Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

Post reply on HN
Print view View original

491–500 of 529 posts

Re: JavaScript is now required to sign in to Google

#491

Post by joshstrange »

mrguyorama wrote: post #488
joshstrange wrote: post #433

Earlier quoted context omitted.

> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? I'm not going to say that providing 2FA is "free" in the time sense (both in implementing it initially and supporting people who lock themselves out) but on the surface 2FA requires just a library to verify 2FA codes and a column in your users table to store the shared secret.

The one thing I dislike about 2FA as a user is, if I drop my phone in a lake, can I safely recover my account? I have a lot of time, money, effort, etc invested in my accounts, and I really don't want to lose that

If you use something like Authy or 1Password to store your 2FA tokens then they aren't lost if you lose the phone. Does this mean a single point of failure and in someways undermine the use-case for 2FA? Sure but as with all things security you need to decide where on the spectrum you want to be. It's a game of trading security for usability base on what your situation requires.

Re: JavaScript is now required to sign in to Google

#492

Post by joshstrange »

bgilroy26 wrote: post #451
joshstrange wrote: post #433

Earlier quoted context omitted.

> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? I'm not going to say that providing 2FA is "free" in the time sense (both in implementing it initially and supporting people who lock themselves out) but on the surface 2FA requires just a library to verify 2FA codes and a column in your users table to store the shared secret.

If a website is smaller it may not be sticky enough for a user to feel they get enough value to put in the effort to do 2FA

That's totally fair, but you don't have to force 2FA on your users.

Re: JavaScript is now required to sign in to Google

#493

Post by shittyadmin »

danso wrote: post #435
drb91 wrote: post #432

Earlier quoted context omitted.

This is true. Google has explicitly never put the user first. We should be grateful to give them our information in the first place in the way they deem is best.

Sorry if I don't agree that giving Google a throwaway email address is a significant concession of personal information. Which free services do you recommend that do things better?

You can't give it a throwaway email address - they want your phone number now and will accept nothing less in my experience.

If that doesn't appear true for you, try over Tor and you'll see what happens to many people...

Re: JavaScript is now required to sign in to Google

#494

Post by OJFord »

athorax wrote: post #474
OJFord wrote: post #473

Earlier quoted context omitted.

Then just get your wallet out to use the ATM in the dodgy neighbourhood and put it away again. You just need your wallet for the ATM in the dodgy neighbourhood.

How else are you supposed to get to your money?

You go elsewhere.

Re: JavaScript is now required to sign in to Google

#495

Post by floatboth »

dorgo wrote: post #317
Borealid wrote: post #299

Earlier quoted context omitted.

Can't you use Javascript to implement challenge-response authentication, which meaningfully improves security by: 1. Preventing interception of passwords on the wire 2. Allowing a tunable "difficulty" parameter which makes brute-force attacks cost ineffective 3. Requiring that brute-force attackers either run a Javascript interpreter (dangerous, because the web site chooses what they do and could make them mine Bitco…

>1. Preventing interception of passwords on the wire Isn't this solved by https? I have no idea, but I hope at least that https protects my passwords. >2. Allowing a tunable "difficulty" parameter which makes brute-force attacks cost ineffective I don't want to wait for a login more than a second. Actually, I don't want to wait at all. >3. ... or rewrite their brute-forcer each time the JS-driven network communicatio…

> I don't want to wait for a login more than a second.

Do you log in that often?

Re: JavaScript is now required to sign in to Google

#496

Post by pharrington »

mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

It's unfortunate that your work is being used in such a massively economically wasteful manner.

The core issue is - it's all computers. The reason you can't reliably detect the difference between an average user using a computer to log in to your computer versus a fairly sophisticated computer using a computer to log in to your computer is that the transition between user and tool is not smooth. It is always going to be easier to find the various boundary points between user and tool than it is to construct a passable simulation of the user using that tool.

Yes, bot detection does make account hijacking attempts more expensive, but it makes all logins more expensive, and the rate of expense increases faster for you than it does the account hijackers.

Re: JavaScript is now required to sign in to Google

#497

Post by [deleted] »

mike_hearn wrote: post #311

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiri…

[deleted]

Re: JavaScript is now required to sign in to Google

#498

Post by proneb1rd »

shittyadmin wrote: post #493
danso wrote: post #435

Earlier quoted context omitted.

Sorry if I don't agree that giving Google a throwaway email address is a significant concession of personal information. Which free services do you recommend that do things better?

You can't give it a throwaway email address - they want your phone number now and will accept nothing less in my experience. If that doesn't appear true for you, try over Tor and you'll see what happens to many people...

I am surprised to see a long thread about nothing. Google does force you to give them your phone number and they do not let you register new emails after you hit some limit.

Re: JavaScript is now required to sign in to Google

#499

Post by proneb1rd »

mrguyorama wrote: post #488
joshstrange wrote: post #433

Earlier quoted context omitted.

> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? I'm not going to say that providing 2FA is "free" in the time sense (both in implementing it initially and supporting people who lock themselves out) but on the surface 2FA requires just a library to verify 2FA codes and a column in your users table to store the shared secret.

The one thing I dislike about 2FA as a user is, if I drop my phone in a lake, can I safely recover my account? I have a lot of time, money, effort, etc invested in my accounts, and I really don't want to lose that

You can write down on paper the private key you get when enabling 2FA. Some providers also give you a list of recovery keys.

Re: JavaScript is now required to sign in to Google

#500

Post by colemickens »

jgaa wrote: post #344
colemickens wrote: post #146

I try hard not to be a luddite as I age, but this level of automation and machine learning is so concerning. It is SO frustrating to accidentally appear as a bot and get stuck at the mercy of an automated system. I was on some random site the other day and spent 3+ minutes solving Captchas until it finally let me through. I thought I was losing my mind. I don't spam, I don't automate queries, I come from an IP that h…

Google captchas appears (to me) to be designed to identify individuals, not to separate anonymous users from machines. Google want to know exactly who you are, when they harvest your visits and behavior on almost all sites on the Internet.

I don't understand what this has to do with the fact that I repeatedly am having to prove that I'm not a bot despite doing nothing that ought to be triggering Captcha checks.

But hey, I guess mentioning this simple observation is worthy of numerous downvotes here. Always lovely.

Post reply on HN