131–140 of 529 posts
I tried to live with javascript disabled by default but gave up after two months because all I did was white-listing every page I opened. Gave up on my own side projects too. Building something that works with and without javascript is just to much work for me and it becomes ugly quickly. I still think modern websites over use javascript too often and should use markup over code whenever possible. And of course no on…
0.1% of Google's users is still quite a lot of users, is it not? Somewhere over a billion, perhaps, which would mean 1 million+ with JS off.
0.1% of roughly 4 billion would be about 4 million. Somewhat more in pageviews. Of course, this fails to account for self-selection, a beehaviour has encountered before, in which increasing Youtube performance slowed average load times ... because users who'd previously found the site intolerably slow now found it slow, but tolerable. (I've looked for the story, can't find it.) Much as those who prefer to avoid use o…
Earlier quoted context omitted.
Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate
Who is sending passwords in cleartext on the wire?
Your password _is_ whatever you send over the wire. Doing a hash in JavaScript before sending it won't obscure the user's password from anyone who can see their traffic; it will obscure the user's password from the user.
Earlier quoted context omitted.
Running untrusted code on your machine _is_ a bad thing though.
Yeah, because permissions, sandboxing, and access controls don't exist. Oh wait, they do, and they work, so you're wrong.
Earlier quoted context omitted.
> Why would google not at least have an incentive they'd have to work against, to add tracking into their sign in pages? You're signing in . That's literally asking them to identify you across pages so you can have access to them.
No it isn't; that's just a side effect of the bolted-on implementation of cookies. Signing in is literally asking them to identify you on one page so you can have access to that page.
Earlier quoted context omitted.
Hashing passwords client side has no benefit if a site uses HTTPS. If a site uses HTTP, then hashing the password client-side and sending it up to the server is equivalent to sending a clear text password. If an attacker can already read your traffic, what is stopping them from using your password's hash to log-in to your account?
You are wrong. Client-side hashing CAN be a silly thing, but it can also prevent a (compromised) server from seeing your password which you probably use on other websites (which is what most people do unfortunately).
Earlier quoted context omitted.
No it isn't; that's just a side effect of the bolted-on implementation of cookies. Signing in is literally asking them to identify you on one page so you can have access to that page.
ha well turn off javascript too and you won't be able to use even hackernews, so good luck with that.
Earlier quoted context omitted.
Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate
Hashing passwords client side has no benefit if a site uses HTTPS. If a site uses HTTP, then hashing the password client-side and sending it up to the server is equivalent to sending a clear text password. If an attacker can already read your traffic, what is stopping them from using your password's hash to log-in to your account?
About client side benefits. I'm not advocating for JS in the browser but there are benefits to doing some work client side.
ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…
Why is it not sufficient simply to throttle logins at the server?
This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.
Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.