Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

431–440 of 529 posts

Re: JavaScript is now required to sign in to Google

#431

Post by msla »

mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

> Firstly, this isn't some weird ploy to boost ad revenue.

Everything Google does is a ploy to boost ad revenue. That's the whole business model.

> Without a doubt, it's being enforced for the first time due to some large account hijacking attack that has proven impossible to stop any other way. After so many years of bending over backwards to keep support for JS blocking users alive, it's presumably now become the weakest link in the digital Maginot line surrounding their network.

You're doing two things here:

1. Reasoning from no evidence, and ignoring a much simpler reason in the process.

2. Acting like the honest web users, the ones blocking malware-laden JS, are the ones who are wrong.

It's much simpler to conclude that Google engineers simply got lazy and decided to punt the hard work of security to some JS library, instead of looking at it honestly.

Re: JavaScript is now required to sign in to Google

#432

Post by drb91 »

danso wrote: post #424
gambler wrote: post #414

Earlier quoted context omitted.

Sorry, but at this point it is pretty obvious that big tech companies care about account security only as far as it impact their services. The late revelation about Facebook abusing 2FA phone numbers for marketing is a great demonstration of how that works. Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number. Even when those acc…

> Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number. Well yes, these kind of accounts are highly susceptible to being bot accounts. What obligation does Google have to be the place for people's free, anonymous accounts? In any case, I haven't had a problem with the number of secondary accounts I've created that are tied to me…

This is true. Google has explicitly never put the user first. We should be grateful to give them our information in the first place in the way they deem is best.

Re: JavaScript is now required to sign in to Google

#433

Post by joshstrange »

gambler wrote: post #414
mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

Sorry, but at this point it is pretty obvious that big tech companies care about account security only as far as it impact their services. The late revelation about Facebook abusing 2FA phone numbers for marketing is a great demonstration of how that works. Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number. Even when those acc…

> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA?

I'm not going to say that providing 2FA is "free" in the time sense (both in implementing it initially and supporting people who lock themselves out) but on the surface 2FA requires just a library to verify 2FA codes and a column in your users table to store the shared secret.

Re: JavaScript is now required to sign in to Google

#434

Post by CaptSpify »

StavrosK wrote: post #419
CaptSpify wrote: post #413

Earlier quoted context omitted.

Which self-hosted calendar do you use? would you recommend it? I'm in the market for a new one, but the current offerings that I've seen aren't great.

I use Radicale and find it great, but there's no UI, so you need to use whatever client you want that supports CalDAV (I use Lightning and the calendar on my phone). Lately I've been liking Nextcloud a lot, and that's a one-stop solution for lots of things, so nowadays I would recommend that if you have a home server or want to pay someone to host it.

Thanks!

I've looked at nextcloud, but IIRC, you have to have the whole suite installed, right? I'd love a way to just use the calendar function.

Re: JavaScript is now required to sign in to Google

#435

Post by danso »

drb91 wrote: post #432
danso wrote: post #424

Earlier quoted context omitted.

> Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number. Well yes, these kind of accounts are highly susceptible to being bot accounts. What obligation does Google have to be the place for people's free, anonymous accounts? In any case, I haven't had a problem with the number of secondary accounts I've created that are tied to me…

This is true. Google has explicitly never put the user first. We should be grateful to give them our information in the first place in the way they deem is best.

Sorry if I don't agree that giving Google a throwaway email address is a significant concession of personal information. Which free services do you recommend that do things better?

Re: JavaScript is now required to sign in to Google

#437

Post by StavrosK »

CaptSpify wrote: post #434
StavrosK wrote: post #419

Earlier quoted context omitted.

I use Radicale and find it great, but there's no UI, so you need to use whatever client you want that supports CalDAV (I use Lightning and the calendar on my phone). Lately I've been liking Nextcloud a lot, and that's a one-stop solution for lots of things, so nowadays I would recommend that if you have a home server or want to pay someone to host it.

Thanks! I've looked at nextcloud, but IIRC, you have to have the whole suite installed, right? I'd love a way to just use the calendar function.

Yeah, you do. As I said above, Fastmail's calendar is very good too, and you can load your self-hosted/CalDAV calendars into it, so that's a good option.

Re: JavaScript is now required to sign in to Google

#438

Post by 72deluxe »

horsawlarway wrote: post #421
nathan_long wrote: post #415

Earlier quoted context omitted.

> That said, I'd be willing to wager a fair bit that literally every line of code you've run on your machine (probably ever if it's been bought in the last few years) outside of the vendor installed OS and drivers came from the internet. We explicitly decide to install software and we know where we're getting it from. We may not be careful enough, but I certainly trust `brew install` a lot more than I trust a random…

I think this is a reversal of responsibility. You're shifting the responsibility from yourself to a different entity for the choices you're making. The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit. > I bought my car to drive it, but that doesn't mean that every person I pass on the street gets to drive my car. Damn right you don't let ra…

Are you aware how many requests pages make simply by visiting them? Hae you ran a DNS server and seen how many third-party sites get hit simply by visiting one news page, for example?

I would rather have more control over what gets scraped from who-knows-where and ran on my machine than not.

Re: JavaScript is now required to sign in to Google

#439

Post by sjapkee »

sjroot wrote: post #54
afandian wrote: post #35

Earlier quoted context omitted.

Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.

What version of Firefox are you running? You are either exaggerating greatly or have other issues with your system. I run the latest stable release of Firefox and the performance of Gmail (particularly the features you mention) is fine. I’d be happy to upload a screen recording to verify.

>and the performance of Gmail (particularly the features you mention) is fine

>ten seconds to load your inbox

>16 GB, i7, SSD, 100 MB/s internet etc.

>fine

Re: JavaScript is now required to sign in to Google

#440

Post by driverdan »

tomrittervg wrote: post #394
lordcorvin1 wrote: post #102

Earlier quoted context omitted.

If you enable privacy.resistFingerprinting in Firefox you automatically fail v3 Captcha with score 0.1 People who want to try it out: https://recaptcha-demo.appspot.com/recaptcha-v3-request-scor...

Thanks! I filed https://bugzilla.mozilla.org/show_bug.cgi?id=1503872 When we have time we'll have to trace through what it's doing and what components of RFP are causing the failure. (If anyone wants to do that and report in the bug, we (Mozilla/Tor) would much appreciate the contributions!)

Sounds like the feature is working exactly as intended and the problem is with reCAPTCHA.
Post reply on HN