12 ms·
Google bans niche browsers from Gmail?
- dTal 7y agoScreenshot: https://imgur.com/a/wfi3hFR https://imgur.com/a/wfi3hFR I have reproduced this on OpenSUSE Tumbleweed, with stock Falkon browser (QT+Webkit) and javascript enabled. I have confirmed that this is accomplished through UA sniffing. I reproduce the message in plaintext below: Sign in with a supported browser To help protect your account, Google doesn’t let you sign in from some browsers. Google might stop sign-ins from browsers that: Don’t support JavaScript or have Javascript turned off. Have unsecure or unsupported extensions added. Use automation testing frameworks. Are embedded in a different application.
- shantly 7y agoJust tried Links, doesn't work. They let you try, presumably because they like fucking with people, but then block you when you successfully log in. Time to get off my ass and switch email providers, finally. [EDIT] incidentally, is this what we can expect to see on more and more sites as Google's new version of Recaptcha rolls out?
- ad404b8a372f2b9 7y agoWhich provider do you intend to switch to? It's something I've been meaning to do for a while but haven't had the time to research alternatives.
- shantly 7y agoProbably just fastmail. I have trouble justifying the higher expense of maybe-more-secure options like Protonmail when really 99% of my use of email is transactional stuff or (product, job) alerts or updates. I've trialed them a couple times for side projects that never went anywhere, and they seem nice enough.
- reaperducer 7y agoI think you'll like Fastmail. I moved from Gmail in January, and was surprised that the spam protection is even better than Gmail's. I still have a few Gmail accounts for clients, and my Fastmail accounts get about half the spam.
- jhabdas 7y agoGet off your ass indeed. It took me the better part of 3 months to close my Google account and get rid of Gmail.
- Causality1 7y ago>unsupported extensions added I find it a security threat that websites are able to tell what extensions I have installed, supported or otherwise.
- RenRav 7y agoOnly a problem with Chrome.
- gpm 7y agoI sort of interpret "unsupported extensions" as "adblockers" - and with the current model of modifying the DOM I don't think it's preventable. Maybe in the future we could run the website in one version of the DOM, hidden from the user, and then have the adblocker make a separate DOM that is displayed to the user. That loses almost all of the anti tracking and most of the security benefits though.
- tpmx 7y agoOpera went through this fight between e.g. 2004-2013. It wasn't really fully resolved until the browser engine was switched to Blink/Chromium. Now, of course Opera is ~indirectly managed by the chinese government, so no-one should be using it. Please just trust me on this one. The desktop browser is now built in Poland (not Norway/Sweden). The remaining technical management is very weak when it comes to things like principles.
- papito 7y agoSon of a bitch. I love Opera. I use it for home and work.
- paulryanrogers 7y agoVivaldi is the spiritual successor
- linux2647 7y agoDo you have a source on China (indirectly) managing Opera?
- tpmx 7y agoA source on China indirectly managing Chinese companies? That is generally speaking a true statement, regardless of which Chinese company you're speaking of. Do you want a source on that?
- tandr 7y agoAccording to https://en.wikipedia.org/wiki/Opera_(web_browser) https://en.wikipedia.org/wiki/Opera_(web_browser) "Opera is a freeware web browser ..., developed by Opera Software, a Norwegian software company, ... with the majority of ownership and control belonging to Chinese businessman Zhou Yahui, founder of Beijing Kunlun Tech and Chinese cybersecurity company Qihoo 360."
- floatingatoll 7y agoWas JavaScript enabled and allowed to run automatically in your browser on *.google.com when you reproduced this?
- dTal 7y agoYes, changing the user agent was all I needed to do in order to be permitted to log in. Not that javascript is required for GMail - it has a perfectly serviceable 'basic HTML' mode. Google's own support document[0] provides a link to it, although notably it's not canonical (the link will be different you than for me (why??)). The same document is now obsolete - it claims "If you're using a browser that isn't supported, you'll see Gmail in HTML view." This is not true, as in fact what you'll see is "up yours, go away". https://support.google.com/mail/answer/15049?hl=en https://support.google.com/mail/answer/15049?hl=en
- buboard 7y agois this why i'm getting "basic HTML view" in my iphone ? i can't even find a link to switch to normal HTML. And if i log out, "take me to the latest gmail" doesn't work
- dvtrn 7y agoI wish this were the only problem I had with gmail on the iphone (because I'm not downloading the app) where switching accounts is essentially a roll of the dice whether or not gmail feels like actually taking me from one account to another. Fixed it in the end by just bookmarking the two account pages separately.
- buboard 7y agothat's the reason i also use the HTML version, to switch between multiple accounts. sometimes one of the accounts will stop refreshing but will not tell me that i need to log in again. and logging out logs out all accounts so you have to start over. i 'll try the bookmarking thing if they ever fix it because now i m stuck with basic HTML version for feature phones.
- dvtrn 7y agoSounds like we're in the exact same boat then, but yes that's basically been the workaround I've had to endure. Would be nice if the feature worked as designed, but this will have to do.
- shantly 7y agoGoogle's the only of the big tech companies where my every interaction with their products leaves me thinking they must let the interns do everything while the presumably-brilliant FTEs eat free snacks and play Smash Brothers all day, or something. Been that way for years. Even their libraries and SDKs and such give that impression. It's so weird. I don't know what's wrong there but it must be some deep-rooted cultural problem, is all I can figure.
- 7y ago
- wtfrmyinitials 7y agoReason number n+1 why Google is bad for the open web
- vernie 7y agoJust use AMP it'll be fiiine...
- brunoTbear 7y agoThat's a pretty big stretch.
- xdcfvgbhjn 7y ago$\lim_{n\to\infty} n+1 = n$
- tomaszs 7y agoGoogle decides what is good for you. You will will be safe!
- mnm1 7y agoHow long before Firefox is considered a niche browser by Google and banned? I'll start holding my breath. It won't be long especially if we, as tech users, continue to promote Chrome to the rest of the world like it isn't the cancer it has grown into.
- seabrookmx 7y agoGoogle funds Mozilla by paying to be their default search engine. I think we'd see that deal cancelled before Google dropped support for Firefox.
- PretzelFisch 7y agoHow would that matter to google though? Better to push the user directly into chrome and then the rest of Google offerings then share ad revenue.
- reaperducer 7y agoGoogle funds Mozilla by paying to be their default search engine. Until it is no longer in Google's interest to do so.
- paulryanrogers 7y agoNo always though. At times and in some markets it has been others like Yahoo
- mnm1 7y agoYup and it'd be easy for them to do so. They could also just keep FF funded with a low market share to pretend like they don't want to get rid of it in the same way that large companies donate to different causes to pretend like they are not the ones causing the essential problems that they are donating to fix in the first place.
- Endy 7y agoThis makes me very glad that I don't use GMail regularly, and the only access I have to it is via IMAP in Interlink.
- luxuryballs 7y agoStop using gmail, it seems daunting but it really only took me a few solid hours to switch all my important accounts to a paid provider like fastmail. Think about how many important accounts you link through email and then think about how, if you don’t pay for gmail, Google doesn’t owe you access to your email or any service at all. It feels great being free and you can setup forwarding so you can pick up the stragglers. You also get the added spam freedom and security benefit of changing both your email and password which is great since we have no idea what leaked email/password lists are floating around out there... it’s like the ultimate unsubscribe!
- bredren 7y agoDo you use google docs and other office tools? I've tried to switch to Dropbox Paper and Microsoft but they feel clumsy or incomplete or spammy or slow compared to Doc and Sheets. I'm looking for a relatively straightfoward set of changes to my major web activities away from google.
- shantly 7y agoApple's office suite is really nice, if you're in that world. I dunno if they do collaborative editing, but Notes does, so they might. If it's gotta be in a browser—IDK, it bugs me having a document editor or spreadsheet program eat so much memory and so many background cycles that I don't feel like I can leave it open and forget about it while doing other things even on a pretty powerful machine without slowing things down and killing my battery, plus they all feel really laggy, so I've mostly stopped using browser-based office tools, period, whenever I can avoid them.
- reaperducer 7y agoPages, Numbers, and Keynote do collaborative editing, even across devies: https://support.apple.com/en-us/HT206181 https://support.apple.com/en-us/HT206181 "Invite others to your documents and work on them together in real time. Collaboration is built into the iWork apps on iPhone, iPad, iPod touch, Mac, and iCloud.com"
- vortico 7y agoThis is why I fake my user agent. I use Qutebrowser (https://www.qutebrowser.org/ https://www.qutebrowser.org/) but pretend to use the most common user agent on this list. https://techblog.willshouse.com/2012/01/03/most-common-user-agents/ https://techblog.willshouse.com/2012/01/03/most-common-user-...
- Pete_D 7y agoThe User-Agent header was a mistake. Servers shouldn't care what my client is, only that it speaks well-formed HTTP.
- PretzelFisch 7y agoThe servers care because for many years clients had no guarantee of handling well-formed html and javascript.
- 0x00000000 7y agoIt’s still a bandaid solution that makes the problem even worse by increasing fragmentation. It’s the best way to make sure browsers never follow any standard and nothing ever gets fixed by shifting responsibility to hundreds of millions of websites individually rather than a few clients
- paulryanrogers 7y agoThis. It reminds me of the recycling campaigns shifting responsibility to the consumer with the transition from glass to plastic. As a web developer though I know the agent shortcut is tempting. Without it I imagine we'd have to wait for a quorum of popular browsers before dropping feature detection for any given capability.
- The-Compiler 7y agoFrom what I've heard, setting a Chrome UA doesn't help with the Google Mail sign-in.
- pugio 7y agoI just encountered this with an Election app (Polarized Bookshelf) trying to do an OAuth flow. I can no longer log in to my account on the app! I'm not actually upset, though. Such is life when you rely on entirely free services provided by another company. It's almost like the role Google plays in my life is that of some natural phenomena, perhaps as seen by an ancient civilisation: omnipresent, inscrutable, unthinkingly capricious. Such is the way is the world, my son.
- tedivm 7y agoGoogle isn't a natural phenomena though- it's a group of people making decisions that have a huge ripple effect throughout our society. Google using it's monopoly powers to restrict how the internet can grow is something we should all take seriously.
- foob4r 7y agoProtonMail with Brave works really well.
- eddieh 7y agoNot if you use ProtonMail for an anonymous Instagram account. Instagram will lock almost all features like following/unfollowing, comments, descriptions, etc.
- brenden2 7y agoI've been super happy with Fastmail, I suggest you give it a shot if you've become as frustrated as I have with Google's products. When they killed Inbox it was the final straw for me.
- dessant 7y agoGoogle is also going forward with deprecating the blocking portion of the webRequest API, it is already in Chrome Canary. The change will break extensions, and will make several use cases impossible which are not related to ad blocking, but center around privacy and security, or just a need to modify requests for various reasons. Their reasoning is so baffling, and technically incorrect about browser performance and security, that there is one conclusion to be made: Google and the Chrome team is dishonest about why they're partially deprecating the webRequest API. Extensions are free to observe requests and page content, and exfiltrate data at will, but you no longer have full control over the requests Chrome is making. It is about control, not your privacy and security.
- userbinator 7y agoIt is about control, not your privacy and security. The big organisations behind browsers have been spinning it this way for years, and unfortunately the majority still haven't realised the truth. It's the same strategy that makes "think of the children" and "war on terrorism" arguments so pernicious --- taking away freedom by reasoning that it's for a cause so "ostensibly good" that no one would be seen arguing against.
- 3xblah 7y ago"... that no one would be seen arguing against." They know some would argue against. What gives this away as "spin" is that they will not make these changes optional. A Google user cannot opt out of signing in with Javascript enabled and permitting a device fingerprint to be taken. Even in the case where the user can accept the risks of allowing sign in without JS, e.g., automated sign-in -- which as we know is very convenient for many HN readers -- there is no way to opt out. For example, the user may have email accounts that she does not use for anything sensitive, throwaway accounts. More savvy users, who truly are concerned about security of Google Mail, might purposely avoid using @gmail accounts for important matters. It is of little benefit to such users if Google fingerprints their devices "in order to keep [those] accounts safe". However, the benefits to Google of identifying users via device fingerprinting are numerous. Google is an online advertising sales company.
- 7y ago
- jrockway 7y agoIn a world where half the population uses "password" as their password for their identity provider and bank, I am not sure why we're upset that fingerprinting is going on. It's that or a lot of hacked accounts. Sure, you have a nine million character password with eight hardware factors to turn on your light bulb... but you have to realize that's rather uncommon.
- plorkyeran 7y agoI don't understand how this comment is related to the submission in any way.
- Avamander 7y agoThe ban is because those browsers are "hard to fingeprint as safe".
- thu2111 7y agoThis change by Google is about blocking bots and automation, as their error message makes clear. All the big service providers have a large problem with botnets logging in to accounts with stolen credentials, or with fake spam accounts they created themselves. They do this with automation and so detecting automation is a good way to detect and stop them without major inconvenience to users (who generally don't automate their own Google accounts). The nature of this technique means their servers can't tell the difference between a niche browser and a dedicated abuse tool. If a tool claims to be Chrome and gets spotted because it's not, the obvious fallback is to just make up new user agents that are rare or unusual. Sure, the traffic is very visible to humans who may be watching post-hoc, but a UA is just a string so it can be constantly changed. Blocking bad traffic means adapting to changes in it automatically and quickly. So eventually this pushes companies towards just locking out browsers nobody uses because it's too hard to tell them apart from malicious automation software. That's unfortunate: it makes it harder for someone to get traction with a genuinely new rendering engine. But those cost billions of dollars to develop these days and even Microsoft doesn't want to play that game anymore, so it's a rather theoretical loss compared to the gains, which are large and real. Source: I used to work on this stuff.
- a3n 7y agoFastmail. Happy customer for many years.
- 3xblah 7y agoJavascript is obviously not required for Google Mail to work. Browsers that do not support Javascript work just fine. If we adjust the user-agent string to match a "supported browser" there is no need to change any Google settings. See https://support.google.com/mail/answer/15049 https://support.google.com/mail/answer/15049 What is happening here is Google is only requiring Javascript to be turned on when the user signs in so Google (or its partners) can uniquely track users, even when users have indicated they do not want to be tracked, such as using session-only cookies, clearing stored cookies after signing out, enabling the DNT header, etc. https://en.wikipedia.org/wiki/Device_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint
- wayneftw 7y agoYou never needed Javascript to access your @gmail anyway. Just use a dedicated mail client. Thunderbird, Outlook, Mail.app or any number of others... I don't sign into any Google services in my web browser. If I need to sign in with Google, I use incognito or a separate browser profile if it's constantly necessary for some set of tasks. They're still probably tracking me, but I don't care as much about that as I do about not getting locked into any one platform. The only Google service I'm really hooked on is their search but I'll switch away from that the second that it becomes unbearable to use. I've done stints on DDG and I'll be perfectly happy using that whenever Google search really starts going south.
- brunoTbear 7y agoThis is not necessarily about uniquely tracking users. This is likely about telling automation from manual traffic to login. Credential stuffing is a large enough problem for account takeover and the cost to a user of losing their gmail account so high that at some point a team has to make tradeoffs about what can and cannot be used to log in. edit: am Googler, not working on this area. Have background in account takeover/browser fingerprinting.
- parthdesai 7y agoYou say that, but my friend's google drive account is basically locked because of "spam/take over detection" and there's no response from google's customer support. Does google really care about end user here?
- mirimir 7y agoI don't get why this matters. I mean, why would anyone who goes out of their way to use a "niche browser" even have a Gmail account? Edit: My point here is that Google is so invasive and fundamentally hostile to privacy that using it with anything more secure than Firefox seems futile. And if you love some niche browser so much, go for it. But use Firefox for Gmail. Or even better, use Thunderbird.
- AlchemistCamp 7y agoI use DDG app as my primary browser on mobile and I have a Gmail account. I like both for their ability to limit the amount of interruptive advertising I have to deal with.
- mirimir 7y agoI don't see any advertising anywhere. Except using Tor browser, which doesn't block ads.
- jcjordyn120 7y agoI mainly use Qutebrowser and I have a gmail account, I can't really afford to pay a monthly fee for email.
- mirimir 7y agoThere are other free email providers that snoop far less than Google does. VFEmail has a $25 lifetime option, payable with cards or Bitcoin.
- ha470 7y agoAnyone have any idea how they're doing this? Switching user agents doesn't seem to help.
- pcmaffey 7y agoI only use gmail in chrome. And I only use chrome for google services (and development). It's like a quarantine. All my other browsing happens in firefox...
- dhimes 7y agoExactly how I work also.
- ginko 7y agoIt's really becoming a pet peeve of mine when people randomly add question marks at the end of titles on HN (the linked article doesn't). Especially when it doesn't make sense grammatically.
- dTal 7y agoI did not add the question mark. Take it up with the site admins.
- lonelappde 7y agoIt's better than putting false or dubious statements as titles.
- arminiusreturns 7y agoI really really liked squirrelmail when my host used it. It wasn't perfect but had lots of plugins and was light and fast, and was open source. It was ugly though, and had a few bugs. Then my host pushed, despite objections from the community, atmail, a proprietary gmail-alike webmail interface. It is even more buggy, and slow as hell, but hey, at least it looks "cool".
- konart 7y agoJust use email client like you do (most likely) on your phone.
- Const-me 7y agoI prefer my e-mails in a standalone IMAP client. E-mail clients don’t serve ads. For security reasons, they block linked content by default, meaning google can’t track what I do with my e-mails. Google can terminate an account any time without any reason, if they do that, I won’t lose access the e-mails I’ve received or sent. My screen refresh rate is 60Hz, ping from here to gmail.com 36ms, this means web interface has at least 3x latency compared to a locally running app. I don’t care about their web interface re-designs, or browser compatibility issues like the one discussed. Gmail can’t turn off IMAP as it would break e-mail on smartphones. Large share of these smartphones run old versions of Google Android which will never be updated, this also helps to ensure their IMAP access is here to stay.
- r00fus 7y agoSo Google still harvests/analyzes all your email data. Is this just "step1" of migrating off Gmail for good?
- HN-Censorship 7y agoJust get a domain name and a cheap web hosting account and setup an email address and client through that
- Const-me 7y agoI have both, but not using them for e-mails. This adds another huge attack surface — my domain name’s registration esp. the MX records. I’ve read horror stories about people having their online accounts stolen this way. I don’t think it’s possible to hijack gmail.com domain out of google’s control, they might be evil nowadays, but technically they’re still very professional, I believe.
- eblanshey 7y ago> Google can terminate an account any time without any reason, if they do that, I won’t lose access the e-mails I’ve received or sent. A) Assuming you keep copies of all folders/emails locally B) Assuming Google isn't evil and won't delete all your mail first before shutting down your account, thus causing your IMAP client to sync their deletion
- virtuallyvivek 7y agoI experienced something similar with Electron applications too. If you're an Electron dev, do NOT handle authentication within Electron. Handle it in their default browser.
- mehrdadn 7y agoI see lots of people mentioning email clients. What email client do people use? Is it fast and robust? Every one I know of seems to have severe lags and/or have a lot of mess to clean up when it inevitably crashes.
- shmerl 7y agoKmail is not bad.
- smittywerben 7y agoIs this more robust than just User Agent sniffing? I'm pretty sure Google basically assigns browsers a credit rating. i.e. UA string CoolBrowser v1.8.8 is good but CoolBrowser v1.7.0 is downgraded or blocked. This goes against Google's own web accessibility guidelines circa 2008 that they seemingly ignore now, but was the reason I left internet explorer to begin with.
- rasz 7y agoIn related news Vivaldi (spiritual successor to old, pre Chrome Opera) just dropped its labelling/branding from User Agent string to counter this type of shenanigans https://vivaldi.com/blog/user-agent-changes/ https://vivaldi.com/blog/user-agent-changes/