Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

241–250 of 529 posts

Re: JavaScript is now required to sign in to Google

#241

Post by perl4ever »

colemickens wrote: post #146

I try hard not to be a luddite as I age, but this level of automation and machine learning is so concerning. It is SO frustrating to accidentally appear as a bot and get stuck at the mercy of an automated system. I was on some random site the other day and spent 3+ minutes solving Captchas until it finally let me through. I thought I was losing my mind. I don't spam, I don't automate queries, I come from an IP that h…

I was getting a persistent but unhelpful error message from an airline website while trying to change my reservation shortly after midnight. I assumed at first I just hit the maintenance window and should try again in the morning, but now I am reading this thread and wondering if it's a deliberate obfuscation that it deemed my connection suspicious.

Re: JavaScript is now required to sign in to Google

#242

Post by blux »

afandian wrote: post #35
c487bd62 wrote: post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.

Same issue here. Mails not loading, poor initial load time. That is with zero extensions enabled.

I am now using mutt/notmuch/mbsync to prevent having to go through their horrendously slow web interface, and eventually move away from Gmail completely (probably to ProtonMail or fastmail).

Re: JavaScript is now required to sign in to Google

#244

Post by dingaling »

c487bd62 wrote: post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

> Sorry, you don't have enough Google Points

In the past few months all our domestic devices have gradually hit that notional condition with Google Search. All the laptops one by one, and then last night my phone. My wife's phone is the only one that can still use their search without a ten-round Recaptcha challenge.

As each device was locked-out from Google I switched the default over to DDG.

Re: JavaScript is now required to sign in to Google

#245

Post by neotek »

userbinator wrote: post #119
brunoTbear wrote: post #78

Earlier quoted context omitted.

It's surprising to me how many users on HN can only think as far as their own browser. Really the question here is not "what's the harm of JS across the web" but rather what is the specific privacy cost of running JS on a sign in page and what is the security benefit of the same. The worst case cost of JS on a browser is that you get a drive by download and your endpoint is owned. This seems unlikely on a Google doma…

I'm sure tracking everyone and controlling exactly what they can do will make them safer. Why don't we put surveillance cameras everywhere and make them record 24/7 too? Authoritarian ideology like this is what turned me off the whole "security industry" years ago.

Adding "" to the end of a sentence doesn't make it any less of a strawman.

Re: JavaScript is now required to sign in to Google

#246

Post by eropple »

devy wrote: post #60
yetanotherjosh wrote: post #50

Earlier quoted context omitted.

Indeed. And: who is hashing passwords on the client? As this would require either not using a salted hash, or sharing the server's salt with the client, in order to obtain identical hash values for comparison. In either case that system's entire password inventory would be a lot more vulnerable. TLDR don't do that, send passwords over SSL and use a good password hashing algorithm on the server like BCrypt.

Yep. Proper password hashing requires per-credential salt, pepper (for all credentials) and a strong algorithm (IV, iterations etc.) Revealing all those information is a leak and arguably making client side hashing less secure (by giving away a lot of parameters for attackers to attack)

NIST may say that you should use "peppers" for passwords, but nobody else does.

None of bcrypt, scrypt, or Argon2 use them and are not materially worse for it.

Re: JavaScript is now required to sign in to Google

#247

Post by PeterHK »

i have javascript disabled mostly to save bandwidth against nasty ads. Most sites that requires JS i usually ignore if possible (seriously why do some content provider think its ok to require JS?). For certain things like soon google login i do just whitelist them. But by default if i do not trust your site enough and/or its not that important in the end ill just close my tab

Re: JavaScript is now required to sign in to Google

#248

Post by ndnxhs »

bluetidepro wrote: post #10

I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?

I have umateix installed and set to block 3rd party scripts. Almost all websites work fine or even better like this but sometimes I have to enable a CDN to get the website to work.

Re: JavaScript is now required to sign in to Google

#249

Post by ndnxhs »

modzu wrote: post #163

coming soon: we noticed you are in private browsing mode. to keep your browsing secure, please sign in with history enabled.

Nooo, google wants you to think you are in private browsing mode so you share more secrets with them. They will just collect it all no matter what you do.

Re: JavaScript is now required to sign in to Google

#250

Post by ndnxhs »

Operyl wrote: post #34
Zelphyr wrote: post #32

I'm getting tired of Google dictating how the web should work. That's the job of standards bodies. Google is increasingly taking the place of overbearing overlord that Microsoft embodied in the 90's and early 2000's.

Google is dictating how signing into their account system on their properties works, not login forms for _every single site_.

Google is quickly becoming the login form for every website. And even if the website has its own login it will always have recaptca
Post reply on HN