Slashdot Mirror
Google Won't Let You Sign In If You Disabled JavaScript In Your Browser (zdnet.com)
An anonymous reader quotes a report from ZDNet: Google announced today four new security features for securing Google accounts. These four updates are meant to bolster protections before and after users sign into accounts, but also in the case of recovering after a hack. According to Google's Jonathan Skelker, the first of these protections that Google has rolled out today comes into effect even before users start typing their username and password. In the coming future, Skelker says that Google won't allow users to sign into accounts if they disabled JavaScript in their browser. The reason is that Google uses JavaScript to run risk assessment checks on the users accessing the login page, and if JavaScript is disabled, this allows crooks to pass through those checks undetected. This change is likely to impact only a very small number of users -- around 0.01 percent according to Google's data -- but it will likely impact bots harder, as many of them run through headless browsers where this feature is turned off for performance reasons. Google also plans to pull data from Google Play Protect and list all malicious apps that are still installed on a user's Android smartphone. Google's Jonathan Skelker says they will be notifying you "whenever you share any data from your Google Account," expanding on the notifications it sends when you've granted access to sensitive information, like Gmail data or your Google Contacts.
"Last but not least is a security feature that Google plans to use after an account hack," reports ZDNet. "This feature is already live and is a new set of procedures for regaining access and re-securing compromised profiles. The procedure is detailed in this Google support page, and besides just helping users regain access to accounts, it will also help them check financial activity related to Google Pay accounts, review new files added to Gmail or Drive, and secure other accounts at other services that are tied to the main Google account."
"Last but not least is a security feature that Google plans to use after an account hack," reports ZDNet. "This feature is already live and is a new set of procedures for regaining access and re-securing compromised profiles. The procedure is detailed in this Google support page, and besides just helping users regain access to accounts, it will also help them check financial activity related to Google Pay accounts, review new files added to Gmail or Drive, and secure other accounts at other services that are tied to the main Google account."
Maybe this javascript thing will finally take off
So Google says that only 1 in 10,000 of us have a Google account and disable Javascript?
I feel special.
ENABLE Javascript to increase security.
Now I've seen it all.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I'm inclined to ask what the colour of the sky is in google-world.
Especially text browsers that don't support javascript often used by people with disabilities.
Boiling like frogs.
They dont even care about the optics of payouts to coverup serial sexual predators in their org. Fuck Goog.
Google locked me out of my account, and won't let me back in. I have the password.
Google keeps asking me for my frequent flyer number, which I never provided to them.
I did provide Google with my phone number a while back, but there doesn't seem to be a way to get Google to call me to verify.
Google accounts are worth what you pay for them...
This is a pretty transparent attempt to try to make surveillance easier for themselves under the guise of user security
They need javascript to show you even more annoying ads
Google silently starts using their new bot that has hardware accelerated javascript engine.
They aren't doing this for security, they are doing it so they can better track you and to try to make it more difficult for their competition by making a quick change that is tough to immediately adjust for, but that they have probably been working on for months.
Last I checked, screen-reading tools support major web browsers, which in turn run JavaScript. There are even versions of elinks and w3m that run JavaScript. Karl Groves created "Mother Effing Tool Confuser", a webpage where a script adds sufficient accessibility markup, to demonstrate this fact.
And I will generally avoid logging in in the first place. Fortunately I need their poisoned "services" only very rarely.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The reason is that Google uses JavaScript to run risk assessment checks on the users
Google is all about tracking people on the net. Anything google does is about tracking people. The reason google needs javascript to be enabled is so that the javascript can help track people. Enabling javascript does not increase security, it decreases security. Javascript is a huge attack surface.
Bring back Damore and Rubin!
If client-side javascript is part of the security check, I don't see how that prevents a crook from forging an authentic-looking HTTP request.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
And onto Firefox. I only use chrome now to use the google products (docs, gmail, etc). I dunno if that's any better, but I figured it would be the next best thing besides just dropping down to links.
Don't use Google. Google uses you. You don't need Google. Google needs you.
> The reason is that Google uses JavaScript to run risk assessment checks on the users accessing the login page, and if JavaScript is disabled, this allows crooks to pass through those checks undetected.
Hahahaha..... enable arbitrary code to increase security... and it JUST SO HAPPENS this also forces people to enable Google's shitty tracking tech, doesn't it? Oh, and the automatic sign in that's forcing tracking people that's a big point of contention right now has nothing to do with this.
Yeah, no. Google, people have figured out they don't want ads. Deal with it.
You'd think Google would know that code running on your attacker's computer is inherently insecure. I admit it won't be easy to effectively subvert the javascript that Google wants to execute in your browser, but it's not impossible. I don't see this stopping a determined and knowledgeable attacker.
Thanks Google! Each press release you provide makes it one step easier for me to stop using your services.
No javascript, NO ADS! I found this out last week. And I am loving every minute of it. Have you tried it? Try it. You will love every minute of it. I guarantee it or my name isn't.... oh, you almost tricked me there but I am too fast for you.
Since google's services like gmail, maps, and docs all REQUIRE javascript anyway, you will need to allow javascript in order for those to even work. If you're logging into another service using your google account, then that's where things become sketchy. Of course you can just allow the google domains required for the login using something like noscript or uMatrix.
:)
I just logged into gmail, and didn't allow gstatic.com and googleusercontent.com and it allowed me to log in. Of course, without gstatic, I couldn't log out.
The reality is that the web began with a certain concept of the domain of a user agent and how sites interconnect and could be merged into one. One web page could freely POST to another domain and that was the security paradigm.
The problem turned out that even as a site 'trusst' the user to be authentic, that user may be under attack by other windows in the same browser, or not even visiting *your* site but a third site is using your cookies to induce the client to do undesirable things. It's not that you don't trust the client, it's that you need to protect the legitimate user of the client from attackers.
Javascript stumbled upon having a more appropriate domain to operate in, and so has become a big player in things like CSRF protection and other such security measures. Yes there are non-javascript ways of CSRF protection, but the javascript strategies for CSRF demonstrate why 'client side' security has a role in the web context when it normally is nonsense.
Of course, a lot of web security practices are obviously more duct taping together accidental behaviors that happen to break in undesirable situations, so there's a lot of ugliness in that realm in general.
XML is like violence. If it doesn't solve the problem, use more.
I use Chrome but I never sign into anything Google. Javascript is a security problem or so I was told for years. Is this really about security Google? I have to wonder.
First it's "sign into Google accounts". But next it's "not get flagged as a bot by reCaptcha3" that they're rolling out (link to /. from a few days ago is an exercise for the reader). So it becomes "use 90% of the web.
It's pretty clearly on their path in the next year or two (maybe three, however long it takes for reCaptcha3 to roll out).
Your ad here. Ask me how!
Hmm. The main thing I use Google for is searching. That doesn't require logging in. Then there's maps, but that doesn't require logging in either.
No, wait.. then there's ads. If I weren't using ad blockers, then failing to log in would mean that I wouldn't get the correct ads.
It's stupid and disappointing to make a website thta requires javascript (it always makes the developer look totally incompetent), but in this case, I can't think of a single reason to give a fuck, from the user's point of view. Gmail users probably care. Analytics users probably care. Me? Not so much.
Disabling java script is for security. Enabling it just opens more holes than anything they can possibly do with their risk assesment.
They just want to make sure people aren't escaping their tracking bullshit and ads.
Either way, mutt will most likely continue to work for the moment, so no big deal.
As a human being using a browser, I, too, disable Javascript for performance reasons.
Just keep adding more and more reasons for users to leave you. Eventually your user base will decline. You're already my second choice for a search engine and it's not difficult to transfer bookmarks to another browser.
CUR ALLOC 20195.....5804M
Not what the web look in 2018 without Javascript but I hope you enjoy your private and secure experience.
I do my google things in a google-specific-local-user-account in a virtual-machine
Often the difference between "your device is not recognized, verify your identity to continue" and "welcome back, Dave" is javascript and referrers.
so people who disable javascript are now CROOKS? ...
no js means no trackers, no spyware, no coin mining
Does anyone have any suggestions about a better e-mail service that is mostly free ( or for low cost) where I don't have to deal with all this mess. It was fun while it was novel but I've about lost patients now.
I'm a little too lazy / busy to set up my own e-mail server in my own domain on my house network. Nothing secure about xfinity anyway. Oh well, living it a glass house is kinda cool I guess =)
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
I know, Booo Javascript sucks! However Javascript is better then Sliverlight, Flash, Active X, Java Applets, in terms of keeping the web platform open, while offering the features most people wanted.
Some Slashdot users would claim that web applications written in JavaScript are still inferior to native applications made with Qt or another multi-platform GUI framework and distributed to the public in the form of source code under a free software license. They see the web not as an application platform but as a platform for publishing documents.
Bye bye Google.
Google just keeps on doing things to aggravate users who care about their privacy and security into doing things that cause them to sacrifice it. Google instant was one of the first things. Anyone who is a touch typist (doesn't have to look at the keyboard to type) likely despise the fact that the screen changes and lags as you type. No way to disable it permanently without logging in and confirming your identity. Another example is how hard it has gotten to use Google services without giving them your phone number and a way to tie the account to a real human. The whole goal of using web services for many is a way to have an anonymous identity. If you use project fi for your voice services, then there is no way to keep your phone and email separate. Even if you turn off 2 factor auth through your phone, it still requires it if you use Project Fi. This is just another case of Google disguising actions as security which reduce the level of privacy and security you have. They look at security/privacy as something they provide for you and what they say is best. They refuse to see that there are many of us who refuse to give up our privacy and security to someone else and that it is very likely Google and other corporations who we are trying to protect ourselves from.
Digital is, by definition, imperfect. Analog is the way to go.
I don't know if this helps, but at home to prevent any contamination between my normal browsing (no-cookies-allowed, no-js-allowed, no-anything-allowed) and my gmail acct (which needs cookies, and now it seems will need JS) is to have a separate login just for email (with username 'mail', unsurprisingly), where I have a palemoon instance which runs gmail AND NOTHING ELSE.
When I check my email I have to switch accounts. Tracking or any other info cannot leak between accounts.
It takes a few seconds to switch accounts and to switch back, its inconvenient but very worth it for me.
Just a suggestion instead of the endless bitching about how simply awful everything is.
(and yes, it's not a perfect solution, I'm not offering it as one. A possibly even better one is to have a gmail session running in a VM, so no need to switch accounts)
I wonder if it's some sjw worker deliberately impacting performance out of protest for Google's rape bonuses and new censorship engine, or if it's just total incompetence by a diverse employee. Either way I've started moving off of Google shit. First switch off chrome when they put that stupid "hold cmd + q to quit" shit last month, and now gmail takes 30 seconds to a minute to login.
Google is firing us as customers. They aren't happy tracking us everywhere and having access to data we provide. They want more.
Live by the cloud, die by the cloud. If there was any question, google is heavy into "cloudy" stuff.
Microsoft did that when they forced "telemetry" and took away control for patching.
Amazon is going to be next, probably. Alexa and TV sticks are making them greedy for our data.
I've blocked most of google's domains for over a decade. Every once in a while, I have to fire up a container with a totally insecure browser to work with other people at other companies, but that happens less and less.
Never forget, live by the cloud, die by the cloud. Don't be surprised when your metadata is used against your wishes.
Their "Security" is to simply tax the bot so it's uneconomical to code logins en masse. Now you have to consume cycles running their crap. It works, but it's just crude.
If you want privacy, freedom, and security you have to stop using products and services that will own you. Google is well known for tracking you and selling advertising. Same with Facebook. But don't think for a moment your Apple shit is safe. They're all a problem.
I make sure host my own social networking and communications tech from Mastodon to email to web hosting to 'cloud-like' calendaring software Nextcloud, to storage/file hosting, to smart phones to routers. The up-keep is a bit of work, but stuff worth doing isn't always the easiest. But it certainly worth doing. I have never had a Facebook account, Gmail, or an unfixed Android phone.
What's next, Google? Everyone needs to use your shitty browser to authenticate because of extra security?
I wonder how my iOS built in mail app can even authenticate with your super secure servers...
Gmail logins are much slower since they changed this. Bring the old one back.
Says Google. And the sheeple will comply. Even without the inducement of a wet bar of soap on the floor.
I will not comply.
I've encountered one such situation, involving applications that happen not to be built on a multi-platform framework. Say a particular application is available as a macOS app or a web app. How is the web app "10,000 times shittier" than not being able to use the app at all because it's not made for your platform?
Or if you're a Mac user:
Say a particular application is available as a Windows app or a web app. How is the web app "10,000 times shittier" than not being able to use the app at all because it's not made for your platform?
Would you download and install an app for participating in Slashdot?
If there's no native app for it to begin with then clearly I never had the "possibility of doing a particular task" both ways in the first place.
In theory, you had the possibility of buying a second computer on which to run the application designed for that make of computer.
In the same way, trying to shove all native applications onto the web basically amounts to reinventing the operating system inside a browser - a dramatically more confining ecosystem.
You are correct that Java, Flash, Silverlight, and JavaScript with the HTML DOM all act as an inner platform. The "dramatically more confining ecosystem" exists for privilege separation reasons: the app player attempts to act as a sandbox. It also exists to isolate the application from operating system and instruction set dependencies, so that the application need not be remade for each underlying operating system and instruction set.
Since google's services like gmail, maps, and docs all REQUIRE javascript anyway
That's not true for one of these. Gmail works just fine without any Javascript at all. The pure HTML interface is arguably even better (and certainly faster for most activities) than the normal version. Try it for yourself. Logout completely, then disable all of your Javascript (not just selectively). You can readily login, work with your account, and log out with no problem at all. It's actually my preferred way to interact with the web interface, when I must use it.
...are on slashdot!
This is called the "Run our spyware or fuck off" policy.