5 ms·
Sorry, but at this point it is pretty obvious that big tech companies care about account security only as far as it impact their services. The late revelation a
by gambler 8y ago
Sorry, but at this point it is pretty obvious that big tech companies care about account security only as far as it impact their services. The late revelation about Facebook abusing 2FA phone numbers for marketing is a great demonstration of how that works.
Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number. Even when those accounts are just used for browsing and bookmarking, without sending any outgoing information.
>When an account is taken over it's abused and that abuse creates more victims.
Pushing JavaScript everywhere increases the attack surface for every single user on the web. Except it doesn't happen overnight, and big companies who do it (by affecting standards, or by doing stuff like this ^) aren't affected by client-side exploits and privacy loss.
If someone hijacks my browser through some clever JS API exploit and steals my credentials, what is Google's response? "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? "They should authenticate through us." All roads seem to conveniently lead to centralization.
BTW, it is worth noting that the impact of a compromised account isn't nearly as significant if a single account doesn't hold keys to pretty much everything you do online. Somehow this is rarely factored in during such discussions.
- danso 8y ago> Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number. Well yes, these kind of accounts are highly susceptible to being bot accounts. What obligation does Google have to be the place for people's free, anonymous accounts? In any case, I haven't had a problem with the number of secondary accounts I've created that are tied to me only by another email address (which can point to another provider, like Yahoo). > BTW, it is worth noting that the impact of a compromised account isn't nearly as significant if a single account doesn't hold keys to pretty much everything you do online. Somehow this is rarely factored in during such discussions. How should this be factored into the current discussion? The use of JS is to ostensibly make it more difficult for automated hijacking to prey on users.
- drb91 8y agoThis is true. Google has explicitly never put the user first. We should be grateful to give them our information in the first place in the way they deem is best.
- danso 8y agoSorry if I don't agree that giving Google a throwaway email address is a significant concession of personal information. Which free services do you recommend that do things better?
- shittyadmin 8y agoYou can't give it a throwaway email address - they want your phone number now and will accept nothing less in my experience. If that doesn't appear true for you, try over Tor and you'll see what happens to many people...
- proneb1rd 8y agoI am surprised to see a long thread about nothing. Google does force you to give them your phone number and they do not let you register new emails after you hit some limit.
- danso 8y agoI just tried creating a new account from a VPN, using a browser that I haven't used to log into Google previously. It allowed me to create a new account without a backup phone or email, and allowed me to send an email. How does Google know you've hit a limit when you've registered new emails? And, not to belabor the point, but why should they be expected to give you unlimited number of free accounts -- or, what service do you recommend that will be that generous?
- drb91 8y agoI mean they could accept my cash instead of offering a service paid for with your information. Oh that’s right, they’ll never give the consumer power over their data because that’s google’s entire value proposition.
- joshstrange 8y ago> "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? I'm not going to say that providing 2FA is "free" in the time sense (both in implementing it initially and supporting people who lock themselves out) but on the surface 2FA requires just a library to verify 2FA codes and a column in your users table to store the shared secret.
- detuur 8y agoYeah it's a bullshit argument. 2FA is a very cheap solution to a problem that could end up very expensive. If you can afford to (securely!) store account information and have a login infrastructure, 2FA is a minimal amount of effort to implement. You could add 2FA from scratch in less than 50 lines of code and one extra column in your account DB. There's no excuses.
- gambler 8y ago>2FA is a very cheap solution If you don't know the technologies the website is built upon or how much it will be impacted by increased barrier of entry for users, this statement is baseless.
- Natanael_L 8y agoWho uses malbolge to create servers?
- Filligree 8y agoI take offense at your tone, and the implied judgement. Malbolge was the right tool for us, and let us tap into a talent pool that was otherwise going unused.
- bgilroy26 8y agoIf a website is smaller it may not be sticky enough for a user to feel they get enough value to put in the effort to do 2FA
- signal11 8y ago> Pushing JavaScript everywhere increases the attack surface for every single user on the web. I understand where you're coming from, but most users browse the web with Javascript = on. Even as a NoScript user I have Google whitelisted because most of their services are unusable without Javascript. Even automated tools have good Javascript engines now thanks to headless mode in popular browsers. I suspect the next steps in browser security will not be to blanket-deny scripting, but instead focus on containers and sandboxing to make script-based attacks less worthwhile.
- pentagonpapers 8y agoDoes anyone know of a good way in NoScript to block say, facebook.com or google.com, except when I am on those domains specifically? When I am using FB I do want it to work.
- gambler 8y agoI am not talking about merely enabling JavaScript. I am talking about normalizing more and more APIs accessible to every website I visit. Sound. Canvas. 3D. Local storage.