Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

441–450 of 529 posts

Re: JavaScript is now required to sign in to Google

#441

Post by mikepurvis »

plankers wrote: post #423
z3t4 wrote: post #417

Earlier quoted context omitted.

I'm hijacking this thread to say we need a better ID system for the web! That preferably work without JS. Something built into browsers, that also allow you to create as many identities you want. When a id-signup header is detected, the user see a signup button, and can chose what information is sent to the web site/app. The user can login to any site with the push of a button, or even automatically. With a built in…

This is brilliant! Has the IETF put out any proposals for a standard of this sort or is this just an idea you had?

Unsure if sarcasm, but OpenID has been a thing for over ten years, and the only place it's ever gained significant traction is with Facebook and Google as the providers: https://en.wikipedia.org/wiki/OpenID#History

Other than StackExchange, I can think of no other major site who looked at the over-engineered protocol, the implementation headaches, the confusing user experience (nascar board of provider logos), and said "yes, that is definitely what we want to have rather than a validated user email address."

Re: JavaScript is now required to sign in to Google

#442

Post by nova22033 »

xg15 wrote: post #358
mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

Javascript ist also required for the vast majority of web-based exploits. I find it somewhat strange that you ask me to make my system less secure so you can better secure my account.

> Javascript ist also required for the vast majority of web-based exploits.

So are browsers...

Re: JavaScript is now required to sign in to Google

#444

Post by detuur »

joshstrange wrote: post #433
gambler wrote: post #414

Earlier quoted context omitted.

Sorry, but at this point it is pretty obvious that big tech companies care about account security only as far as it impact their services. The late revelation about Facebook abusing 2FA phone numbers for marketing is a great demonstration of how that works. Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number. Even when those acc…

> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? I'm not going to say that providing 2FA is "free" in the time sense (both in implementing it initially and supporting people who lock themselves out) but on the surface 2FA requires just a library to verify 2FA codes and a column in your users table to store the shared secret.

Yeah it's a bullshit argument. 2FA is a very cheap solution to a problem that could end up very expensive. If you can afford to (securely!) store account information and have a login infrastructure, 2FA is a minimal amount of effort to implement. You could add 2FA from scratch in less than 50 lines of code and one extra column in your account DB. There's no excuses.

Re: JavaScript is now required to sign in to Google

#445

Post by [deleted] »

ihuman wrote: post #382
xg15 wrote: post #358

Earlier quoted context omitted.

Javascript ist also required for the vast majority of web-based exploits. I find it somewhat strange that you ask me to make my system less secure so you can better secure my account.

Then just turn Javascript on to log in, then turn it back off again. You just need Javascript for the sign-on page.

[deleted]

Re: JavaScript is now required to sign in to Google

#446

Post by STRML »

z3t4 wrote: post #417
whack wrote: post #371

Earlier quoted context omitted.

Like the blog post mentioned, 99.9% of users already have JS enabled, and this number is only going to go up as websites rely more and more on JS. For them, this is a purely beneficial change, with no downsides. It's somewhat selfish for you to ask that your system be made more secure, even at the cost of security for 99.9% of other users.

I'm hijacking this thread to say we need a better ID system for the web! That preferably work without JS. Something built into browsers, that also allow you to create as many identities you want. When a id-signup header is detected, the user see a signup button, and can chose what information is sent to the web site/app. The user can login to any site with the push of a button, or even automatically. With a built in…

In a certain sense this existed with the `` element (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ke...) which is unfortunately deprecated. But you still have all the same issues of moving and safeguarding key material.

These days with browser/mobile sync, maybe it's actually possible. But like a synced password manager, it makes a primary account breach that much more devastating.

Re: JavaScript is now required to sign in to Google

#447

Post by gambler »

detuur wrote: post #444
joshstrange wrote: post #433

Earlier quoted context omitted.

> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? I'm not going to say that providing 2FA is "free" in the time sense (both in implementing it initially and supporting people who lock themselves out) but on the surface 2FA requires just a library to verify 2FA codes and a column in your users table to store the shared secret.

Yeah it's a bullshit argument. 2FA is a very cheap solution to a problem that could end up very expensive. If you can afford to (securely!) store account information and have a login infrastructure, 2FA is a minimal amount of effort to implement. You could add 2FA from scratch in less than 50 lines of code and one extra column in your account DB. There's no excuses.

>2FA is a very cheap solution

If you don't know the technologies the website is built upon or how much it will be impacted by increased barrier of entry for users, this statement is baseless.

Re: JavaScript is now required to sign in to Google

#448

Post by ValentineC »

ifdefdebug wrote: post #278
brunoTbear wrote: post #41

ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…

So what about a opt-out at account level? Something in the account settings, like this: [check] Allow sign-in from javascript disabled browsers. WARNING etc. (usual warnings about security etc.) Edit: because users who know to use long passwords and 2FA do exist and don't need all that extra security stuff ...

> So what about a opt-out at account level? Something in the account settings, like this:

> [check] Allow sign-in from javascript disabled browsers. WARNING etc. (usual warnings about security etc.)

It sounds a bit like what Gmail's doing with their "allow less secure apps" login option, except that's more for allowing IMAP logins using password instead of OAuth.

Re: JavaScript is now required to sign in to Google

#449

Post by Operyl »

ndnxhs wrote: post #250
Operyl wrote: post #34

Earlier quoted context omitted.

Google is dictating how signing into their account system on their properties works, not login forms for _every single site_.

Google is quickly becoming the login form for every website. And even if the website has its own login it will always have recaptca

I wouldn't blame Google for this phenomenon, though. They provided a solution, others were quick to jump to and use said solution. Might be better to complain to the sites following the herd then?

Re: JavaScript is now required to sign in to Google

#450

Post by CivBase »

tetromino_ wrote: post #226
CivBase wrote: post #161

Yah, but what if I want to be able to log into my account using a script? I know I'm in a tiny minority, but I have on several occasions had to use selenium to automate actions on a web app. For this reason, captchas are similarly annoying to me.

If you want to automate your actions, you should get an API key and use the official APIs.

I wish official APIs were available for everything I want to do.
Post reply on HN