Guidance to developers affected by effort to block less secure browsers, apps • Hacker News Board

Re: Guidance to developers affected by effort to block less secure browsers, apps

#71

Post by whereistimbo » Sat, Nov 21, 2020, 10:43 PM UTC

pitaj wrote: post #50

tinus_hn wrote: post #21

Earlier quoted context omitted.

Never mind carrying around 6 copies of Chrome on your phone

What are you talking about? Embedded browsers use the system webview, provided by Chrome, Firefox, or whatever is configured.

Recent version of Android reverts the default webview to Android System WebView again.

Re: Guidance to developers affected by effort to block less secure browsers, apps

#72

Post by etaioinshrdlu » Sat, Nov 21, 2020, 10:44 PM UTC

How does this mesh with their plans to deprecate User-Agent? https://9to5google.com/2020/01/14/google-deprecate-chrome-us...

Re: Guidance to developers affected by effort to block less secure browsers, apps

#73

Post by indymike » Sat, Nov 21, 2020, 10:45 PM UTC

This reads like Google is trying to eliminate browsers that don't have a user attached to them. Good luck with that.

Re: Guidance to developers affected by effort to block less secure browsers, apps

#74

Post by detaro » Sat, Nov 21, 2020, 10:45 PM UTC

dleslie wrote: post #58

detaro wrote: post #48

Earlier quoted context omitted.

How does youtube-dl obtain the token today?

https://github.com/ytdl-org/youtube-dl#authentication-option... Username, Password, 2FA, etc.

And you claim that doing more to stop people from giving their google account password to "random apps" (I personally trust youtube-dl a lot too, but "random apps" is what it comes down to) and forcing those apps to use OAuth to obtain scoped tokens has "nothing to do with security"?

Re: Guidance to developers affected by effort to block less secure browsers, apps

#75

Post by dleslie » Sat, Nov 21, 2020, 10:48 PM UTC

detaro wrote: post #74

dleslie wrote: post #58

Earlier quoted context omitted.

https://github.com/ytdl-org/youtube-dl#authentication-option... Username, Password, 2FA, etc.

And you claim that doing more to stop people from giving their google account password to "random apps" (I personally trust youtube-dl a lot too, but "random apps" is what it comes down to) and forcing those apps to use OAuth to obtain scoped tokens has "nothing to do with security"?

If that were all that they were doing I might agree; but they are blocking browser identity misrepresentation and automation, as well; it also requires that all "browsers" have a complete implementation of web standards.

It explicitly blocks "headless" browsers.

> You must confirm that your browser does not contain any of the following:

> Headless browsers

> Node.js

> Text-based browsers

Re: Guidance to developers affected by effort to block less secure browsers, apps

#76

Post by LockAndLol » Sat, Nov 21, 2020, 10:49 PM UTC

If you don't like that google does this: stop using their products. Make the effort to choose, use and promote a service you think is doing a better job. If you so deem it necessary, tell Google why you're switching.

If people actually did something instead of just complain, companies like this would think pretty hard about their actions since it would harm their bottom line.

Re: Guidance to developers affected by effort to block less secure browsers, apps

#77

Post by izacus » Sat, Nov 21, 2020, 10:49 PM UTC

pjc50 wrote: post #59

scrollaway wrote: post #15

Earlier quoted context omitted.

If you'd bothered to read a little more before knee-jerking a reaction comment, you'd know this is only for the authentication flow.

And? What if I want to automate my login flow?

You'll need to find another provider which doesn't care that much about preventing phishing attacks. Google accounts are a big target so it makes sense you move away from the masses.

Re: Guidance to developers affected by effort to block less secure browsers, apps

#78

Post by Aldipower » Sat, Nov 21, 2020, 10:51 PM UTC

This is a campaign against Lynx!

> The browser must have JavaScript enabled.

> You must confirm that your browser does not contain any of the following: > * Text-based browsers

Once upon a time the internet was TCP with things like FTP, Email, Newsgroups, IRC and yes also HTTP (aka WWW).

Now, the internet seems to be Google, Apple, Facebook aaand SEO.

Hey, wait! There is a small shiny place!! Hackernews! :)

Re: Guidance to developers affected by effort to block less secure browsers, apps

#79

Post by pjc50 » Sat, Nov 21, 2020, 10:52 PM UTC

detaro wrote: post #74

dleslie wrote: post #58

Earlier quoted context omitted.

https://github.com/ytdl-org/youtube-dl#authentication-option... Username, Password, 2FA, etc.

And you claim that doing more to stop people from giving their google account password to "random apps" (I personally trust youtube-dl a lot too, but "random apps" is what it comes down to) and forcing those apps to use OAuth to obtain scoped tokens has "nothing to do with security"?

Security for whom? Locking the user out of the software they want to use is not improving security for them.

Re: Guidance to developers affected by effort to block less secure browsers, apps

#80

Post by pjc50 » Sat, Nov 21, 2020, 10:54 PM UTC

izacus wrote: post #77

pjc50 wrote: post #59

Earlier quoted context omitted.

And? What if I want to automate my login flow?

You'll need to find another provider which doesn't care that much about preventing phishing attacks. Google accounts are a big target so it makes sense you move away from the masses.

In practice it just means faking the user-agent and other fingerprinting more enthusiastically. I'm not sure how google can win that without resorting to the same anti-cheat measures as games companies.