5 ms·
It's tricky. Although this is being justified with references to phishing (which may well be the case) it's also an issue for spambots that need to sign in to a
by thu2111 6y ago
It's tricky. Although this is being justified with references to phishing (which may well be the case) it's also an issue for spambots that need to sign in to a Google account in order to e.g. post spam links to YouTube comments.
If you think about it, you'll quickly end up in a briar patch of confusion over what exactly the definition of a "browser" is. Google have attempted to provide a definition here which is better than most, but it's basically a subtractive definition. A browser is a thing that supports "modern web standards" whilst not supporting automation features. OK. What about extensions?
The intent is to ensure that only people can sign in when they understand which site they're on. If anyone can define any program as a browser you can't enforce that and would have to allow unlimited automation of web sites. That is too hard to do, purely server side content analysis algorithms don't get you far enough, hence CAPTCHAs and now this JavaScript based enforcement.
- Thorrez 6y ago>spambots that need to sign in to a Google account in order to e.g. post spam links to YouTube comments. Wouldn't sign up be a better enforcement point than sign in?
- thu2111 6y agoThe same system is enforced on sign up too, but the spam market is split between account creators/sellers and account users. So you need it everywhere.
- Thorrez 6y agoDo you need it everywhere? Why can't you just cut off the sellers?
- yencabulator 6y agoBecause of the asymmetry of use. Signing up takes a small amount of human labor, and there's already several sellers of fake accounts who use cheap human labor to create them. If actually sending spam would require human labor too, spamming would not be as desirable. (For the record: I vehemently disagree with the idea of dictating what browsers are allowed to use an online service.)