13

I've found that recently when I visit YouTube, I am automatically logged in with my Google/Gmail Account. I don't like this at all. I do not want my video browsing history tied up with my Google account.

I've disabled third-party cookies in Firefox, but this still happens.

  1. Log into Gmail.com
  2. Visit YouTube.com. Shows my username as my Gmail screen name
  3. Logout on Youtube.com
  4. Go back to Gmail, logged out there also.

How can I adjust my Firefox settings to avoid this?

1

6 Answers 6

10

I havn't checked the method (and it currently doesn't happen for me, btw. - I'm logged in on GMail, but logged out on YouTube). But third-party cookies aren't necessarily what is happening here. There are other ways, similar to the way OpenID authentication works, or the way Wikipedia (probably) logs you into all of Wikimedia.

Say youtube.com embeds an image google.com/authenticate?id=uniqueid&domain=youtube.com, then gets a Google-internal callback with your Google identity, to log you in. Or the other way round: when you log into Google, they load an image from YouTube - say youtube.com/authenticate?id=uniqueid&source=google.com, then do an internal callback with the unqiue session ID to retrieve your authentication data and set another regular cookie on the youtube.com domain.

I don't think you will be able to block this easily, not unless installing a proxy filter that e.g. disables all cookies from youtube.com; using "incognito" mode, or essentially rejecting all cookies from youtube.com in the browser (in the blocked list).

1
  • 2
    This is correct. No cookies are used. The two sites are under common administration and share information with each other through a "back door" that doesn't involve your browser.
    – David Schwartz
    Dec 11, 2011 at 0:28
3

To avoid this, follow this instruction:

add ||*.google.*^$domain=~google.com|~0.0.0.0 to your AdBlockPlus filters, so that youtube.com cannot get data from google.com.

I think you could also detach your YouTube account from your Google account.

1
  • 1
    "I think you could also detach your YouTube account from your Google account.". If you created your Youtube account after may 2009, you can't unlink your google account & youtube. You can't even change it. If you want to separate youtube & gmail, you'll need to create two separate google accounts (and start over with youtube, reupload videos, etc).
    – Julien N
    Dec 12, 2011 at 17:14
1

I guess that the easiest solution (but also the worse if you have some content on your YouTube account) is to create another YouTube account linked to a new Google profile that you use only for YouTube. If you look on the Google forums & FAQs, this is the "official" "recommanded" solution to dissociate accounts.

Then you'll be able to be logged on Gmail without being logged on YouTube.
This is not an acceptable solution, I know, so you may have to use some tricks to achieve that.

1

Don't use the log out!

Go into the YouTube's account management (Your User -> Settings -> Manage Account) and look for the option that says Sign out of all YouTube Sessions. Click on the Sign Out Everywhere link. It will shutdown your YouTube session without logging you out from Gmail.

enter image description here

1
1

This is called Single sign-on (SSO). When you click the sign-in button on google.com it redirects you to accounts.google.com with a bunch of url-encoded params. We only care about the continue param, which represents the page where the sign-in button was clicked.

Next, you sign-in to your account at accounts.google.com. accounts.google.com sets a cookie for google.com. It can do this since this is its super domain. It then redirects you back to the page where you clicked sign-in (continue param).

From that point on, google.com can recognize you. As well as all of its sub domains.

But how can youtube.com recognize you? It is not a subdomain of google.com.

The point is that when accounts.google.com redirects you back to continue param. Before that it redirects you to accounts.youtube.com with continue and token params. And accounts.youtube.com in its turn sets a cookie for youtube.com and finally redirects you to continue param.

Thus youtube.com recognizes you. You can clear cookies specific to youtube.com to exit only from youtube.

-2

It could be done with third party cookies (see http://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie). To find out how it is done exactly, you could clean all cookies and watch the traffic with wireshark or tcpdump.