JavaScript is now required to sign in to Google • Hacker News Board

Re: JavaScript is now required to sign in to Google

#221

Post by oconnor663 » Thu, Nov 01, 2018, 4:45 AM UTC

UnoriginalGuy wrote: post #63

totony wrote: post #37

Earlier quoted context omitted.

Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate

If the client hashes the password then the hash itself is the password. Meaning stealing the hashes passwords is the same as stealing the plain text password for which they're based, since you can post them direct. Blizzard entertainment does half client half server hashing which is rather clever, one of the few examples where client hashing makes sense.

I'm curious, how is half-hashing the password different from really hashing it?

The best protocol I know of is to derive a signing keypair from your (salted, stretched) password, and store the public key on the server instead of a password hash. Then during login, the server sends a challenge to the client, and the client signs it. The server never sees any secret material at all. Keybase uses a version of this protocol.

Unfortunately all the magical client side crypto in the world doesn't save you if the attacker can compromise your server and then send clients bad JS :p

Re: JavaScript is now required to sign in to Google

#222

Post by zamalek » Thu, Nov 01, 2018, 4:47 AM UTC

rhblake wrote: post #205

int_19h wrote: post #141

Earlier quoted context omitted.

Gmail is more than just mail, it's also integration with other Google services, like calendar. How does Fastmail fare in that regard?

FastMail supports CalDAV. I use my FastMail calendar with Thunderbird (Lightning) and on my iPhone; works great. They also support CardDAV for contacts. /satisfied FM customer since ~2008 or so

I had to purchase a CalDAV and CardDAV app (which were extremely cheap, mind) for Android, so it's not quite as plug'n'play there.

Re: JavaScript is now required to sign in to Google

#223

Post by ghop02 » Thu, Nov 01, 2018, 4:48 AM UTC

What many of the comments seem to be missing is that you don't need to enable javascript on all google sites, only the sign-in page. With that in mind, I don't think there needs to be as much concern as we're seeing here.

Re: JavaScript is now required to sign in to Google

#224

Post by diminoten » Thu, Nov 01, 2018, 4:49 AM UTC

Dylan16807 wrote: post #218

diminoten wrote: post #152

Earlier quoted context omitted.

Do you wear a bulletproof vest every time you go outside? No? Interesting.

>Do you wear a bulletproof vest every time you go outside? No? Interesting. You realize the bulletproof vest is the sandbox, right? You've just made an argument against enabling all javascript.

No, it's not. The lack of availability of guns is the sandbox, the cultural more of not killing people is the access controls.

"Bulletproof vest" in this analogy is "extraordinary activity designed to keep you safe".

You don't "wear a bulletproof vest" (a stand-in for "take extraordinary measures") to prevent yourself from "getting shot" (a stand-in for "thing that happens very rarely").

In other words, your assessment of the risk of JavaScript running in a browser is higher than it actually is.

Re: JavaScript is now required to sign in to Google

#225

Post by wowamit » Thu, Nov 01, 2018, 4:52 AM UTC

It is so difficult to explore anything that Google announces without passing it through the lens shaded by their ad business model. It doesn't matter with what intention they implement a change or if those intentions are pure.

Sure, this will make the login secure by preventing credential stuffing. But doesn't this also help them get more data from users who preferred not to by disabling JS? And was this the best and only solution to tackle this problem?

I believe internally too, Google must struggle with this perception.

Re: JavaScript is now required to sign in to Google

#226

Post by tetromino_ » Thu, Nov 01, 2018, 4:53 AM UTC

CivBase wrote: post #161

Yah, but what if I want to be able to log into my account using a script? I know I'm in a tiny minority, but I have on several occasions had to use selenium to automate actions on a web app. For this reason, captchas are similarly annoying to me.

If you want to automate your actions, you should get an API key and use the official APIs.

Re: JavaScript is now required to sign in to Google

#227

Post by bigblind » Thu, Nov 01, 2018, 4:53 AM UTC

bsamuels wrote: post #203

lisper wrote: post #139

Earlier quoted context omitted.

> Good luck detecting and preventing automation of sign in pages at scale without robust JS based defenses Why is it not sufficient simply to throttle logins at the server?

Modern cred stuffing is done by botnets. When I see a cred stuffing attack, it's maybe 1-3 attempts per IP address spread over 100-500k IP addresses. Often you'll have a family of legitimate users behind an IP address that's cred stuffing you at the same time. Throttling by IP address may have worked 10 years ago, unfortunately it's not an effective measure anymore. Modern cred stuffing countermeasures include a wide…

Any advice on where to read more about these modern cred stuffing countermeasures? I'd love to learn more.

Re: JavaScript is now required to sign in to Google

#228

Post by [deleted] » Thu, Nov 01, 2018, 4:55 AM UTC

djsumdog wrote: post #61

smadge wrote: post #16

Earlier quoted context omitted.

Additionally they imply the only motivation for disabling JavaScript is to increase performance and decrease bandwidth. They conveniently don’t mention the other, arguably more prevalent motivations: to increase privacy and security.

...and speed, and decreasing the amount of arbitrary code execution on your machine. Most people don't disable JS entirely, but use something like uMatrix or noscript. It takes more work, but you can turn off a significant number of things that just don't need to be executed and get around a lot of annoying modals and paywalls (or see a lot of blank pages; that happens a lot too).

[deleted]

Re: JavaScript is now required to sign in to Google

#229

Post by kevin_thibedeau » Thu, Nov 01, 2018, 5:02 AM UTC

the_clarence wrote: post #127

c487bd62 wrote: post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

Tbf you don’t require Google to browse the web.

There are also employers who don't treat their employees like children.

Re: JavaScript is now required to sign in to Google

#230

Post by jjawssd » Thu, Nov 01, 2018, 5:06 AM UTC

zamalek wrote: post #222

rhblake wrote: post #205

Earlier quoted context omitted.

FastMail supports CalDAV. I use my FastMail calendar with Thunderbird (Lightning) and on my iPhone; works great. They also support CardDAV for contacts. /satisfied FM customer since ~2008 or so

I had to purchase a CalDAV and CardDAV app (which were extremely cheap, mind) for Android, so it's not quite as plug'n'play there.

Completely unnecessary. Install davdroid from f-droid market, free.