Live data from Hacker News

JavaScript is now required to sign in to Google

security.googleblog.com

501–510 of 529 posts

Re: JavaScript is now required to sign in to Google

#502
post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

> Sorry, you don't have enough Google Points In the past few months all our domestic devices have gradually hit that notional condition with Google Search. All the laptops one by one, and then last night my phone. My wife's phone is the only one that can still use their search without a ten-round Recaptcha challenge. As each device was locked-out from Google I switched the default over to DDG.

Me too. Its creepy being locked out of half the internet for daring to block ad servers.

Re: JavaScript is now required to sign in to Google

#503

I try hard not to be a luddite as I age, but this level of automation and machine learning is so concerning. It is SO frustrating to accidentally appear as a bot and get stuck at the mercy of an automated system. I was on some random site the other day and spent 3+ minutes solving Captchas until it finally let me through. I thought I was losing my mind. I don't spam, I don't automate queries, I come from an IP that h…

I get this constantly. Its the new digital ghetto google has created.

Re: JavaScript is now required to sign in to Google

#504
post #54

Earlier quoted context omitted.

What version of Firefox are you running? You are either exaggerating greatly or have other issues with your system. I run the latest stable release of Firefox and the performance of Gmail (particularly the features you mention) is fine. I’d be happy to upload a screen recording to verify.

>and the performance of Gmail (particularly the features you mention) is fine >ten seconds to load your inbox >16 GB, i7, SSD, 100 MB/s internet etc. >fine

Exactly what I was thinking. How is that even close to fine? WTF?

Re: JavaScript is now required to sign in to Google

#505
post #9

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

reCAPTCHA can go frick off into a hole. I've stopped using all websites that use reCaptcha because it takes me sometimes 10 minutes to login to them. I also don't feel right providing free data so Google can help a military drone bomb children on busses one day. I miss old captchas.

> I also don't feel right providing free data so Google can help a military drone bomb children on busses one day.

reCAPTCHA v4: please click on all the pictures of insurgents.

Re: JavaScript is now required to sign in to Google

#506
post #417

Earlier quoted context omitted.

I'm hijacking this thread to say we need a better ID system for the web! That preferably work without JS. Something built into browsers, that also allow you to create as many identities you want. When a id-signup header is detected, the user see a signup button, and can chose what information is sent to the web site/app. The user can login to any site with the push of a button, or even automatically. With a built in…

This is brilliant! Has the IETF put out any proposals for a standard of this sort or is this just an idea you had?

Chrome supports U2F and that is basically a client cert based ID. But yes, the browser should be able to manage identities on a per domain basis.

Re: JavaScript is now required to sign in to Google

#507
post #486
post #446

Earlier quoted context omitted.

In a certain sense this existed with the ` ` element ( https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ke... ) which is unfortunately deprecated. But you still have all the same issues of moving and safeguarding key material. These days with browser/mobile sync, maybe it's actually possible. But like a synced password manager, it makes a primary account breach that much more devastating.

The problem with certificates is they require a central authority, eg. politics. We need something that can work anywhere, without any third party or central authority.

There's nothing about specifically that requires a central signing authority. You could just as well generate a public/private pair, feed the website your public key, and sign challenges with the privkey to log in.

Re: JavaScript is now required to sign in to Google

#508
post #507
post #486

Earlier quoted context omitted.

The problem with certificates is they require a central authority, eg. politics. We need something that can work anywhere, without any third party or central authority.

There's nothing about specifically that requires a central signing authority. You could just as well generate a public/private pair, feed the website your public key, and sign challenges with the privkey to log in.

You can also create a public-private key pair using JavaScript. Only problem is that when you go to another site, it wont let you identify yourself using the public key you generated on another site. And the browser won't answer the challenge automatically. Lets say we make a browser plugin, as a proof of concept. Then when it has "product market fit" browsers can make it a built in functionality. It will however be hard to ask a user to install a plugin, just to signup/identify to your site/app.

Re: JavaScript is now required to sign in to Google

#509

Earlier quoted context omitted.

I’m a little surprised to read this because Google Mail works fine for me in Firefox (ArchLinux). In fact it’s smoother than some of the Electron-based clients I’ve tried and less painful than trying to get push messages on Thunderbird working (sure, there is always IMAP but that requires regular fetches).

FIY, IMAP actually allows "push messages" via the IDLE extension. If you use K9 on android, it's enabled by default. I never used gmail, but I'd be surprised if the gmail imap server didn't support it (and I would dismiss gmail entirely if it didn't).

Is this a new thing? I don't recall seeing an option for that in Thunderbird (desktop version by the way; not the mobile / Android version) the last time I looked (~9 months ago).

Re: JavaScript is now required to sign in to Google

#510
post #435
post #432

Earlier quoted context omitted.

This is true. Google has explicitly never put the user first. We should be grateful to give them our information in the first place in the way they deem is best.

Sorry if I don't agree that giving Google a throwaway email address is a significant concession of personal information. Which free services do you recommend that do things better?

[deleted]
Post reply on HN