On other stackexchange sites, when an unregistered user logs in we can enter a name and password into an Open ID page, and once that is accepted we are taken to the front page for that stackexchange site. But on MO, after entering an Open ID name and password there is an additional page that pops up saying MO wants to view the Open ID information (at least if your Open ID is a gmail account), with a choice to Accept or Cancel. Why does MO have this last step, which other stackexchange sites I've used do not?

Extra question: when I give a tag on this question I chose "registration", but then I am told that I must use one of the 4 tags bug, feature-request, discussion, or support. Why is one of these four tags mandatory?

  • 5
    $\begingroup$ Regarding the addon question, I assume to struture meta a bit (like we have in principle on main also top level tags). And, also it could be quite helpful for the network-wide moderators to be able to filter out bug reports, support questions, feature requests from general discussions. I am not sure, but actually I would have rather tagged this support or perhaps even bug (it says unexpted behavior in the description too) than discussion. $\endgroup$ – user9072 Jul 1 '13 at 16:32
  • $\begingroup$ I think the Open ID stuff is specific to Google Open IDs, SE needs the mail address to connect users across sites due to the way Google implemented Open ID. There is nothing specific to MO in terms of registrations as far as I know. $\endgroup$ – user35354 Jul 1 '13 at 17:25
  • $\begingroup$ The following tea-discussion on logging in after migration mentions a SO-blog post that could be interesting. $\endgroup$ – user9072 Jul 1 '13 at 17:47
  • $\begingroup$ What @quid wrote is correct. On meta sites on SE you have to give some general classification to your post, and it has to be one of four general classifications. That's just how it is on meta sites. $\endgroup$ – Asaf Karagila Jul 1 '13 at 18:55
  • $\begingroup$ @MadScientist: when I log in as an unregistered user on math.stackexchange using my Gmail account as my Open ID, I am not asked to give MSE permission to use my account information as an intermediate step between entering the information and seeing the MSE front page. That's similar to other stackexchange sites I have used except for MO after it moved to stackexchange, so what I am writing about definitely seems like something specific to MO. $\endgroup$ – KConrad Jul 1 '13 at 19:00
  • 1
    $\begingroup$ @KConrad I tried it and it seems the permission is saved on the Google account. When I manually revoked the permission for a specific SE site and then tried to sign up, I was asked for the mail address also on other sites. You might have given MSE the permission to access this information previously. $\endgroup$ – user35354 Jul 1 '13 at 19:08
  • $\begingroup$ It's probably that the domain isn't *.SE so google doesn't recognize that it already gave permission. $\endgroup$ – Noah Snyder Jul 1 '13 at 19:17
  • $\begingroup$ If that's the reason, there should be a way to fix it: the old MO was also .net and could handle the concept of Open ID without any extra step. $\endgroup$ – KConrad Jul 1 '13 at 19:55
  • 1
    $\begingroup$ The point is that now SE wants to receive an identifying token from the OpenID process (in order to connect network accounts), while the most basic form of OpenID authentication that google provides actually generates a new identity for each login domain. $\endgroup$ – Scott Morrison Jul 1 '13 at 20:05
  • $\begingroup$ @MadScientist: All sites lead you to enter the Gmail address on a Gmail page if that is the Open ID you choose. What is different with the new MO is that, when using Gmail for the Open ID, there is an extra page you see where you have to explicitly click Accept on Cancel to give stackexchange permission to see your address. I have used multiple stackexchange sites and that step is not on any of them except the new MO. Did you see an Accept/Cancel page on any other stackexchange site when registering with Gmail as your Open ID? $\endgroup$ – KConrad Jul 1 '13 at 20:35
  • $\begingroup$ @ScottMorrison: Can you clarify what you mean by connecting network accounts, maybe with an example? Is this an effect of retaining the URL mathoverflow.net instead of switching it to, say, mathoverflow.stackexchange.com? $\endgroup$ – KConrad Jul 1 '13 at 20:36
  • 1
    $\begingroup$ @KConrad: my rough understanding is that for Google OpenID for different sites they give out different indentifying info for the same email. So you could have accounts on various different (SE) sites, without SE being able to tell that these accounts come from one and the same email, so SE would not be able to automatically connect these accounts (which one can consider as a disadvantage or also an advantage). The view taken here is the former and therefore they ask explcitly for the email not just the indentifier (as it is different for different sites, in the network). $\endgroup$ – user9072 Jul 1 '13 at 20:54
  • $\begingroup$ @quid: OK, maybe that explains things, but I don't know why the process of registration for the new MO can't be identical to that of any other stackexchange site, for which such an explicit request never occurs. Is this essentially an effect of the URL for the new MO not ending in stackexchange.com? I'd think such a glitch ought to be fixable in some way. $\endgroup$ – KConrad Jul 2 '13 at 1:35
  • 1
    $\begingroup$ I seem to get the permission request at all SE sites, regardless of the domain name. $\endgroup$ – Scott Morrison Jul 2 '13 at 1:44
  • 2
    $\begingroup$ @EmilJeřábek: the solution described by Shog9 below solved my problem without having to change my use of a Gmail address as the OpenID. See also Noah's comment to Shog9's answer. $\endgroup$ – KConrad Jul 4 '13 at 13:22

This is really a Google support issue, but I'll try to walk you through it as best I can...

  1. Visit your Google Account Settings - https://accounts.google.com/
  2. Verify you're logged in with the account you use to access Math Overflow (if you're not, you should be able to click on your account name near the top-right and select or log into a different account)
  3. Select "Security" on the left sidebar
  4. Next to the header "Connected applications and sites", click the link labeled "Review permissions". You'll be asked to confirm your password.
  5. You should now see a list of every site you've given Google permission to authenticate. Mine starts out like this:

    Google authorized apps

  6. Verify that mathoverflow.net is in that list. If it's not, something else is wrong. If it is, then click the "Revoke Access" button - you'll see a message indicating that this has been done.

  7. Now go log into Mathoverflow.net again by clicking "log in with Google" on the login page. You should see a prompt that looks like this:

    MO view email

    Clicking Accept here will re-add mathoverflow.net to your list of authorized apps/sites - hopefully now with the correct permissions.

  8. (bonus step) Log out and try logging in again - you shouldn't see the prompt from Step #7 this time.

  • 3
    $\begingroup$ I had the same problem as Keith, though I hadn't realized it since I stay logged in all the time. When I followed Shog9's instructions I found that mathoverflow.net was listed twice. I revoked one of them and it automatically revoked both. Then following the rest of these instructions indeed fixed the problem. $\endgroup$ – Noah Snyder Jul 4 '13 at 5:40
  • 1
    $\begingroup$ Perfect! This solved the problem completely. $\endgroup$ – KConrad Jul 4 '13 at 13:20

The behavior is the same on all sites. The difference is that when you log in to a particular site using a particular OpenID for the first time, most OpenID providers ask for verification1. So, while you may be used to logging into tex.SE without being asked for confirmation, the first time you log in to MO with the same credentials, you will be asked. Next time you log in (unless you use a different associated OpenID), this step will no longer trouble you.

Regarding the four meta tags, this is because all meta posts fall into at least one of those four categories. In this case it's . Usually, is a catch-all tag and always works whenever you're not sure.

1. This is to protect your personal information. If the provided did not do this, one can set up a webpage that submits an OpenID connect request the moment you visit it and get your personal details without you being alerted. On the other hand, the confirmation page cannot be automatically bypassed without the user's consent due to CORS and iframe sandboxing

  • $\begingroup$ This does not reflect how things look for me. My cookies always clear when I close a browser, so when I go to a SE site I am asked to provide an Open ID. I always use the same Gmail account, and for any SE site I am sent to a Gmail page to enter an account name and password. After that, for SE sites other than MO I am then sent to the front page. Only for MO do I get sent instead to a page asking me to confirm or cancel permission for SE to see my account name, and that always happens. See the tea link that quid provides above; it shows you a second user who is experiencing this issue too. $\endgroup$ – KConrad Jul 2 '13 at 7:25
  • $\begingroup$ @KConrad That.. should not happen. Try this: Go to your profile, click "my logins", and then "add logins" (add your Google login again). It ought to ask you for "permission", but if you log out and log back in again that should stop happening. $\endgroup$ – Manishearth Jul 2 '13 at 7:29
  • $\begingroup$ What's probably happening here is that Google is detecting a change in MO (the IP, or something else), but that change is not properly logged. $\endgroup$ – Manishearth Jul 2 '13 at 7:31
  • $\begingroup$ I tried that, but when I logged back in I again get the prompt asking for permission for SE to see my Gmail account name (what always happens every time, just on MO). $\endgroup$ – KConrad Jul 2 '13 at 7:36
  • $\begingroup$ @KConrad hmm. You probably should retag your question as a [bug] then (better visibility for the developers) $\endgroup$ – Manishearth Jul 2 '13 at 7:37
  • $\begingroup$ @KConrad, you may want to have a look at here to see what is going on: plus.google.com/u/0/apps $\endgroup$ – Kaveh Jul 2 '13 at 8:01
  • $\begingroup$ @Manishearth: I retagged. Thanks for the suggestion. $\endgroup$ – KConrad Jul 2 '13 at 14:19
  • $\begingroup$ @Kaveh: The link in your comment took me to an empty page about managing apps, with no information on it at all. What did you intend to be seen from the link you used? $\endgroup$ – KConrad Jul 2 '13 at 14:20
  • 1
    $\begingroup$ @kconrad it should show a list of websites that you have connected with Google via OpenID $\endgroup$ – Manishearth Jul 2 '13 at 15:27
  • $\begingroup$ @KConrad: since you actually did not retag, I assumed an oversight (failure to save due to new interface perhaps?) and did it. $\endgroup$ – user9072 Jul 2 '13 at 16:22

Added note: this is not what is actually happening (see comment of Shog9), I leave this up since some of the general information could be of (limited) interest to some.

I decided to record some thoughts and pieces of information to complement and summarize already provided information by others, trying to focus specifically on the problem KConrad (and likely some others) encounter [I always say KConrad as while this might read slightly strange it seems better readable than to say "some user wit this or that additional property relative to the system"]. I am not sure if all I say is fully correct [added: turns out it is not], but after some thought this scenario seems reasonable and compatible with all reported and observed behavior. (I also wrote something like this on "tea" but thought I repost it here for visibility). My main reference is the following (official) blog post on OpenID on the network previosuly mentioned in my comment.

In order to use a site via Google OpenID (or also other OpenID providers) the site is given an OpenID string (by the provider) to identify the user. For Google (yet not some other providers) the OpenID string does not only depend on the gmail account but also on the domainname of the site for which it is to be used. In particular, KConrad's OpenID string for mathoverflow.net is different from the one for stackexchange.com, and since it appears all other sites in the network used by KConrad are [something].stackexchange.com for KConrad only MO has the property of upon login not giving his OpenID string for stackexchange.com (but rather mathoverflow.net). [Added: This is wrong, since the OpenID strings for different stackexchange.com are also different, and the subsequent speculations are thus also not correct.] (A more elaborated and abstract version of this is to be found in said blog-post.) After this explanation the blog-post says:

That’s a major bummer for site networks like us with multiple domains. We use the OpenID string as your user "fingerprint", so if your "fingerprint" changes, we can’t tell who you are any more. It’s a frustrating problem, but we think we’ve finally come up with a fix: we demand email from Google GMail OpenIDs!

So, SE has typically two identifying pieces of information for a user (using Google OpenID). One OpenID string, generated for some of their domainnames (likely the first ever used) and the associated email address (to get this they need to ask permission, which is the step discussed here). This email is then stored.

I assume KConrad's "fingerprint" (see the quote above) is his OpenID string for stackexchange.com. This OpenID string is likely the same over all the others sites except MO he uses, as all seem to be [something].stackexchange.com (yet not stackoverflow.com for example), so the domainname is the same and Google gives out the same string. Likely, permission was granted SE once, and now long ago, to retrive the email address when he started using the network.

Thus, when he logs in to one of the stackexchange.com sites the system recognizes the OpenID string Google gives (the one for SE.com) as his "fingerprint" and thus has no need for the email address.

If however, he logs in to MO, then Google gives his OpenID string for MO.net, which is different. Thus, this is not his "fingerprint" and the system does not recognize him. And, thus, needs to ask for the second piece of indentifying information the email-address.

The reason that this was a non-issue on the old MO is that there was only one domainname at all, and thus the OpenID string was always suffcient.

The reason that this does not happen to everybody using Google OpenID for MO now, is that for some (in particular those not having had an account on the network before) their "fingerprint" is the OpenID for MO.net. Likely, they have the dual problem, being asked on each stackexchange.com site (as reported by Scott Morrison).

Possibly a solution: (This is only a rephrasing of my understanding of what Manishearth said already.) It seems to be possible to add more than one OpenID string to an account, i.e., to have more than one "fingerprint" recognized by the system. So, via adding the OpenID string for MO.net as additional fingerprint to the account, KConrad might be able to avoid having to grant permission each time.

  • $\begingroup$ Interesting, however note that nobody has ever had this problem with Stack Overflow/Super User, which have their own domain too. $\endgroup$ – Manishearth Jul 2 '13 at 15:26
  • $\begingroup$ @Manishearth: this is suprising to me, perhaps they handle it differently there, and add the (other) OpenID string(s) automatically as a "fingerprint" on confirmation once, which at least naively would make sense, and this somehow does not work for MO (either by design or not). But then there seem to be some other things too (this chat thing for example) where MO (understandably) is not yet fully integrated so it might also be related to this. As said I do not really know what is going on. But, something along these lines seems like a potential explanation for what we see. $\endgroup$ – user9072 Jul 2 '13 at 15:31
  • 2
    $\begingroup$ Good theory, but... Google generates a distinct OpenID for every subdomain of stackexchange.com too. This is why one of the big changes from SE 1.0 to the current software is the use of email addresses as primary credentials when possible (that is, when they can be trusted) - Google will return the same email regardless of which domain you log into. Of course, the downside of this is that changing the email associated with your Google account breaks things... As a hundred or so MO users recently found out. $\endgroup$ – Shog9 Jul 4 '13 at 5:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .