Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

231–240 of 529 posts

Re: JavaScript is now required to sign in to Google

#231

Post by jjawssd »

shshhdhs wrote: post #2

> But, because it may save bandwidth or help pages load more quickly, a tiny minority of our users (0.1%) choose to keep it off. This might make sense if you are reading static content, but we recommend that you keep Javascript on while signing into your Google Account so we can better protect you. They don’t seem to explain why though? Did I miss it? Are they fingerprinting the JavaScript environment of my browser?…

> Are they fingerprinting the JavaScript environment of my browser?

No, they are fingerprinting YOU and YOUR BEHAVIOR so it can be tracked across the entire internet. Intelligence agencies will use this information to track you across the web as well.

Re: JavaScript is now required to sign in to Google

#232

Post by brunoTbear »

bigblind wrote: post #227
bsamuels wrote: post #203

Earlier quoted context omitted.

Modern cred stuffing is done by botnets. When I see a cred stuffing attack, it's maybe 1-3 attempts per IP address spread over 100-500k IP addresses. Often you'll have a family of legitimate users behind an IP address that's cred stuffing you at the same time. Throttling by IP address may have worked 10 years ago, unfortunately it's not an effective measure anymore. Modern cred stuffing countermeasures include a wide…

Any advice on where to read more about these modern cred stuffing countermeasures? I'd love to learn more.

A relatively successful company in the area is Shape Security. Their marketing is a bit painful, but they invented the concept of cred stuffing. Disclaimer: I worked there for four years.

Re: JavaScript is now required to sign in to Google

#233

Post by bsamuels »

bigblind wrote: post #227
bsamuels wrote: post #203

Earlier quoted context omitted.

Modern cred stuffing is done by botnets. When I see a cred stuffing attack, it's maybe 1-3 attempts per IP address spread over 100-500k IP addresses. Often you'll have a family of legitimate users behind an IP address that's cred stuffing you at the same time. Throttling by IP address may have worked 10 years ago, unfortunately it's not an effective measure anymore. Modern cred stuffing countermeasures include a wide…

Any advice on where to read more about these modern cred stuffing countermeasures? I'd love to learn more.

Unfortunately I don't have much reading material to provide. It's a bit of an arms war, so the latest and greatest countermeasures are typically kept secret/protected by NDA. The rabbit hole can go very deep and can differ from company to company.

The most drastic example I can think of was an unverified rumor that a certain company would "fake" log users in when presented with valid credentials from a client they considered suspicious. They would then monitor what the client did - from the client's point of view it successfully logged in and would begin normal operation. If server observed the device was acting "correctly" with the fake login token, they would fully log it in. If the client deviated from expected behavior, it would present false data to the client & ban the client based on a bunch of fancy fingerprinting.

Every once in awhile, someone will publish their methods/software; Salesforce and their SSL fingerprinting software comes to mind: https://github.com/salesforce/ja3

Re: JavaScript is now required to sign in to Google

#234

Post by shakna »

diminoten wrote: post #98
vageli wrote: post #68

Earlier quoted context omitted.

Running untrusted code on your machine _is_ a bad thing though.

Yeah, because permissions, sandboxing, and access controls don't exist. Oh wait, they do, and they work, so you're wrong.

> and they work

... They break about as often as they work. [0][1]

There are a lot of vulnerabilities that appear in web browser protections, and almost all of them get exploited via JavaScript. Running untrusted software is not safe.

[0] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium

[1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox

Re: JavaScript is now required to sign in to Google

#235

Post by 2RTZZSro »

userbinator wrote: post #97

What a bunch of, excuse the language, paternalist fear-mongering bullshit. Of course Google wants you to enable JS, because it allows them to monitor and track everything about you more easily. Twisting it into "this will make you safer" is sad and undeniably repugnant. I've noticed a lot of other sites practically begging you to "enable JavaScript for a better experience", when all their content is static text and i…

[flagged]

Re: JavaScript is now required to sign in to Google

#236

Post by astura »

afandian wrote: post #35
c487bd62 wrote: post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.

Fwiw, I use Gmail exclusively in Firefox and have no problems at all. (And my machines are fairly dated.)

Re: JavaScript is now required to sign in to Google

#237

Post by Too »

lisper wrote: post #193
Phlarp wrote: post #171

Earlier quoted context omitted.

Throttle based on what? IP address? This works for domestic IT departments looking to shut out automated attempts from specific ranges but at Google's scale IP based filtering could end up shutting out an entire country.

> Throttle based on what? User Id?

That's the first obvious countermeasure and will prevent hackers targeting a specific account. But there are other ways to crack passwords, one is to try the same password but iterate over user ids instead. As hackers would start with the most common password you can't throttle globally on same password attempts either because well yeah, it is by definition the most commonly used one which should have a lot of traffic.

Re: JavaScript is now required to sign in to Google

#239

Post by eksemplar »

asdkhadsj wrote: post #58
afandian wrote: post #35

Earlier quoted context omitted.

Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.

Switching email providers is reasonably painless, fwiw. Set up forwarding, migrate mail when you can. Even better if you set up the majority of your non-security-essential mail to be at your own domain, hosted by Fastmail/etc. Then you can easily change your email provider and your contacts don't even care. I've yet to implement this is in my own life, I just switched to fast mail - so I can't speak from personal exp…

I used fastmail for a year and can recommend it, but if you’re European you should probably look up runbox instead as it’s housed in Norway.

That’s what I eventually switched to and it works fine.

Re: JavaScript is now required to sign in to Google

#240

Post by perl4ever »

2RTZZSro wrote: post #235
userbinator wrote: post #97

What a bunch of, excuse the language, paternalist fear-mongering bullshit. Of course Google wants you to enable JS, because it allows them to monitor and track everything about you more easily. Twisting it into "this will make you safer" is sad and undeniably repugnant. I've noticed a lot of other sites practically begging you to "enable JavaScript for a better experience", when all their content is static text and i…

[flagged]

"Pretty soon your every action will be tracked throughout the Internet"

You're saying soon the computers that make up the internet will gain the capabilities of IBM machinery of the 1930s?

Post reply on HN