Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

211–220 of 529 posts

Re: JavaScript is now required to sign in to Google

#211
post #193
post #171

Earlier quoted context omitted.

Throttle based on what? IP address? This works for domestic IT departments looking to shut out automated attempts from specific ranges but at Google's scale IP based filtering could end up shutting out an entire country.

> Throttle based on what? User Id?

With credential stuffing, isn't it unlikely the perpetrator wants to make more than one or two attempts per user ID?

Re: JavaScript is now required to sign in to Google

#212
post #151
post #71

Earlier quoted context omitted.

Being allowed to pay for services with money, rather than being required to pay for services with your personal data. I browse the web via a proxy when I'm on public wifi, and Google is nigh unusable with how many captchas it forces you to solve to do a single Google search. Fortunately Bing and DDG still work, for now.

> Being allowed to pay for services with money, rather than being required to pay for services with your personal data One possible big disadvantage for a site owner in letting people pay with money instead of data is dealing with taxes. I'm not actually sure how most jurisdictions tend to classify it when someone comes to your site and you charge them to access your content. My guess would be it would be taxed the s…

My experience with taxation out side of the US, currently Australia, is that they are ridiculously reasonable and probably more on my, that is the business owners, side that I would like them to be.

It would be a net benefit for everyone, including the US, if it's broken taxation system becomes a national emergency and finally gets fixed.

Re: JavaScript is now required to sign in to Google

#213
post #176

Earlier quoted context omitted.

I can speak from experience regarding FastMail because that's exactly what I did. In fact, I migrated off a grandfathered Google Apps account with my custom domain to FastMail with that same domain. Yeah, it's a bunch of steps, but I'm very comfortable with making DNS changes. My wife and I have an account; it's worth every penny. Also, FastMail allows for subdomain handling. I use this feature with nearly every site…

I'm in the weird Google Apps for Your Domain limbo right now myself. I've wondered what would happen if I switched to something other than GMail but kept my google account with that email address. I know a long time ago you could set up a Google account using a non-GMail email address but I'm not sure if that's even a thing anymore. That's what I want though. Keep the email address with my own domain that I've used f…

You can continue using your email address for your Google account even if you've got someone else handling the mail now. You can also sign up for a Google account with an email account from any domain or provider.

Re: JavaScript is now required to sign in to Google

#214
post #71
post #57

Earlier quoted context omitted.

Do you have a better solution for differentiating yourself as an actual user from a robot spammer?

Being allowed to pay for services with money, rather than being required to pay for services with your personal data. I browse the web via a proxy when I'm on public wifi, and Google is nigh unusable with how many captchas it forces you to solve to do a single Google search. Fortunately Bing and DDG still work, for now.

And for the "this is a real person" service, they really don't have to charge much. I should be able to go to the store and pay a dollar for a PIN that gets anonymized on use and lasts a long time if not indefinitely when not abused.

Re: JavaScript is now required to sign in to Google

#215
post #91
post #6

For about a month or so I tried browsing with JavaScript turned off but gave up after having to modify settings for just about every single site I visited to get pages working, often with them silently failing in the background leaving me wondering what was going on. Sometimes I'd get halfway through a payment transaction before realising that the lack of JavaScript was preventing it from going through and then chang…

try umatrix

Umatrix is build around reactionary settings, and once you're reacting it's usually too late to fix a failed payment attempt.

I've faced the same problem a lot, and what I really need is a way in ublock/umatrix to turn it off for the current tab, even as it jumps across several domains. But this doesn't seem to be an option. Am I missing something?

Re: JavaScript is now required to sign in to Google

#216

I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?

I browse with 3rd party frames and JS disabled. Not as extreme as all JS so it doesn't break most things. Occasionally I need to whitelist a CDN or related domain for that site to get things working.

Re: JavaScript is now required to sign in to Google

#217

I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?

> Wouldn't 99.9999% of the web basically break?

What leads you to a number like that? I can tell you that you're wrong, but I'm much more interested in how you got there.

Youtube needs javascript, and images or sometimes body text on badly-designed blogs need javascript. Most sites are fine. HN is fine, for the most obvious example.

Re: JavaScript is now required to sign in to Google

#218

Earlier quoted context omitted.

No, they don't always work. We have bullet proof vests but it's still not safe to put one on and have someone start shooting you.

Do you wear a bulletproof vest every time you go outside? No? Interesting.

>Do you wear a bulletproof vest every time you go outside? No? Interesting.

You realize the bulletproof vest is the sandbox, right? You've just made an argument against enabling all javascript.

Re: JavaScript is now required to sign in to Google

#219
post #6

For about a month or so I tried browsing with JavaScript turned off but gave up after having to modify settings for just about every single site I visited to get pages working, often with them silently failing in the background leaving me wondering what was going on. Sometimes I'd get halfway through a payment transaction before realising that the lack of JavaScript was preventing it from going through and then chang…

You can disable Javascript ... if your time has no value.

Re: JavaScript is now required to sign in to Google

#220

ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…

XSS vulnerabilities are everywhere. You obliviously don’t realize that. Note that I do use js, because it makes life easier. But you got to realize that not using js will at some point protect you against an XSS vuln. They are that prevalent.

There's absolutely nothing in the above comment that indicates the person you're replying to doesn't know the prevalence of XSS vulnerabilities.
Post reply on HN