3 ms·

> Their reasons for it are security based, and make sense to me Preventing legitimate users that use different browsers is not good behaviour. One company shou

> Their reasons for it are security based, and make sense to me Preventing legitimate users that use different browsers is not good behaviour. One company shouldn't be able to control the web this way. If they wanted to add a warning about a particular security issue in a browser, OK, but this blocks them outright. You'll also know that you have fight captchas in Firefox, but rarely in Chrome. It's not right!

madrox 6y ago
If you read the article, you'd know they're blocking all embedded browser frameworks, including CEF. Embedded chrome has the same security risks. This isn't a partisan policy, nor is punting responsibility to the end user to make decisions always better. Even as an educated engineer, you have no way of evaluating whether that embedded browser is doing something nefarious with your login data or not unless it's open source, which few mobile apps are. Non-actionable warnings are meaningless.
- andyroid 6y ago
  > Non-actionable warnings are meaningless. Agreed. Yet that’s exactly what they’re trying to make use of here. “The browser must not try to impersonate another browser like Chrome or Firefox.”
  - disgruntledphd2 6y ago
    But again, there's a double-bind here. Option 1: Remove UA spoofing, presumably Google will allow sign-in. However, Youtube and Gmail won't work. Option 2: Keep the UA spoofing, lose ability to sign in to Google. There's literally no way to comply. This is super, super anti-competitive, and I guess I'll have to figure out which MEP/Commission person I need to complain to (as they appear to be the only regulator likely to care).
kbenson 6y ago
> Preventing legitimate users that use different browsers is not good behaviour. One company shouldn't be able to control the web this way. They're talking about their own services that they require accounts for here, not "the web", or even general search, AFAICT. You can still use google, you just can't log in using an app they aren't sure is trusted, for user security. Google goes a great many problematic things these days, but I'm not sure this is one of them. You could keep a trusted browser around and use it just for authenticating and getting a token. That's all they care about here, that they have a certain base level of assurance that you aren't being directed through an application that can steal credentials.
- anonymousab 6y ago
  > you just can't log in using an app they aren't sure is trusted, for user security s/app/browser, though. Effectively and strongly kneecapping any new browser competition.
  - kbenson 6y ago
    I mean app in the traditional sense, application. It's apps (almost) all the way down. ;) And any new browser competition has been kneecapped in that way by recaptcha for a long time already. You either deal with the web being less convenient because you've opted somewhat out of the easy path presented you (like I do, with Firefox and many container tabs), or you don't use Google services, or accept the easy path of Chrome and Google services together. We're talking about convenience here. Google makes it convenient and more secure (from others) to use their applications and services together. I'm not going to begrudge them making something harder to do it a way they think is worse for them as a company as long as they still leave it possible. That's better than you'll get from Apple.

madrox 6y ago

If you read the article, you'd know they're blocking all embedded browser frameworks, including CEF. Embedded chrome has the same security risks. This isn't a partisan policy, nor is punting responsibility to the end user to make decisions always better. Even as an educated engineer, you have no way of evaluating whether that embedded browser is doing something nefarious with your login data or not unless it's open source, which few mobile apps are. Non-actionable warnings are meaningless.

andyroid 6y ago
> Non-actionable warnings are meaningless. Agreed. Yet that’s exactly what they’re trying to make use of here. “The browser must not try to impersonate another browser like Chrome or Firefox.”
- disgruntledphd2 6y ago
  But again, there's a double-bind here. Option 1: Remove UA spoofing, presumably Google will allow sign-in. However, Youtube and Gmail won't work. Option 2: Keep the UA spoofing, lose ability to sign in to Google. There's literally no way to comply. This is super, super anti-competitive, and I guess I'll have to figure out which MEP/Commission person I need to complain to (as they appear to be the only regulator likely to care).

kbenson 6y ago

> Preventing legitimate users that use different browsers is not good behaviour. One company shouldn't be able to control the web this way. They're talking about their own services that they require accounts for here, not "the web", or even general search, AFAICT. You can still use google, you just can't log in using an app they aren't sure is trusted, for user security. Google goes a great many problematic things these days, but I'm not sure this is one of them. You could keep a trusted browser around and use it just for authenticating and getting a token. That's all they care about here, that they have a certain base level of assurance that you aren't being directed through an application that can steal credentials.

anonymousab 6y ago
> you just can't log in using an app they aren't sure is trusted, for user security s/app/browser, though. Effectively and strongly kneecapping any new browser competition.
- kbenson 6y ago
  I mean app in the traditional sense, application. It's apps (almost) all the way down. ;) And any new browser competition has been kneecapped in that way by recaptcha for a long time already. You either deal with the web being less convenient because you've opted somewhat out of the easy path presented you (like I do, with Firefox and many container tabs), or you don't use Google services, or accept the easy path of Chrome and Google services together. We're talking about convenience here. Google makes it convenient and more secure (from others) to use their applications and services together. I'm not going to begrudge them making something harder to do it a way they think is worse for them as a company as long as they still leave it possible. That's better than you'll get from Apple.