JavaScript is now required to sign in to Google • Hacker News Board

Re: JavaScript is now required to sign in to Google

#451

Post by bgilroy26 » Thu, Nov 01, 2018, 4:30 PM UTC

joshstrange wrote: post #433

gambler wrote: post #414

Earlier quoted context omitted.

Sorry, but at this point it is pretty obvious that big tech companies care about account security only as far as it impact their services. The late revelation about Facebook abusing 2FA phone numbers for marketing is a great demonstration of how that works. Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number. Even when those acc…

> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? I'm not going to say that providing 2FA is "free" in the time sense (both in implementing it initially and supporting people who lock themselves out) but on the surface 2FA requires just a library to verify 2FA codes and a column in your users table to store the shared secret.

If a website is smaller it may not be sticky enough for a user to feel they get enough value to put in the effort to do 2FA

Re: JavaScript is now required to sign in to Google

#452

Post by antpls » Thu, Nov 01, 2018, 4:32 PM UTC

mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

> All mass account hijacking attacks rely on bots that either emulate or automate web browsers, and Google has a technology that has proven quite effective at detecting these tools

It sounds untrue and short-sighted. Even Google provides the tools for anyone to automatically navigate in a javascript-enabled website with Chrome Headless. All this will do is to provide a short-term security before the bots can again perfectly mimic humans with JavaScript enabled, this time.

Most "mass bots" can be stopped by logging the access attempts on the server side, with plain old HTML on the client side.

Re: JavaScript is now required to sign in to Google

#453

Post by danmg » Thu, Nov 01, 2018, 4:34 PM UTC

mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

Do you glow in the dark?

Re: JavaScript is now required to sign in to Google

#454

Post by cbkeller » Thu, Nov 01, 2018, 4:39 PM UTC

mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

Interesting to hear from someone involved.

> This is the login page - users are typing in a long term stable identifier already!

There are so many other considerations at work here though, and I can't imagine that they're not obvious to you as well? For starters, we're creatures of convenience, and this makes it significantly inconvenient to block google scripts on other websites even when not signed in. It also guarantees that you have the chance to produce a (likely unique) JS-based fingerprint of every google user that can then be used for correlation and de-anonymization of other data.

But really the most basic point that probably makes folks here suspicious: if this were really only about preventing malicious login attempts by bots, then why not give users a clear, explicitly stated choice: either JS or 2FA.

Re: JavaScript is now required to sign in to Google

#455

Post by Animats » Thu, Nov 01, 2018, 4:40 PM UTC

How long until you have to sign into Google to search?

They already pop up messages trying to trick you into logging in to "adjust your settings" or "improve your privacy" or some such.

Re: JavaScript is now required to sign in to Google

#456

Post by O_H_E » Thu, Nov 01, 2018, 4:41 PM UTC

NullPrefix wrote: post #298

zuzun wrote: post #286

Earlier quoted context omitted.

I also have no faith in their risk assessment. For a very long time I have only used one computer from one location to log into my Gmail account and every time I log in they consider it a suspicious activity. They even forced me to confirm my identity on my last login. What's their risk assessment doing if it can't get the baseline right?

What makes you think that their end goal wasn't getting your identity confirmed?

I don't think they are questioning Google's end goal, but more the effectiveness of the current system.

Re: JavaScript is now required to sign in to Google

#457

Post by Natanael_L » Thu, Nov 01, 2018, 4:42 PM UTC

gambler wrote: post #447

detuur wrote: post #444

Earlier quoted context omitted.

Yeah it's a bullshit argument. 2FA is a very cheap solution to a problem that could end up very expensive. If you can afford to (securely!) store account information and have a login infrastructure, 2FA is a minimal amount of effort to implement. You could add 2FA from scratch in less than 50 lines of code and one extra column in your account DB. There's no excuses.

>2FA is a very cheap solution If you don't know the technologies the website is built upon or how much it will be impacted by increased barrier of entry for users, this statement is baseless.

Who uses malbolge to create servers?

Re: JavaScript is now required to sign in to Google

#458

Post by Natanael_L » Thu, Nov 01, 2018, 4:45 PM UTC

z3t4 wrote: post #417

whack wrote: post #371

Earlier quoted context omitted.

Like the blog post mentioned, 99.9% of users already have JS enabled, and this number is only going to go up as websites rely more and more on JS. For them, this is a purely beneficial change, with no downsides. It's somewhat selfish for you to ask that your system be made more secure, even at the cost of security for 99.9% of other users.

I'm hijacking this thread to say we need a better ID system for the web! That preferably work without JS. Something built into browsers, that also allow you to create as many identities you want. When a id-signup header is detected, the user see a signup button, and can chose what information is sent to the web site/app. The user can login to any site with the push of a button, or even automatically. With a built in…

This is basically U2F

Re: JavaScript is now required to sign in to Google

#459

Post by dspillett » Thu, Nov 01, 2018, 4:45 PM UTC

aequitas wrote: post #354

dspillett wrote: post #334

Earlier quoted context omitted.

You risk setting up a little cold war that you probably don't have time for though... "Think you are clever, eh, try this for size..." -- some attackers in response to being affected by your counter measures.

Whats stopping that war from happening at any other time? If a attacker has the resources and carelessness to mount such an attack at a whim you should be prepared for it?

Nothing, but trying to hack them back seems like a way to invite more personal attention than your services might otherwise get.

Re: JavaScript is now required to sign in to Google

#460

Post by taeric » Thu, Nov 01, 2018, 4:46 PM UTC

mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

I'd be curious if the tools are only effective because of the fringe requirement of them. That is to say, right now, many malicious users are easy to spot using these, precisely because they don't have to be hard to spot.

That is to say, in the long run, it will be interesting if this actually reduces malicious use. Seems like it would be just as easy to avoid.