4 ms·

Screenshot: https://imgur.com/a/wfi3hFR https://imgur.com/a/wfi3hFR I have reproduced this on OpenSUSE Tumbleweed, with stock Falkon browser (QT+Webkit) and ja

by dTal 7y ago

Screenshot: https://imgur.com/a/wfi3hFR https://imgur.com/a/wfi3hFR I have reproduced this on OpenSUSE Tumbleweed, with stock Falkon browser (QT+Webkit) and javascript enabled. I have confirmed that this is accomplished through UA sniffing. I reproduce the message in plaintext below: Sign in with a supported browser To help protect your account, Google doesn’t let you sign in from some browsers. Google might stop sign-ins from browsers that: Don’t support JavaScript or have Javascript turned off. Have unsecure or unsupported extensions added. Use automation testing frameworks. Are embedded in a different application.

shantly 7y ago
Just tried Links, doesn't work. They let you try, presumably because they like fucking with people, but then block you when you successfully log in. Time to get off my ass and switch email providers, finally. [EDIT] incidentally, is this what we can expect to see on more and more sites as Google's new version of Recaptcha rolls out?
- ad404b8a372f2b9 7y ago
  Which provider do you intend to switch to? It's something I've been meaning to do for a while but haven't had the time to research alternatives.
  - shantly 7y ago
    Probably just fastmail. I have trouble justifying the higher expense of maybe-more-secure options like Protonmail when really 99% of my use of email is transactional stuff or (product, job) alerts or updates. I've trialed them a couple times for side projects that never went anywhere, and they seem nice enough.
    - reaperducer 7y ago
      I think you'll like Fastmail. I moved from Gmail in January, and was surprised that the spam protection is even better than Gmail's. I still have a few Gmail accounts for clients, and my Fastmail accounts get about half the spam.
- jhabdas 7y ago
  Get off your ass indeed. It took me the better part of 3 months to close my Google account and get rid of Gmail.
Causality1 7y ago
>unsupported extensions added I find it a security threat that websites are able to tell what extensions I have installed, supported or otherwise.
- RenRav 7y ago
  Only a problem with Chrome.
- gpm 7y ago
  I sort of interpret "unsupported extensions" as "adblockers" - and with the current model of modifying the DOM I don't think it's preventable. Maybe in the future we could run the website in one version of the DOM, hidden from the user, and then have the adblocker make a separate DOM that is displayed to the user. That loses almost all of the anti tracking and most of the security benefits though.
tpmx 7y ago
Opera went through this fight between e.g. 2004-2013. It wasn't really fully resolved until the browser engine was switched to Blink/Chromium. Now, of course Opera is ~indirectly managed by the chinese government, so no-one should be using it. Please just trust me on this one. The desktop browser is now built in Poland (not Norway/Sweden). The remaining technical management is very weak when it comes to things like principles.
- papito 7y ago
  Son of a bitch. I love Opera. I use it for home and work.
  - paulryanrogers 7y ago
    Vivaldi is the spiritual successor
- linux2647 7y ago
  Do you have a source on China (indirectly) managing Opera?
  - tpmx 7y ago
    A source on China indirectly managing Chinese companies? That is generally speaking a true statement, regardless of which Chinese company you're speaking of. Do you want a source on that?
  - tandr 7y ago
    According to https://en.wikipedia.org/wiki/Opera_(web_browser) https://en.wikipedia.org/wiki/Opera_(web_browser) "Opera is a freeware web browser ..., developed by Opera Software, a Norwegian software company, ... with the majority of ownership and control belonging to Chinese businessman Zhou Yahui, founder of Beijing Kunlun Tech and Chinese cybersecurity company Qihoo 360."
floatingatoll 7y ago
Was JavaScript enabled and allowed to run automatically in your browser on *.google.com when you reproduced this?
- dTal 7y ago
  Yes, changing the user agent was all I needed to do in order to be permitted to log in. Not that javascript is required for GMail - it has a perfectly serviceable 'basic HTML' mode. Google's own support document[0] provides a link to it, although notably it's not canonical (the link will be different you than for me (why??)). The same document is now obsolete - it claims "If you're using a browser that isn't supported, you'll see Gmail in HTML view." This is not true, as in fact what you'll see is "up yours, go away". https://support.google.com/mail/answer/15049?hl=en https://support.google.com/mail/answer/15049?hl=en

by dTal 7y ago

shantly 7y ago

Just tried Links, doesn't work. They let you try, presumably because they like fucking with people, but then block you when you successfully log in. Time to get off my ass and switch email providers, finally. [EDIT] incidentally, is this what we can expect to see on more and more sites as Google's new version of Recaptcha rolls out?

ad404b8a372f2b9 7y ago
Which provider do you intend to switch to? It's something I've been meaning to do for a while but haven't had the time to research alternatives.
- shantly 7y ago
  Probably just fastmail. I have trouble justifying the higher expense of maybe-more-secure options like Protonmail when really 99% of my use of email is transactional stuff or (product, job) alerts or updates. I've trialed them a couple times for side projects that never went anywhere, and they seem nice enough.
  - reaperducer 7y ago
    I think you'll like Fastmail. I moved from Gmail in January, and was surprised that the spam protection is even better than Gmail's. I still have a few Gmail accounts for clients, and my Fastmail accounts get about half the spam.
jhabdas 7y ago
Get off your ass indeed. It took me the better part of 3 months to close my Google account and get rid of Gmail.

Causality1 7y ago

>unsupported extensions added I find it a security threat that websites are able to tell what extensions I have installed, supported or otherwise.

RenRav 7y ago
Only a problem with Chrome.
gpm 7y ago
I sort of interpret "unsupported extensions" as "adblockers" - and with the current model of modifying the DOM I don't think it's preventable. Maybe in the future we could run the website in one version of the DOM, hidden from the user, and then have the adblocker make a separate DOM that is displayed to the user. That loses almost all of the anti tracking and most of the security benefits though.

tpmx 7y ago

Opera went through this fight between e.g. 2004-2013. It wasn't really fully resolved until the browser engine was switched to Blink/Chromium. Now, of course Opera is ~indirectly managed by the chinese government, so no-one should be using it. Please just trust me on this one. The desktop browser is now built in Poland (not Norway/Sweden). The remaining technical management is very weak when it comes to things like principles.

papito 7y ago
Son of a bitch. I love Opera. I use it for home and work.
- paulryanrogers 7y ago
  Vivaldi is the spiritual successor
linux2647 7y ago
Do you have a source on China (indirectly) managing Opera?
- tpmx 7y ago
  A source on China indirectly managing Chinese companies? That is generally speaking a true statement, regardless of which Chinese company you're speaking of. Do you want a source on that?
- tandr 7y ago
  According to https://en.wikipedia.org/wiki/Opera_(web_browser) https://en.wikipedia.org/wiki/Opera_(web_browser) "Opera is a freeware web browser ..., developed by Opera Software, a Norwegian software company, ... with the majority of ownership and control belonging to Chinese businessman Zhou Yahui, founder of Beijing Kunlun Tech and Chinese cybersecurity company Qihoo 360."

floatingatoll 7y ago

Was JavaScript enabled and allowed to run automatically in your browser on *.google.com when you reproduced this?

dTal 7y ago
Yes, changing the user agent was all I needed to do in order to be permitted to log in. Not that javascript is required for GMail - it has a perfectly serviceable 'basic HTML' mode. Google's own support document[0] provides a link to it, although notably it's not canonical (the link will be different you than for me (why??)). The same document is now obsolete - it claims "If you're using a browser that isn't supported, you'll see Gmail in HTML view." This is not true, as in fact what you'll see is "up yours, go away". https://support.google.com/mail/answer/15049?hl=en https://support.google.com/mail/answer/15049?hl=en