I hate the smartphone app trend of having embedded browsers. Just launch me to my preferred real browser. Stop trying to trap us in your ecosystem.
Never mind carrying around 6 copies of Chrome on your phone
Guidance to developers affected by effort to block less secure browsers, apps
21–30 of 165 posts
Re: Guidance to developers affected by effort to block less secure browsers, apps
#22This has nothing to do with security and everything to do with banning tools like youtube-dl, wget and others; from the post: > The browser must identify itself clearly in the User-Agent. The browser must not try to impersonate another browser like Chrome or Firefox. > The browser must not provide automation features. This includes scripts that automate keystrokes or clicks, especially to perform automatic sign-ins.…
> To protect our users from these types of attacks Google Account sign-ins from all embedded frameworks will be blocked starting on January 4, 2021.
(emphasis mine)
So I don't follow how this would have anything to do with banning youtube-dl, which doesn't require login? And as the blog post mentions, you can still bootstrap auth through a normal web browser, and pass the auth token to your command line / less secure browser / ... app.
(Disclaimer: I work at Google, not on anything related to this blog post or to your hypothetical scenario.)
Re: Guidance to developers affected by effort to block less secure browsers, apps
#23Dear god I'm glad I got my crap off of google.
Re: Guidance to developers affected by effort to block less secure browsers, apps
#24This has nothing to do with security and everything to do with banning tools like youtube-dl, wget and others; from the post: > The browser must identify itself clearly in the User-Agent. The browser must not try to impersonate another browser like Chrome or Firefox. > The browser must not provide automation features. This includes scripts that automate keystrokes or clicks, especially to perform automatic sign-ins.…
If you'd bothered to read a little more before knee-jerking a reaction comment, you'd know this is only for the authentication flow.
I did read that; did you know that passing oauth tokens into such automation tools is commonplace?
Re: Guidance to developers affected by effort to block less secure browsers, apps
#25This has nothing to do with security and everything to do with banning tools like youtube-dl, wget and others; from the post: > The browser must identify itself clearly in the User-Agent. The browser must not try to impersonate another browser like Chrome or Firefox. > The browser must not provide automation features. This includes scripts that automate keystrokes or clicks, especially to perform automatic sign-ins.…
> To protect our users from these types of attacks Google Account sign-ins from all embedded frameworks will be blocked starting on January 4, 2021. (emphasis mine) So I don't follow how this would have anything to do with banning youtube-dl, which doesn't require login? And as the blog post mentions, you can still bootstrap auth through a normal web browser, and pass the auth token to your command line / less secure…
Passing oauth tokens into automation tools is a common use case in order to automate the retrieval of account-restricted content.
Re: Guidance to developers affected by effort to block less secure browsers, apps
#26Earlier quoted context omitted.
If you'd bothered to read a little more before knee-jerking a reaction comment, you'd know this is only for the authentication flow.
I did read that; did you know that passing oauth tokens into such automation tools is commonplace?
OAuth tokens used in automation tools will continue to work. Entering in username & password through auth, to automate an OAuth flow (or any other traditionally manual flow) will stop working. Breaks some puppeteer scripts too - but those have been getting flaky for a while now.
Re: Guidance to developers affected by effort to block less secure browsers, apps
#27Earlier quoted context omitted.
> To protect our users from these types of attacks Google Account sign-ins from all embedded frameworks will be blocked starting on January 4, 2021. (emphasis mine) So I don't follow how this would have anything to do with banning youtube-dl, which doesn't require login? And as the blog post mentions, you can still bootstrap auth through a normal web browser, and pass the auth token to your command line / less secure…
Passing oauth tokens into automation tools is a common use case in order to automate the retrieval of account-restricted content.
What does that have to do with youtube-dl? (Sorry it's been like 5 years since I used it, I don't remember that being required)
Re: Guidance to developers affected by effort to block less secure browsers, apps
#28Anti-trust action can't come fast enough.
Once upon a time Google would've been applauded for forcing people to improve their security. Like when they made https a ranking factor for sites and overnight forced all the laggards to move off http. Now, people just scream "monopoly" at everything google does, good or bad and boy is it getting tedious.
Once upon a time Google had "don't be evil" in their corporate mission and people trusted them to act in good faith. Good old times.
Re: Guidance to developers affected by effort to block less secure browsers, apps
#29This has nothing to do with security and everything to do with banning tools like youtube-dl, wget and others; from the post: > The browser must identify itself clearly in the User-Agent. The browser must not try to impersonate another browser like Chrome or Firefox. > The browser must not provide automation features. This includes scripts that automate keystrokes or clicks, especially to perform automatic sign-ins.…
Google has went rouge for quite a while.
AMP was another example of the same nature.
Re: Guidance to developers affected by effort to block less secure browsers, apps
#30Earlier quoted context omitted.
Passing oauth tokens into automation tools is a common use case in order to automate the retrieval of account-restricted content.
What does that have to do with youtube-dl? (Sorry it's been like 5 years since I used it, I don't remember that being required)
It allows one to download private videos that your account can access.