5 ms·

Does this mean Google is explicitly repudiating web standards and refusing to interoperate with any browsers except the ones they approve? Or is there more to i

by dn3500 6y ago

Does this mean Google is explicitly repudiating web standards and refusing to interoperate with any browsers except the ones they approve? Or is there more to it than that?

izacus 6y ago
No, this means that Google demands that apps use the default browser you've set for login instead of the builtin WebKit of the device.
- Wowfunhappy 6y ago
  And what if your default web browser is Epiphany?
  - deleted 6y ago
    [deleted]
  - methodsignature 6y ago
    The user you asked has apparently decided to pretend that particular reality doesn't exist.
paxys 6y ago
Quite the opposite actually. OAuth is designed to broker token exchange between two services in a standards-compliant web browser. Apps have increasingly been getting around it by embedding browser shells in their own interface, making the process less transparent for the end user. This opens users to all kinds of phishing attacks (e.g. an app might show you a Google sign-in page which is actually hosted on their own server, or steal your credentials even if you are actually on google.com, or automatically click "approve" without any user feedback etc.) Enforcing that OAuth is handled in a browser controlled directly by the OS is the right thing to do.
- mehrdadn 6y ago
  > an app might show you a Google sign-in page which is actually hosted on their own server, or steal your credentials even if you are actually on google.com I'm confused, how does "this browser is not supported" translate into "this request is coming from a third party server"? Can't a third party just use whatever browser is supported to send the request?
  - paxys 6y ago
    The idea is that users should not be expected to or used to entering their Google credentials outside of a browser they don't fully trust.
    - andreabedini 6y ago
      > entering their Google credentials outside a browser Google doesn’t fully trust FIFY As the user, I fully trust my Epiphany browser.

by dn3500 6y ago

Does this mean Google is explicitly repudiating web standards and refusing to interoperate with any browsers except the ones they approve? Or is there more to it than that?

izacus 6y ago

No, this means that Google demands that apps use the default browser you've set for login instead of the builtin WebKit of the device.

Wowfunhappy 6y ago
And what if your default web browser is Epiphany?
- deleted 6y ago
  [deleted]
- methodsignature 6y ago
  The user you asked has apparently decided to pretend that particular reality doesn't exist.

paxys 6y ago

Quite the opposite actually. OAuth is designed to broker token exchange between two services in a standards-compliant web browser. Apps have increasingly been getting around it by embedding browser shells in their own interface, making the process less transparent for the end user. This opens users to all kinds of phishing attacks (e.g. an app might show you a Google sign-in page which is actually hosted on their own server, or steal your credentials even if you are actually on google.com, or automatically click "approve" without any user feedback etc.) Enforcing that OAuth is handled in a browser controlled directly by the OS is the right thing to do.

mehrdadn 6y ago
> an app might show you a Google sign-in page which is actually hosted on their own server, or steal your credentials even if you are actually on google.com I'm confused, how does "this browser is not supported" translate into "this request is coming from a third party server"? Can't a third party just use whatever browser is supported to send the request?
- paxys 6y ago
  The idea is that users should not be expected to or used to entering their Google credentials outside of a browser they don't fully trust.
  - andreabedini 6y ago
    > entering their Google credentials outside a browser Google doesn’t fully trust FIFY As the user, I fully trust my Epiphany browser.