Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

101–110 of 529 posts

Re: JavaScript is now required to sign in to Google

#101

Post by jazzyjackson »

afandian wrote: post #35
c487bd62 wrote: post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.

I've recently switched to MacOS's built in mail client with IMAP to Gmail, never have to wait for my UI to do something. So count me in as surprised how far gmail has gone downhill.

Re: JavaScript is now required to sign in to Google

#102

Post by lordcorvin1 »

c487bd62 wrote: post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

If you enable privacy.resistFingerprinting in Firefox you automatically fail v3 Captcha with score 0.1 People who want to try it out: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor...

Re: JavaScript is now required to sign in to Google

#103

Post by your-nanny »

afandian wrote: post #35
c487bd62 wrote: post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.

I've had the same experience. poor performance and display anomolies.

Re: JavaScript is now required to sign in to Google

#104

Post by greglindahl »

Operyl wrote: post #34
Zelphyr wrote: post #32

I'm getting tired of Google dictating how the web should work. That's the job of standards bodies. Google is increasingly taking the place of overbearing overlord that Microsoft embodied in the 90's and early 2000's.

Google is dictating how signing into their account system on their properties works, not login forms for _every single site_.

Google's policies get exported.

For a long time it was OK to drop email that came from a server without rDNS. Then gmail started allowing such emails, and then legit sites started sending email from servers without rDNS.

In this case the export mechanism is Captcha v3.

Re: JavaScript is now required to sign in to Google

#105

Post by brunoTbear »

esotericn wrote: post #93
brunoTbear wrote: post #41

ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…

Your first statement is incompatible with your second. (I think the second statement is reasonable, although I disagree with the conclusion). People aren't underestimating the risk to _their_ accounts, they are discounting the risk to _others_ accounts. That is, they're essentially saying, 'well, other users chose to have bad passwords, so bully them'. I think that's a fair viewpoint to have. We've entered a world in…

I think you may be giving people more credit than they deserve, but I'm willing to accept that they're making that argument. Even if that's their argument, that their personal habits around password use and being attentive to not being phished are so good they don't need Google's help defending themselves, so bully for everyone who does, I'm not convinced it's a good one.

There are a few things needed for that to be a good argument 1) Their security really is so good (I'd bet it isn't. I saw a tenured security professor/former State Department cyber expert get phished on the first go by an undergrad.) 2) Google isn't improving their security posture on top of that (I'd be shocked if Google isn't improving theirs, and I'm certain having JS required to sign into gmail closes a major hole in observability of automation) 3) There are real harms from the JS being there for their security/privacy posture (as I've said elsewhere, I'm unconvinced Google is allowed by their own privacy policy from doing anything untoward here)

As to your point about computer literacy and existence, I think the sad truth is that computer engagement is required, but literacy is optional. When that's the case, large companies are in the position of having to defend even the least computer literate against the most vicious of attackers.

Re: JavaScript is now required to sign in to Google

#106

Post by StavrosK »

asdkhadsj wrote: post #58
afandian wrote: post #35

Earlier quoted context omitted.

Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.

Switching email providers is reasonably painless, fwiw. Set up forwarding, migrate mail when you can. Even better if you set up the majority of your non-security-essential mail to be at your own domain, hosted by Fastmail/etc. Then you can easily change your email provider and your contacts don't even care. I've yet to implement this is in my own life, I just switched to fast mail - so I can't speak from personal exp…

I switched to Fastmail years ago and it was the best mail-related thing I ever did. I was dreading the migration but it literally took ten minutes, switch DNS records (I have my own domain), run Fastmail's import, done.

I still can't believe how fast the UI is. It's by far the fastest web app I've ever used, and the same goes for the service in general.

Seriously, just ditch Gmail now, the alternatives are great.

Re: JavaScript is now required to sign in to Google

#107

Post by jazzyjackson »

diminoten wrote: post #43
tree_of_item wrote: post #26

Earlier quoted context omitted.

You're misunderstanding: you browse with JS disabled by default . Random sites shouldn't be running programs on your computer. If you trust the site, you whitelist it.

You're acting like "running programs on your computer" is a bad thing. It's not.

Well I don't want to run EVERYone's program on my computer, I want to run MY programs on my computer.

Most websites are made of text, I usually want the text, not whatever program they're running.

Re: JavaScript is now required to sign in to Google

#108

Post by yetanotherjosh »

bluetidepro wrote: post #10

I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?

It's a pretty extreme practice, and only something a tiny fraction of very technical users will do. I think in general the people who turn off JS do it in a way that they allow it on sites they really have to use that really don't work without it.

Asking this question on HN will have an extreme selection bias, sort of like asking "who really thinks aliens are vising Earth and abducting people?" in the Roswell UFO museum staff meeting.

Re: JavaScript is now required to sign in to Google

#109

Post by StavrosK »

asdkhadsj wrote: post #58
afandian wrote: post #35

Earlier quoted context omitted.

Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.

Switching email providers is reasonably painless, fwiw. Set up forwarding, migrate mail when you can. Even better if you set up the majority of your non-security-essential mail to be at your own domain, hosted by Fastmail/etc. Then you can easily change your email provider and your contacts don't even care. I've yet to implement this is in my own life, I just switched to fast mail - so I can't speak from personal exp…

> assuming fast mail lets me

It does let you, you can create as many aliases as you want (I'm assuming) on any of their or your domains.

Re: JavaScript is now required to sign in to Google

#110

Post by throwawaymath »

userbinator wrote: post #97

What a bunch of, excuse the language, paternalist fear-mongering bullshit. Of course Google wants you to enable JS, because it allows them to monitor and track everything about you more easily. Twisting it into "this will make you safer" is sad and undeniably repugnant. I've noticed a lot of other sites practically begging you to "enable JavaScript for a better experience", when all their content is static text and i…

> Browser exploits are almost all JS-based, and even the few that aren't, are in practice deployed using obfuscation involving JS, to make analysis and detection harder.

Go take a look through Pwn2Own. Most browser exploits do not involve JavaScript. JavaScript can be a delivery mechanism for a certain class of payloads, but it's not the substantial weakness in browser vulnerabilities (as opposed to web application vulnerabilities).

Given that this isn't familiar to you, I'd recommend you reevaluate how confident you are in the JavaScript-focused defenses you've outlined in the rest of your comment.

Post reply on HN