Thanks Mike, so the way I understand it, roughly it works like this: JS tries to gather some set of information about browser's environment (capabilities, netw

Thanks Mike, so the way I understand it, roughly it works like this: JS tries to gather some set of information about browser's environment (capabilities, network access, reaction to edge-cases, …) sends it to google and google decides if they should allow user to continue authentication (by providing crypto signature of request+nonce or smth.like that… or just by flipping key in session)