Whenever users are not logged into Stack Overflow or another Stack Exchange website, the Google login popup is shown in the top right:
Looks innocent until I look at the code:
<iframe
src="https://accounts.google.com/gsi/iframe/select?client_id=REDACTED;origin=https%3A%2F%2Fstackoverflow.com"
title=""
style="height: 301px; width: 391px; overflow: hidden;"></iframe>
<iframe
src="https://accounts.google.com/gsi/iframe/select?client_id=REDACTED;origin=https%3A%2F%2Fgamedev.stackexchange.com"
title=""
style="height: 301px; width: 391px; overflow: hidden;"></iframe>
You can see that the origin
parameter is the domain of the current website. For example, https%3A%2F%2Fstackoverflow.com
for Stack Overflow, and https%3A%2F%2Fgamedev.stackexchange.com
for the game dev Stack Exchange website. This means that Google is able to know when and for how long a user visits a Stack Exchange website.
Can we please stop Google login from spying on Stack Exchange user activity? Surely it isn't that hard to delete the origin parameter, or change it to a useless origin parameter such that Google login won't know which specific website the user is currently visiting.
iframe
elements. I wouldn't count on that.