Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

1–10 of 529 posts

Re: JavaScript is now required to sign in to Google

#2
> But, because it may save bandwidth or help pages load more quickly, a tiny minority of our users (0.1%) choose to keep it off. This might make sense if you are reading static content, but we recommend that you keep Javascript on while signing into your Google Account so we can better protect you.

They don’t seem to explain why though? Did I miss it? Are they fingerprinting the JavaScript environment of my browser? Why? The 0.1% are the people who would like to know why they need it, but this message is written ironically for those who don’t know what JavaScript is.

Re: JavaScript is now required to sign in to Google

#6
For about a month or so I tried browsing with JavaScript turned off but gave up after having to modify settings for just about every single site I visited to get pages working, often with them silently failing in the background leaving me wondering what was going on. Sometimes I'd get halfway through a payment transaction before realising that the lack of JavaScript was preventing it from going through and then changing settings and reloading the page would break my session. Long story short, I gave up on this and have succumbed to running JavaScript for all sites again.

Re: JavaScript is now required to sign in to Google

#7

To keep your account secure, turn on Javascript?? If anything is making your web browsing less secure, it's JS. I don't particularly care that Google isn't letting you sign in without JS, but the message is just plain wrong..

I'm not sure about you, but most people with js "disabled" don't browse with javascript disabled entirely, but instead use a whitelisting/blacklisting plugin, otherwise they don't be able to access many essential sites (eg. banks). under this setup, whitelisting google isn't going to decrease security unless you think they're going to serve a 0day when you sign in.

Re: JavaScript is now required to sign in to Google

#8

The correct, non-editorialized title is: "Announcing some security treats to protect you from attackers’ tricks"

Both are editorialized. I think a better, more neutral title would be "Google now requiring JavaScript to be enabled to sign in".
Post reply on HN