Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

361–370 of 529 posts

Re: JavaScript is now required to sign in to Google

#361

Post by zbentley »

dorgo wrote: post #317
Borealid wrote: post #299

Earlier quoted context omitted.

Can't you use Javascript to implement challenge-response authentication, which meaningfully improves security by: 1. Preventing interception of passwords on the wire 2. Allowing a tunable "difficulty" parameter which makes brute-force attacks cost ineffective 3. Requiring that brute-force attackers either run a Javascript interpreter (dangerous, because the web site chooses what they do and could make them mine Bitco…

>1. Preventing interception of passwords on the wire Isn't this solved by https? I have no idea, but I hope at least that https protects my passwords. >2. Allowing a tunable "difficulty" parameter which makes brute-force attacks cost ineffective I don't want to wait for a login more than a second. Actually, I don't want to wait at all. >3. ... or rewrite their brute-forcer each time the JS-driven network communicatio…

> Actually, I don't want to wait at all.

Neither do I. But I also accept that, given the sheer volume of stolen creds and bots out there, sites that damage their bang/buck performance, even at the cost of very minor inconvenience to users, are likely to be targeted less frequently and in lower volume. Even if I wasn't begrudgingly willing to pay that price, I'd at least admit to the logic of making the process more time-consuming as a deterrent.

Re: JavaScript is now required to sign in to Google

#362

Post by protonmail »

omnimus wrote: post #348
tyfon wrote: post #70

Earlier quoted context omitted.

I have a lot of issues with google apps for business. Sometimes I have to refresh the browser 5-6 times before it will display any email in the primary inbox as well. It's just horrible to use in firefox (in arch linux) and I'm currently looking for a new provider. I might just go all in and use protonmail.

Protonmail is great but doesnt offer custom domains. If you need domains people mostly mention fastmail but i think there are far better choices like mailbox.org and kolabnow. Mailbox does not look like much from their homepage but it has awesome web client and it extremly reliable private provider thats in bussiness from 90s. I had account there for last 5 years without single problem.

This is actually not quite right, we have offered custom domain support since 2016 :)

https://protonmail.com/support/knowledge-base/custom-domain-...

Re: JavaScript is now required to sign in to Google

#363

Post by esotericn »

wild_preference wrote: post #287
brunoTbear wrote: post #105

Earlier quoted context omitted.

I think you may be giving people more credit than they deserve, but I'm willing to accept that they're making that argument. Even if that's their argument, that their personal habits around password use and being attentive to not being phished are so good they don't need Google's help defending themselves, so bully for everyone who does, I'm not convinced it's a good one. There are a few things needed for that to be…

> I think the sad truth is that computer engagement is required, but literacy is optional. You're right on, but I wouldn't call it sad. The population is expected to operate vehicles without putting others in danger, not credentialize in how cars work. There are endless amounts of things we could demand people spend their precious time deeply understanding. We just like to demand tech-savviness because it's self-aggr…

> The population is expected to operate vehicles without putting others in danger, not credentialize in how cars work.

Exactly! We require "car literacy" in drivers before we allow them to use them. Pretty much every advanced economy has mandatory driver licensing.

A driver can trivially press a few levers and slam themselves into a barrier at 100mph. But they don't do that, because they know, through experience and education, that it's a terrible idea.

That's the exact opposite of the approach that would have cars restrict their own usage into a narrow set of patterns and refuse to function otherwise.

WRT the last half of your comment: I think that's reasonable. Generating random passwords for users is a fair approach.

Account security exists on a spectrum. I don't think anyone (reasonable) is arguing against that, we're talking about mutable state here, actual _actions_.

What I'm railing against, is this idea that every webpage on the internet needs to be behind a CAPTCHA that does a bunch of invasive data collection including probably asking the user to perform a Mechanical Turk task in order to _access a website_ without even logging in.

It happens all the time. A website doesn't like my IP block -> forced through a bunch of nonsense. The site operator probably isn't even aware because they're using an upstream service which does it for them.

Re: JavaScript is now required to sign in to Google

#366

Post by lima »

userbinator wrote: post #351
mike_hearn wrote: post #325

Earlier quoted context omitted.

Ah, you're assuming it's the same strength on all places it's used - and also that it actually has been bypassed. There didn't used to be any public bots that can beat the strongest version and from a quick Googling around I don't see that it's changed. Someone took apart a single program manually, years ago, but the programs are randomly generated and constantly evolve. So that's not sufficient to be able to bypass…

It's a lot faster and more scalable to not automate a full web browser. Bot developers would rather not do it, they only do because they're forced to. Forced to ... by requiring Javascript, like this. In other words, the bot developers are still getting through, and meanwhile it's the actual humans who don't want JS which get screwed. Reminds me of DRM... honest customers are the most inconvenienced, while crackers s…

Javascript allows them to identify bots who automate a full web browser.

Re: JavaScript is now required to sign in to Google

#367

Post by arendtio »

When Javascript becomes the new pillar of security something has gone terribly wrong.

Background: I love building Single Page Applications, Progressive Web Apps and have JS always enabled. So no hate for JS in general, but when your security depends on the correct evaluation on the client side, you are starting a dangerous cat and mouse game.

Re: JavaScript is now required to sign in to Google

#368

Post by somecallitblues »

mysterydip wrote: post #316
mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

I understand what you're saying and it makes sense. I think in my mind it's the fact that javascript has the potential to do so many things, not that it's being used that way today. To use a bad car analogy, the in-car entertainment used to be just a dumb radio. Now that it's a computer connected to the main car network, it has a lot more potential to do things, whether it's a feature, bug, or an exploit.

That was indeed some shit analogy.

Re: JavaScript is now required to sign in to Google

#369

Post by Jonnax »

ifdefdebug wrote: post #278
brunoTbear wrote: post #41

ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…

So what about a opt-out at account level? Something in the account settings, like this: [check] Allow sign-in from javascript disabled browsers. WARNING etc. (usual warnings about security etc.) Edit: because users who know to use long passwords and 2FA do exist and don't need all that extra security stuff ...

It costs money to support and a miniscule amount of users would care.

The majority of Google's customers also don't pay for an account.

Re: JavaScript is now required to sign in to Google

#370

Post by kakarot »

We can argue back and forth about the pros and cons of requiring JS. But one thing we can't argue about is the loss of security for political dissidents and other non-protected groups who access Gmail or other Google services through systems like Tor.

No, this isn't Google's problem, but it illuminates what kind of purpose Google believes its products should serve, and what kind of people it should serve.

Post reply on HN