So many Google/Javascript shills in this thread.
Quick poll: how many of you rely on Javascript for your income?
JavaScript is now required to sign in to Google
461–470 of 529 posts
Re: JavaScript is now required to sign in to Google
#462Thank you Google for making me investigate alternatives.
I am serious, I've been using gmail since 2004.
I realize some day my main account is going to be permanently inaccessible just because I will be in the "wrong" country or will be using the wrong browser in the wrong cafe.
There should be no need for Javascript with proper 2FA.
Your algorithms already make me solve ridiculous captchas "some" of the time.
Re: JavaScript is now required to sign in to Google
#463When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…
Couldn't the attacker just switch to imap/pop3 for those attacks? (And (why )aren't they doing that already?)
pop3 / non-oauth imap login attempts are blocked unless the user has explicitly opted in to allow those protocols:
Re: JavaScript is now required to sign in to Google
#464"When your username and password are entered on Google’s sign-in page, we’ll run a risk assessment and only allow the sign-in if nothing looks suspicious." In my experience (it is already the case with gmail and outlook up and now), this means I will not be able to login to my account when in holiday in another city, country, or when I use a borrowed device, or when I am behind VPN/Tor, etc, unless I give google my p…
They're giving you a free account to burst out mails with. Your account will most likely contain a lot of private or privileged information about other people, e.g. their mails, pictures, contact data, etc. You have a responsibility so why should you be allowed to reduce the security of your account?
Because I "have a responsibility" if it is truly mine I should be allowed to.
But just as you said, they are giving it away for free, so it is technically theirs, we are not paying customers. (Except for G-Suite users)
Re: JavaScript is now required to sign in to Google
#465Earlier quoted context omitted.
> That said, I'd be willing to wager a fair bit that literally every line of code you've run on your machine (probably ever if it's been bought in the last few years) outside of the vendor installed OS and drivers came from the internet. We explicitly decide to install software and we know where we're getting it from. We may not be careful enough, but I certainly trust `brew install` a lot more than I trust a random…
I think this is a reversal of responsibility. You're shifting the responsibility from yourself to a different entity for the choices you're making. The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit. > I bought my car to drive it, but that doesn't mean that every person I pass on the street gets to drive my car. Damn right you don't let ra…
> The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit.
This would be accurate, if watering hole attacks[1] weren't a thing.
Re: JavaScript is now required to sign in to Google
#466Earlier quoted context omitted.
I think this is a reversal of responsibility. You're shifting the responsibility from yourself to a different entity for the choices you're making. The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit. > I bought my car to drive it, but that doesn't mean that every person I pass on the street gets to drive my car. Damn right you don't let ra…
Correct me if I'm wrong, but it seems that your personal philosophy places absoluely none of the onus for the internet being dangerous and unfriendly on the people who actually develop things for the internet. You instead blame the layman who has no power to control how websites are constructed. The heck?
I'd disagree entirely. I'd argue that I'm aware of how much effort has gone into making the web much, Much, MUCH more convenient and less risky for the average, day to day user.
It's frankly stunning how much the ecosystem has changed just over the last 5-10 years. And I mean that as a developer who works in the security industry with a focus on browsers/extensions. It's ludicrous how much more secure the web of today is over the web of the past.
That said, it's not yet secure. There's always a risk/reward decision for using the web, especially around HOW you - the user - uses the web.
So to make an analogy: The infrastructure in place between root authorities, the IETF, browser vendors, ISRG (Let's Encrypt is just one), and website developers has done a DAMN good job in making the web less vulnerable than it was.
It's a nicely paved two lane road that goes nearly everywhere.
That said, you are interacting with the entity hosting the site you visit, NOT THOSE GROUPS, when you visit a site.
It's your responsibility to make sure you trust that entity, and do your due diligence.
Just like I wouldn't try to drive my crappy 1998 Mazda Protege offroad - It's dangerous and I would be unprepared.
Its your responsibility to make decisions for yourself (or at least I fucking hope it is... that's a fundamental aspect of a democratic society that I STRONGLY believe in). That means living with the consequences.
It can also mean choosing different service providers that are less convenient if you deem the easy ones too risky. If you're not willing to do that (aka: switch away from gmail if you want js disabled everywhere) and you still want to complain... I find it hard to treat you seriously.
Re: JavaScript is now required to sign in to Google
#467Earlier quoted context omitted.
I think this is a reversal of responsibility. You're shifting the responsibility from yourself to a different entity for the choices you're making. The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit. > I bought my car to drive it, but that doesn't mean that every person I pass on the street gets to drive my car. Damn right you don't let ra…
Are you aware how many requests pages make simply by visiting them? Hae you ran a DNS server and seen how many third-party sites get hit simply by visiting one news page, for example? I would rather have more control over what gets scraped from who-knows-where and ran on my machine than not.
You have that control.
You have not lost that control.
Why does this matter in the context of this discussion?
If you choose to visit that news site, you're trusting their web developers. You can always manually go and setup tools and systems to block those 3rd party requests (like I mentioned earlier, an ad blocker is a great first step, because it's easy and automatic). If you're not willing to take those steps...
Don't use the site.
Re: JavaScript is now required to sign in to Google
#468I think this is a really braindead argument. Of course users are going to use javascript more, the more the internet demands it, the more people will be willing to allow it. When I first started using noscript there were few exceptional sites which didn’t work and I didn’t bother with them after, if that was the majority of sites, I would probably just disable noscript. The idea that I _have_ to let your site run cod…
We detached this subthread from https://news.ycombinator.com/item?id=18353373.
Re: JavaScript is now required to sign in to Google
#469How is this nonsense upvoted on hackernews..?
We detached this subthread from https://news.ycombinator.com/item?id=18350261 and marked it off-topic. Could you please stop posting angry meta muck like this?
Re: JavaScript is now required to sign in to Google
#470Earlier quoted context omitted.
I think this is a reversal of responsibility. You're shifting the responsibility from yourself to a different entity for the choices you're making. The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit. > I bought my car to drive it, but that doesn't mean that every person I pass on the street gets to drive my car. Damn right you don't let ra…
> The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit. This would be accurate, if watering hole attacks[1] weren't a thing. [1]: https://en.wikipedia.org/wiki/Watering_hole_attack
Nope, it's still accurate. There are always risks. This is one (it's not a common one, but it's a risk).
To reframe - my statement is akin to saying: the single safest thing you can do while driving is to pay attention to the road.
And you responding with: "This would be accurate, if trees falling on you weren't a thing."
Sure it's a risk, it's not the primary risk.