3 ms·

> A new standalone browser should be a separate case. Right, but what are the chances google will allow people to sign up with their own user agent with their

> A new standalone browser should be a separate case. Right, but what are the chances google will allow people to sign up with their own user agent with their new browser engine? Or even if that was a feasible thing for them to do, why should _they_ be able to gatekeep that? The security argument is valid, but there should be some web standard or something to address that, not google deciding who gets to read their email depending on the browser they use.

thu2111 6y ago
It's tricky. Although this is being justified with references to phishing (which may well be the case) it's also an issue for spambots that need to sign in to a Google account in order to e.g. post spam links to YouTube comments. If you think about it, you'll quickly end up in a briar patch of confusion over what exactly the definition of a "browser" is. Google have attempted to provide a definition here which is better than most, but it's basically a subtractive definition. A browser is a thing that supports "modern web standards" whilst not supporting automation features. OK. What about extensions? The intent is to ensure that only people can sign in when they understand which site they're on. If anyone can define any program as a browser you can't enforce that and would have to allow unlimited automation of web sites. That is too hard to do, purely server side content analysis algorithms don't get you far enough, hence CAPTCHAs and now this JavaScript based enforcement.
- Thorrez 6y ago
  >spambots that need to sign in to a Google account in order to e.g. post spam links to YouTube comments. Wouldn't sign up be a better enforcement point than sign in?
  - thu2111 6y ago
    The same system is enforced on sign up too, but the spam market is split between account creators/sellers and account users. So you need it everywhere.
    - Thorrez 6y ago
      Do you need it everywhere? Why can't you just cut off the sellers?
      - yencabulator 6y ago
        Because of the asymmetry of use. Signing up takes a small amount of human labor, and there's already several sellers of fake accounts who use cheap human labor to create them. If actually sending spam would require human labor too, spamming would not be as desirable. (For the record: I vehemently disagree with the idea of dictating what browsers are allowed to use an online service.)

thu2111 6y ago

It's tricky. Although this is being justified with references to phishing (which may well be the case) it's also an issue for spambots that need to sign in to a Google account in order to e.g. post spam links to YouTube comments. If you think about it, you'll quickly end up in a briar patch of confusion over what exactly the definition of a "browser" is. Google have attempted to provide a definition here which is better than most, but it's basically a subtractive definition. A browser is a thing that supports "modern web standards" whilst not supporting automation features. OK. What about extensions? The intent is to ensure that only people can sign in when they understand which site they're on. If anyone can define any program as a browser you can't enforce that and would have to allow unlimited automation of web sites. That is too hard to do, purely server side content analysis algorithms don't get you far enough, hence CAPTCHAs and now this JavaScript based enforcement.

Thorrez 6y ago
>spambots that need to sign in to a Google account in order to e.g. post spam links to YouTube comments. Wouldn't sign up be a better enforcement point than sign in?
- thu2111 6y ago
  The same system is enforced on sign up too, but the spam market is split between account creators/sellers and account users. So you need it everywhere.
  - Thorrez 6y ago
    Do you need it everywhere? Why can't you just cut off the sellers?
    - yencabulator 6y ago
      Because of the asymmetry of use. Signing up takes a small amount of human labor, and there's already several sellers of fake accounts who use cheap human labor to create them. If actually sending spam would require human labor too, spamming would not be as desirable. (For the record: I vehemently disagree with the idea of dictating what browsers are allowed to use an online service.)