91–100 of 529 posts
For about a month or so I tried browsing with JavaScript turned off but gave up after having to modify settings for just about every single site I visited to get pages working, often with them silently failing in the background leaving me wondering what was going on. Sometimes I'd get halfway through a payment transaction before realising that the lack of JavaScript was preventing it from going through and then chang…
ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…
People aren't underestimating the risk to _their_ accounts, they are discounting the risk to _others_ accounts.
That is, they're essentially saying, 'well, other users chose to have bad passwords, so bully them'.
I think that's a fair viewpoint to have. We've entered a world in which computer literacy is a basic requirement in order to, well, exist.
That said, what's reasonable, and what actually occurs, are two different things. A company isn't going to ideologically decide "screw the users that use bad passwords" if it loses them money.
So we get _seemingly_ suboptimal solutions like this.
Earlier quoted context omitted.
Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.
I have the same problems on Chrome.
Earlier quoted context omitted.
Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate
Hashing passwords client side has no benefit if a site uses HTTPS. If a site uses HTTP, then hashing the password client-side and sending it up to the server is equivalent to sending a clear text password. If an attacker can already read your traffic, what is stopping them from using your password's hash to log-in to your account?
Earlier quoted context omitted.
This is only truly necessary as a mechanism to prevent automated signups. It is less necessary, but can be useful, to prevent repeated login attempts (rate limiting works there). For accessing a website it's completely inexcusable.
Rate limiting login attempts means I can prevent you from logging in indefinitely by pushing your account into the rate limited status.
I've noticed a lot of other sites practically begging you to "enable JavaScript for a better experience", when all their content is static text and images. I fell for that once, a long time ago --- enabled JS briefly to see what the big deal was --- and was promptly bombarded with popups, slide-overs, and even more ads. No thank you, I'll keep it off.
For many years I used IE6 with JS off (and a whitelist for a very, very small number of selected and highly-trusted sites. IE has a "security zone" feature which to my knowledge no other browser comes with by default.) Not a single malware infection, and that's despite often visiting the... shadier parts of the Internet.
Browser exploits are almost all JS-based, and even the few that aren't, are in practice deployed using obfuscation involving JS, to make analysis and detection harder. Turning off JS effectively kills those risks as well as other annoyances (blocking right-click, text selection, injecting crap into copied content, etc.)
IMHO the advantages of not having JS on by default are underrated. I'd consider ~99% of the sites I come across when searching for content to not require it at all, which certainly is a stark contrast from the "you'll break the Internet!" screams of the JS-advocates and "web designers". Sites that "break" from not having JS, and which aren't specifically "appsites" but mostly content-sites, are not worth visiting anyway.
Perhaps it's time to raise a counter-movement, and add (via tags, of course) "you have JavaScript turned on in your browser, this is a security risk! Click (link to appropriate page with all the risks and how to turn it off) to learn more." Or "You have JavaScript enabled, please disable it for a better experience."
If a certain vocal minority managed to demonise Flash (another powerful technology that had major uses) to almost completely kill it, maybe the same can happen for JavaScript?
Earlier quoted context omitted.
You're acting like "running programs on your computer" is a bad thing. It's not.
Running untrusted code on your machine _is_ a bad thing though.
Oh wait, they do, and they work, so you're wrong.
Earlier quoted context omitted.
This is only truly necessary as a mechanism to prevent automated signups. It is less necessary, but can be useful, to prevent repeated login attempts (rate limiting works there). For accessing a website it's completely inexcusable.
Background: I spent years developing a product that currently defends F500 websites against automated attacks. If you live in the US you've more than likely used my software this week without knowing it. Rate limiting is completely ineffective in preventing credential stuffing attacks from determined adversaries. The challenge is not brute-forcing, but credential leaks and password reuse. Attackers have access to vas…
I don't want google to protect me in this way. Can I opt out?