"Sign in with Google temporarily disabled for this app" message

[andrawaag]

As mentioned in a duplicate track, the SSO bug resurrected again. For two weeks I had no issue with access to iNaturalist.
https://forum.inaturalist.org/t/howto-change-the-google-sso-to-a-native-inaturalist-login/8247

[kueda]

Ok, after a long struggle, this should now be working again, with the caveat that we’re including the Google Photos permission even on sign in, which is going to look scary to some people. I needed to do this to get that permission approved for anyone who’s still trying to import photos from Google Photos. I’ll see if we can support sign in without it.

Also, small editorial: while signing in with third parties is convenient, I don’t think it’s a great idea, personally. The degree to which third parties like Google and Facebook verify site authenticity vary widely (Google: “you have to control the domain”, Twitter: “whatever, just paste in whatever URL we should redirect people to”), and none of them really make it clear how much access the service you’re authorizing really has. For example, the Google confirmation screen doesn’t make it clear that we get access to your email address, name, and profile pic. We need all that stuff, and it would be nice to have an opportunity to explain why on that screen, but it’s totally unclear to the person signing in. Way back when, Facebook used to expose all your friends when you granted this kind of sign in permission (they don’t anymore), which was SUPER creepy and also completely not obvious to the person signing in. Add to all this the many security vulnerabilities that have popped up over the years in some of the software that mitigates this process, and the vulnerability of losing access to all kinds of services just by getting locked out of one service, and you’ve got a generally not great situation. I understand the belief that Google can protect your privacy better than iNat can (I think that belief is well-founded), but I think the best response to that is to use a unique and strong password for your iNat account. Ok, end rant.