made a big push in that direction starting in the Google+ era. IIRC at some point my fake names were rejected by Google and I had to change to more plausible fake names. You can't fault regular people for falling into Big Tech's traps. |
|
|
|
| ▲ | KwanEsq 5 days ago | parent | prev | next [-] |
| Is this a successor to Mozilla's old Persona project, or similar in anyway? |
|
| ▲ | BobbyTables2 5 days ago | parent | prev | next [-] |
| Sounds great in theory, but how does this square with Google/Facebook tracking pixels and such. Seems like either way, they’re in control of a massive amount of tracking data… |
|
| ▲ | jazzyjackson 5 days ago | parent | prev | next [-] |
| That sounds really interesting, but is there any hope chrome would allow use of an identity provider other than google? |
| |
| ▲ | sgoto 5 days ago | parent [-] | | Yeah, websites can choose any other identity provider, and in fact, do. |
|
|
| ▲ | WhyNotHugo 4 days ago | parent | prev | next [-] |
| Vaguely reminds me of the now defunct OpenID. But with browser-native integration. |
| |
|
| ▲ | otabdeveloper4 5 days ago | parent | prev [-] |
| > The Chrome experience is actually part of a new Google non-standard Fixed it for you. |
