7

Whenever users are not logged into Stack Overflow or another Stack Exchange website, the Google login popup is shown in the top right:

google login popup in top right corner

Looks innocent until I look at the code:

<iframe 
  src="https://accounts.google.com/gsi/iframe/select?client_id=REDACTED;origin=https%3A%2F%2Fstackoverflow.com" 
  title="" 
  style="height: 301px; width: 391px; overflow: hidden;"></iframe>    
 
<iframe 
  src="https://accounts.google.com/gsi/iframe/select?client_id=REDACTED;origin=https%3A%2F%2Fgamedev.stackexchange.com" 
  title="" 
  style="height: 301px; width: 391px; overflow: hidden;"></iframe>

You can see that the origin parameter is the domain of the current website. For example, https%3A%2F%2Fstackoverflow.com for Stack Overflow, and https%3A%2F%2Fgamedev.stackexchange.com for the game dev Stack Exchange website. This means that Google is able to know when and for how long a user visits a Stack Exchange website.

Can we please stop Google login from spying on Stack Exchange user activity? Surely it isn't that hard to delete the origin parameter, or change it to a useless origin parameter such that Google login won't know which specific website the user is currently visiting.

7
  • 2
    "Surely it isn't that hard to delete the origin parameter" This assumes that SO has full control over whatever creates those iframe elements. I wouldn't count on that.
    – Cerbrus
    Commented Aug 30 at 12:20
  • 2
    That's probably a "feature", Google probably needs that to figure out whether it needs to show the login prompt or not (Depending on logout, account removal, etc. and other things). It would probably be easier (relatively, since there's little chance of the company agreeing to it) to ask the company to remove the Google One tap login. Commented Aug 30 at 12:33
  • 2
    That's the best way to scrobble tracking data; have a legitimate use for the data as well. Let's not pretend we can outsmart Google, not even governments really get anywhere.
    – Gimby
    Commented Aug 30 at 12:36
  • 20
    This Google login thing doesn't really matter. Stack Exchange has been making extensive use of googleapis.com since at least 2012 (source), uses Google Analytics for tracking and has previously even marked it as essential (source) and has probably more Google integrations. Changing this origin URL probably won't harm Googles ability to figure out what you're doing on SE at all
    – Erik A
    Commented Aug 30 at 12:50
  • 16
    We seriously don't need that Google login popup on any site ever.
    – Dalija Prasnikar Mod
    Commented Aug 30 at 13:57
  • 2
    @Gimby: Let's pretend we can. Commented Aug 30 at 15:12
  • Use 'uBlock' or any equivalent to block the HTML elements in your browser and your OS firewall rules to block any sites/URL's/ports... The 'GoogleUpdater.exe' has been a dead duck for about 10 years on all my PC's... (Comes when installing Google 'Chrome' or any Google product, but behaves like malware, mostly invisible, will only try "to do its payload" for 5sec and disappear again... - Easy to decompile, interesting to see what it does...)
    – chivracq
    Commented Aug 31 at 2:46

0

You must log in to answer this question.

Browse other questions tagged .