Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

41–50 of 529 posts

Re: JavaScript is now required to sign in to Google

#41

Post by brunoTbear »

ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS.

They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss of one account being popped is likely far greater than the privacy loss of thousands of users' browsing patterns being correlated.

tl; dr: Good luck detecting and preventing automation of sign in pages at scale without robust JS based defenses. I think there's a shortsightedness and self-centeredness to a lot of these comments.

Re: JavaScript is now required to sign in to Google

#42

Post by cm2187 »

dimgl wrote: post #31
todd3834 wrote: post #28

This seems reasonable to me. JavaScript is being used everywhere and most people are okay with it. As a business decision I don’t see why Google would support such a small edge case. That being said, if they feel like explaing why they should maybe try a little harder. I assume most people with JavaScript turned off might appreciate more details so they can decide how to respond to the requirement. Then again, their…

99.9% of users are okay with JavaScript.

99.8% of users don't know what javascript is.

Re: JavaScript is now required to sign in to Google

#43

Post by diminoten »

tree_of_item wrote: post #26
bluetidepro wrote: post #10

I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?

You're misunderstanding: you browse with JS disabled by default . Random sites shouldn't be running programs on your computer. If you trust the site, you whitelist it.

You're acting like "running programs on your computer" is a bad thing. It's not.

Re: JavaScript is now required to sign in to Google

#44

Post by lerax »

cm2187 wrote: post #42
dimgl wrote: post #31

Earlier quoted context omitted.

99.9% of users are okay with JavaScript.

99.8% of users don't know what javascript is.

Thus only 0.1% of users know what javascript is and it's okay with it. That is an interesting random stats, seems pretty realistic. I at least liked it.

Re: JavaScript is now required to sign in to Google

#45

Post by sroussey »

NeoBasilisk wrote: post #40
totony wrote: post #37

Earlier quoted context omitted.

Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate

Who is sending passwords in cleartext on the wire?

Lots. But even those that don’t tend to send the password to the server, which is still bad.

Re: JavaScript is now required to sign in to Google

#46

Post by nneonneo »

NeoBasilisk wrote: post #40
totony wrote: post #37

Earlier quoted context omitted.

Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate

Who is sending passwords in cleartext on the wire?

Almost any http site with a login form is sending your password in cleartext. Thankfully, initiatives like Let's Encrypt have made plain http sites much less common than they used to be.

Hashing the password before sending it doesn't really help you much - the naïve approach is vulnerable to "pass-the-hash" (where you basically send the hash instead of the password as the authentication token). The secure approach involves either some kind of challenge-response or a nonce salt, but these aren't as easy to implement correctly.

Re: JavaScript is now required to sign in to Google

#47

Post by stanleydrew »

NeoBasilisk wrote: post #40
totony wrote: post #37

Earlier quoted context omitted.

Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate

Who is sending passwords in cleartext on the wire?

Literally almost everyone. (Wrapped in a TLS connection of course.)

Re: JavaScript is now required to sign in to Google

#48

Post by devy »

NeoBasilisk wrote: post #40
totony wrote: post #37

Earlier quoted context omitted.

Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate

Who is sending passwords in cleartext on the wire?

I think totony meant sending passwords without pre-hashing, but yeah it doesn't make sense to send any confidential information in clear text that should be sent via E2E encrypted TLS channels.

Furthermore, pre-hashing doesn't necessarily make transmitting confidential information safer, as one would argue that your client side javascript can be reverse-engineered and give the attacker more information about how you hash your data.

Re: JavaScript is now required to sign in to Google

#49

Post by stabbles »

totony wrote: post #37
mattcoles wrote: post #3

To keep your account secure, turn on Javascript?? If anything is making your web browsing less secure, it's JS. I don't particularly care that Google isn't letting you sign in without JS, but the message is just plain wrong..

Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate

Have you heard of this new technique called HTTPS?

Re: JavaScript is now required to sign in to Google

#50

Post by yetanotherjosh »

NeoBasilisk wrote: post #40
totony wrote: post #37

Earlier quoted context omitted.

Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate

Who is sending passwords in cleartext on the wire?

Indeed. And: who is hashing passwords on the client? As this would require either not using a salted hash, or sharing the server's salt with the client, in order to obtain identical hash values for comparison. In either case that system's entire password inventory would be a lot more vulnerable.

TLDR don't do that, send passwords over SSL and use a good password hashing algorithm on the server like BCrypt.

Post reply on HN