Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

291–300 of 529 posts

Re: JavaScript is now required to sign in to Google

#291

Post by anonunt »

arkadiyt wrote: post #14

As others have mentioned, nearly the entire internet breaks without javascript - it's a sad state of affairs. One protection I like to use is to disable javascript that is loaded over plaintext http - this breaks nearly nothing, and is easy to do via Chrome settings: https://i.imgur.com/NRVg5Xf.png

I browse without javascript all the time, sometimes i need to switch to another browser to buy something from some random site, but generally its just a faster better internet with very dodgey sites self selecting themselves out of my usage.

If there is one or two sites i really want to use in my main browser that need JS i can white list that site - but only exactly that site.

I am not an expert but it seems a better experience to me and i don't really think it make me less secure?

Re: JavaScript is now required to sign in to Google

#293

Post by dorgo »

aequitas wrote: post #275
roenxi wrote: post #271

Earlier quoted context omitted.

I'm not up to speed with the latest and greatest of what java-script can do, but isn't the source code fundamentally user-visible? We always used to laugh at people who did website security with javascript, the whole idea was that security processing had to be done server-side.

Javascript can be served dynamic as well, per user/connection specific even. So an attacker would have to investigate and counter each new version of the scripts. Even if this could be done automatic it greatly increases the cat/mouse factor for Google.

So, basically javascript is used for security through obscurity?

Re: JavaScript is now required to sign in to Google

#295

Post by wild_preference »

Vinnl wrote: post #262
c487bd62 wrote: post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

What is especially interesting is that this will allow Google to track you on more pages, but that in this case, you can by definition not block the tracker. I've checked, but reCAPTCHA just falls under the general Google Terms of Service. I don't believe this to be done with that goal, but it is an unfortunate side-effect.

ReCaptcha is like Cloudflare's free DDoS protection: we like to point at these services and complain how people are "ruining the web" by using them because that's what we do on HN. We ignore the big picture and whine.

But I encourage everyone to consider a darker reality: that centralized services by large companies are becoming more and more necessary in a world where it's becoming easier and easier to be an attacker. The internet is kinda broken. Like how half the ISPs in the world don't filter their egress for spoofed IPs because there's no real incentive. That every networked device in every household could unknowingly be part of a botnet because we aren't billed for externalities.

Yeah, maybe it's kinda spooky that now ReCaptcha v3 wants to be loaded on every page. But is that really the take-away? What about the fact that this is what's necessary to detect the next generation of attacker? That you can either use Google's omniscient neural-network to dynamically identify abuse or you can, what? Roll your own? What exactly is the alternative?

Do HNers think this stuff is a non-issue because nobody has every attacked their Jekyll blog hosted on Github Pages (btw, another free service by a large company)?

Re: JavaScript is now required to sign in to Google

#296

Post by jasonvorhe »

guest0001 wrote: post #274

"When your username and password are entered on Google’s sign-in page, we’ll run a risk assessment and only allow the sign-in if nothing looks suspicious." In my experience (it is already the case with gmail and outlook up and now), this means I will not be able to login to my account when in holiday in another city, country, or when I use a borrowed device, or when I am behind VPN/Tor, etc, unless I give google my p…

They're giving you a free account to burst out mails with. Your account will most likely contain a lot of private or privileged information about other people, e.g. their mails, pictures, contact data, etc. You have a responsibility so why should you be allowed to reduce the security of your account?

Re: JavaScript is now required to sign in to Google

#297

Post by wild_preference »

GLjEI4YbnGD27LB wrote: post #269
mrep wrote: post #57

Earlier quoted context omitted.

Do you have a better solution for differentiating yourself as an actual user from a robot spammer?

There's a solution here that's being used in email. The user has to provide a proof of work.

Where is it being used?

Because the reason why https://en.wikipedia.org/wiki/Hashcash wasn't useful for anti-spam after all is because attackers have access to the cheapest compute in the world: botnets and devices that aren't their own.

Re: JavaScript is now required to sign in to Google

#298

Post by NullPrefix »

zuzun wrote: post #286
guest0001 wrote: post #274

"When your username and password are entered on Google’s sign-in page, we’ll run a risk assessment and only allow the sign-in if nothing looks suspicious." In my experience (it is already the case with gmail and outlook up and now), this means I will not be able to login to my account when in holiday in another city, country, or when I use a borrowed device, or when I am behind VPN/Tor, etc, unless I give google my p…

I also have no faith in their risk assessment. For a very long time I have only used one computer from one location to log into my Gmail account and every time I log in they consider it a suspicious activity. They even forced me to confirm my identity on my last login. What's their risk assessment doing if it can't get the baseline right?

What makes you think that their end goal wasn't getting your identity confirmed?

Re: JavaScript is now required to sign in to Google

#299

Post by Borealid »

dorgo wrote: post #293
aequitas wrote: post #275

Earlier quoted context omitted.

Javascript can be served dynamic as well, per user/connection specific even. So an attacker would have to investigate and counter each new version of the scripts. Even if this could be done automatic it greatly increases the cat/mouse factor for Google.

So, basically javascript is used for security through obscurity?

Can't you use Javascript to implement challenge-response authentication, which meaningfully improves security by:

1. Preventing interception of passwords on the wire

2. Allowing a tunable "difficulty" parameter which makes brute-force attacks cost ineffective

3. Requiring that brute-force attackers either run a Javascript interpreter (dangerous, because the web site chooses what they do and could make them mine Bitcoins) or rewrite their brute-forcer each time the JS-driven network communication channel is altered

It seems to me that having a client-and-server protocol beyond just "POST this data here" can be more secure than sending a password to the server for verification...

Re: JavaScript is now required to sign in to Google

#300

Post by wild_preference »

esotericn wrote: post #96
yetanotherjosh wrote: post #85

Earlier quoted context omitted.

Rate limiting login attempts means I can prevent you from logging in indefinitely by pushing your account into the rate limited status.

Only as long as you keep up the attack.

So your solution is "sorry, come back later when the attacker hopefully stops"?

I can keep you out of your account indefinitely with a curl loop and a rotation of proxies?

Post reply on HN