Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

421–430 of 529 posts

Re: JavaScript is now required to sign in to Google

#421

Post by horsawlarway »

nathan_long wrote: post #415
horsawlarway wrote: post #400

Earlier quoted context omitted.

Sorry, but you're out of touch. Almost everyone wants the features that JS enables. Literally: Almost everyone. I understand you don't, and I absolutely respect that decision, but it means that you're not worth developing for. Full stop. It's not a matter of mal-intent, it's a matter of financial logistics. You bought that machine to run code. If you don't want to run code that sites serve you on the internet, don't…

> That said, I'd be willing to wager a fair bit that literally every line of code you've run on your machine (probably ever if it's been bought in the last few years) outside of the vendor installed OS and drivers came from the internet. We explicitly decide to install software and we know where we're getting it from. We may not be careful enough, but I certainly trust `brew install` a lot more than I trust a random…

I think this is a reversal of responsibility. You're shifting the responsibility from yourself to a different entity for the choices you're making.

The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit.

> I bought my car to drive it, but that doesn't mean that every person I pass on the street gets to drive my car.

Damn right you don't let random people drive your car! just like I expect you not to click every link you see!

I'd also love it if you'd install an ad blocker, remove just about every other extension you have in your browser (ABSOLUTELY do this for old firefox extensions and IE BHOs) and trust your browser when it tells you that maybe visiting that particular site isn't the best idea.

That said, modern browsers do a really, really good job at isolating the code running in that page from anything you care about.

Re: JavaScript is now required to sign in to Google

#422

Post by [deleted] »

horsawlarway wrote: post #416
dijit wrote: post #412

Earlier quoted context omitted.

Wow, I'm sorry... are you trolling? This thread is about google forcing everyone to use javascript to use their services. That's literally the topic of conversation. EDIT: I'm not allowed to post because of downvotes, to reply to the child: I am not forced to use google, no, but I don't think I'd get very far on todays internet without javascript. Google are enabling that: Now people will say "Oh, well google are abl…

You're talking about a service that this company provides at no charge. No one is forcing anyone to use these services. If you don't like that, go somewhere else. No one is holding a gun to your head and going "RUN JS OR I SHOOT!". Why do you assume that you, and the people you claim to be advocating for, are able to compel this entirely separate entity, making a decision it believes is best for the majority of it's…

[deleted]

Re: JavaScript is now required to sign in to Google

#423

Post by plankers »

z3t4 wrote: post #417
whack wrote: post #371

Earlier quoted context omitted.

Like the blog post mentioned, 99.9% of users already have JS enabled, and this number is only going to go up as websites rely more and more on JS. For them, this is a purely beneficial change, with no downsides. It's somewhat selfish for you to ask that your system be made more secure, even at the cost of security for 99.9% of other users.

I'm hijacking this thread to say we need a better ID system for the web! That preferably work without JS. Something built into browsers, that also allow you to create as many identities you want. When a id-signup header is detected, the user see a signup button, and can chose what information is sent to the web site/app. The user can login to any site with the push of a button, or even automatically. With a built in…

This is brilliant! Has the IETF put out any proposals for a standard of this sort or is this just an idea you had?

Re: JavaScript is now required to sign in to Google

#424

Post by danso »

gambler wrote: post #414
mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

Sorry, but at this point it is pretty obvious that big tech companies care about account security only as far as it impact their services. The late revelation about Facebook abusing 2FA phone numbers for marketing is a great demonstration of how that works. Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number. Even when those acc…

> Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number.

Well yes, these kind of accounts are highly susceptible to being bot accounts. What obligation does Google have to be the place for people's free, anonymous accounts? In any case, I haven't had a problem with the number of secondary accounts I've created that are tied to me only by another email address (which can point to another provider, like Yahoo).

> BTW, it is worth noting that the impact of a compromised account isn't nearly as significant if a single account doesn't hold keys to pretty much everything you do online. Somehow this is rarely factored in during such discussions.

How should this be factored into the current discussion? The use of JS is to ostensibly make it more difficult for automated hijacking to prey on users.

Re: JavaScript is now required to sign in to Google

#425

Post by mqus »

mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

Couldn't the attacker just switch to imap/pop3 for those attacks? (And (why )aren't they doing that already?)

Re: JavaScript is now required to sign in to Google

#426

Post by diminoten »

hueving wrote: post #268
diminoten wrote: post #224

Earlier quoted context omitted.

No, it's not. The lack of availability of guns is the sandbox, the cultural more of not killing people is the access controls. "Bulletproof vest" in this analogy is "extraordinary activity designed to keep you safe". You don't "wear a bulletproof vest" (a stand-in for "take extraordinary measures") to prevent yourself from "getting shot" (a stand-in for "thing that happens very rarely"). In other words, your assessme…

I'm not sure you understand how many entities are trying to get into your computer to track you/steal data/mine bitcoin/etc. These are active attacks against your computer every day if you are a regular user clicking viral shit on Facebook, random ads for things, etc. Look at how many 3rd party JS libraries get loaded from remote sites for metrics, frameworks, tracking, ads, etc for something like a newspaper site. T…

And I'm not sure how secure I am against those entities. There are active and unsuccessful attacks against my computer every day, and none of those attacks rely exclusively on running JavaScript in a browser sandbox.

Re: JavaScript is now required to sign in to Google

#427

Post by plankers »

horsawlarway wrote: post #421
nathan_long wrote: post #415

Earlier quoted context omitted.

> That said, I'd be willing to wager a fair bit that literally every line of code you've run on your machine (probably ever if it's been bought in the last few years) outside of the vendor installed OS and drivers came from the internet. We explicitly decide to install software and we know where we're getting it from. We may not be careful enough, but I certainly trust `brew install` a lot more than I trust a random…

I think this is a reversal of responsibility. You're shifting the responsibility from yourself to a different entity for the choices you're making. The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit. > I bought my car to drive it, but that doesn't mean that every person I pass on the street gets to drive my car. Damn right you don't let ra…

Correct me if I'm wrong, but it seems that your personal philosophy places absoluely none of the onus for the internet being dangerous and unfriendly on the people who actually develop things for the internet. You instead blame the layman who has no power to control how websites are constructed.

The heck?

Re: JavaScript is now required to sign in to Google

#428

Post by diminoten »

shakna wrote: post #234
diminoten wrote: post #98

Earlier quoted context omitted.

Yeah, because permissions, sandboxing, and access controls don't exist. Oh wait, they do, and they work, so you're wrong.

> and they work ... They break about as often as they work. [0][1] There are a lot of vulnerabilities that appear in web browser protections, and almost all of them get exploited via JavaScript. Running untrusted software is not safe. [0] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox

This is factually incorrect. It is entirely safe to run JavaScript in your browser. Your definition of "a lot" doesn't fit this conversation, because it doesn't represent constant and regular vulnerabilities.

Browsers are very safe. Not perfectly safe, but very safe. Thinking otherwise is paranoia, just like not running JavaScript by default in your browser is paranoid.

Re: JavaScript is now required to sign in to Google

#429

Post by mrep »

z3t4 wrote: post #417
whack wrote: post #371

Earlier quoted context omitted.

Like the blog post mentioned, 99.9% of users already have JS enabled, and this number is only going to go up as websites rely more and more on JS. For them, this is a purely beneficial change, with no downsides. It's somewhat selfish for you to ask that your system be made more secure, even at the cost of security for 99.9% of other users.

I'm hijacking this thread to say we need a better ID system for the web! That preferably work without JS. Something built into browsers, that also allow you to create as many identities you want. When a id-signup header is detected, the user see a signup button, and can chose what information is sent to the web site/app. The user can login to any site with the push of a button, or even automatically. With a built in…

> The contact list can even be inside the browser, and web site's can ask for it, allowing for example white-listing in messenger apps, or let the user pick who are allowed to see their family pictures, etc.

How would that work for sites like Hacker news, reddit, and twitter? Does every single user have to preview and approve every single other user on the website? That doesn't scale at all.

Re: JavaScript is now required to sign in to Google

#430

Post by izacus »

hpcjoe wrote: post #401
mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

"Google had the ability to enforce a JS-required rule on login at least 6 years ago and never used it until now." Um ... this should terrify everyone. 'We had the power to impose this, and we graciously chose not to. You should be thankful for what we have done.' No. Just ... no.

What exactly? The fact that login owner can change the login system at any point?
Post reply on HN