Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Won't Let You Sign In If You Disabled JavaScript In Your Browser (zdnet.com)

Posted by BeauHD on from the safety-first dept.

An anonymous reader quotes a report from ZDNet: Google announced today four new security features for securing Google accounts. These four updates are meant to bolster protections before and after users sign into accounts, but also in the case of recovering after a hack. According to Google's Jonathan Skelker, the first of these protections that Google has rolled out today comes into effect even before users start typing their username and password. In the coming future, Skelker says that Google won't allow users to sign into accounts if they disabled JavaScript in their browser. The reason is that Google uses JavaScript to run risk assessment checks on the users accessing the login page, and if JavaScript is disabled, this allows crooks to pass through those checks undetected. This change is likely to impact only a very small number of users -- around 0.01 percent according to Google's data -- but it will likely impact bots harder, as many of them run through headless browsers where this feature is turned off for performance reasons. Google also plans to pull data from Google Play Protect and list all malicious apps that are still installed on a user's Android smartphone. Google's Jonathan Skelker says they will be notifying you "whenever you share any data from your Google Account," expanding on the notifications it sends when you've granted access to sensitive information, like Gmail data or your Google Contacts.

"Last but not least is a security feature that Google plans to use after an account hack," reports ZDNet. "This feature is already live and is a new set of procedures for regaining access and re-securing compromised profiles. The procedure is detailed in this Google support page, and besides just helping users regain access to accounts, it will also help them check financial activity related to Google Pay accounts, review new files added to Gmail or Drive, and secure other accounts at other services that are tied to the main Google account."

23 of 172 comments (clear)

  1. Good by Anonymous Coward · · Score: 4, Funny

    Maybe this javascript thing will finally take off

    1. Re:Good by jellomizer · · Score: 5, Insightful

      Actually Google has been leading JavaScript adoption for over a decade.
      Even back in the early 2000's web/web app developers were slow to use Javascript on their pages (Or limited to input validation). Mostly because they were afraid of people using old browsers that didn't support it. If you did a lot of stuff, you probably didn't get the customer, because you cannot reference an other popular site that needs Javascript.
      Then with Googles Autocomplete feature and Google Maps, becoming a popular feature, it opened the door for the rest of us to apply Javascript,Ajax and DHTML to the pages.
      I know, Booo Javascript sucks! However Javascript is better then Sliverlight, Flash, Active X, Java Applets, in terms of keeping the web platform open, while offering the features most people wanted.

      Now Javascript has its issues... However it is used on all major browsers, and if coded well, it makes your pages load and run faster. (if not then we have the suckyness we think of wanting to block Javascript for)

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    2. Re:Good by UnknownSoldier · · Score: 3, Insightful

      > and if coded well,

      IF

      That's a mighty big if as websites pull in JS and images from a dozen different sites ...

    3. Re:Good by sycodon · · Score: 5, Insightful

      My Very Large Defense company employer disables javascript via group policies.

      Security reasons.

      --
      When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
    4. Re:Good by oh_my_080980980 · · Score: 5, Insightful

      So you just backed tracked on your own argument. Please just stop. You do not know what you are fucking talking about.

      People block JavaScript for security reasons because of all the malicious stuff it can do. Google forcing you to enable JavaScript is fucking stupid. Hint, they can do what they want without enabling JavaScript. Google is looking for something else.

  2. Only .01%? by PuddleBoy · · Score: 5, Insightful

    So Google says that only 1 in 10,000 of us have a Google account and disable Javascript?

    I feel special.

    1. Re:Only .01%? by Anonymous Coward · · Score: 5, Interesting

      Probably because anyone paranoid (rightfully) about JS is even more skeptical of intentionally storing information with Google.

    2. Re:Only .01%? by jellomizer · · Score: 5, Interesting

      You can only really trust Javascript as much as you trust the page creators.

      Sure turn off Javascript for your random browsing, but if you are going to a site, where your personal info and needs to log into with... Then you might as well have it enabled. Because your data is already compromised, and you are just missing out on features which may make your browsing a bit easier.

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    3. Re:Only .01%? by lgw · · Score: 4, Interesting

      Sure turn off Javascript for your random browsing, but if you are going to a site, where your personal info and needs to log into with... Then you might as well have it enabled. Because your data is already compromised,

      Fun fact: web sites often contain content originating from more than one company. You might trust the people you're giving your info to, but is there an ad anywhere on their web site? Heck, even banks run web content from "partners" these days.

      --
      Socialism: a lie told by totalitarians and believed by fools.
  3. It's 1st of November, not April by Opportunist · · Score: 5, Insightful

    ENABLE Javascript to increase security.

    Now I've seen it all.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    1. Re:It's 1st of November, not April by Anonymous Coward · · Score: 4, Interesting

      Something seems to be badly broken in the brains of the people behind this.

      Not when you realize that Javascript is primarily about user-tracking, not functionality or "safety". Those are the ways to sell it to the dumb masses. Google's is a mass surveillance company, and javascript allows much better tracking of people as they use and move around the web.

      Requiring it is completely consistent with Google's business goals of knowing everything about everybody.

    2. Re:It's 1st of November, not April by bentcd · · Score: 5, Insightful

      Enable javascript to improve security for Google, not for yourself.

      To improve security for yourself, don't have a Google account.

      --
      sigs are hazardous to your health
    3. Re:It's 1st of November, not April by squiggleslash · · Score: 3, Interesting

      I'm about 90% sure that most security vulnerabilities involved plugins, Flash being the biggest offender but also with problems in plugins that should know better like Java. And, of course, there's ActiveX, plus the ability to download .exes or MSIs and tell people they're OK honest and you should have it because it installs this awesome toolbar.

      I don't recall seeing many Javascript vulnerabilities. The only serious ones I can think of are:

      1. There are a few XSS vulnerabilities that have popped up from time to time. While initially the browser makers blamed the webdevs for this, they've tightened up the scope for XSS attacks to make them extremely difficult over the years.
      2. One of the CPU branch-prediction bugs from last year was exploitable via JS, I forget which but IIRC it was the less severe one and was still pretty close to impossible to exploit in a real world scenario (yes, you could build a carefully constructed proof of concept where you knew exactly what browser was being used on a specific CPU on a specific version of a specific operating system with specific versions of specific shared libraries installed, but outside of that it was hard to exploit.

      Ultimately any web technology can be poorly implemented in such a way that it'll lead to exploits. I wouldn't be remotely surprised to hear, even today, of a buffer overflow bug in a GIF or HTML parser. Disabling JS seems like poor security to me, it reduces the attack surface, sure, but so does disabling images, and like the latter it means most modern web pages aren't going to work properly.

      --
      You are not alone. This is not normal. None of this is normal.
  4. This negatively impacts alternative browsers by xack · · Score: 5, Interesting

    Especially text browsers that don't support javascript often used by people with disabilities.

    1. Re:This negatively impacts alternative browsers by Anonymous Coward · · Score: 5, Insightful

      Exactly. This goes against everything webdevs were taught to do (DEGRADE GRACEFULLY) for the past 20 years.

  5. I might be cynical but... by Anonymous Coward · · Score: 3, Insightful

    This is a pretty transparent attempt to try to make surveillance easier for themselves under the guise of user security

  6. "Mother Effing Tool Confuser" by Karl Groves by tepples · · Score: 4, Insightful

    Last I checked, screen-reading tools support major web browsers, which in turn run JavaScript. There are even versions of elinks and w3m that run JavaScript. Karl Groves created "Mother Effing Tool Confuser", a webpage where a script adds sufficient accessibility markup, to demonstrate this fact.

  7. It's about tracking... by QuietLagoon · · Score: 5, Insightful

    The reason is that Google uses JavaScript to run risk assessment checks on the users

    Google is all about tracking people on the net. Anything google does is about tracking people. The reason google needs javascript to be enabled is so that the javascript can help track people. Enabling javascript does not increase security, it decreases security. Javascript is a huge attack surface.

    1. Re:It's about tracking... by 110010001000 · · Score: 5, Funny

      That isn't true. They are just a bunch of altruistic guys that like to program stuff.

    2. Re:It's about tracking... by Anonymous Coward · · Score: 5, Insightful

      Javascript is a huge attack surface.

      When it comes to the modern web, Javascript is all but THE attack surface.

      ActiveX used to be another big one, but we got rid of that.

      In recent years, virtually every instance of "I went to this web site and now my computer is infected" has been due to javascript. And about 90% of the tracking, and about 100% of the annoyware like popping up boxes over the top of the pages content or disabling right clicks is due to javascript.

      It's also what allows the majority (but not all) of panoptoclick style attacks.

      Javascript is a cancer on the web. It has occasional, small uses, but its use should be minimized at all costs.

  8. Color me dubious. by hey! · · Score: 3, Insightful

    If client-side javascript is part of the security check, I don't see how that prevents a crook from forging an authentic-looking HTTP request.

    --
    Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
  9. DUH! by freeze128 · · Score: 4, Interesting

    Since google's services like gmail, maps, and docs all REQUIRE javascript anyway, you will need to allow javascript in order for those to even work. If you're logging into another service using your google account, then that's where things become sketchy. Of course you can just allow the google domains required for the login using something like noscript or uMatrix.

    I just logged into gmail, and didn't allow gstatic.com and googleusercontent.com and it allowed me to log in. Of course, without gstatic, I couldn't log out. :)

  10. Applications vs. documents by tepples · · Score: 5, Insightful

    I know, Booo Javascript sucks! However Javascript is better then Sliverlight, Flash, Active X, Java Applets, in terms of keeping the web platform open, while offering the features most people wanted.

    Some Slashdot users would claim that web applications written in JavaScript are still inferior to native applications made with Qt or another multi-platform GUI framework and distributed to the public in the form of source code under a free software license. They see the web not as an application platform but as a platform for publishing documents.