Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

171–180 of 529 posts

Re: JavaScript is now required to sign in to Google

#171

Post by Phlarp »

lisper wrote: post #139
brunoTbear wrote: post #41

ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…

> Good luck detecting and preventing automation of sign in pages at scale without robust JS based defenses Why is it not sufficient simply to throttle logins at the server?

Throttle based on what? IP address? This works for domestic IT departments looking to shut out automated attempts from specific ranges but at Google's scale IP based filtering could end up shutting out an entire country.

Re: JavaScript is now required to sign in to Google

#172

Post by paulcole »

ekianjo wrote: post #51
lerax wrote: post #44

Earlier quoted context omitted.

Thus only 0.1% of users know what javascript is and it's okay with it. That is an interesting random stats, seems pretty realistic. I at least liked it.

Thats the wrong take on the stats. It means among the ones who know, half of them dont want it. This is more telling that looking at the 0.1%.

I think you’re confusing “numbers some guy made up” with “stats.”

Re: JavaScript is now required to sign in to Google

#173

Post by duxup »

greglindahl wrote: post #73
brunoTbear wrote: post #41

ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…

Calling other people, or their opinions, shortsighed and self-centered is usually not the start of a good conversation.

I'll be the guy who says that while I recognize those are insults, they are also sufficiently descriptive of a point of view... it's not like he called someone Mr. Poopypants.

Re: JavaScript is now required to sign in to Google

#174

Post by asdfasgasdgasdg »

OrderlyTiamat wrote: post #80
sjroot wrote: post #54

Earlier quoted context omitted.

What version of Firefox are you running? You are either exaggerating greatly or have other issues with your system. I run the latest stable release of Firefox and the performance of Gmail (particularly the features you mention) is fine. I’d be happy to upload a screen recording to verify.

He's not the only one. It's a recurring comment here on hacker news and a problem I've encountered as well, and I'm running the latest stable release.

The classic question to ask at this point is whether this affects you with a fresh install, or only once you have added all your extensions?

Re: JavaScript is now required to sign in to Google

#175

Post by JoshMnem »

magicalist wrote: post #143
cesarb wrote: post #137

Earlier quoted context omitted.

Hacker News works perfectly fine without Javascript. In fact, I don't think I've ever enabled Javascript here on Hacker News.

> Hacker News works perfectly fine without Javascript. keyword being " too ". > In fact, I don't think I've ever enabled Javascript here on Hacker News. I mean, that's super, but it's just one more point in the column of how HN's population is out of touch with any regular person. It's really annoying to wait for the page reload on even a fast network, and good luck finding your place again if a thread is even modera…

I leave JS off on this site and vote by middle clicking. There is no wait for a page reload.

In any case, you don't have to search for your place again, because the browser reloads with that comment on the top.

Re: JavaScript is now required to sign in to Google

#176

Post by eco »

nathanaldensr wrote: post #117
asdkhadsj wrote: post #58

Earlier quoted context omitted.

Switching email providers is reasonably painless, fwiw. Set up forwarding, migrate mail when you can. Even better if you set up the majority of your non-security-essential mail to be at your own domain, hosted by Fastmail/etc. Then you can easily change your email provider and your contacts don't even care. I've yet to implement this is in my own life, I just switched to fast mail - so I can't speak from personal exp…

I can speak from experience regarding FastMail because that's exactly what I did. In fact, I migrated off a grandfathered Google Apps account with my custom domain to FastMail with that same domain. Yeah, it's a bunch of steps, but I'm very comfortable with making DNS changes. My wife and I have an account; it's worth every penny. Also, FastMail allows for subdomain handling. I use this feature with nearly every site…

I'm in the weird Google Apps for Your Domain limbo right now myself. I've wondered what would happen if I switched to something other than GMail but kept my google account with that email address.

I know a long time ago you could set up a Google account using a non-GMail email address but I'm not sure if that's even a thing anymore. That's what I want though. Keep the email address with my own domain that I've used for 17 years and just have a regular old Google account using that email (and keep all my Google services and purchases associated with it).

Google has been absolutely terrible to Google Apps for Your Domain users (who were often Google's biggest supporters back in the day). They've been shoved into this weird second class status where their Google accounts only partially work with Google services. I completely regret ever setting it up.

Re: JavaScript is now required to sign in to Google

#177

Post by duxup »

I'm not really sure how it works if you don't want to use JavaScript, do you then whitelist sites that you're ok with it?

Wouldn't the solution for folks who don't want to run JavaScript just to whitelist it for Google?

Maybe I'm missing something but that seems pretty simple, would let Google do their thing and the folks who don't want to run it run it just for Google and places they want to.

If someone already doesn't trust Google, I gotta think they abandoned their products entirely already. Google's data collecting is so complete that JS or not, same objections.

Re: JavaScript is now required to sign in to Google

#178

Post by rtpg »

allenz wrote: post #165
OrderlyTiamat wrote: post #80

Earlier quoted context omitted.

He's not the only one. It's a recurring comment here on hacker news and a problem I've encountered as well, and I'm running the latest stable release.

Same here, I run the latest Firefox on both Windows and Linux. Gmail always takes at least 5 seconds to load.

I think that Chrome also suffers on this front? But it's better at doing pre-fetching than Firefox is

This could really just be that part. I have a hard time imagining explicit sabotage of FF on the gmail frontend. The likeliest explanation is that perf testing and the like only happens in Chrome

Re: JavaScript is now required to sign in to Google

#179

Post by asdfasgasdgasdg »

CivBase wrote: post #161

Yah, but what if I want to be able to log into my account using a script? I know I'm in a tiny minority, but I have on several occasions had to use selenium to automate actions on a web app. For this reason, captchas are similarly annoying to me.

Isn't that what Oauth is for?

Re: JavaScript is now required to sign in to Google

#180

Post by repiret »

esotericn wrote: post #96
yetanotherjosh wrote: post #85

Earlier quoted context omitted.

Rate limiting login attempts means I can prevent you from logging in indefinitely by pushing your account into the rate limited status.

Only as long as you keep up the attack.

But an attack that keeps rate limits saturated doesn’t require much bandwidth (you know, because rate limits) and is therefore easy to keep up. Most services would consider it unacceptable if a script kiddie with a botnet and a generic list of usernames were able to prevent even 1% of their users from logging in.
Post reply on HN