Slashdot Mirror
Google Won't Let You Sign In If You Disabled JavaScript In Your Browser (zdnet.com)
An anonymous reader quotes a report from ZDNet: Google announced today four new security features for securing Google accounts. These four updates are meant to bolster protections before and after users sign into accounts, but also in the case of recovering after a hack. According to Google's Jonathan Skelker, the first of these protections that Google has rolled out today comes into effect even before users start typing their username and password. In the coming future, Skelker says that Google won't allow users to sign into accounts if they disabled JavaScript in their browser. The reason is that Google uses JavaScript to run risk assessment checks on the users accessing the login page, and if JavaScript is disabled, this allows crooks to pass through those checks undetected. This change is likely to impact only a very small number of users -- around 0.01 percent according to Google's data -- but it will likely impact bots harder, as many of them run through headless browsers where this feature is turned off for performance reasons. Google also plans to pull data from Google Play Protect and list all malicious apps that are still installed on a user's Android smartphone. Google's Jonathan Skelker says they will be notifying you "whenever you share any data from your Google Account," expanding on the notifications it sends when you've granted access to sensitive information, like Gmail data or your Google Contacts.
"Last but not least is a security feature that Google plans to use after an account hack," reports ZDNet. "This feature is already live and is a new set of procedures for regaining access and re-securing compromised profiles. The procedure is detailed in this Google support page, and besides just helping users regain access to accounts, it will also help them check financial activity related to Google Pay accounts, review new files added to Gmail or Drive, and secure other accounts at other services that are tied to the main Google account."
"Last but not least is a security feature that Google plans to use after an account hack," reports ZDNet. "This feature is already live and is a new set of procedures for regaining access and re-securing compromised profiles. The procedure is detailed in this Google support page, and besides just helping users regain access to accounts, it will also help them check financial activity related to Google Pay accounts, review new files added to Gmail or Drive, and secure other accounts at other services that are tied to the main Google account."
Maybe this javascript thing will finally take off
So Google says that only 1 in 10,000 of us have a Google account and disable Javascript?
I feel special.
ENABLE Javascript to increase security.
Now I've seen it all.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Especially text browsers that don't support javascript often used by people with disabilities.
This is a pretty transparent attempt to try to make surveillance easier for themselves under the guise of user security
Last I checked, screen-reading tools support major web browsers, which in turn run JavaScript. There are even versions of elinks and w3m that run JavaScript. Karl Groves created "Mother Effing Tool Confuser", a webpage where a script adds sufficient accessibility markup, to demonstrate this fact.
The reason is that Google uses JavaScript to run risk assessment checks on the users
Google is all about tracking people on the net. Anything google does is about tracking people. The reason google needs javascript to be enabled is so that the javascript can help track people. Enabling javascript does not increase security, it decreases security. Javascript is a huge attack surface.
If client-side javascript is part of the security check, I don't see how that prevents a crook from forging an authentic-looking HTTP request.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Since google's services like gmail, maps, and docs all REQUIRE javascript anyway, you will need to allow javascript in order for those to even work. If you're logging into another service using your google account, then that's where things become sketchy. Of course you can just allow the google domains required for the login using something like noscript or uMatrix.
:)
I just logged into gmail, and didn't allow gstatic.com and googleusercontent.com and it allowed me to log in. Of course, without gstatic, I couldn't log out.
First it's "sign into Google accounts". But next it's "not get flagged as a bot by reCaptcha3"
^^^ This. ^^^ . . . How long before google becomes the effective gatekeeper on the net? How long before you need to allow google to track you (via javascript) in order to log into a website you want to visit?
I know, Booo Javascript sucks! However Javascript is better then Sliverlight, Flash, Active X, Java Applets, in terms of keeping the web platform open, while offering the features most people wanted.
Some Slashdot users would claim that web applications written in JavaScript are still inferior to native applications made with Qt or another multi-platform GUI framework and distributed to the public in the form of source code under a free software license. They see the web not as an application platform but as a platform for publishing documents.
Why don't you use GMail.... and access it via IMAP?
Or you can pay any domain host for a domain with email... they start are literally pence normally.
You don't / can't run email servers from home anyway (you'll be on SpamHaus policy blacklist because the ISP almost certainly list all their dynamic IP's there), you need an secure outside machine that's on 24/7 with a fixed IP and not listed as being a "home" connection via SpamHaus PBL/XBL etc. Don't even get me started on sending email, you need to be SPF'd up too, really, and a proper reverse DNS entry.
You can get a VPS for a pittance a month, and a ten minute tutorial on, say, Postfix will set it up for you and include forwarding / copying all email to something like GMail or any other provider if you ever need it in the future should something go wrong.
Personally I do the latter. And I can collect via GMail (via IMAP) or via my server direct (via IMAP), they both get copies of all emails. But if you're that worried, almost certainly whoever you hold domains with will have free email forwarding and free/pittance webmail access too if you want.
Protonmail seems to be the popular choice. I use it, as well as their VPN service in a bundled deal. So far I've yet to uncover any news or evidence that the promise of privacy is just a marketing ploy.