36 ms·

JavaScript is now required to sign in to Google

593 points by amaccuish 8y ago

shshhdhs 8y ago
> But, because it may save bandwidth or help pages load more quickly, a tiny minority of our users (0.1%) choose to keep it off. This might make sense if you are reading static content, but we recommend that you keep Javascript on while signing into your Google Account so we can better protect you. They don’t seem to explain why though? Did I miss it? Are they fingerprinting the JavaScript environment of my browser? Why? The 0.1% are the people who would like to know why they need it, but this message is written ironically for those who don’t know what JavaScript is.
- smadge 8y ago
  Additionally they imply the only motivation for disabling JavaScript is to increase performance and decrease bandwidth. They conveniently don’t mention the other, arguably more prevalent motivations: to increase privacy and security.
  - djsumdog 8y ago
    ...and speed, and decreasing the amount of arbitrary code execution on your machine. Most people don't disable JS entirely, but use something like uMatrix or noscript. It takes more work, but you can turn off a significant number of things that just don't need to be executed and get around a lot of annoying modals and paywalls (or see a lot of blank pages; that happens a lot too).
    - deleted 8y ago
      [deleted]
  - yjftsjthsd-h 8y ago
    Yeah, it struck me as extremely disingenuous; while I like the other benefits, I disable JS mostly because I hate being tracked and noticed that many (most?) browser exploits require JS to run.
- yayana 8y ago
  They are trying to detect state actor hacking and track individual devices and whether they are new or impersonations of devices. Some states have mitm certs on all their domestic machines but (hopefully) not much competence except on whatever schedule they buy updates. I would be implenting a u2f soft client in js if I were Google. IMO you need a private key a state would need to retrieve by tampering with js and that isn't being sent over the wire with every connection. (Just to give them their first level of headache, when it comes to transitioning from observing to impersonation.)
- jjawssd 8y ago
  > Are they fingerprinting the JavaScript environment of my browser? No, they are fingerprinting YOU and YOUR BEHAVIOR so it can be tracked across the entire internet. Intelligence agencies will use this information to track you across the web as well.
- thinkingemote 8y ago
  0.1% of Google accounts is a huge number of people. Millions?
mattcoles 8y ago
To keep your account secure, turn on Javascript?? If anything is making your web browsing less secure, it's JS. I don't particularly care that Google isn't letting you sign in without JS, but the message is just plain wrong..
- gruez 8y ago
  I'm not sure about you, but most people with js "disabled" don't browse with javascript disabled entirely, but instead use a whitelisting/blacklisting plugin, otherwise they don't be able to access many essential sites (eg. banks). under this setup, whitelisting google isn't going to decrease security unless you think they're going to serve a 0day when you sign in.
- totony 8y ago
  Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate
  - NeoBasilisk 8y ago
    Who is sending passwords in cleartext on the wire?
    - sroussey 8y ago
      Lots. But even those that don’t tend to send the password to the server, which is still bad.
      - yetanotherjosh 8y ago
        How is sending the password to the server over HTTPS bad? What would you do otherwise? Hash it on the client? So are you not using salted hashes for your password store? That's far worse. Or you're hashing twice, the first with no salt client-side, then again with salt on the server side, which is fine, but the client-generated hash must be unsalted so is basically just the password itself: steal the client-generated hash instead of the original password, just as good with only minor loss in value (might not be able to reuse it on other sites for the victim; but actually maybe still could if you can build a reverse index of common passwords hashed using whatever algo is in use.) And if you don't trust HTTPS to protect sensitive information, why would you send the auth cookies over it that have virtually as much power the password that was given in exchange for them in the first place?
ddoolin 8y ago
0.1% of Google's users is still quite a lot of users, is it not? Somewhere over a billion, perhaps, which would mean 1 million+ with JS off.
- dredmorbius 8y ago
  0.1% of roughly 4 billion would be about 4 million. Somewhat more in pageviews. Of course, this fails to account for self-selection, a beehaviour has encountered before, in which increasing Youtube performance slowed average load times ... because users who'd previously found the site intolerably slow now found it slow, but tolerable. (I've looked for the story, can't find it.) Much as those who prefer to avoid use of Google won't appear in site use metrics. And enforced JS could well prove a deterrant.
  - EpicEng 8y ago
    You stopped reading the single sentence in the comment you responded to about half way through.
- NelsonMinar 8y ago
  I'm gonna wager that 0.1% of users who don't or can't run Javascript aren't very valuable to Google.
draw_down 8y ago
The correct, non-editorialized title is: "Announcing some security treats to protect you from attackers’ tricks"
- saagarjha 8y ago
  Both are editorialized. I think a better, more neutral title would be "Google now requiring JavaScript to be enabled to sign in".
  - Wowfunhappy 8y ago
    I'm sure this is on me, but I'm genuinely not sure what the difference is between your suggested title and what was used. (Obviously, I can see which words you changed, but I'm missing the significance)
    - saagarjha 8y ago
      The title has been changed recently; the old one was significantly more inflammatory.
amanzi 8y ago
For about a month or so I tried browsing with JavaScript turned off but gave up after having to modify settings for just about every single site I visited to get pages working, often with them silently failing in the background leaving me wondering what was going on. Sometimes I'd get halfway through a payment transaction before realising that the lack of JavaScript was preventing it from going through and then changing settings and reloading the page would break my session. Long story short, I gave up on this and have succumbed to running JavaScript for all sites again.
- trisomy21 8y ago
  Same exact journey for me.
- doorbellguy 8y ago
  You can add exceptions to websites you visit you know..
- goatsi 8y ago
  I browse with javascript blocked by default and also often need to enable a script for proper functionality. However when I enable that one script, I will almost always see numerous other blocked scripts that can remain suppressed without a problem for me. Most of these are related to tracking/advertising. For me blocking the rest of the scripts is well worth having to play around a bit when I first visit a new website.
- superkuh 8y ago
  I'm on ~5 years of temp-whitelist only for JS domains. I have acquired a third sense for which CDN and assort domains are really required for what. Sure, it does take some back and forth testing, and some sites like wix.com sites are terrible no matter what, but in general it's a better browsing experience.
  - jandrese 8y ago
    My favourite are pages that embed videos using a huge collection of different third party embedding tools. It usually takes 2 or 3 rounds of whitelisting to get the video to even show up, and another to get it to play.
c487bd62 8y ago
This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.
- doorbellguy 8y ago
  Haha yeah, thanks for the recommendation Google. Chrome is never gonna come back on my PC.
- Crontab 8y ago
  Google has becoming increasingly annoying. Every time I browse from work, where I have to use Internet Explorer, I have to suffer Chrome ads. They also require me to solve a Captcha every time I change the number of results per page via the search settings.
- afandian 8y ago
  Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.
  - sjroot 8y ago
    What version of Firefox are you running? You are either exaggerating greatly or have other issues with your system. I run the latest stable release of Firefox and the performance of Gmail (particularly the features you mention) is fine. I’d be happy to upload a screen recording to verify.
    - tyfon 8y ago
      I have a lot of issues with google apps for business. Sometimes I have to refresh the browser 5-6 times before it will display any email in the primary inbox as well. It's just horrible to use in firefox (in arch linux) and I'm currently looking for a new provider. I might just go all in and use protonmail.
bluetidepro 8y ago
I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?
- tree_of_item 8y ago
  You're misunderstanding: you browse with JS disabled by default. Random sites shouldn't be running programs on your computer. If you trust the site, you whitelist it.
  - diminoten 8y ago
    You're acting like "running programs on your computer" is a bad thing. It's not.
    - vageli 8y ago
      Running untrusted code on your machine _is_ a bad thing though.
      - diminoten 8y ago
        Yeah, because permissions, sandboxing, and access controls don't exist. Oh wait, they do, and they work, so you're wrong.
        cesarb 8y ago
        Even setting aside things like rowhammer and spectre, something like half of the browser vulnerabilities need Javascript to be exploited.
        hueving 8y ago
        No, they don't always work. We have bullet proof vests but it's still not safe to put one on and have someone start shooting you.
saagarjha 8y ago
I find it kind of humorous that the "mobile demo" seems to have been made on a Mac, complete with a cursor, and then resized to have a mobile border around it.
ouid 8y ago
I don't want google to protect me in this way. Can I opt out?
- ravenstine 8y ago
  Don't use Google?
  - Figs 8y ago
    That is unfortunately not a practical option for many people whose school or workplace forces use of GMail.
- greglindahl 8y ago
  Good luck with the introduction of Captcha v3.
arkadiyt 8y ago
As others have mentioned, nearly the entire internet breaks without javascript - it's a sad state of affairs. One protection I like to use is to disable javascript that is loaded over plaintext http - this breaks nearly nothing, and is easy to do via Chrome settings: https://i.imgur.com/NRVg5Xf.png https://i.imgur.com/NRVg5Xf.png
- snowwrestler 8y ago
  Chrome will always block an HTTP javascript call by an HTTPS page. So given the growing prevalence of HTTPS, I think this setting is probably doing less and less for you.
  - yjftsjthsd-h 8y ago
    And therefore, this setting is safer and safer to enable:)
- anonunt 8y ago
  I browse without javascript all the time, sometimes i need to switch to another browser to buy something from some random site, but generally its just a faster better internet with very dodgey sites self selecting themselves out of my usage. If there is one or two sites i really want to use in my main browser that need JS i can white list that site - but only exactly that site. I am not an expert but it seems a better experience to me and i don't really think it make me less secure?
Sephr 8y ago
Chrome team members have said that preventing modern web browsers from leaking enough entropy to uniquely identify users across sessions (fingerprinting) is impractical with all of the features that the modern web provides. This sentiment has probably lead to some at Google to think that it is justifiable impose pervasive tracking and surveillance technologies as a condition for using Google services. Look at the new ReCAPTCHA v3 to see how fingerprinting is trending at Google.
- mrep 8y ago
  Do you have a better solution for differentiating yourself as an actual user from a robot spammer?
  - kibwen 8y ago
    Being allowed to pay for services with money, rather than being required to pay for services with your personal data. I browse the web via a proxy when I'm on public wifi, and Google is nigh unusable with how many captchas it forces you to solve to do a single Google search. Fortunately Bing and DDG still work, for now.
    - tzs 8y ago
      > Being allowed to pay for services with money, rather than being required to pay for services with your personal data One possible big disadvantage for a site owner in letting people pay with money instead of data is dealing with taxes. I'm not actually sure how most jurisdictions tend to classify it when someone comes to your site and you charge them to access your content. My guess would be it would be taxed the same way they tax digital goods such as downloadable software that does not include any physical components. For such goods most jurisdictions that tax them seem to base the tax on the buyer's location rather than the seller's location, so the seller has to deal with charging the appropriate tax and filing returns for potentially a large number of jurisdictions. If the seller is providing the content for "free" and making their money selling visitor data to advertisers then their income will probably only be subject to taxation in their own jurisdiction. It will simply be ordinary business income.
kps 8y ago
Amusingly, the article is perfectly readable with javascript off, but with only first-party js allowed, it's blank.
- yesenadam 8y ago
  Ohh that is interesting. Anyone know why that is?
  - cesarb 8y ago
    Blogger (which is what hosts this article) includes a copy of the whole article within <noscript> tags. If you completely disable Javascript, the browser shows the content of these tags, so the article is visible. If you have Javascript enabled, even if all domains are blocked, the content of these tags is hidden, so the article show as a blank page. You have to unblock the third-party domains where Blogger hosts its scripts to make the article appear again.
deleted 8y ago
[deleted]
todd3834 8y ago
This seems reasonable to me. JavaScript is being used everywhere and most people are okay with it. As a business decision I don’t see why Google would support such a small edge case. That being said, if they feel like explaing why they should maybe try a little harder. I assume most people with JavaScript turned off might appreciate more details so they can decide how to respond to the requirement. Then again, their current approach actually seems reasonable to me.
- dimgl 8y ago
  99.9% of users are okay with JavaScript.
  - cm2187 8y ago
    99.8% of users don't know what javascript is.
    - lerax 8y ago
      Thus only 0.1% of users know what javascript is and it's okay with it. That is an interesting random stats, seems pretty realistic. I at least liked it.
      - ekianjo 8y ago
        Thats the wrong take on the stats. It means among the ones who know, half of them dont want it. This is more telling that looking at the 0.1%.
        notatoad 8y ago
        it would mean that, if it's a real stat and not just something that was invented on the spot.
        jake_the_third 8y ago
        Then if we take this 0.2% as representative (and 6 million out of three billion users probably is), it would be fair to say that this 50% split would scale if more people learned about javascript. Google will be in hot water if humanity ever decides to take on javascript.. assuming the source for those states aren't someone's ass.
Zelphyr 8y ago
I'm getting tired of Google dictating how the web should work. That's the job of standards bodies. Google is increasingly taking the place of overbearing overlord that Microsoft embodied in the 90's and early 2000's.
- Operyl 8y ago
  Google is dictating how signing into their account system on their properties works, not login forms for _every single site_.
  - Zelphyr 8y ago
    You're right. My comment is out of place in this particular instance. But there are plenty of other examples where Google does have too much power and influence.
  - greglindahl 8y ago
    Google's policies get exported. For a long time it was OK to drop email that came from a server without rDNS. Then gmail started allowing such emails, and then legit sites started sending email from servers without rDNS. In this case the export mechanism is Captcha v3.
    - asdfasgasdgasdg 8y ago
      So you're saying you're getting tired of everyone else copying Google's behavior?
  - ndnxhs 8y ago
    Google is quickly becoming the login form for every website. And even if the website has its own login it will always have recaptca
    - Operyl 8y ago
      I wouldn't blame Google for this phenomenon, though. They provided a solution, others were quick to jump to and use said solution. Might be better to complain to the sites following the herd then?
rinchik 8y ago
Is there an alternative to gMail? Just tried Protonmail and Fastmail, both require JS.
- 0xb100db1ade 8y ago
  ProtonMail requires JavaScript for client-side encryption. You can use a non-web client, though.
- TheDong 8y ago
  Yeah, use mutt or thunderbird. Conveniently those both work with either fastmail, gmail, or any other popular IMAP-compatible email provider.
- dredmorbius 8y ago
  Protnmail requires JS, or offers an app (Android/IOS). But it doesn't infect uncountable other websites.
brunoTbear 8y ago
ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss of one account being popped is likely far greater than the privacy loss of thousands of users' browsing patterns being correlated. tl; dr: Good luck detecting and preventing automation of sign in pages at scale without robust JS based defenses. I think there's a shortsightedness and self-centeredness to a lot of these comments.
- Forge36 8y ago
  Even when I ran noscript Google domains were allowed. It's extra step for a small number of technical users.
- greglindahl 8y ago
  Calling other people, or their opinions, shortsighed and self-centered is usually not the start of a good conversation.
  - brunoTbear 8y ago
    You're right. I was shortsighted and self-centered.
  - kadendogthing 8y ago
    I mean, why not cut to the chase?
  - duxup 8y ago
    I'll be the guy who says that while I recognize those are insults, they are also sufficiently descriptive of a point of view... it's not like he called someone Mr. Poopypants.
  - coldtea 8y ago
    To a good conversation no. But not always is a conversation what's desirable. Sometimes one just wants an accurate depiction of a situation -- and those might still be totally accurate characterizations...
kwoff 8y ago
How is this nonsense upvoted on hackernews..?
- dang 8y ago
  "Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- brunoTbear 8y ago
  It's surprising to me how many users on HN can only think as far as their own browser. Really the question here is not "what's the harm of JS across the web" but rather what is the specific privacy cost of running JS on a sign in page and what is the security benefit of the same. The worst case cost of JS on a browser is that you get a drive by download and your endpoint is owned. This seems unlikely on a Google domain. The other, more normal, case is that a user is concerned about ad tracking. Providing an ad tracker on a sign in page seems pretty lame, and I'd be surprised, again, if Google was doing that. The security upsides are likely several: anti-automation, anti-phishing, and an opportunity to track state-level adversaries who target users' Google accounts. I don't know how others weigh these factors, but to me it seems entirely obvious that this is a good idea. Could the blog post have better laid out this case? Sure.
  - lovich 8y ago
    Why would google not at least have an incentive they'd have to work against, to add tracking into their sign in pages? They make all of their money off of ads and they do that by tracking people to target ads. You might as well say people shouldn't take precautions swimming around sharks, because it's rare and be surprising if they attacked
    - magicalist 8y ago
      > Why would google not at least have an incentive they'd have to work against, to add tracking into their sign in pages? You're signing in. That's literally asking them to identify you across pages so you can have access to them.
largehotcoffee 8y ago
Death to n o s c r i p t
- Kiro 8y ago
  I agree. I instantly IP ban anyone using noscript on my site.
  - yjftsjthsd-h 8y ago
    If you're serious, I would much appreciate an explanation for why you would do such a thing.
    - Kiro 8y ago
      I love JavaScript and hate NoScript.
monochromatic 8y ago
I don’t remember the last google story that made me think “wow, what a cool idea.” That used to be the norm. Now it’s “ugh what happened to y’all??”
deleted 8y ago
[deleted]
userbinator 8y ago
What a bunch of, excuse the language, paternalist fear-mongering bullshit. Of course Google wants you to enable JS, because it allows them to monitor and track everything about you more easily. Twisting it into "this will make you safer" is sad and undeniably repugnant. I've noticed a lot of other sites practically begging you to "enable JavaScript for a better experience", when all their content is static text and images. I fell for that once, a long time ago --- enabled JS briefly to see what the big deal was --- and was promptly bombarded with popups, slide-overs, and even more ads. No thank you, I'll keep it off. For many years I used IE6 with JS off (and a whitelist for a very, very small number of selected and highly-trusted sites. IE has a "security zone" feature which to my knowledge no other browser comes with by default.) Not a single malware infection, and that's despite often visiting the... shadier parts of the Internet. Browser exploits are almost all JS-based, and even the few that aren't, are in practice deployed using obfuscation involving JS, to make analysis and detection harder. Turning off JS effectively kills those risks as well as other annoyances (blocking right-click, text selection, injecting crap into copied content, etc.) IMHO the advantages of not having JS on by default are underrated. I'd consider ~99% of the sites I come across when searching for content to not require it at all, which certainly is a stark contrast from the "you'll break the Internet!" screams of the JS-advocates and "web designers". Sites that "break" from not having JS, and which aren't specifically "appsites" but mostly content-sites, are not worth visiting anyway. Perhaps it's time to raise a counter-movement, and add (via <script> tags, of course) "you have JavaScript turned on in your browser, this is a security risk! Click <here> (link to appropriate page with all the risks and how to turn it off) to learn more." Or "You have JavaScript enabled, please disable it for a better experience." If a certain vocal minority managed to demonise Flash (another powerful technology that had major uses) to almost completely kill it, maybe the same can happen for JavaScript?
- throwawaymath 8y ago
  > Browser exploits are almost all JS-based, and even the few that aren't, are in practice deployed using obfuscation involving JS, to make analysis and detection harder. Go take a look through Pwn2Own. Most browser exploits do not involve JavaScript. JavaScript can be a delivery mechanism for a certain class of payloads, but it's not the substantial weakness in browser vulnerabilities (as opposed to web application vulnerabilities). Given that this isn't familiar to you, I'd recommend you reevaluate how confident you are in the JavaScript-focused defenses you've outlined in the rest of your comment.
h43z 8y ago
I tried to live with javascript disabled by default but gave up after two months because all I did was white-listing every page I opened. Gave up on my own side projects too. Building something that works with and without javascript is just to much work for me and it becomes ugly quickly. I still think modern websites over use javascript too often and should use markup over code whenever possible. And of course no one wants to go back to iframes to load dynamic content. Or should we?
- the_clarence 8y ago
  Same thing with littlesnitch
- singularity2001 8y ago
  try again with noscript allowing main page by default but not 3rd party.
  - h43z 8y ago
    I think that most of the annoying (but non breaking) javascript is already covered by ublock.
colemickens 8y ago
I try hard not to be a luddite as I age, but this level of automation and machine learning is so concerning. It is SO frustrating to accidentally appear as a bot and get stuck at the mercy of an automated system. I was on some random site the other day and spent 3+ minutes solving Captchas until it finally let me through. I thought I was losing my mind. I don't spam, I don't automate queries, I come from an IP that has two residential users (netflix, xbox traffic dominate everything). Who knows what I did to offend the algorithm.
- perl4ever 8y ago
  I was getting a persistent but unhelpful error message from an airline website while trying to change my reservation shortly after midnight. I assumed at first I just hit the maintenance window and should try again in the morning, but now I am reading this thread and wondering if it's a deliberate obfuscation that it deemed my connection suspicious.
- jgaa 8y ago
  Google captchas appears (to me) to be designed to identify individuals, not to separate anonymous users from machines. Google want to know exactly who you are, when they harvest your visits and behavior on almost all sites on the Internet.
  - colemickens 8y ago
    I don't understand what this has to do with the fact that I repeatedly am having to prove that I'm not a bot despite doing nothing that ought to be triggering Captcha checks. But hey, I guess mentioning this simple observation is worthy of numerous downvotes here. Always lovely.
- justtopost 8y ago
  I get this constantly. Its the new digital ghetto google has created.
marcrosoft 8y ago
This reads like an April fools joke.
bonsai80 8y ago
"But, because it may save bandwidth or help pages load more quickly, a tiny minority of our users choose to keep it off" Yeeaaah Google. Thaaaat's why we don't load JavaScript from you ;) I get it they can't make this opt-in and expect many to use it, but it'd be nice to see an opt-out be made available.
CivBase 8y ago
Yah, but what if I want to be able to log into my account using a script? I know I'm in a tiny minority, but I have on several occasions had to use selenium to automate actions on a web app. For this reason, captchas are similarly annoying to me.
- modzu 8y ago
  no hax0r, no soup for you!
- asdfasgasdgasdg 8y ago
  Isn't that what Oauth is for?
- tetromino_ 8y ago
  If you want to automate your actions, you should get an API key and use the official APIs.
  - CivBase 8y ago
    I wish official APIs were available for everything I want to do.
modzu 8y ago
coming soon: we noticed you are in private browsing mode. to keep your browsing secure, please sign in with history enabled.
- ndnxhs 8y ago
  Nooo, google wants you to think you are in private browsing mode so you share more secrets with them. They will just collect it all no matter what you do.
duxup 8y ago
I'm not really sure how it works if you don't want to use JavaScript, do you then whitelist sites that you're ok with it? Wouldn't the solution for folks who don't want to run JavaScript just to whitelist it for Google? Maybe I'm missing something but that seems pretty simple, would let Google do their thing and the folks who don't want to run it run it just for Google and places they want to. If someone already doesn't trust Google, I gotta think they abandoned their products entirely already. Google's data collecting is so complete that JS or not, same objections.
- sunsetMurk 8y ago
  Yes, practical.
- hnzix 8y ago
  > pretty simple, [] let Google do their thing Unfortunately El Goog is now a de facto monopoly both for makers (organic traffic) and users (AMP, discovery, federated logins etc). I'm not angry at Goog for winning, they did it by (mostly) being 100x more awesome than the competition and surfing the network effects into the endgame. But here's the elephant in the room: outside walled gardens, Goog runs da tubes, and they're not as fluffy as Mr Cutts would have you believe. Mandatory JS and AMP are the not-even thin end of the wedge.
  - duxup 8y ago
    It certainly is it's on monopoly, but at least for personal use folks who don't like JavaScript can avoid it if they really want. Just generally this decision for logins and javascript seems pretty... not a huge deal IMO for folks who aren't a fan of JavaScript, whitelisting google seems like a pretty simple choice.
martin1975 8y ago
JavaScript is fast becoming, if it hasn't already, the next rich GUI framework... It was supposed to be just touch up on HTML, now you can't sign in anymore w/out JS enabled. What if I wanted to do a rich client in C# or Qt? Do I need a JavaScript engine to sign in?
- Spivak 8y ago
  Yes, plenty of apps allow you to sign in with Google -- they open up an embedded web browser for the sign-in dialog and oauth permission screen.
PeterHK 8y ago
i have javascript disabled mostly to save bandwidth against nasty ads. Most sites that requires JS i usually ignore if possible (seriously why do some content provider think its ok to require JS?). For certain things like soon google login i do just whitelist them. But by default if i do not trust your site enough and/or its not that important in the end ill just close my tab
ghop02 8y ago
What many of the comments seem to be missing is that you don't need to enable javascript on all google sites, only the sign-in page. With that in mind, I don't think there needs to be as much concern as we're seeing here.
- pdkl95 8y ago
  This kind of apology for a problematic change misses how allowing small changes eventually normalizes the change[1], allowing another similarly "small" step to be taken in the future. Today it's "just the sign-in page"; tomorrow it will expand to cover something else because "it's already something you're used to using on the sign-in page". It's rare for major changes to arrive all at once. Small steps are taken, with each eventually becoming the new normal that allows another small step to be taken[2]. This isn't always intentional - each small step can seem rational at the time, in isolation. [any replies complaining about "slippery slopes" will be ignored; the normalization of deviance does not mean change necessarily will follow, just that normalizing incremental changes allows people to support changes without noticing the larger picture] [1] https://en.wikibooks.org/wiki/Professionalism/Diane_Vaughan_and_the_normalization_of_deviance https://en.wikibooks.org/wiki/Professionalism/Diane_Vaughan_... [2] https://en.wikipedia.org/wiki/Overton_window https://en.wikipedia.org/wiki/Overton_window
wowamit 8y ago
It is so difficult to explore anything that Google announces without passing it through the lens shaded by their ad business model. It doesn't matter with what intention they implement a change or if those intentions are pure. Sure, this will make the login secure by preventing credential stuffing. But doesn't this also help them get more data from users who preferred not to by disabling JS? And was this the best and only solution to tackle this problem? I believe internally too, Google must struggle with this perception.
dcow 8y ago
Google is not in my internet hot path anymore. So, good for them. DDG & ProtonMail work just fine.
jhabdas 8y ago
With regards to NewPipe, you don't need to sign in to enjoy streaming YouTube in 4K (where supported).
guest0001 8y ago
"When your username and password are entered on Google’s sign-in page, we’ll run a risk assessment and only allow the sign-in if nothing looks suspicious." In my experience (it is already the case with gmail and outlook up and now), this means I will not be able to login to my account when in holiday in another city, country, or when I use a borrowed device, or when I am behind VPN/Tor, etc, unless I give google my phone number, and can afford to get a call / sms at that point of time and unblock the account. It should be my choice, as it is my account that is at risk, to turn on/off such dubious security measures. It is fine to have these features on by default, but I would like to turn this particular feature off for my account. Any clever "risk assessment" thing where a computer decides without an option to turn if off/on is problematic. I have sometimes the feeling they know this and it is on purpose. They want not only to collect data, they want to collect high quality data and these measures help to clean their data sets at time of collection.
- realusername 8y ago
  > In my experience (it is already the case with gmail and outlook up and now), this means I will not be able to login to my account when in holiday in another city, country, or when I use a borrowed device, or when I am behind VPN/Tor, etc, unless I give google my phone number, and can afford to get a call / sms at that point of time and unblock the account. That's exactly it, there's already two Gmail accounts from high school I can't access despite knowing the passwords.
- zuzun 8y ago
  I also have no faith in their risk assessment. For a very long time I have only used one computer from one location to log into my Gmail account and every time I log in they consider it a suspicious activity. They even forced me to confirm my identity on my last login. What's their risk assessment doing if it can't get the baseline right?
  - NullPrefix 8y ago
    What makes you think that their end goal wasn't getting your identity confirmed?
amelius 8y ago
Just remember that CSS3 is already Turing complete.
scoot_718 8y ago
Okay. No more Google account. So that means I miss out on... What exactly?
- aembleton 8y ago
  The Play store if you're on Android
  - jgaa 8y ago
    I don't have a Google account on my new Android phone. I get my apps from F-Droid, or I write them myself.
- trulyrandom 8y ago
  Everything in the Google product suite, clearly.
naijabb 8y ago
Talking of protection.
enriquto 8y ago
This is a sad state of affairs. However, notice that once you are logged-in into gmail, you can still disable all javascript and go to https://mail.google.com/mail/h/ https://mail.google.com/mail/h/ for a somewhat reasonable user experience. It is best to run gmail on a separate, private browsing window, so that it does not interfere with normal web browsing (i.e., make sure that other websites such as google search cannot see that you are actually logged into gmail).
mike_hearn 8y ago
When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiring here are designed to detect tools, not people. All mass account hijacking attacks rely on bots that either emulate or automate web browsers, and Google has a technology that has proven quite effective at detecting these tools. There's a little bit of info on how it works scattered around the internet, but none of the explanations are even remotely complete, and they're all years old now too. Suffice it to say: no JS = no bot signals. Google had the ability to enforce a JS-required rule on login at least 6 years ago and never used it until now. Without a doubt, it's being enforced for the first time due to some large account hijacking attack that has proven impossible to stop any other way. After so many years of bending over backwards to keep support for JS blocking users alive, it's presumably now become the weakest link in the digital Maginot line surrounding their network. For the people asking for the risk analysis to be disable-able: you used to be able to do that by enabling two-factor authentication. You can't roll back your account to just username and password security though: it's worth remembering that account hijacks are about more than just the immediate victim. When an account is taken over it's abused and that abuse creates more victims. Perhaps the account is used to send phishing mails to your contacts, or financial scams, or perhaps it's used to just do normal spamming which can - at enough volume - cause Gmail IPs to get blocked by third party spam filters, and user's emails to get bounced even if their own account is entirely secure. The risk analysis is mostly about securing people's accounts, but it's also about securing the products more generally too.
- mysterydip 8y ago
  I understand what you're saying and it makes sense. I think in my mind it's the fact that javascript has the potential to do so many things, not that it's being used that way today. To use a bad car analogy, the in-car entertainment used to be just a dumb radio. Now that it's a computer connected to the main car network, it has a lot more potential to do things, whether it's a feature, bug, or an exploit.
jgaa 8y ago
Why would anyone who cares even a tiny bit about security or privacy ever want to sign in to Google?
h2onock 8y ago
I don't get the same behaviour as what is shown in the screenshots of the google blog. If I go to Google, disable JS and click on 'sign in' I go to an 'account chooser' page. From there, no matter what I do I end up being redirected to that same page. Not great UX from Google if others experience the same as me.
lucb1e 8y ago
So I'm wondering, all these automated detections and CAPTCHAs... how does that tie in with automated decisions being made about you under GDPR? They're trying to protect us from bots, but those decisions are also made by bots. What if their bot makes a mistake? Does that count as an automated decision under GDPR, for which I should be able to ask a human for a second opinion?
hjorthjort 8y ago
> But, because it may save bandwidth or help pages load more quickly, a tiny minority of our users (0.1%) choose to keep it off. That's a gross misrepresentation, isn't it?
Ensorceled 8y ago
A lot of the arguments in this thread sound like the people who don’t want to vaccinate their kids. Right down to not giving a shit about “herd immunity” - not caring if their hacked account is used to attack their less informed friends and family.
arendtio 8y ago
When Javascript becomes the new pillar of security something has gone terribly wrong. Background: I love building Single Page Applications, Progressive Web Apps and have JS always enabled. So no hate for JS in general, but when your security depends on the correct evaluation on the client side, you are starting a dangerous cat and mouse game.
- neolefty 8y ago
  They've been playing a dangerous cat and mouse game the whole time — I'm sure the old tools are not being discarded; just added to.
kakarot 8y ago
We can argue back and forth about the pros and cons of requiring JS. But one thing we can't argue about is the loss of security for political dissidents and other non-protected groups who access Gmail or other Google services through systems like Tor. No, this isn't Google's problem, but it illuminates what kind of purpose Google believes its products should serve, and what kind of people it should serve.
dijit 8y ago
I think this is a really braindead argument. Of course users are going to use javascript more, the more the internet demands it, the more people will be willing to allow it. When I first started using noscript there were few exceptional sites which didn’t work and I didn’t bother with them after, if that was the majority of sites, I would probably just disable noscript. The idea that I _have_ to let your site run code on my machine is only laughable when it’s an exception, the problem is the industry. And google is telling the industry that it’s ok. edit: yes, I understand; I'm over the hill and you all absolutely love shoving javascript down peoples throats, I get it. But please take a moment to consider... not? maybe you have a financial incentive to avoid thinking about the ramifications you inflict on others, maybe you're paid to be a JS dev. But really, if you're making the web worse, I will not cry for being downvoted, just know that I hate you. :)
- arcticfox 8y ago
  > Of course users are going to use javascript more, the more the internet demands it, the more people will be willing to allow it. I think you have this backwards; the vast majority of users like the benefits of js-enabled sites, so they get built. That ship has sailed long ago.
  - dijit 8y ago
    Even so, making the assertion that: "javascript adoption in the browser will increase in future, therefore we will enforce javascript" is like saying: "more people will have passports in future, therefore we require passports to get a bus pass". By doing that; you make it true.
    - horsawlarway 8y ago
      It's already true. You can quibble over who's fault it was, but it really doesn't matter at this point. The web serves code that users run. That's because the web is the best distribution medium for code we've ever seen. I bet you've also installed client side applications that came from the web, on a vendor installed OS that came from the web, and drivers for your machine that came from the web.
hpcjoe 8y ago
This is unfortunate. On all my phones, I find the most annoying malware is spread via javascript. I'll get onto a page I read a few times a day, and suddenly, thanks to ads, I am served some javascript malware that attempts to tell me "my PC is infected" or other such garbage. I grouse, turn off javascript, clean my caches, and then everything is copacetic for a bit. If this means that, thanks to google's decision, that I must in no uncertain terms, have javascript on in order to interact with their product line, then I need to weigh risks and benefits. Not proclaim loudly that I will run away from the google ecosystem, as many are likely proclaiming in this forum. But weigh the risks of using products which require me to be vulnerable to attacks, versus alternatives. From the viewpoint of google, you don't want your customer to ever be in that position. As it is an arms race against bad actors, and forcing users to effectively lower their defensive posture means you really ... REALLY ... need to up your game on value for this to be even net neutral relative to previous state. Given how completely horrendous google's customer support is, and how incredibly hard it is to administer basic stuff (it took me more than 1/2 hour! to search and find out how to close an unused business g-suite account, which I couldn't do, until I manually disconnected from a marketplace product ... where this disconnection was also hidden ... google doesn't do ux/ui worth a crap, and has no real support for smaller users), I am not sure this is in their best interests. I am sure there is a product manager trying to pull them back from this ... somewhere ... Or at least I hope so. Basically the risk calculation is when where you look at something holistically. Is using the google universe worth the risk that universe forces you to accept? Part of the reason that facebook is in user count freefall, is this inherent risk. You are volunteering info that advertisers are dying to get, and they are the ones paying facebook. You are a packaged product, you can be microtargeted, and various bits of self-serving posturing over election non-interference and account termination aside, they haven't quite grasped that this intimate relationship brings substantial risk for participants. I've dropped messenger from my phone, and am about a few months away from dropping facebook from the phone. I don't need it there, and the risk to me is far higher than the "value" it brings. Back to google. You don't want customers thinking this. You want them happily and securely playing in your garden. You don't want to force them to go out without their armor. Turning off javascript strengthens that armor. Forcing it on strips users of their most important armor. Put more simply, bad google, bad.
throwawaynpc123 8y ago
AI should be able to defeat it by copying real users, it would require a full browser running tho.
coldacid 8y ago
If you're an Amiga user, Google is now dead to you. As far as I can tell, none of the browsers available for the Amiga platform support JavaScript.
Animats 8y ago
How long until you have to sign into Google to search? They already pop up messages trying to trick you into logging in to "adjust your settings" or "improve your privacy" or some such.
nofunsir 8y ago
So many Google/Javascript shills in this thread. Quick poll: how many of you rely on Javascript for your income?
sireat 8y ago
Thank you Google for making me investigate alternatives. I am serious, I've been using gmail since 2004. I realize some day my main account is going to be permanently inaccessible just because I will be in the "wrong" country or will be using the wrong browser in the wrong cafe. There should be no need for Javascript with proper 2FA. Your algorithms already make me solve ridiculous captchas "some" of the time.
bogomipz 8y ago
The post states: >"When your username and password are entered on Google’s sign-in page, we’ll run a risk assessment and only allow the sign-in if nothing looks suspicious. We’re always working to improve this analysis, and we’ll now require that JavaScript is enabled on the Google sign-in page, without which we can’t run this assessment." Is the idea that an actual browser will be able to have a fingerprint whereas a bot would not? Is the check for a javascript a way to short-circuit responding to a non-browser based request? It wasn't clear to me.
justtopost 8y ago
Goodbye google. Wanted to leave, but was lazy. Thanks for focing my hand, and those of thousands more.

593 points by amaccuish 8y ago

> But, because it may save bandwidth or help pages load more quickly, a tiny minority of our users (0.1%) choose to keep it off. This might make sense if you are reading static content, but we recommend that you keep Javascript on while signing into your Google Account so we can better protect you. They don’t seem to explain why though? Did I miss it? Are they fingerprinting the JavaScript environment of my browser? Why? The 0.1% are the people who would like to know why they need it, but this message is written ironically for those who don’t know what JavaScript is.

smadge 8y ago
Additionally they imply the only motivation for disabling JavaScript is to increase performance and decrease bandwidth. They conveniently don’t mention the other, arguably more prevalent motivations: to increase privacy and security.
- djsumdog 8y ago
  ...and speed, and decreasing the amount of arbitrary code execution on your machine. Most people don't disable JS entirely, but use something like uMatrix or noscript. It takes more work, but you can turn off a significant number of things that just don't need to be executed and get around a lot of annoying modals and paywalls (or see a lot of blank pages; that happens a lot too).
  - deleted 8y ago
    [deleted]
- yjftsjthsd-h 8y ago
  Yeah, it struck me as extremely disingenuous; while I like the other benefits, I disable JS mostly because I hate being tracked and noticed that many (most?) browser exploits require JS to run.
yayana 8y ago
They are trying to detect state actor hacking and track individual devices and whether they are new or impersonations of devices. Some states have mitm certs on all their domestic machines but (hopefully) not much competence except on whatever schedule they buy updates. I would be implenting a u2f soft client in js if I were Google. IMO you need a private key a state would need to retrieve by tampering with js and that isn't being sent over the wire with every connection. (Just to give them their first level of headache, when it comes to transitioning from observing to impersonation.)
jjawssd 8y ago
> Are they fingerprinting the JavaScript environment of my browser? No, they are fingerprinting YOU and YOUR BEHAVIOR so it can be tracked across the entire internet. Intelligence agencies will use this information to track you across the web as well.
thinkingemote 8y ago
0.1% of Google accounts is a huge number of people. Millions?

mattcoles 8y ago

To keep your account secure, turn on Javascript?? If anything is making your web browsing less secure, it's JS. I don't particularly care that Google isn't letting you sign in without JS, but the message is just plain wrong..

gruez 8y ago
I'm not sure about you, but most people with js "disabled" don't browse with javascript disabled entirely, but instead use a whitelisting/blacklisting plugin, otherwise they don't be able to access many essential sites (eg. banks). under this setup, whitelisting google isn't going to decrease security unless you think they're going to serve a 0day when you sign in.
totony 8y ago
Passwords can be hashed directly client-side with javascript, which is way more secure than sending them clear on the wire, so i dont disagree with Google's stance here and dont understand the hate
- NeoBasilisk 8y ago
  Who is sending passwords in cleartext on the wire?
  - sroussey 8y ago
    Lots. But even those that don’t tend to send the password to the server, which is still bad.
    - yetanotherjosh 8y ago
      How is sending the password to the server over HTTPS bad? What would you do otherwise? Hash it on the client? So are you not using salted hashes for your password store? That's far worse. Or you're hashing twice, the first with no salt client-side, then again with salt on the server side, which is fine, but the client-generated hash must be unsalted so is basically just the password itself: steal the client-generated hash instead of the original password, just as good with only minor loss in value (might not be able to reuse it on other sites for the victim; but actually maybe still could if you can build a reverse index of common passwords hashed using whatever algo is in use.) And if you don't trust HTTPS to protect sensitive information, why would you send the auth cookies over it that have virtually as much power the password that was given in exchange for them in the first place?

ddoolin 8y ago

0.1% of Google's users is still quite a lot of users, is it not? Somewhere over a billion, perhaps, which would mean 1 million+ with JS off.

dredmorbius 8y ago
0.1% of roughly 4 billion would be about 4 million. Somewhat more in pageviews. Of course, this fails to account for self-selection, a beehaviour has encountered before, in which increasing Youtube performance slowed average load times ... because users who'd previously found the site intolerably slow now found it slow, but tolerable. (I've looked for the story, can't find it.) Much as those who prefer to avoid use of Google won't appear in site use metrics. And enforced JS could well prove a deterrant.
- EpicEng 8y ago
  You stopped reading the single sentence in the comment you responded to about half way through.
NelsonMinar 8y ago
I'm gonna wager that 0.1% of users who don't or can't run Javascript aren't very valuable to Google.

draw_down 8y ago

The correct, non-editorialized title is: "Announcing some security treats to protect you from attackers’ tricks"

saagarjha 8y ago
Both are editorialized. I think a better, more neutral title would be "Google now requiring JavaScript to be enabled to sign in".
- Wowfunhappy 8y ago
  I'm sure this is on me, but I'm genuinely not sure what the difference is between your suggested title and what was used. (Obviously, I can see which words you changed, but I'm missing the significance)
  - saagarjha 8y ago
    The title has been changed recently; the old one was significantly more inflammatory.

amanzi 8y ago

For about a month or so I tried browsing with JavaScript turned off but gave up after having to modify settings for just about every single site I visited to get pages working, often with them silently failing in the background leaving me wondering what was going on. Sometimes I'd get halfway through a payment transaction before realising that the lack of JavaScript was preventing it from going through and then changing settings and reloading the page would break my session. Long story short, I gave up on this and have succumbed to running JavaScript for all sites again.

trisomy21 8y ago
Same exact journey for me.
doorbellguy 8y ago
You can add exceptions to websites you visit you know..
goatsi 8y ago
I browse with javascript blocked by default and also often need to enable a script for proper functionality. However when I enable that one script, I will almost always see numerous other blocked scripts that can remain suppressed without a problem for me. Most of these are related to tracking/advertising. For me blocking the rest of the scripts is well worth having to play around a bit when I first visit a new website.
superkuh 8y ago
I'm on ~5 years of temp-whitelist only for JS domains. I have acquired a third sense for which CDN and assort domains are really required for what. Sure, it does take some back and forth testing, and some sites like wix.com sites are terrible no matter what, but in general it's a better browsing experience.
- jandrese 8y ago
  My favourite are pages that embed videos using a huge collection of different third party embedding tools. It usually takes 2 or 3 rounds of whitelisting to get the video to even show up, and another to get it to play.

c487bd62 8y ago

This is coming right after the reCAPTCHA v3 announcement https://news.ycombinator.com/item?id=18331159 https://news.ycombinator.com/item?id=18331159 Sorry, you don't have enough Google Points to browse the web. Please enable JavaScript and install Google Chrome.

doorbellguy 8y ago
Haha yeah, thanks for the recommendation Google. Chrome is never gonna come back on my PC.
Crontab 8y ago
Google has becoming increasingly annoying. Every time I browse from work, where I have to use Internet Explorer, I have to suffer Chrome ads. They also require me to solve a Captcha every time I change the number of results per page via the search settings.
afandian 8y ago
Recent new version of Google Mail flat out doesn't work to any usable standard in Firefox. Ten seconds to open a new 'compose mail' window. A context menu does a multi-second HTTP fetch before showing. The previous version worked great. Either the dev team has just given up on quality or they're intentionally goading me into installing Chrome. I'm not going to play that game -- at this point Thunderbird works better.
- sjroot 8y ago
  What version of Firefox are you running? You are either exaggerating greatly or have other issues with your system. I run the latest stable release of Firefox and the performance of Gmail (particularly the features you mention) is fine. I’d be happy to upload a screen recording to verify.
  - tyfon 8y ago
    I have a lot of issues with google apps for business. Sometimes I have to refresh the browser 5-6 times before it will display any email in the primary inbox as well. It's just horrible to use in firefox (in arch linux) and I'm currently looking for a new provider. I might just go all in and use protonmail.

bluetidepro 8y ago

I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?

tree_of_item 8y ago
You're misunderstanding: you browse with JS disabled by default. Random sites shouldn't be running programs on your computer. If you trust the site, you whitelist it.
- diminoten 8y ago
  You're acting like "running programs on your computer" is a bad thing. It's not.
  - vageli 8y ago
    Running untrusted code on your machine _is_ a bad thing though.
    - diminoten 8y ago
      Yeah, because permissions, sandboxing, and access controls don't exist. Oh wait, they do, and they work, so you're wrong.
      - cesarb 8y ago
        Even setting aside things like rowhammer and spectre, something like half of the browser vulnerabilities need Javascript to be exploited.
      - hueving 8y ago
        No, they don't always work. We have bullet proof vests but it's still not safe to put one on and have someone start shooting you.

saagarjha 8y ago

I find it kind of humorous that the "mobile demo" seems to have been made on a Mac, complete with a cursor, and then resized to have a mobile border around it.

ouid 8y ago

I don't want google to protect me in this way. Can I opt out?

ravenstine 8y ago
Don't use Google?
- Figs 8y ago
  That is unfortunately not a practical option for many people whose school or workplace forces use of GMail.
greglindahl 8y ago
Good luck with the introduction of Captcha v3.

arkadiyt 8y ago

As others have mentioned, nearly the entire internet breaks without javascript - it's a sad state of affairs. One protection I like to use is to disable javascript that is loaded over plaintext http - this breaks nearly nothing, and is easy to do via Chrome settings: https://i.imgur.com/NRVg5Xf.png https://i.imgur.com/NRVg5Xf.png

snowwrestler 8y ago
Chrome will always block an HTTP javascript call by an HTTPS page. So given the growing prevalence of HTTPS, I think this setting is probably doing less and less for you.
- yjftsjthsd-h 8y ago
  And therefore, this setting is safer and safer to enable:)
anonunt 8y ago
I browse without javascript all the time, sometimes i need to switch to another browser to buy something from some random site, but generally its just a faster better internet with very dodgey sites self selecting themselves out of my usage. If there is one or two sites i really want to use in my main browser that need JS i can white list that site - but only exactly that site. I am not an expert but it seems a better experience to me and i don't really think it make me less secure?

Sephr 8y ago

Chrome team members have said that preventing modern web browsers from leaking enough entropy to uniquely identify users across sessions (fingerprinting) is impractical with all of the features that the modern web provides. This sentiment has probably lead to some at Google to think that it is justifiable impose pervasive tracking and surveillance technologies as a condition for using Google services. Look at the new ReCAPTCHA v3 to see how fingerprinting is trending at Google.

mrep 8y ago
Do you have a better solution for differentiating yourself as an actual user from a robot spammer?
- kibwen 8y ago
  Being allowed to pay for services with money, rather than being required to pay for services with your personal data. I browse the web via a proxy when I'm on public wifi, and Google is nigh unusable with how many captchas it forces you to solve to do a single Google search. Fortunately Bing and DDG still work, for now.
  - tzs 8y ago
    > Being allowed to pay for services with money, rather than being required to pay for services with your personal data One possible big disadvantage for a site owner in letting people pay with money instead of data is dealing with taxes. I'm not actually sure how most jurisdictions tend to classify it when someone comes to your site and you charge them to access your content. My guess would be it would be taxed the same way they tax digital goods such as downloadable software that does not include any physical components. For such goods most jurisdictions that tax them seem to base the tax on the buyer's location rather than the seller's location, so the seller has to deal with charging the appropriate tax and filing returns for potentially a large number of jurisdictions. If the seller is providing the content for "free" and making their money selling visitor data to advertisers then their income will probably only be subject to taxation in their own jurisdiction. It will simply be ordinary business income.

kps 8y ago

Amusingly, the article is perfectly readable with javascript off, but with only first-party js allowed, it's blank.

yesenadam 8y ago
Ohh that is interesting. Anyone know why that is?
- cesarb 8y ago
  Blogger (which is what hosts this article) includes a copy of the whole article within <noscript> tags. If you completely disable Javascript, the browser shows the content of these tags, so the article is visible. If you have Javascript enabled, even if all domains are blocked, the content of these tags is hidden, so the article show as a blank page. You have to unblock the third-party domains where Blogger hosts its scripts to make the article appear again.

deleted 8y ago

[deleted]

todd3834 8y ago

This seems reasonable to me. JavaScript is being used everywhere and most people are okay with it. As a business decision I don’t see why Google would support such a small edge case. That being said, if they feel like explaing why they should maybe try a little harder. I assume most people with JavaScript turned off might appreciate more details so they can decide how to respond to the requirement. Then again, their current approach actually seems reasonable to me.

dimgl 8y ago
99.9% of users are okay with JavaScript.
- cm2187 8y ago
  99.8% of users don't know what javascript is.
  - lerax 8y ago
    Thus only 0.1% of users know what javascript is and it's okay with it. That is an interesting random stats, seems pretty realistic. I at least liked it.
    - ekianjo 8y ago
      Thats the wrong take on the stats. It means among the ones who know, half of them dont want it. This is more telling that looking at the 0.1%.
      - notatoad 8y ago
        it would mean that, if it's a real stat and not just something that was invented on the spot.
      - jake_the_third 8y ago
        Then if we take this 0.2% as representative (and 6 million out of three billion users probably is), it would be fair to say that this 50% split would scale if more people learned about javascript. Google will be in hot water if humanity ever decides to take on javascript.. assuming the source for those states aren't someone's ass.

Zelphyr 8y ago

I'm getting tired of Google dictating how the web should work. That's the job of standards bodies. Google is increasingly taking the place of overbearing overlord that Microsoft embodied in the 90's and early 2000's.

Operyl 8y ago
Google is dictating how signing into their account system on their properties works, not login forms for _every single site_.
- Zelphyr 8y ago
  You're right. My comment is out of place in this particular instance. But there are plenty of other examples where Google does have too much power and influence.
- greglindahl 8y ago
  Google's policies get exported. For a long time it was OK to drop email that came from a server without rDNS. Then gmail started allowing such emails, and then legit sites started sending email from servers without rDNS. In this case the export mechanism is Captcha v3.
  - asdfasgasdgasdg 8y ago
    So you're saying you're getting tired of everyone else copying Google's behavior?
- ndnxhs 8y ago
  Google is quickly becoming the login form for every website. And even if the website has its own login it will always have recaptca
  - Operyl 8y ago
    I wouldn't blame Google for this phenomenon, though. They provided a solution, others were quick to jump to and use said solution. Might be better to complain to the sites following the herd then?

rinchik 8y ago

Is there an alternative to gMail? Just tried Protonmail and Fastmail, both require JS.

0xb100db1ade 8y ago
ProtonMail requires JavaScript for client-side encryption. You can use a non-web client, though.
TheDong 8y ago
Yeah, use mutt or thunderbird. Conveniently those both work with either fastmail, gmail, or any other popular IMAP-compatible email provider.
dredmorbius 8y ago
Protnmail requires JS, or offers an app (Android/IOS). But it doesn't infect uncountable other websites.

brunoTbear 8y ago

ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss of one account being popped is likely far greater than the privacy loss of thousands of users' browsing patterns being correlated. tl; dr: Good luck detecting and preventing automation of sign in pages at scale without robust JS based defenses. I think there's a shortsightedness and self-centeredness to a lot of these comments.

Forge36 8y ago
Even when I ran noscript Google domains were allowed. It's extra step for a small number of technical users.
greglindahl 8y ago
Calling other people, or their opinions, shortsighed and self-centered is usually not the start of a good conversation.
- brunoTbear 8y ago
  You're right. I was shortsighted and self-centered.
- kadendogthing 8y ago
  I mean, why not cut to the chase?
- duxup 8y ago
  I'll be the guy who says that while I recognize those are insults, they are also sufficiently descriptive of a point of view... it's not like he called someone Mr. Poopypants.
- coldtea 8y ago
  To a good conversation no. But not always is a conversation what's desirable. Sometimes one just wants an accurate depiction of a situation -- and those might still be totally accurate characterizations...

kwoff 8y ago

How is this nonsense upvoted on hackernews..?

dang 8y ago
"Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
brunoTbear 8y ago
It's surprising to me how many users on HN can only think as far as their own browser. Really the question here is not "what's the harm of JS across the web" but rather what is the specific privacy cost of running JS on a sign in page and what is the security benefit of the same. The worst case cost of JS on a browser is that you get a drive by download and your endpoint is owned. This seems unlikely on a Google domain. The other, more normal, case is that a user is concerned about ad tracking. Providing an ad tracker on a sign in page seems pretty lame, and I'd be surprised, again, if Google was doing that. The security upsides are likely several: anti-automation, anti-phishing, and an opportunity to track state-level adversaries who target users' Google accounts. I don't know how others weigh these factors, but to me it seems entirely obvious that this is a good idea. Could the blog post have better laid out this case? Sure.
- lovich 8y ago
  Why would google not at least have an incentive they'd have to work against, to add tracking into their sign in pages? They make all of their money off of ads and they do that by tracking people to target ads. You might as well say people shouldn't take precautions swimming around sharks, because it's rare and be surprising if they attacked
  - magicalist 8y ago
    > Why would google not at least have an incentive they'd have to work against, to add tracking into their sign in pages? You're signing in. That's literally asking them to identify you across pages so you can have access to them.

largehotcoffee 8y ago

Death to n o s c r i p t

Kiro 8y ago
I agree. I instantly IP ban anyone using noscript on my site.
- yjftsjthsd-h 8y ago
  If you're serious, I would much appreciate an explanation for why you would do such a thing.
  - Kiro 8y ago
    I love JavaScript and hate NoScript.

monochromatic 8y ago

I don’t remember the last google story that made me think “wow, what a cool idea.” That used to be the norm. Now it’s “ugh what happened to y’all??”

deleted 8y ago

[deleted]

userbinator 8y ago

What a bunch of, excuse the language, paternalist fear-mongering bullshit. Of course Google wants you to enable JS, because it allows them to monitor and track everything about you more easily. Twisting it into "this will make you safer" is sad and undeniably repugnant. I've noticed a lot of other sites practically begging you to "enable JavaScript for a better experience", when all their content is static text and images. I fell for that once, a long time ago --- enabled JS briefly to see what the big deal was --- and was promptly bombarded with popups, slide-overs, and even more ads. No thank you, I'll keep it off. For many years I used IE6 with JS off (and a whitelist for a very, very small number of selected and highly-trusted sites. IE has a "security zone" feature which to my knowledge no other browser comes with by default.) Not a single malware infection, and that's despite often visiting the... shadier parts of the Internet. Browser exploits are almost all JS-based, and even the few that aren't, are in practice deployed using obfuscation involving JS, to make analysis and detection harder. Turning off JS effectively kills those risks as well as other annoyances (blocking right-click, text selection, injecting crap into copied content, etc.) IMHO the advantages of not having JS on by default are underrated. I'd consider ~99% of the sites I come across when searching for content to not require it at all, which certainly is a stark contrast from the "you'll break the Internet!" screams of the JS-advocates and "web designers". Sites that "break" from not having JS, and which aren't specifically "appsites" but mostly content-sites, are not worth visiting anyway. Perhaps it's time to raise a counter-movement, and add (via <script> tags, of course) "you have JavaScript turned on in your browser, this is a security risk! Click <here> (link to appropriate page with all the risks and how to turn it off) to learn more." Or "You have JavaScript enabled, please disable it for a better experience." If a certain vocal minority managed to demonise Flash (another powerful technology that had major uses) to almost completely kill it, maybe the same can happen for JavaScript?

throwawaymath 8y ago
> Browser exploits are almost all JS-based, and even the few that aren't, are in practice deployed using obfuscation involving JS, to make analysis and detection harder. Go take a look through Pwn2Own. Most browser exploits do not involve JavaScript. JavaScript can be a delivery mechanism for a certain class of payloads, but it's not the substantial weakness in browser vulnerabilities (as opposed to web application vulnerabilities). Given that this isn't familiar to you, I'd recommend you reevaluate how confident you are in the JavaScript-focused defenses you've outlined in the rest of your comment.

h43z 8y ago

I tried to live with javascript disabled by default but gave up after two months because all I did was white-listing every page I opened. Gave up on my own side projects too. Building something that works with and without javascript is just to much work for me and it becomes ugly quickly. I still think modern websites over use javascript too often and should use markup over code whenever possible. And of course no one wants to go back to iframes to load dynamic content. Or should we?

the_clarence 8y ago
Same thing with littlesnitch
singularity2001 8y ago
try again with noscript allowing main page by default but not 3rd party.
- h43z 8y ago
  I think that most of the annoying (but non breaking) javascript is already covered by ublock.

colemickens 8y ago

I try hard not to be a luddite as I age, but this level of automation and machine learning is so concerning. It is SO frustrating to accidentally appear as a bot and get stuck at the mercy of an automated system. I was on some random site the other day and spent 3+ minutes solving Captchas until it finally let me through. I thought I was losing my mind. I don't spam, I don't automate queries, I come from an IP that has two residential users (netflix, xbox traffic dominate everything). Who knows what I did to offend the algorithm.

perl4ever 8y ago
I was getting a persistent but unhelpful error message from an airline website while trying to change my reservation shortly after midnight. I assumed at first I just hit the maintenance window and should try again in the morning, but now I am reading this thread and wondering if it's a deliberate obfuscation that it deemed my connection suspicious.
jgaa 8y ago
Google captchas appears (to me) to be designed to identify individuals, not to separate anonymous users from machines. Google want to know exactly who you are, when they harvest your visits and behavior on almost all sites on the Internet.
- colemickens 8y ago
  I don't understand what this has to do with the fact that I repeatedly am having to prove that I'm not a bot despite doing nothing that ought to be triggering Captcha checks. But hey, I guess mentioning this simple observation is worthy of numerous downvotes here. Always lovely.
justtopost 8y ago
I get this constantly. Its the new digital ghetto google has created.

marcrosoft 8y ago

This reads like an April fools joke.

bonsai80 8y ago

"But, because it may save bandwidth or help pages load more quickly, a tiny minority of our users choose to keep it off" Yeeaaah Google. Thaaaat's why we don't load JavaScript from you ;) I get it they can't make this opt-in and expect many to use it, but it'd be nice to see an opt-out be made available.

CivBase 8y ago

Yah, but what if I want to be able to log into my account using a script? I know I'm in a tiny minority, but I have on several occasions had to use selenium to automate actions on a web app. For this reason, captchas are similarly annoying to me.

modzu 8y ago
no hax0r, no soup for you!
asdfasgasdgasdg 8y ago
Isn't that what Oauth is for?
tetromino_ 8y ago
If you want to automate your actions, you should get an API key and use the official APIs.
- CivBase 8y ago
  I wish official APIs were available for everything I want to do.

modzu 8y ago

coming soon: we noticed you are in private browsing mode. to keep your browsing secure, please sign in with history enabled.

ndnxhs 8y ago
Nooo, google wants you to think you are in private browsing mode so you share more secrets with them. They will just collect it all no matter what you do.

duxup 8y ago

I'm not really sure how it works if you don't want to use JavaScript, do you then whitelist sites that you're ok with it? Wouldn't the solution for folks who don't want to run JavaScript just to whitelist it for Google? Maybe I'm missing something but that seems pretty simple, would let Google do their thing and the folks who don't want to run it run it just for Google and places they want to. If someone already doesn't trust Google, I gotta think they abandoned their products entirely already. Google's data collecting is so complete that JS or not, same objections.

sunsetMurk 8y ago
Yes, practical.
hnzix 8y ago
> pretty simple, [] let Google do their thing Unfortunately El Goog is now a de facto monopoly both for makers (organic traffic) and users (AMP, discovery, federated logins etc). I'm not angry at Goog for winning, they did it by (mostly) being 100x more awesome than the competition and surfing the network effects into the endgame. But here's the elephant in the room: outside walled gardens, Goog runs da tubes, and they're not as fluffy as Mr Cutts would have you believe. Mandatory JS and AMP are the not-even thin end of the wedge.
- duxup 8y ago
  It certainly is it's on monopoly, but at least for personal use folks who don't like JavaScript can avoid it if they really want. Just generally this decision for logins and javascript seems pretty... not a huge deal IMO for folks who aren't a fan of JavaScript, whitelisting google seems like a pretty simple choice.

martin1975 8y ago

JavaScript is fast becoming, if it hasn't already, the next rich GUI framework... It was supposed to be just touch up on HTML, now you can't sign in anymore w/out JS enabled. What if I wanted to do a rich client in C# or Qt? Do I need a JavaScript engine to sign in?

Spivak 8y ago
Yes, plenty of apps allow you to sign in with Google -- they open up an embedded web browser for the sign-in dialog and oauth permission screen.

PeterHK 8y ago

i have javascript disabled mostly to save bandwidth against nasty ads. Most sites that requires JS i usually ignore if possible (seriously why do some content provider think its ok to require JS?). For certain things like soon google login i do just whitelist them. But by default if i do not trust your site enough and/or its not that important in the end ill just close my tab

ghop02 8y ago

What many of the comments seem to be missing is that you don't need to enable javascript on all google sites, only the sign-in page. With that in mind, I don't think there needs to be as much concern as we're seeing here.

pdkl95 8y ago
This kind of apology for a problematic change misses how allowing small changes eventually normalizes the change[1], allowing another similarly "small" step to be taken in the future. Today it's "just the sign-in page"; tomorrow it will expand to cover something else because "it's already something you're used to using on the sign-in page". It's rare for major changes to arrive all at once. Small steps are taken, with each eventually becoming the new normal that allows another small step to be taken[2]. This isn't always intentional - each small step can seem rational at the time, in isolation. [any replies complaining about "slippery slopes" will be ignored; the normalization of deviance does not mean change necessarily will follow, just that normalizing incremental changes allows people to support changes without noticing the larger picture] [1] https://en.wikibooks.org/wiki/Professionalism/Diane_Vaughan_and_the_normalization_of_deviance https://en.wikibooks.org/wiki/Professionalism/Diane_Vaughan_... [2] https://en.wikipedia.org/wiki/Overton_window https://en.wikipedia.org/wiki/Overton_window

wowamit 8y ago

It is so difficult to explore anything that Google announces without passing it through the lens shaded by their ad business model. It doesn't matter with what intention they implement a change or if those intentions are pure. Sure, this will make the login secure by preventing credential stuffing. But doesn't this also help them get more data from users who preferred not to by disabling JS? And was this the best and only solution to tackle this problem? I believe internally too, Google must struggle with this perception.

dcow 8y ago

Google is not in my internet hot path anymore. So, good for them. DDG & ProtonMail work just fine.

jhabdas 8y ago

With regards to NewPipe, you don't need to sign in to enjoy streaming YouTube in 4K (where supported).

guest0001 8y ago

"When your username and password are entered on Google’s sign-in page, we’ll run a risk assessment and only allow the sign-in if nothing looks suspicious." In my experience (it is already the case with gmail and outlook up and now), this means I will not be able to login to my account when in holiday in another city, country, or when I use a borrowed device, or when I am behind VPN/Tor, etc, unless I give google my phone number, and can afford to get a call / sms at that point of time and unblock the account. It should be my choice, as it is my account that is at risk, to turn on/off such dubious security measures. It is fine to have these features on by default, but I would like to turn this particular feature off for my account. Any clever "risk assessment" thing where a computer decides without an option to turn if off/on is problematic. I have sometimes the feeling they know this and it is on purpose. They want not only to collect data, they want to collect high quality data and these measures help to clean their data sets at time of collection.

realusername 8y ago
> In my experience (it is already the case with gmail and outlook up and now), this means I will not be able to login to my account when in holiday in another city, country, or when I use a borrowed device, or when I am behind VPN/Tor, etc, unless I give google my phone number, and can afford to get a call / sms at that point of time and unblock the account. That's exactly it, there's already two Gmail accounts from high school I can't access despite knowing the passwords.
zuzun 8y ago
I also have no faith in their risk assessment. For a very long time I have only used one computer from one location to log into my Gmail account and every time I log in they consider it a suspicious activity. They even forced me to confirm my identity on my last login. What's their risk assessment doing if it can't get the baseline right?
- NullPrefix 8y ago
  What makes you think that their end goal wasn't getting your identity confirmed?

amelius 8y ago

Just remember that CSS3 is already Turing complete.

scoot_718 8y ago

Okay. No more Google account. So that means I miss out on... What exactly?

aembleton 8y ago
The Play store if you're on Android
- jgaa 8y ago
  I don't have a Google account on my new Android phone. I get my apps from F-Droid, or I write them myself.
trulyrandom 8y ago
Everything in the Google product suite, clearly.

naijabb 8y ago

Talking of protection.

enriquto 8y ago

This is a sad state of affairs. However, notice that once you are logged-in into gmail, you can still disable all javascript and go to https://mail.google.com/mail/h/ https://mail.google.com/mail/h/ for a somewhat reasonable user experience. It is best to run gmail on a separate, private browsing window, so that it does not interfere with normal web browsing (i.e., make sure that other websites such as google search cannot see that you are actually logged into gmail).

mike_hearn 8y ago

When I was at Google I started both the login risk analysis project and the Javascript-based bot detection framework they're now enforcing, so it's a pity to see so many angry comments. Maybe a bit of background will make it seem more reasonable. Firstly, this isn't some weird ploy to boost ad revenue. This is the login page - users are typing in a long term stable identifier already! The Javascripts they are requiring here are designed to detect tools, not people. All mass account hijacking attacks rely on bots that either emulate or automate web browsers, and Google has a technology that has proven quite effective at detecting these tools. There's a little bit of info on how it works scattered around the internet, but none of the explanations are even remotely complete, and they're all years old now too. Suffice it to say: no JS = no bot signals. Google had the ability to enforce a JS-required rule on login at least 6 years ago and never used it until now. Without a doubt, it's being enforced for the first time due to some large account hijacking attack that has proven impossible to stop any other way. After so many years of bending over backwards to keep support for JS blocking users alive, it's presumably now become the weakest link in the digital Maginot line surrounding their network. For the people asking for the risk analysis to be disable-able: you used to be able to do that by enabling two-factor authentication. You can't roll back your account to just username and password security though: it's worth remembering that account hijacks are about more than just the immediate victim. When an account is taken over it's abused and that abuse creates more victims. Perhaps the account is used to send phishing mails to your contacts, or financial scams, or perhaps it's used to just do normal spamming which can - at enough volume - cause Gmail IPs to get blocked by third party spam filters, and user's emails to get bounced even if their own account is entirely secure. The risk analysis is mostly about securing people's accounts, but it's also about securing the products more generally too.

mysterydip 8y ago
I understand what you're saying and it makes sense. I think in my mind it's the fact that javascript has the potential to do so many things, not that it's being used that way today. To use a bad car analogy, the in-car entertainment used to be just a dumb radio. Now that it's a computer connected to the main car network, it has a lot more potential to do things, whether it's a feature, bug, or an exploit.

jgaa 8y ago

Why would anyone who cares even a tiny bit about security or privacy ever want to sign in to Google?

h2onock 8y ago

I don't get the same behaviour as what is shown in the screenshots of the google blog. If I go to Google, disable JS and click on 'sign in' I go to an 'account chooser' page. From there, no matter what I do I end up being redirected to that same page. Not great UX from Google if others experience the same as me.

lucb1e 8y ago

So I'm wondering, all these automated detections and CAPTCHAs... how does that tie in with automated decisions being made about you under GDPR? They're trying to protect us from bots, but those decisions are also made by bots. What if their bot makes a mistake? Does that count as an automated decision under GDPR, for which I should be able to ask a human for a second opinion?

hjorthjort 8y ago

> But, because it may save bandwidth or help pages load more quickly, a tiny minority of our users (0.1%) choose to keep it off. That's a gross misrepresentation, isn't it?

Ensorceled 8y ago

A lot of the arguments in this thread sound like the people who don’t want to vaccinate their kids. Right down to not giving a shit about “herd immunity” - not caring if their hacked account is used to attack their less informed friends and family.

arendtio 8y ago

When Javascript becomes the new pillar of security something has gone terribly wrong. Background: I love building Single Page Applications, Progressive Web Apps and have JS always enabled. So no hate for JS in general, but when your security depends on the correct evaluation on the client side, you are starting a dangerous cat and mouse game.

neolefty 8y ago
They've been playing a dangerous cat and mouse game the whole time — I'm sure the old tools are not being discarded; just added to.

kakarot 8y ago

We can argue back and forth about the pros and cons of requiring JS. But one thing we can't argue about is the loss of security for political dissidents and other non-protected groups who access Gmail or other Google services through systems like Tor. No, this isn't Google's problem, but it illuminates what kind of purpose Google believes its products should serve, and what kind of people it should serve.

dijit 8y ago

I think this is a really braindead argument. Of course users are going to use javascript more, the more the internet demands it, the more people will be willing to allow it. When I first started using noscript there were few exceptional sites which didn’t work and I didn’t bother with them after, if that was the majority of sites, I would probably just disable noscript. The idea that I _have_ to let your site run code on my machine is only laughable when it’s an exception, the problem is the industry. And google is telling the industry that it’s ok. edit: yes, I understand; I'm over the hill and you all absolutely love shoving javascript down peoples throats, I get it. But please take a moment to consider... not? maybe you have a financial incentive to avoid thinking about the ramifications you inflict on others, maybe you're paid to be a JS dev. But really, if you're making the web worse, I will not cry for being downvoted, just know that I hate you. :)

arcticfox 8y ago
> Of course users are going to use javascript more, the more the internet demands it, the more people will be willing to allow it. I think you have this backwards; the vast majority of users like the benefits of js-enabled sites, so they get built. That ship has sailed long ago.
- dijit 8y ago
  Even so, making the assertion that: "javascript adoption in the browser will increase in future, therefore we will enforce javascript" is like saying: "more people will have passports in future, therefore we require passports to get a bus pass". By doing that; you make it true.
  - horsawlarway 8y ago
    It's already true. You can quibble over who's fault it was, but it really doesn't matter at this point. The web serves code that users run. That's because the web is the best distribution medium for code we've ever seen. I bet you've also installed client side applications that came from the web, on a vendor installed OS that came from the web, and drivers for your machine that came from the web.

hpcjoe 8y ago

This is unfortunate. On all my phones, I find the most annoying malware is spread via javascript. I'll get onto a page I read a few times a day, and suddenly, thanks to ads, I am served some javascript malware that attempts to tell me "my PC is infected" or other such garbage. I grouse, turn off javascript, clean my caches, and then everything is copacetic for a bit. If this means that, thanks to google's decision, that I must in no uncertain terms, have javascript on in order to interact with their product line, then I need to weigh risks and benefits. Not proclaim loudly that I will run away from the google ecosystem, as many are likely proclaiming in this forum. But weigh the risks of using products which require me to be vulnerable to attacks, versus alternatives. From the viewpoint of google, you don't want your customer to ever be in that position. As it is an arms race against bad actors, and forcing users to effectively lower their defensive posture means you really ... REALLY ... need to up your game on value for this to be even net neutral relative to previous state. Given how completely horrendous google's customer support is, and how incredibly hard it is to administer basic stuff (it took me more than 1/2 hour! to search and find out how to close an unused business g-suite account, which I couldn't do, until I manually disconnected from a marketplace product ... where this disconnection was also hidden ... google doesn't do ux/ui worth a crap, and has no real support for smaller users), I am not sure this is in their best interests. I am sure there is a product manager trying to pull them back from this ... somewhere ... Or at least I hope so. Basically the risk calculation is when where you look at something holistically. Is using the google universe worth the risk that universe forces you to accept? Part of the reason that facebook is in user count freefall, is this inherent risk. You are volunteering info that advertisers are dying to get, and they are the ones paying facebook. You are a packaged product, you can be microtargeted, and various bits of self-serving posturing over election non-interference and account termination aside, they haven't quite grasped that this intimate relationship brings substantial risk for participants. I've dropped messenger from my phone, and am about a few months away from dropping facebook from the phone. I don't need it there, and the risk to me is far higher than the "value" it brings. Back to google. You don't want customers thinking this. You want them happily and securely playing in your garden. You don't want to force them to go out without their armor. Turning off javascript strengthens that armor. Forcing it on strips users of their most important armor. Put more simply, bad google, bad.

throwawaynpc123 8y ago

AI should be able to defeat it by copying real users, it would require a full browser running tho.

coldacid 8y ago

If you're an Amiga user, Google is now dead to you. As far as I can tell, none of the browsers available for the Amiga platform support JavaScript.

Animats 8y ago

How long until you have to sign into Google to search? They already pop up messages trying to trick you into logging in to "adjust your settings" or "improve your privacy" or some such.

nofunsir 8y ago

So many Google/Javascript shills in this thread. Quick poll: how many of you rely on Javascript for your income?

sireat 8y ago

Thank you Google for making me investigate alternatives. I am serious, I've been using gmail since 2004. I realize some day my main account is going to be permanently inaccessible just because I will be in the "wrong" country or will be using the wrong browser in the wrong cafe. There should be no need for Javascript with proper 2FA. Your algorithms already make me solve ridiculous captchas "some" of the time.

bogomipz 8y ago

The post states: >"When your username and password are entered on Google’s sign-in page, we’ll run a risk assessment and only allow the sign-in if nothing looks suspicious. We’re always working to improve this analysis, and we’ll now require that JavaScript is enabled on the Google sign-in page, without which we can’t run this assessment." Is the idea that an actual browser will be able to have a fingerprint whereas a bot would not? Is the check for a javascript a way to short-circuit responding to a non-browser based request? It wasn't clear to me.

justtopost 8y ago

Goodbye google. Wanted to leave, but was lazy. Thanks for focing my hand, and those of thousands more.