Guidance to developers affected by effort to block less secure browsers, apps

Post by detaro » Sat, Nov 21, 2020, 10:31 PM UTC

dleslie wrote: post #33

ath0 wrote: post #26

Earlier quoted context omitted.

OAuth tokens used in automation tools will continue to work. Entering in username & password through auth, to automate an OAuth flow (or any other traditionally manual flow) will stop working. Breaks some puppeteer scripts too - but those have been getting flaky for a while now.

Thus making it even more cumbersome for users; now they simply login, in the future they'll have to know how to get the oauth token.

Post by Ygg2 » Sat, Nov 21, 2020, 10:33 PM UTC

gostsamo wrote: post #28

dageshi wrote: post #7

Earlier quoted context omitted.

Once upon a time Google would've been applauded for forcing people to improve their security. Like when they made https a ranking factor for sites and overnight forced all the laggards to move off http. Now, people just scream "monopoly" at everything google does, good or bad and boy is it getting tedious.

Once upon a time Google had "don't be evil" in their corporate mission and people trusted them to act in good faith. Good old times.

Post by swiley » Sat, Nov 21, 2020, 10:34 PM UTC

brokencode wrote: post #47

throwawayay02 wrote: post #34

I really dislike this notion of many internet companies of their own self-importance. To me the obvious example is a website that requires you to set up a very strong password and link a phone number. A user account is a two way street, the website should give you the tools for good protection, and you should use them if it matters. If it doesn't matter to me let me use a weak password. If it doesn't matter to me let…

1. Many uses are not computer experts and don’t realize they’re at risk. They won’t adopt extra security measures unless they need to. 2. No company wants to announce that a bunch of accounts were hacked. The excuse that “our users don’t care” would be widely criticized. 3. Well yes, of course companies want to reduce customer support costs, but guess who else benefits from not needing customer support? The customers…

Post by DevKoala » Sat, Nov 21, 2020, 10:35 PM UTC

dleslie wrote: post #10

This has nothing to do with security and everything to do with banning tools like youtube-dl, wget and others; from the post: > The browser must identify itself clearly in the User-Agent. The browser must not try to impersonate another browser like Chrome or Firefox. > The browser must not provide automation features. This includes scripts that automate keystrokes or clicks, especially to perform automatic sign-ins.…

Post by pjc50 » Sat, Nov 21, 2020, 10:37 PM UTC

scrollaway wrote: post #15

dleslie wrote: post #10

This has nothing to do with security and everything to do with banning tools like youtube-dl, wget and others; from the post: > The browser must identify itself clearly in the User-Agent. The browser must not try to impersonate another browser like Chrome or Firefox. > The browser must not provide automation features. This includes scripts that automate keystrokes or clicks, especially to perform automatic sign-ins.…

If you'd bothered to read a little more before knee-jerking a reaction comment, you'd know this is only for the authentication flow.