8

I pointed my browser at the website of a web developer I barely know, and the page returned was his home page, with the message "Welcome myname@gmail.com!"

Whoa. Where did it get my Gmail address? Never seen that before. I was logged in to that Google account at that time, but somehow that login account is accessible to someone whose web page I go to. That info sure isn't contained in any Apache logs, though certainly my IP address is. I am aware that Google makes all kinds of information available to users, unless one tells them not to.

  1. How does one prevent one's Gmail address from being transmitted to a website, so as to preserve some semblance of anonymity?
  2. How do you set up a website to get that info?

migrated from webmasters.stackexchange.com Aug 24 '15 at 19:04

This question came from our site for pro webmasters.

  • 1
    We might need to inspect the page's code to narrow down the possibilities, else we're guessing. – schroeder Aug 24 '15 at 19:07
  • 5
    If you provide the URL, we can take a look. – ThoriumBR Aug 24 '15 at 19:09
  • 1
    I am using Mac Firefox 40.0. Um, wait. What that web page showing me is a Google Drive pane, which says "You are signed in as xxxx@gmail.com". So does this mean that Google Drive is telling me who I am signed in as, but not telling the website owner who I am signed in as? I have no problem with that. – user618 Aug 24 '15 at 21:24
  • 1
    @Gewure that only works for detecting if someone is logged in to, for example, Google, not for obtaining the e-mail address. – user2428118 Sep 7 '15 at 16:24
  • 1
    @Gewure - I tried the "Demo" page: tomanthony.co.uk/tools/detect-social-network-logins (Thanks for the links). It appears to be working for Facebook, Google, and Google+, but not for Twitter. Perhaps this is temporary, or perhaps Twitter has changed their site and the script no longer works. – Kevin Fegan Nov 21 '15 at 1:12
1

The website is simply asking the Google login handler to display the information to you -- and then placing it on the website in such a fashion that it appears to be the website knowing your logged in account. But in truth it's just a tag to them, like <%InsertLoggedInName%> or something like that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.