Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

71–80 of 529 posts

Re: JavaScript is now required to sign in to Google

#71

Post by kibwen »

mrep wrote: post #57
Sephr wrote: post #17

Chrome team members have said that preventing modern web browsers from leaking enough entropy to uniquely identify users across sessions (fingerprinting) is impractical with all of the features that the modern web provides. This sentiment has probably lead to some at Google to think that it is justifiable impose pervasive tracking and surveillance technologies as a condition for using Google services. Look at the new…

Do you have a better solution for differentiating yourself as an actual user from a robot spammer?

Being allowed to pay for services with money, rather than being required to pay for services with your personal data. I browse the web via a proxy when I'm on public wifi, and Google is nigh unusable with how many captchas it forces you to solve to do a single Google search. Fortunately Bing and DDG still work, for now.

Re: JavaScript is now required to sign in to Google

#72

Post by totony »

yetanotherjosh wrote: post #50
NeoBasilisk wrote: post #40

Earlier quoted context omitted.

Who is sending passwords in cleartext on the wire?

Indeed. And: who is hashing passwords on the client? As this would require either not using a salted hash, or sharing the server's salt with the client, in order to obtain identical hash values for comparison. In either case that system's entire password inventory would be a lot more vulnerable. TLDR don't do that, send passwords over SSL and use a good password hashing algorithm on the server like BCrypt.

Salts are not meant to be secret, nor are the hashing functions. You gain little by hiding them

Re: JavaScript is now required to sign in to Google

#73

Post by greglindahl »

brunoTbear wrote: post #41

ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…

Calling other people, or their opinions, shortsighed and self-centered is usually not the start of a good conversation.

Re: JavaScript is now required to sign in to Google

#74

Post by yayana »

shshhdhs wrote: post #2

> But, because it may save bandwidth or help pages load more quickly, a tiny minority of our users (0.1%) choose to keep it off. This might make sense if you are reading static content, but we recommend that you keep Javascript on while signing into your Google Account so we can better protect you. They don’t seem to explain why though? Did I miss it? Are they fingerprinting the JavaScript environment of my browser?…

They are trying to detect state actor hacking and track individual devices and whether they are new or impersonations of devices.

Some states have mitm certs on all their domestic machines but (hopefully) not much competence except on whatever schedule they buy updates.

I would be implenting a u2f soft client in js if I were Google. IMO you need a private key a state would need to retrieve by tampering with js and that isn't being sent over the wire with every connection. (Just to give them their first level of headache, when it comes to transitioning from observing to impersonation.)

Re: JavaScript is now required to sign in to Google

#75

Post by anothergoogler »

brunoTbear wrote: post #41

ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…

> The privacy loss of one account being popped is likely far greater than the privacy loss of thousands of users' browsing patterns being correlated.

That's quite the hand-wave. How do you even measure privacy loss? And given that browsing history is not in your inbox, why are you so confident that one compromised email account is a bigger deal?

Re: JavaScript is now required to sign in to Google

#76

Post by esotericn »

mrep wrote: post #57
Sephr wrote: post #17

Chrome team members have said that preventing modern web browsers from leaking enough entropy to uniquely identify users across sessions (fingerprinting) is impractical with all of the features that the modern web provides. This sentiment has probably lead to some at Google to think that it is justifiable impose pervasive tracking and surveillance technologies as a condition for using Google services. Look at the new…

Do you have a better solution for differentiating yourself as an actual user from a robot spammer?

This is only truly necessary as a mechanism to prevent automated signups.

It is less necessary, but can be useful, to prevent repeated login attempts (rate limiting works there).

For accessing a website it's completely inexcusable.

Re: JavaScript is now required to sign in to Google

#77

Post by mabbo »

afandian wrote: post #35
c487bd62 wrote: post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.

I have the same problems on Chrome.

Re: JavaScript is now required to sign in to Google

#78

Post by brunoTbear »

kwoff wrote: post #69

How is this nonsense upvoted on hackernews..?

It's surprising to me how many users on HN can only think as far as their own browser.

Really the question here is not "what's the harm of JS across the web" but rather what is the specific privacy cost of running JS on a sign in page and what is the security benefit of the same.

The worst case cost of JS on a browser is that you get a drive by download and your endpoint is owned. This seems unlikely on a Google domain.

The other, more normal, case is that a user is concerned about ad tracking. Providing an ad tracker on a sign in page seems pretty lame, and I'd be surprised, again, if Google was doing that.

The security upsides are likely several: anti-automation, anti-phishing, and an opportunity to track state-level adversaries who target users' Google accounts.

I don't know how others weigh these factors, but to me it seems entirely obvious that this is a good idea. Could the blog post have better laid out this case? Sure.

Re: JavaScript is now required to sign in to Google

#80

Post by OrderlyTiamat »

sjroot wrote: post #54
afandian wrote: post #35

Earlier quoted context omitted.

Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.

What version of Firefox are you running? You are either exaggerating greatly or have other issues with your system. I run the latest stable release of Firefox and the performance of Gmail (particularly the features you mention) is fine. I’d be happy to upload a screen recording to verify.

He's not the only one. It's a recurring comment here on hacker news and a problem I've encountered as well, and I'm running the latest stable release.
Post reply on HN