I went to an article on medium.com earlier today, and instead of the annoying full screen popup they usually show to returning visitors, I saw this in the upper right corner:

Google popup

Right there on the medium page they have my name and google email-address! I do not have an account on Medium, nor have I ever done anything but read various articles I received direct links to.

How is medium able to display this popup? I have no memory of telling them who I am, and with all the talk about cross-origin protections this doesn't seem like it should be possible.

I suppose it probably is a popup feature provided by google, but that sounds like it could be easily misused by any site to steal my name and email. I use firefox, so it can't be some crazy chrome feature.

  • Got hit with that this morning, and while I'm sure it's sandboxed, it distracted me for a few minutes while I examined it, then very carefully closed it while making sure I didn't accidentally approve anything. Makes me want to block medium from my google news sources, actually. Jun 4, 2019 at 20:02
  • How to disable Google One Tap sign-up prompts? on Super User
    – pk_
    Apr 26, 2021 at 5:12

2 Answers 2


Web developers can integrate Google Sign-In with their website.

Google Sign-In manages the OAuth 2.0 flow and token lifecycle, simplifying your integration with Google APIs. A user always has the option to revoke access to an application at any time.

Websites can access information such as your name or email when you login. There are many ways to customize the login button or popup which is sometimes why it looks integrated to the page, while it is actually being served by Google over HTTPS. This is also why the website is able to show your name, because it is actually served by the Google API. In this specific example, an iframe is used which prevents information being shared with Medium due to the same-origin policy.

  • 1
    If it is embedded in a webpage then what prevents that site to run a JavaScript which sends what is being displayed on the webpage?
    – defalt
    Dec 30, 2018 at 5:16
  • Good question @defalt, I don't think you can prevent that. Maybe Google uses a different implementation then I thought of.
    – Kevin
    Jan 1, 2019 at 17:54
  • 1
    So before I do anything on the site, Google knows that I've visited Medium, and presumably which page. Or am I missing something?
    – NealeU
    Mar 12, 2019 at 10:39
  • Most websites these days use some sort of Google services (such as Adwords, Analytics etc.) so yes, most of the times you visit any website Google knows about that unless you use some sort of tracking/ad blocker @NealeU
    – Kevin
    Mar 13, 2019 at 0:03
  • 1
    You REALLY should have mentioned that it's an iframe. It's not "embedded" in Medium, it's a completely separate web page from a different origin (google.com) that is shown within a corner of Medium's page. Medium.com cannot access the contents of the iframe (or vice-versa) due to the same-origin policy.
    – CBHacking
    Jun 5, 2019 at 2:34

They do that via an iframe with one of Google's beta features which is currently closed. You can see the iframe in the following screenshot of Medium's website.

Screenshot of Medium's website and Google iframe

However, this does not mean Medium will be able to access your user information. The content inside of the iframe is sandboxed and can only be accessed if Google adds a same origin policy permission permitting Medium's domain to access it. See this Medium article for more information on cross origin policies with iframes.

  • It seems like Google One Tap is out of beta now. The documentation is here.
    – aiyan
    Apr 12, 2020 at 2:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .