6

This question seems to be all over various forms, but i haven't yet found an answer.

On my Android phone, the stock web browser offers to sign in to my Google account when i visit Google websites. At the top of the screen appears a yellow pop-up listing all my Google account in a drop-down, and two buttons: "hide" and "sign in". Simply selecting an account and tapping "sign in" gives unchallenged access to my account via the web; no password is required.

This bothers me, since any malicious person who picks up my phone when I'm not looking can access my email, Google Drive, etc without knowing my password.

Let's assume that my screen-lock hasn't had time to kick in.... or we could assume it's easy to circumvent.

Enabling 2-stage sign in wouldn't help, since if someone has unauthorised access to my phone, they's receive the one-time token.

I've tried looking through all phone and browser settings to no avail. I've hunted through Google Dashboard, and cannot see how to disable this. I've signed out, but the yellow pop-up always appears, always giving unchallenged access.

An app-lock app might be an option, but is inconvenient, especially since friends often use each other's mobile browsers.

Installing a different browser may be an option, although again that's inconvenient, and would mean disabling the stock browser, which my come with other issues.

I'd really like to disable the yellow pop-up permanently, but i cannot seem to find out how to do this. Apologies if this has been answered already.

I'm running Android 4.0.4 Cyanogen mod 9.1.0 on a rooted Samsung Galaxy S GT-i9000.

I'm specifically looking for a way to prevent the yellow authentication pop-up in the stock web browser. I'm not bothered about other apps. I'm also not really bothered about why Google has chosen to do this. The lock screen isn't an issue either.

One scenario might be: an acquaintance asks to borrow my phone to use the web browser. Being a little cheeky, they go to Google and sign in, without a password being required. I wish to prevent this. If they were using a web browser on my laptop, they'd need a password. I'm not happy that they don't require it on my phone.

Other apps can be trivially protected by an app-lock. I prefer not to use an app-lock for the web browser. And anyway, unlocking it for a friend to use just leaves the same problem.

Improve this question
5
  • This is deliberately done for convenience reasons by Google. And by the way, generally, I don't see the problem here. Your device is already connected to your account (i.e. a working access token is stored on it). If someone wants access to your Google Drive/Calender/Mail/Contacts/etc. that's all possible without using the browser at all (maybe one has to install additional apps. For max security, enable a lockscreen passphrase (not a numerical PIN or pattern) and also enable full device encryption. PS: It's easy to read a Samsung phone's flash with a custom recovery (flashed via heimdall).
    – ce4
    Oct 30, 2012 at 11:45
  • I'm specifically looking for a way to prevent the yellow authentication pop-up in the stock browser. I'm not bothered about why Google has chosen to do this. The lock screen isn't an issue. One scenario might be: an acquaintance asks to borrow my phone to use the web browser. Being cheeky, they go to Google and sign in, without a password. I wish to prevent this. If they were using a browser on my laptop, they'd need a password. prefer not to use an app-lock for the web browser. And anyway, unlocking it for a friend to use just leaves the same problem.
    – ukosteopath
    Oct 30, 2012 at 14:35
  • You can't change it in the app itself. Here's a nice talk on this topic by Hak5.org
    – ce4
    Oct 30, 2012 at 23:12
  • Added link to XDA article in my answer...
    – ce4
    Nov 1, 2012 at 16:43
  • 1
    " they were using a web browser on my laptop, they'd need a password." Actually if you're logged into chrome, it won't ask for a password either.
    – user13391
    Nov 1, 2012 at 17:33

4 Answers 4

Reset to default
3

The only solution I am aware of (besides hacking the code itself) is blocking permissions:

Regarding PDroid: Currently, only Gingerbread is supported officially but you may find a working patcher for your CM9.1 firmware on XDA. Its Google Play description says: PDroid allows you to block access to the following private data for any application regardless of its permissions: [...] Account auth tokens, [...]

EDIT:
Tried PDroid and found it to work great. You need a compatible ROM (CM, AOKP, PA,...) and AutoPatcher (download here) plus either the original PDroid or the PDroid2.0 app (see 1st post/attachment). Note: v2.0 needs JellyBean, use the old one for ICS and below (the original author hasn't updated the app for some time and hasn't ported the original Gingerbread patches. Autopatcher includes both ported original PDroid patches and the v2.0 fork for JellyBean)

Improve this answer
3

Disable "Google Account sign-in prompts," which allow Google to offer a faster way to sign in with your Google Account on supported third-party sites

https://myaccount.google.com/permissions?pli=1

Improve this answer
2
  • This worked nicely for me on reddit using Edge.
    – Dwayne Robinson
    Mar 4, 2021 at 1:43
  • This. Don't bug me to "Log me in with Google" on sites other than Google's own.
    – Tom Hundt
    May 4, 2021 at 18:04
1

I had the same problem. I downloaded a separate browser (Skyfire) for "guests" to use and used an app lock to lock my main browser. The authentication option did not drop down in the second browser.

Improve this answer
-2

Change your homepage to www.google.com or similar

Improve this answer
4
  • 2
    I fail to see how this answers the question.
    – ce4
    Dec 10, 2014 at 9:42
  • OK. On my Samsung Galaxy S2, with Android 4.1.2, I activate the stock browser, go into "settings" + "advanced" & then "Reset to default".Then click browser again: a Google search opens & at top of the screen appears a yellow pop-up to sign in my gmail account in a drop-down, with 2 buttons: "hide" & "sign in", just like Austin had. The URL on my stock browser is then: google.com/… Now if I go to browser settings & replace the home page by: google.com, then I get no more yellow pop-up. For me, the problem is solved.
    – Antoine Roederer
    Dec 10, 2014 at 17:49
  • In this case, it is annoying that this website does not reproduce links as I typed them in: the default home page link creating the problem is google.com/webhp?client=ms-android-samsung&source=android-home which I replace by google.com in my homepage to eliminate the problem.
    – Antoine Roederer
    Dec 10, 2014 at 17:58
  • Please add these details to the answer itself, so it's more readable.
    – onik
    Dec 13, 2014 at 16:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .