How to prevent google from wanting to automatically sign in/up

splosh123

Hey crew,

I'm about a week in to GrapheneOS and loving it. The only google service I require is my work uses google business as their email provider and they host a lot of their documents on google drive. Which I'm okay with as my private personal information is not attached to that google account. So I am logged on in Vanadium to access the google drive as required. But now when I access websites, I get a google prompt to sign in to the website with my work google account. I close it down, but was wondering if there is a way to block this. Screenshot provided below.

https://imgur.com/a/NqK8rEz

Thanks everyone.
Splosh123

LocaLola

splosh123
It may be irrelevant, but have you checked whether your google account was added to the profile? Every time I use Google Play Store, I have to remove my account as it is automatically added.

mr_johnson22

Was wondering this myself. In my case, ever since I signed into YouTube (on web), any other site that supports Google accounts shows that login popup with my Google account information displayed. I'd expect site isolation (as described in the Usage guide] and having disabled third-party cookies to prevent my account login from being detected on sites other than *.youtube.com, so perhaps I'm misunderstanding what kind of state really gets isolated between sites.

Zooming out a bit, is it even worth trying to prevent this? My understanding is that because my account login is accessible to the Google login popup on non-Google sites, it means that Google is able to track my visit to any site that has Google scripts in it, and I'd like to prevent that. But even if my account login were to be isolated between sites, Google scripts on any site I visit would still get a hit from my IP address (in the absence of content filtering), so they'd be able to identify me between sites anyways.

treenutz68

My understanding is that you need to use a separate profile to isolate that google account from everything else. I had the same problem while trying to use google voice in my mail profile, I didn't like how it feels like it is "logged in at a system level".

mr_johnson22

treenutz68 Thanks, but in my scenario I'm logged in only at the level of the web browser / Vanadium, not system-level or app-level. That means Google apps & device features still ask me to sign in (and don't mention anything about what account I'm using in the browser).

treenutz68

mr_johnson22

Ahh I see. Perhaps using a dedicated browser exclusively for your signed in YouTube could work?

mr_johnson22

treenutz68 Yes, that would work. Something similar that would also work is using a separate Android profile to use for with Vanadium, to avoid the increased attack surface of having multiple web browsers installed.

I still wonder though, since Vanadium makes an effort to isolate tab processes from one another, isn't it also supposed to keep login information isolated between tabs as well? If Google login state is shared between tabs, then I assume other services' login state is too, so I wonder if I should be more stingy with which sites I log into in non-incognito tabs.

jarell

mr_johnson22 My current setup is using Brave with exclusively the YouTube PWA app. I've disabled Javascript and cookies for all sites except youtube.com.

Brave also comes with ad-blocking and background playback that works very well on YouTube.

mr_johnson22

jarell Thanks for the advice. At this point I'll accept that what I'm really after is content filtering, which Vanadium intentionally doesn't have much of due to GOS' disapproval of badness enumeration as an effective privacy tactic. If I still can't live without it, I'll look more into the security benefits Vanadium provides over other browsers and decide whether what it offers is what I'm after.

mr_johnson22

LocaLola I believe I'm not, as the Google Play store asks me to sign in, as do other Google apps. And no Google account is shown as enabled in Settings > Passwords, passkeys & accounts.

mr_johnson22

Actually, it looks like it's not websites that see Google login status, but the browser itself. I say this because there was one time by chance that the login popup stayed visible for a moment when I entering the tab menu, meaning the popup must be a part of the browser UI and not in the webpage. The popup also stays the same size when zooming in/out of a page, and its text cannot be highlighted like other text on a page.

So it may very well be that websites aren't seeing Google cookie/login status after all, and Vanadium/Chrome happens to have a feature to detect a Google login session (which it has every right to do) & to offer a Google login on sites that support it. If that's the case, there'd be no 3rd-party cookie/session sharing involved, and I'd be satisfied :)