What does "Log in with your Google account" mean?

[DaveC426913]

I have used this feature to sign in on scores of sites over many years.

As far as I have ever experienced, this is entirely handled under my Google account and that is only thing I have to manage.

I signed in to this one place (major cinema corporation) and this is what I got:

I then received an email telling me I have to update my account.

This is not like any sign in I've ever experienced. AITA?

 

[Borg]

Do you feel lucky?

If you supplied them the address to your gmail account, that doesn't mean that it's trustworthy.

 

[Borg]

What's the return email on their email? Not what they show but what it shows when you mouse over it?

Basically, I wouldn't trust it.

 

[DaveC426913]

The authenticity of the company itself is not really in question. (It's Cineplex)

(I should say that I spent a half hour on a virtual chat arguing my displeasure.)

What's the return email on their email? Not what they show but what it shows when you mouse over it?

Yes. I checked.


My complaint is that seems to be a Dark Design Pattern (from a legit company).

But I'm second-guessing whether I'm right.

 

[Borg]

I don't log into my Gmail for anything like that but as I understand it, once you're logged in, that should be sufficient for a partner company to use some info from your logged in Gmail accout for verification and validation.

Whenever a company runs me though a process like this and then tells me that I "have to install something", red flags go off. If it's something I really want, I may try alternatives but I absolutely would not install anything that a site sent me. If they say that you need to update your browser and you're OK with doing that, then go into your browser's settings and use the update button there. If they still insist that you use their version of the browser, then they're trying to install something that you'll regret - typically a browser addon.

Never, never, never click on anything that a site sends you no matter how legit it may be. Even when I get notifications from my medical provider that I know are legit, I still use my bookmarked link to log in. The only exception that I have to this is if I had to use a "Forgot Password" link and I have no choice.

 

[jack action]

I signed in to this one place (major cinema corporation) and this is what I got:

I then received an email telling me I have to update my account.

I don't understand. Which password do you need to update? Isn't the point of logging in with your Google account to not have a password with them?

Or is it that they want you to sign in again with your Google account to make sure it is still you? (i.e., not sign in with a previously set cookie, or the like.)

 

[DaveC426913]

I don't log into my Gmail for anything like that but as I understand it, once you're logged in, that should be sufficient for a partner company to use some info from your logged in Gmail accout for verification and validation.

Whenever a company runs me though a process like this and then tells me that I "have to install something", red flags go off. If it's something I really want, I may try alternatives but I absolutely would not install anything that a site sent me. If they say that you need to update your browser and you're OK with doing that, then go into your browser's settings and use the update button there. If they still insist that you use their version of the browser, then they're trying to install something that you'll regret - typically a browser addon.

Never, never, never click on anything that a site sends you no matter how legit it may be. Even when I get notifications from my medical provider that I know are legit, I still use my bookmarked link to log in. The only exception that I have to this is if I had to use a "Forgot Password" link and I have no choice.

Agree on all points. I never click through from an email. I always go to the site directly.

But in this case, it's not that I don't trust that I'm dealing with a legit company here (there's no question it's Cineplex); I'm just trying to figure out if Cineplex is using a Dark Design Pattern (leveraging my Google account to get me to make a Cineplex account).

 

[symbolipoint]

But in this case, it's not that I don't trust that I'm dealing with a legit company here (there's no question it's Cineplex); I'm just trying to figure out if Cineplex is using a Dark Design Pattern (leveraging my Google account to get me to make a Cineplex account).

As much as I am aware, you choose to sign into the Cineplex account using your Google account because THAT is how you are choosing to create your Cineplex account. You are not expecting to create a separate password for your Cineplex account.

 

[DaveC426913]

As much as I am aware, you choose to sign into the Cineplex account using your Google account because THAT is how you are choosing to create your Cineplex account. You are not expecting to create a separate password for your Cineplex account.

This is what I think too. And, as far as I am aware, so does the rest of the world. Except Cineplex.

 

[pbuk]

I'm just trying to figure out if Cineplex is using a Dark Design Pattern (leveraging my Google account to get me to make a Cineplex account).

No this is not a "Dark Design Pattern", it is the way that Sign in with Google (and any similar system) works: Google sends Cineplex a message saying "A person we know as Dave with the email address DaveC426913@gmail.com wants to use your site". Cineplex then uses the information in that message to create an account associated with that email address where it stores lots of interesting personal information about you (the kind of film you like, the number and type of tickets you buy etc.).

Many sites just leave it there, meaning you always have to sign in using Google, but many sites also allow you to create a password so that you can log in directly there. It seems that Cineplex are actually requiring you to do this, which is unusual but may well be in accordance with their terms - did you check these before you signed up? (Hint: I have just checked and it is).

This does not change the amount of personal information they have about you, the only thing it does mean is that they are also storing a (one-way encrypted version of) your password. If they have a data breach then it is your personal information that you need to be worried about, not your hashed password (unless your password is "p@ssw0rd").

 

[DaveC426913]

No this is not a "Dark Design Pattern", it is the way that Sign in with Google (and any similar system) works: Google sends Cineplex a message saying "A person we know as Dave with the email address DaveC426913@gmail.com wants to use your site". Cineplex then uses the information in that message to create an account associated with that email address where it stores lots of interesting personal information about you (the kind of film you like, the number and type of tickets you buy etc.).

I've never encountered this before in all my travails across the interwebs.

The key here is that I've never had to provide a separate password; every site just uses my Google credentials (or, more accurately, defers to Google to verify I am a legit user).

But Cineplex is requiring me to change my password.

You see how this is very strange. I will now have an account somewhere that uses my Google email, but not my Google password.

When I sign in anywhere, if I supply my Google email, I am going to invariably supply my Google password. Cineplex - of all the sites on the interwebs - will tell me "that's not the password associated with that email".

That's ridiculous.

 

[symbolipoint]

Dave,..., not being sure if too late now, but could you try to ask Cineplex about this? Could you still create an account there WITHOUT using your Google account?

 

[DaveC426913]

Dave,..., not being sure if too late now, but could you try to ask Cineplex about this? Could you still create an account there WITHOUT using your Google account?

Oh you betcha. I spent half hour in a virtual chat with customer service.

Their repeated response was "If you don't follow the instructions there's nothing I can do. I there anything else I can help you with?"

Got the whole transcript. (Even though their chat transcript is also broken. What a shock.)