Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I tried creating a web browser and Google blocked me (2019)

blog.samuelmaddock.com

Post reply on HN
Print view View original

31–40 of 194 posts

Re: I tried creating a web browser and Google blocked me (2019)

#31

Post by AndrewUnmuted »

atarian wrote: post #22

Not sure if this is covered under Widevine, but Google also blocks anything that is not a major browser from logging into any of its services. https://security.googleblog.com/2019/04/better-protection-ag...

Sorry to go off-topic slightly, but can any INFOSEC people confirm that this idea below makes any sense? The conventional thinking, as far as I am aware, has always been that JavaScript increases your attack vector and diminishes your security coverage.

> Last year, we announced that we would require JavaScript to be enabled in your browser when you sign in so that we can run a risk assessment whenever credentials are entered on a sign-in page and block the sign-in if we suspect an attack. This is yet another layer of protection on top of existing safeguards like Safe Browsing warnings, Gmail spam filters, and account sign-in challenges.

Re: I tried creating a web browser and Google blocked me (2019)

#33

Post by swiftcoder »

sneak wrote: post #18
tracedddd wrote: post #13

I’m not claiming the situation is just or should be ignored, but the option the author seems to be ignoring is to launch without Widevine. Sure, a lot won’t work, but a lot will. Having a vocal community can add a lot of pressure.

They could also reverse engineer the Widevine module binary and reimplement it in their own project. You don't really need Google for this.

This is, unfortunately, explicitly made illegal by the DCMA Anti-Circumvention Provisions.

Re: I tried creating a web browser and Google blocked me (2019)

#34

Post by eivarv »

AndrewUnmuted wrote: post #31
atarian wrote: post #22

Not sure if this is covered under Widevine, but Google also blocks anything that is not a major browser from logging into any of its services. https://security.googleblog.com/2019/04/better-protection-ag...

Sorry to go off-topic slightly, but can any INFOSEC people confirm that this idea below makes any sense? The conventional thinking, as far as I am aware, has always been that JavaScript increases your attack vector and diminishes your security coverage. > Last year, we announced that we would require JavaScript to be enabled in your browser when you sign in so that we can run a risk assessment whenever credentials ar…

There's probably more here, but one thing I can think of is fingerprinting the client as part of the automated risk assessment, deciding whether and when to block attempts, trigger MFA, and recognize specific devices (and potentially tie them to specific users for whatever reason).

Re: I tried creating a web browser and Google blocked me (2019)

#35

Post by schoen »

AndrewUnmuted wrote: post #31
atarian wrote: post #22

Not sure if this is covered under Widevine, but Google also blocks anything that is not a major browser from logging into any of its services. https://security.googleblog.com/2019/04/better-protection-ag...

Sorry to go off-topic slightly, but can any INFOSEC people confirm that this idea below makes any sense? The conventional thinking, as far as I am aware, has always been that JavaScript increases your attack vector and diminishes your security coverage. > Last year, we announced that we would require JavaScript to be enabled in your browser when you sign in so that we can run a risk assessment whenever credentials ar…

I think they're looking at two different notions of security: security of Google's services against bots (which is probably what Google is trying to check with Javascript), and security of users' browsers against malware (which is an attack surface that can be limited by turning off Javascript).

It might be like thinking about whether a "TSA lock" increases security. One might say that it increases security because it allows TSA to check the contents of people's belongings more easily, or that it decreases security because it can allow anyone with brief physical access to a bag to steal its contents.

Edit: the sibling comment also points out a likely use about recognizing your own devices. If you let Google spy on you more, it can more accurately determine what is usual or unusual for you, in order to distinguish you from an impersonator. You might also not want Google or others to have this information.

Re: I tried creating a web browser and Google blocked me (2019)

#36

Post by Devasta »

shuntress wrote: post #24
ttt0 wrote: post #10

Earlier quoted context omitted.

Too many standards to follow, too many APIs, too complicated. Sometimes I wonder if the web standards aren't designed specifically to prevent any meaningful competition.

Web standards are designed for cooperation not competition.

Web standards are whatever Google says web standards are, and will always be adjusted to whatever Chrome does.

Re: I tried creating a web browser and Google blocked me (2019)

#37

Post by paultopia »

Wait, what is this person trying to do? They're not happy that Google open-sourced Chrome, so they also demand that Google open-source some DRM system so that they can make a media player for Netflix or something? Forgive me for not feeling sorry for someone who wants to make a browser polluted with DRM who complains that someone else is enforcing their copyright.

Re: I tried creating a web browser and Google blocked me (2019)

#38

Post by eivarv »

atarian wrote: post #22

Not sure if this is covered under Widevine, but Google also blocks anything that is not a major browser from logging into any of its services. https://security.googleblog.com/2019/04/better-protection-ag...

A more precise wording might be "... Google also blocks anything that's implemented in an embedded framework (e.g. CEF, webviews) and does not use browser-based OAuth authentication."

Re: I tried creating a web browser and Google blocked me (2019)

#39

Post by smaddock »

Blog post author here. Since this post, there's now an option available for DRM-enabled Electron. However, it's only available through a single vendor, castLabs [0].

This is a closed source, downstream effort which means no modifications can be made to Electron itself. All changes must make it upstream to show up in this fork. When asked whether they would eventually merge it upstream, they didn't provide a clear answer [1].

I also wrote a followup blog post with more detail on the current state of DRM options on the web [2]. Spoilers: it's not great.

Regardless of all of these problems, I still hold an interest in browser development and have been working towards making Electron a viable option for building a browser [3].

[0] https://github.com/castlabs/electron-releases

[1] https://github.com/castlabs/electron-releases/discussions/24

[2] https://blog.samuelmaddock.com/posts/the-end-of-indie-web-br...

[3] https://github.com/samuelmaddock/electron-browser-shell

Re: I tried creating a web browser and Google blocked me (2019)

#40

Post by closeparen »

AndrewUnmuted wrote: post #31
atarian wrote: post #22

Not sure if this is covered under Widevine, but Google also blocks anything that is not a major browser from logging into any of its services. https://security.googleblog.com/2019/04/better-protection-ag...

Sorry to go off-topic slightly, but can any INFOSEC people confirm that this idea below makes any sense? The conventional thinking, as far as I am aware, has always been that JavaScript increases your attack vector and diminishes your security coverage. > Last year, we announced that we would require JavaScript to be enabled in your browser when you sign in so that we can run a risk assessment whenever credentials ar…

Phishing is accessible to anyone with basic web development skills, while JavaScript sandbox escapes for major browsers are the domain of pretty sophisticated actors.
Post reply on HN