32

I just created a SE account using my Google account. It said that it needs to "Know who you are on Google" (I guess my connections). As far as I know, SE is not a social network. I can't even follow other people (seeing when they post questions and answers).

What is the reason you need to know my Google connections?

This was on code review. Actually I have an account there, but for some reason it asked me to reconnect. This is the same on MSO; one sees this explained as "This app is requesting permission to associate you with your public Google profile":

Improve this question
7
  • 6
    What site did you create an account on? Google are deprecating OpenId in favor of OAuth 2.0 and we are currently testing OAuth 2.0 on a few sites - it would help to know which one you were registering on for us to narrow it down.
    – Oded StaffMod
    Commented Jun 21, 2014 at 8:21
  • @Oded code review. Actually I have an account there, but for some reason it asked me to reconnect
    – BЈовић
    Commented Jun 21, 2014 at 9:13
  • 5
    <sigh> You'd think one would have to do something very specific in code to get that to happen, all we're doing is trying to authenticate you. Kind of alarmed that this is the 'default' behavior Google assumes third-parties want.
    – user50049
    Commented Jun 21, 2014 at 12:31
  • 12
    I have disabled the oAuth 2.0 login until we can chat with Google on this - it looks like single-sign-on to other platforms and your friends list is a package deal...we don't want access to your friends list. You can read the documentation here: developers.google.com/+/api/oauth#login-scopes I've pinged the lead dev on this, we'll see if we can get another scope to use that works, or likely revert to email-only since the single-sign-on probably isn't worth that prompt alone.
    – Nick Craver Mod
    Commented Jun 21, 2014 at 12:39
  • @Tim, like I commented on Nick's answer: with LinkedIn's OAuth2 one (also) always needs to authorize access to one's (limited) profile, even when the application just uses it for authentication. I guess they just want developers to have access to their network, and hope they then cannot resist using the information :-(
    – Arjan
    Commented Jun 21, 2014 at 14:57
  • 1
    I noticed the same new prompt with request for my identity yesterday when I was somehow logged out on my phone. I did not proceed, and when I retried just now the prompt was gone. Very impressed by the quick and professional resolution here, other companies would have just ignored the problem and figured some use for this new user information.
    – HugoRune
    Commented Jun 22, 2014 at 6:15
  • 3
    @Hugo That's likely what Google wants. Also, I'm impressed too, with SE's dev response speed in this case and others. I'm a relatively new user, but I've seen Nick Craver and others jump on these kind of posts very fast. Only company in the world to respond like that.
    – J.Todd
    Commented Jun 24, 2014 at 15:54

2 Answers 2

Reset to default
17

The only thing we want or use from google is your email, for communication and to associate your accounts. We don't want to know your connections or currently use that data in any way (our code isn't even aware of it).

Can anyone seeing this screen in their country please post a screenshot of what you're seeing? If we can narrow down the permission ask and hopefully have their screen reflect this, we will ASAP.

Improve this answer
8
  • As an aside: we're using openid as the scope and then get thte token_id, which holds sub and email, which is all we need. I'm not sure that Google's dialog gives our users, but I don't recall it asking for anything else but email. (If it even actually did ask for that.)
    – Arjan
    Commented Jun 21, 2014 at 11:53
  • @Arjan oh what the hell, ok we'll try to get that fixed as soon as we can. Geoff is heading up that oAuth 2.0 change (since we're they're deprecating OpenID, surprise!) and is off in the woods somewhere right now - in a trailer, down by the river. Thanks for the sceenshot!
    – Nick Craver Mod
    Commented Jun 21, 2014 at 11:58
  • Sorry, I was wrong saying we use just openid. We actually use ?scope=openid%20email&... (one's got to love those hardcoded URLs in code...) And yes, that gives us the same prompt as seen in the question. And playing with the URL doesn't ever remove the option to access the profile, it seems. I highly doubt it used to be like that, but I cannot find any old screenshots in our documentation. As an aside: with LinkedIn, our users also always needs to authorize access to the profile, even though then we also only need the email address.
    – Arjan
    Commented Jun 21, 2014 at 13:37
  • Related: Scope to get email address alone? on Stack Overflow.
    – Arjan
    Commented Jun 21, 2014 at 13:55
  • @Arjan what does just "profile" get you?
    – Nick Craver Mod
    Commented Jun 21, 2014 at 14:11
  • "View basic information about your account" without the email, Nick. But (today...) such is nicer: "View your name, public profile URL, and photo / View your gender / View your country, language, and timezone". So I guess combine that with email?
    – Arjan
    Commented Jun 21, 2014 at 14:16
  • 1
    Yes, that must be it, Nick!
    – Arjan
    Commented Jun 21, 2014 at 14:20
  • @NickCraver :Can anyone seeing this screen in their country please post a screenshot of what you're seeing? If we can narrow down the permission ask and hopefully have their screen reflect this, we will ASAP. which I did meta.stackexchange.com/q/243366/242800
    – user2284570
    Commented Mar 8, 2016 at 13:22
6

We don't need or care who you know on Google. That is not what we want from Google or what this authorization request returns.

After the next build we will specifically ask for the scope: email+profile so hopefully this will be more clear going forward.

Improve this answer
4
  • Are you stuck getting (but not using) the extra account access with oAuth, or is the access we're being told that you're getting more than what you really recieve?
    – J.Todd
    Commented Jun 24, 2014 at 16:04
  • @jt0dd we're trying to get only your email, but doing so appears to give access to other things now. We have several guys at Google I/O this week that are going to try and pin the Google guys down and see if we can get some reasonable change here. The lefthand screenshot in the question is what happens when you ask for just email, which is what we've always done.
    – Nick Craver Mod
    Commented Jun 25, 2014 at 10:11
  • 2
    I'm afraid you're out of luck: This is an intentional change to more precisely communicate to users the set of permissions that is being granted. Through knowledge of the user's email address it is possible, via indirect means, to locate the user's profile address. In the interest of more accurate disclosure, thus, we are prompting users to approve such disclosure. (Though that is a February 2013 statement.)
    – Arjan
    Commented Jun 28, 2014 at 10:13
  • 2
    WTF. Through knowledge of users email address it is also possible, via indirect means, to locate the users's phone number, home address, profile on other networks like facebook, where they work and so on.. Why not prompt the users to approve that too. I find this reasoning totally idiotic.
    – Adwiv
    Commented Sep 19, 2014 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .