4 ms·

Yes, they'll require this for authentication, not use. There are already ways to log into Google accounts using a trusted platform like a browser when the envi

Yes, they'll require this for authentication, not use. There are already ways to log into Google accounts using a trusted platform like a browser when the environment can't be confirmed. Google Cloud Shell has a mechanism like this, where it will generate a URL that you paste into a browser, and it will prompt for login if you aren't, then provide a token you can paste back into the shell utility, and then it's authenticated to perform actions on Google Compute Engine as you through shell commands. This is essentially what the embedded browser context is doing in an automated way. My guess is there's a way to manually do this already, or there will be soon. The main thing they are trying to do here is make sure the login process is secure as they can make it. I think there's a non-negligible increase in security by requiring somewhat trusted applications to make the request.

Wowfunhappy 6y ago
So in order to log in to Google Services in a browser that isn't Google Chrome, I have to install Google Chrome?
- striking 6y ago
  Or Firefox, or Safari, or Edge, I believe.
  - Wowfunhappy 6y ago
    Sorry, I meant for that to be implied, but should have been explicit. This requirement locks you in to using one of the major players until the end of time.
    - kbenson 6y ago
      Or unless there's a petition process to get another browser added. I think the criteria is "not a webview, not embedded", so if your browser isn't usable for that, or at least not without it being obvious, then maybe that browser can ask to be added? There are reasons why Google doesn't just want to allow any curl request to authenticate a user, and those are valid reasons I agree with. Do those apply to a browser like Epiphany? Probably not, but there's a spectrum along which things will fall, and people will not always agree on where those things belong on that spectrum, and some things may be initially excluded purely on popularity, but that might be an easy problem to fix. Asking is pretty low effort.
      - Wowfunhappy 6y ago
        I do wonder if Michael Catanzaro has tried reaching out to Google. Epiphany's user base is microscopic compared to Chrome's, I'm sure, but they're also very far from a fly-by-night project. Then again, I'm not sure how he would reach out. Google is infamously hard to contact, particularly in these sorts of situations where you're a victim of the AI.
        kbenson 6y ago
        Probably to a dev on the team that implemented this, which might be harder to find, but is also likely to be a more fruitful conversation than some front-line support rep, as technical cases and reasons can be explained dev-to-dev.
      - Arnavion 6y ago
        >then maybe that browser can ask to be added? So as soon as one such webview-based browser gets added via this hypothetical petition process, what's to stop the Evil Nasty Malware (tm) from using the same webview library? The email's author worries about needing their webview-based browser to maintain JS engine and TLS ciphersuite equivalence with an approved browser, but that becomes trivial if the exact same webview library can be used by an approved browser and the Evil Nasty Malware. It seems to me that allowing even a single webview-based browser would go against what Google is trying to do.
        kbenson 6y ago
        If it's a webview based browser, I think it shouldn't be added. Sorry, that's just the price they pay for using a webview as a shortcut to providing a full browser. > It seems to me that allowing even a single webview-based browser would go against what Google is trying to do. I agree. Other than it being weird to ask/need the system to use a different browser than you are using, and possibly a different browser than what you've set as default if you've set it to one Google doesn't trust for auth, nothing prevents any webview browser from acting like any other webview, and outsourcing to Chrome or Firefox for the authentication to get a good token, as long as you can use a token for full Google account login (which I don't know if you can).
est31 6y ago
> they'll require this for authentication, not use. Except for workarounds, I can't watch age restricted youtube videos without an account. And even for normal content, youtube wants me to log in very often. I have to decline all the time. I fear that youtube will be authwalled eventually like instagram and similar services.

Wowfunhappy 6y ago

So in order to log in to Google Services in a browser that isn't Google Chrome, I have to install Google Chrome?

striking 6y ago
Or Firefox, or Safari, or Edge, I believe.
- Wowfunhappy 6y ago
  Sorry, I meant for that to be implied, but should have been explicit. This requirement locks you in to using one of the major players until the end of time.
  - kbenson 6y ago
    Or unless there's a petition process to get another browser added. I think the criteria is "not a webview, not embedded", so if your browser isn't usable for that, or at least not without it being obvious, then maybe that browser can ask to be added? There are reasons why Google doesn't just want to allow any curl request to authenticate a user, and those are valid reasons I agree with. Do those apply to a browser like Epiphany? Probably not, but there's a spectrum along which things will fall, and people will not always agree on where those things belong on that spectrum, and some things may be initially excluded purely on popularity, but that might be an easy problem to fix. Asking is pretty low effort.
    - Wowfunhappy 6y ago
      I do wonder if Michael Catanzaro has tried reaching out to Google. Epiphany's user base is microscopic compared to Chrome's, I'm sure, but they're also very far from a fly-by-night project. Then again, I'm not sure how he would reach out. Google is infamously hard to contact, particularly in these sorts of situations where you're a victim of the AI.
      - kbenson 6y ago
        Probably to a dev on the team that implemented this, which might be harder to find, but is also likely to be a more fruitful conversation than some front-line support rep, as technical cases and reasons can be explained dev-to-dev.
    - Arnavion 6y ago
      >then maybe that browser can ask to be added? So as soon as one such webview-based browser gets added via this hypothetical petition process, what's to stop the Evil Nasty Malware (tm) from using the same webview library? The email's author worries about needing their webview-based browser to maintain JS engine and TLS ciphersuite equivalence with an approved browser, but that becomes trivial if the exact same webview library can be used by an approved browser and the Evil Nasty Malware. It seems to me that allowing even a single webview-based browser would go against what Google is trying to do.
      - kbenson 6y ago
        If it's a webview based browser, I think it shouldn't be added. Sorry, that's just the price they pay for using a webview as a shortcut to providing a full browser. > It seems to me that allowing even a single webview-based browser would go against what Google is trying to do. I agree. Other than it being weird to ask/need the system to use a different browser than you are using, and possibly a different browser than what you've set as default if you've set it to one Google doesn't trust for auth, nothing prevents any webview browser from acting like any other webview, and outsourcing to Chrome or Firefox for the authentication to get a good token, as long as you can use a token for full Google account login (which I don't know if you can).

est31 6y ago

> they'll require this for authentication, not use. Except for workarounds, I can't watch age restricted youtube videos without an account. And even for normal content, youtube wants me to log in very often. I have to decline all the time. I fear that youtube will be authwalled eventually like instagram and similar services.