Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google launches new security features to protect users from unverified apps

techcrunch.com

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Google launches new security features to protect users from unverified apps

#31

Post by [deleted] »

xiaoma wrote: post #28
blojayble wrote: post #11

Earlier quoted context omitted.

Where does this attitude stem from anyway?

I think it really started when Google made its ill-spirited push to make everyone use Plus[1]. Before that point, Google was mostly beloved and most users were truly grateful for Google's free products. After that push, many lost YouTube accounts (including me), people who didn't even want to use Plus for chats were pushed to that page as the popular Google Talk app was killed (and then later forcibly moved from plus…

[deleted]

Re: Google launches new security features to protect users from unverified apps

#32

Post by timlyo »

Moru wrote: post #25
askvictor wrote: post #15

Earlier quoted context omitted.

Typing something unique (eg the name of the app) might also be useful as it forces some cognitive processing.

Or "I allow LeetHaxorApp to access all my data" But I guess that is a bit too much typing for most people.

Might be a good thing for apps that try and looking like something else, G00GLE or FACEB00K could be missed, but having to type a zero manually instead of an O would (hopefully) eliminate that.

Re: Google launches new security features to protect users from unverified apps

#33

Post by bjpbakker »

tokenizerrr wrote: post #30
bjpbakker wrote: post #27

Earlier quoted context omitted.

> Feel free to not integrate with Google's OAuth system if you don't want to deal with them Sorry but that's a bit of an ignorant non-argument. Given the size of Google, I believe that it is important that users can use the apps they want, not the apps that Google wants them to use. Protectionism does not make using Google's services more secure. It serves Google, not its users.

Do you understand what type of apps we are talking about here? It's not Chrome apps. It's not android apps either. It's apps that make use of Google's OAuth connection to do stuff on behalf of the user. So, don't use that if you don't want to deal with the very legitimate security checks. Again, this is NOT about Android or Chrome apps. So yeah, go use whatever apps you want, as long as it doesn't want the users to g…

This is any web app that /you/ granted access to your Google account details (or a wider scope). If you don't want a web app to access your account, then don't grant access. It really is that simple. Now there's an extra step: Google's stamp of trust.

I agree that for most web app this will be an extra formality. For me personally the key point is that there will be web apps that Google does not agree with from a business POV. That is my real problem with this.

If this list was curated by a community rather that Google, I would not have a problem with it.

Re: Google launches new security features to protect users from unverified apps

#34

Post by tokenizerrr »

bjpbakker wrote: post #33
tokenizerrr wrote: post #30

Earlier quoted context omitted.

Do you understand what type of apps we are talking about here? It's not Chrome apps. It's not android apps either. It's apps that make use of Google's OAuth connection to do stuff on behalf of the user. So, don't use that if you don't want to deal with the very legitimate security checks. Again, this is NOT about Android or Chrome apps. So yeah, go use whatever apps you want, as long as it doesn't want the users to g…

This is any web app that /you/ granted access to your Google account details (or a wider scope). If you don't want a web app to access your account, then don't grant access. It really is that simple. Now there's an extra step: Google's stamp of trust. I agree that for most web app this will be an extra formality. For me personally the key point is that there will be web apps that Google does not agree with from a bus…

Everyone can make such an app. A malware site can just redirect an user to that page, and the user thinks they have to log in. They do so. Most users aren't very tech savvy.

For apps that aren't vetted you have to confirm that you really intended to give them access. This is good! It protects most users who aren't a genius like yourself.

Even if you're not verified, users can still grant your app access! Nothing is blocked! Google just wants to be sure the user realizes what is going on.

Re: Google launches new security features to protect users from unverified apps

#35

Post by vitus »

bjpbakker wrote: post #33
tokenizerrr wrote: post #30

Earlier quoted context omitted.

Do you understand what type of apps we are talking about here? It's not Chrome apps. It's not android apps either. It's apps that make use of Google's OAuth connection to do stuff on behalf of the user. So, don't use that if you don't want to deal with the very legitimate security checks. Again, this is NOT about Android or Chrome apps. So yeah, go use whatever apps you want, as long as it doesn't want the users to g…

This is any web app that /you/ granted access to your Google account details (or a wider scope). If you don't want a web app to access your account, then don't grant access. It really is that simple. Now there's an extra step: Google's stamp of trust. I agree that for most web app this will be an extra formality. For me personally the key point is that there will be web apps that Google does not agree with from a bus…

I mean, I see this as a culmination of the response to the OAuth phishing attack that happened a few months ago [0]. Red flags should go up if you were accessing a site yesterday via OAuth, and all of a sudden today on the same site you get an angry full-page alert that "so-and-so wants your credentials, but they haven't been verified yet". I also noticed the presence of the domain name on the OAuth page, which certainly helps but is probably not widely noticed in practice.

It's certainly worth acknowledging that even if users aren't truly blocked, they may be turned away from legitimate apps that just haven't gone through the review process yet -- too many extra clicks, concerns about the legitimacy of the app, whatever.

I wonder how this in particular differs from the vetting process for any mobile app store (Apple's App Store in particular comes to mind with its reputation as a walled garden [1], but Android does also warn the user when enabling the installation of third-party apps not on the Play Store).

[0] http://www.pcworld.com/article/3194816/security/google-docs-...

[1] https://en.wikipedia.org/wiki/IOS_app_approvals

Disclaimer: while I work at Google, I have nothing to do with OAuth or any other user-facing interface.

Re: Google launches new security features to protect users from unverified apps

#36

Post by [deleted] »

timlyo wrote: post #32
Moru wrote: post #25

Earlier quoted context omitted.

Or "I allow LeetHaxorApp to access all my data" But I guess that is a bit too much typing for most people.

Might be a good thing for apps that try and looking like something else, G00GLE or FACEB00K could be missed, but having to type a zero manually instead of an O would (hopefully) eliminate that.

[deleted]

Re: Google launches new security features to protect users from unverified apps

#37

Post by Camille77 »

akuji1993 wrote: post #21
eeveewoofwoof wrote: post #5

Earlier quoted context omitted.

No, it doesn't appear for email/basic profile scopes.

Thanks for that info, if it's setup like this it doesn't affect me at all instead of being really annoying to work with (since most of my apps are still in development).

My Uncle Hayden got an awesome metallic Volvo S60 T6 R by working part-time online. > Open this >>>>>>>>>>>http://www.joinmate2.Com

Re: Google launches new security features to protect users from unverified apps

#38

Post by samtoday »

martin-adams wrote: post #17
philo23 wrote: post #16

I'm not sure I'm a fan of the way Google is re-using the Chrome error page styling for this, but I can't put my finger on why exactly...

Because you associate it with an error that you have no control over? I find that I'm tuned to recognise patterns of behaviour, so when the patterns look similar to other things, but aren't the same, it's quite confusing.

It is literally training users to dismiss these kind of errors. In Chrome, these errors are really bad, like a safebrowsing warning or a TLS error.

On the other hand, this warning will probably happen a lot! Is Google going to be able to "validate" apps fast enough?

Re: Google launches new security features to protect users from unverified apps

#39

Post by londons_explore »

ComodoHacker wrote: post #23

I just can't shrug off the thought that manual review approach is a lost game in the long run. It's a process than requires skilled human and can't be fully automated while generating malicious code perfectly can.

But making legit apps does take human effort.

If an app takes days to make, requiring 5 minutes extra review effort to get it whitelisted seems fine.

Re: Google launches new security features to protect users from unverified apps

#40

Post by eterm »

ComodoHacker wrote: post #23

I just can't shrug off the thought that manual review approach is a lost game in the long run. It's a process than requires skilled human and can't be fully automated while generating malicious code perfectly can.

Tasks of classifying things (in this case into "approved" or "rejected") that humans can routinely do but machines find difficult are areas where ML shines.

Human reviewers today, but once the training set is large enough you can start to let computers take over with human reviewers reviewing the lower certainty cases until the certainties rise further.

Post reply on HN