6/19/2026 at 4:12:24 PM
This isn't the "new thing to worry about" being emphasized, but:> You chose to use a “sign in with <service>” login when you had to create an account, and it sent you through a realistic-looking login flow: a real-seeming Google/iCloud page, perhaps with your email already filled in. When you logged in to this site they used your entered password and subsequent “tap yes on your device” 2FA flow to log in to your account on their end (saving the session cookies), and made it look like a successful login on your end.
The security-hygiene rule to prevent this (which, alas, requires consistency and paranoia) is that passwords may only be entered into Google/iCloud/etc. when you directly visit the provider's site.
Once you know your browser is authenticated to the SSO provider, you reload the target page (e.g. the NDA signing platform) and expect that you will never need to enter a password again.
by Terr_
6/19/2026 at 5:49:33 PM
The fact that your password manager wouldn't offer to fill-in the password field of the fake login page (due to the domain being unknown) should make you raise an eyebrow.by noisem4ker
6/19/2026 at 10:11:39 PM
I say "hygiene" because--like handwashing after the toilet--it's something everyone can do without particular tools or expertise.Archetypal Aunt Tillie's "password manager" will be a handwritten piece of paper, but the rule of "only log-in with this bookmark and assume other prompts are lies" will still work.
by Terr_
6/19/2026 at 10:14:27 PM
This. Depending on your policy or org’s policy, your auth session may be short lived. Going to Google to login and come back every hour is a worse experience. Use your password manager. It will bind the credentials to the domains.by figassis