Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

This question seems to be all over various forms, but i haven't yet found an answer.

On my Android phone, the stock web browser offers to sign in to my Google account when i visit Google websites. At the top of the screen appears a yellow pop-up listing all my Google account in a drop-down, and two buttons: "hide" and "sign in". Simply selecting an account and tapping "sign in" gives unchallenged access to my account via the web; no password is required.

This bothers me, since any malicious person who picks up my phone when I'm not looking can access my email, Google Drive, etc without knowing my password.

Let's assume that my screen-lock hasn't had time to kick in.... or we could assume it's easy to circumvent.

Enabling 2-stage sign in wouldn't help, since if someone has unauthorised access to my phone, they's receive the one-time token.

I've tried looking through all phone and browser settings to no avail. I've hunted through Google Dashboard, and cannot see how to disable this. I've signed out, but the yellow pop-up always appears, always giving unchallenged access.

An app-lock app might be an option, but is inconvenient, especially since friends often use each other's mobile browsers.

Installing a different browser may be an option, although again that's inconvenient, and would mean disabling the stock browser, which my come with other issues.

I'd really like to disable the yellow pop-up permanently, but i cannot seem to find out how to do this. Apologies if this has been answered already.

I'm running Android 4.0.4 Cyanogen mod 9.1.0 on a rooted Samsung Galaxy S GT-i9000.


I'm specifically looking for a way to prevent the yellow authentication pop-up in the stock web browser. I'm not bothered about other apps. I'm also not really bothered about why Google has chosen to do this. The lock screen isn't an issue either.

One scenario might be: an acquaintance asks to borrow my phone to use the web browser. Being a little cheeky, they go to Google and sign in, without a password being required. I wish to prevent this. If they were using a web browser on my laptop, they'd need a password. I'm not happy that they don't require it on my phone.

Other apps can be trivially protected by an app-lock. I prefer not to use an app-lock for the web browser. And anyway, unlocking it for a friend to use just leaves the same problem.

share|improve this question
    
This is deliberately done for convenience reasons by Google. And by the way, generally, I don't see the problem here. Your device is already connected to your account (i.e. a working access token is stored on it). If someone wants access to your Google Drive/Calender/Mail/Contacts/etc. that's all possible without using the browser at all (maybe one has to install additional apps. For max security, enable a lockscreen passphrase (not a numerical PIN or pattern) and also enable full device encryption. PS: It's easy to read a Samsung phone's flash with a custom recovery (flashed via heimdall). –  ce4 Oct 30 '12 at 11:45
    
I'm specifically looking for a way to prevent the yellow authentication pop-up in the stock browser. I'm not bothered about why Google has chosen to do this. The lock screen isn't an issue. One scenario might be: an acquaintance asks to borrow my phone to use the web browser. Being cheeky, they go to Google and sign in, without a password. I wish to prevent this. If they were using a browser on my laptop, they'd need a password. prefer not to use an app-lock for the web browser. And anyway, unlocking it for a friend to use just leaves the same problem. –  Austin Oct 30 '12 at 14:35
    
You can't change it in the app itself. Here's a nice talk on this topic by Hak5.org –  ce4 Oct 30 '12 at 23:12
    
Added link to XDA article in my answer... –  ce4 Nov 1 '12 at 16:43
    
" they were using a web browser on my laptop, they'd need a password." Actually if you're logged into chrome, it won't ask for a password either. –  Richard Borcsik Nov 1 '12 at 17:33

3 Answers 3

up vote 3 down vote accepted

The only solution I am aware of (besides hacking the code itself) is blocking permissions:

Regarding PDroid: Currently, only Gingerbread is supported officially but you may find a working patcher for your CM9.1 firmware on XDA. Its Google Play description says: PDroid allows you to block access to the following private data for any application regardless of its permissions: [...] Account auth tokens, [...]

EDIT:
Tried PDroid and found it to work great. You need a compatible ROM (CM, AOKP, PA,...) and AutoPatcher (download here) plus either the original PDroid or the PDroid2.0 app (see 1st post/attachment). Note: v2.0 needs JellyBean, use the old one for ICS and below (the original author hasn't updated the app for some time and hasn't ported the original Gingerbread patches. Autopatcher includes both ported original PDroid patches and the v2.0 fork for JellyBean)

share|improve this answer

I had the same problem. I downloaded a separate browser (Skyfire) for "guests" to use and used an app lock to lock my main browser. The authentication option did not drop down in the second browser.

share|improve this answer

Change your homepage to www.google.com or similar

share|improve this answer
2  
I fail to see how this answers the question. –  ce4 Dec 10 at 9:42
    
OK. On my Samsung Galaxy S2, with Android 4.1.2, I activate the stock browser, go into "settings" + "advanced" & then "Reset to default".Then click browser again: a Google search opens & at top of the screen appears a yellow pop-up to sign in my gmail account in a drop-down, with 2 buttons: "hide" & "sign in", just like Austin had. The URL on my stock browser is then: google.com/… Now if I go to browser settings & replace the home page by: google.com, then I get no more yellow pop-up. For me, the problem is solved. –  Antoine Roederer Dec 10 at 17:49
    
In this case, it is annoying that this website does not reproduce links as I typed them in: the default home page link creating the problem is google.com/webhp?client=ms-android-samsung&source=android-home which I replace by google.com in my homepage to eliminate the problem. –  Antoine Roederer Dec 10 at 17:58
    
Please add these details to the answer itself, so it's more readable. –  onik Dec 13 at 16:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.