6 ms·

This has nothing to do with security and everything to do with banning tools like youtube-dl, wget and others; from the post: > The browser must identify itsel

This has nothing to do with security and everything to do with banning tools like youtube-dl, wget and others; from the post: > The browser must identify itself clearly in the User-Agent. The browser must not try to impersonate another browser like Chrome or Firefox. > The browser must not provide automation features. This includes scripts that automate keystrokes or clicks, especially to perform automatic sign-ins. Edit: I feel like mentioning youtube-dl was a mistake. It's not just about youtube-dl. This policy bars the use of all text-based browsers, headless browsers, browsers without javascript, and browsers with automation when accessing Google's services. It bans browsers that contain Node.js, even.

austincheney 6y ago
> The browser must not provide automation features. This includes scripts that automate keystrokes or clicks, especially to perform automatic sign-ins. If a web developer knows what they are doing they are using the standard web APIs supplied by the browser in an efficient way, designed to be invisible to accessibility for accessibility test automation, and thus this control from Google is largely unenforceable. As such I believe this is just a block against incompetent forms of automation that probably shouldn't be there in the first place.
InfiniteRand 6y ago
This is kind-of funny requirement given the history of user-agent strings being incredibly convoluted. I mean Chrome doesn't clearly identify itself as Chrome, it still identifies itself as Apple Webkit
- trickstra 6y ago
  Also given Google's history of sending corrupted version of pages to Firefox useragents. https://www.reddit.com/r/firefox/comments/7whdv4/googlecom_in_firefox_for_android_normal_vs_w/ https://www.reddit.com/r/firefox/comments/7whdv4/googlecom_i... https://androidforums.com/threads/problems-with-firefox-user-agent-override-and-google-images.1039531/ https://androidforums.com/threads/problems-with-firefox-user... https://www.ghacks.net/2018/07/25/google-making-youtube-slower-for-non-chromium-browsers/ https://www.ghacks.net/2018/07/25/google-making-youtube-slow... ... and many more
scrollaway 6y ago
If you'd bothered to read a little more before knee-jerking a reaction comment, you'd know this is only for the authentication flow.
- dleslie 6y ago
  I did read that; did you know that passing oauth tokens into such automation tools is commonplace?
  - ath0 6y ago
    OAuth tokens used in automation tools will continue to work. Entering in username & password through auth, to automate an OAuth flow (or any other traditionally manual flow) will stop working. Breaks some puppeteer scripts too - but those have been getting flaky for a while now.
    - dleslie 6y ago
      Thus making it even more cumbersome for users; now they simply login, in the future they'll have to know how to get the oauth token.
      - joshspankit 6y ago
        And, OAuth tokens can be revoked meaning scripts will just suddenly fail.
        scrollaway 6y ago
        What's your point? Passwords can change and sessions can get invalidated, which all has the same effect.
        joshspankit 6y ago
        Yes I would agree with that, except that if you change a password you know the scripts will fail, but if an OAuth token gets invalidated by the system and not you, then it will fail without warning.
delroth 6y ago
> To protect our users from these types of attacks Google Account sign-ins from all embedded frameworks will be blocked starting on January 4, 2021. (emphasis mine) So I don't follow how this would have anything to do with banning youtube-dl, which doesn't require login? And as the blog post mentions, you can still bootstrap auth through a normal web browser, and pass the auth token to your command line / less secure browser / ... app. (Disclaimer: I work at Google, not on anything related to this blog post or to your hypothetical scenario.)
- dleslie 6y ago
  Passing oauth tokens into automation tools is a common use case in order to automate the retrieval of account-restricted content.
  - dmoy 6y ago
    What does that have to do with youtube-dl? (Sorry it's been like 5 years since I used it, I don't remember that being required)
    - dleslie 6y ago
      It allows one to download private videos that your account can access.
      - joshspankit 6y ago
        Such as: - I have a script that downloads my liked videos (in case they get deleted, which I’ve found out happens a fair bit) - I also have a script to download my watch later videos (for sync to devices without YouTube Premium/Red/whatever)
        mattl 6y ago
        Would you share those scripts?
mrjin 6y ago
Google has went rouge for quite a while. AMP was another example of the same nature.
npsimons 6y ago
> The browser must identify itself clearly in the User-Agent. I wonder what they'd think of my proxy which I have setup to (among other privacy respecting features) rewrite the User-Agent to "By allowing me access, you waive all rights and policies regarding my access." This is basically my form of EULA. > The browser must not provide automation features. LOL. This was obviously written by some tech illiterate law type, perhaps a first year law student? I fear to think what incompetent engineer working at google of all places would have come up with that verbiage . . .
- MereInterest 6y ago
  Yeah, the browser itself is an automation feature. It automates the downloading of a file over HTTP, downloading of any dependent resources, managing of caches, and rendering of the result. That these are so frequently done that this automated pipeline is referred to as "a browser" doesn't mean that this isn't an extremely automated system.
userbinator 6y ago
It has everything to do with security: securing Google's control. Google wants to take over the Internet. We should not let it use these "less secure" excuses to sway the public opinion.
- samuelroth 6y ago
  Google’s control...over the security of Google accounts? If you are worried enough about Google’s dominance over the Internet to be upset by this particular practice, it is unlikely you have (or should maintain) a Google account. I’m not a “Google stan” by any means, but to say that they want to take over the Internet is just not true.
  - dvfjsdhgfv 6y ago
    > to say that they want to take over the Internet is just not true. I don't know if they "want", but they already do have control over various aspects of the Internet, especially of the web, but also DNS and email.
  - ForHackernews 6y ago
    Google wants to dictate what user-agent you can use to access their sites: that's pretty controlling! Can you imagine if Fox announced that only approved televisions could show their content?
worldmerge 6y ago
Well I guess my unofficial YouTube chat bot won't work anymore. The YouTube API is awful compared to the Twitch one for bot creation so it is easier to get the functionality you want using Selenium.
- izacus 6y ago
  Why not? This restriction was added on Android years ago and it basically means that you retrieve the OAuth2 token with a normal browser and then send it to your automaton script/app. It blocks auth to prevent phishing, not actual access.
DevKoala 6y ago
Pretty much. It also helps their ad business to combat fraud.
- imglorp 6y ago
  This is probably the only case that actually affects them. There's really no argument for security here.
nojito 6y ago
It's to stop scraping of Google Data. There is currently millions -> hundreds of millions being made by scraping Google content.
- ForHackernews 6y ago
  Kind of hypocritical given that Google's entire business is founded on scraping the rest of the internet.
throwaway09223 6y ago
"The browser must not provide automation features." It would be interesting to see this examined in the context of accessibility requirements created by the ADA.
pvg 6y ago
The whole premise is a mistake, not the mention of youtube-dl. This policy doesn't ban the the things you claim it does. It is not 'everything to do with banning wget'. It's just a strange and mistaken conclusion you arrived at, seemingly by very selective reading.
kevindong 6y ago
The announcement specifically says this: > ...Google Account sign-ins from all embedded frameworks will be blocked starting on January 4, 2021 It says nothing about non-login related actions.
suifbwish 6y ago
Has anyone thought of just not using Google? By using them you give them power in your life
u801e 6y ago
> his has nothing to do with security and everything to do with banning tools like youtube-dl, wget and others Exactly. What's insecure about an application that can establish a secure connection using an accepted version of TLS and cipher?

austincheney 6y ago

> The browser must not provide automation features. This includes scripts that automate keystrokes or clicks, especially to perform automatic sign-ins. If a web developer knows what they are doing they are using the standard web APIs supplied by the browser in an efficient way, designed to be invisible to accessibility for accessibility test automation, and thus this control from Google is largely unenforceable. As such I believe this is just a block against incompetent forms of automation that probably shouldn't be there in the first place.

InfiniteRand 6y ago

This is kind-of funny requirement given the history of user-agent strings being incredibly convoluted. I mean Chrome doesn't clearly identify itself as Chrome, it still identifies itself as Apple Webkit

trickstra 6y ago
Also given Google's history of sending corrupted version of pages to Firefox useragents. https://www.reddit.com/r/firefox/comments/7whdv4/googlecom_in_firefox_for_android_normal_vs_w/ https://www.reddit.com/r/firefox/comments/7whdv4/googlecom_i... https://androidforums.com/threads/problems-with-firefox-user-agent-override-and-google-images.1039531/ https://androidforums.com/threads/problems-with-firefox-user... https://www.ghacks.net/2018/07/25/google-making-youtube-slower-for-non-chromium-browsers/ https://www.ghacks.net/2018/07/25/google-making-youtube-slow... ... and many more

scrollaway 6y ago

If you'd bothered to read a little more before knee-jerking a reaction comment, you'd know this is only for the authentication flow.

dleslie 6y ago
I did read that; did you know that passing oauth tokens into such automation tools is commonplace?
- ath0 6y ago
  OAuth tokens used in automation tools will continue to work. Entering in username & password through auth, to automate an OAuth flow (or any other traditionally manual flow) will stop working. Breaks some puppeteer scripts too - but those have been getting flaky for a while now.
  - dleslie 6y ago
    Thus making it even more cumbersome for users; now they simply login, in the future they'll have to know how to get the oauth token.
    - joshspankit 6y ago
      And, OAuth tokens can be revoked meaning scripts will just suddenly fail.
      - scrollaway 6y ago
        What's your point? Passwords can change and sessions can get invalidated, which all has the same effect.
        joshspankit 6y ago
        Yes I would agree with that, except that if you change a password you know the scripts will fail, but if an OAuth token gets invalidated by the system and not you, then it will fail without warning.

delroth 6y ago

> To protect our users from these types of attacks Google Account sign-ins from all embedded frameworks will be blocked starting on January 4, 2021. (emphasis mine) So I don't follow how this would have anything to do with banning youtube-dl, which doesn't require login? And as the blog post mentions, you can still bootstrap auth through a normal web browser, and pass the auth token to your command line / less secure browser / ... app. (Disclaimer: I work at Google, not on anything related to this blog post or to your hypothetical scenario.)

dleslie 6y ago
Passing oauth tokens into automation tools is a common use case in order to automate the retrieval of account-restricted content.
- dmoy 6y ago
  What does that have to do with youtube-dl? (Sorry it's been like 5 years since I used it, I don't remember that being required)
  - dleslie 6y ago
    It allows one to download private videos that your account can access.
    - joshspankit 6y ago
      Such as: - I have a script that downloads my liked videos (in case they get deleted, which I’ve found out happens a fair bit) - I also have a script to download my watch later videos (for sync to devices without YouTube Premium/Red/whatever)
      - mattl 6y ago
        Would you share those scripts?

mrjin 6y ago

Google has went rouge for quite a while. AMP was another example of the same nature.

npsimons 6y ago

> The browser must identify itself clearly in the User-Agent. I wonder what they'd think of my proxy which I have setup to (among other privacy respecting features) rewrite the User-Agent to "By allowing me access, you waive all rights and policies regarding my access." This is basically my form of EULA. > The browser must not provide automation features. LOL. This was obviously written by some tech illiterate law type, perhaps a first year law student? I fear to think what incompetent engineer working at google of all places would have come up with that verbiage . . .

MereInterest 6y ago
Yeah, the browser itself is an automation feature. It automates the downloading of a file over HTTP, downloading of any dependent resources, managing of caches, and rendering of the result. That these are so frequently done that this automated pipeline is referred to as "a browser" doesn't mean that this isn't an extremely automated system.

userbinator 6y ago

It has everything to do with security: securing Google's control. Google wants to take over the Internet. We should not let it use these "less secure" excuses to sway the public opinion.

samuelroth 6y ago
Google’s control...over the security of Google accounts? If you are worried enough about Google’s dominance over the Internet to be upset by this particular practice, it is unlikely you have (or should maintain) a Google account. I’m not a “Google stan” by any means, but to say that they want to take over the Internet is just not true.
- dvfjsdhgfv 6y ago
  > to say that they want to take over the Internet is just not true. I don't know if they "want", but they already do have control over various aspects of the Internet, especially of the web, but also DNS and email.
- ForHackernews 6y ago
  Google wants to dictate what user-agent you can use to access their sites: that's pretty controlling! Can you imagine if Fox announced that only approved televisions could show their content?

worldmerge 6y ago

Well I guess my unofficial YouTube chat bot won't work anymore. The YouTube API is awful compared to the Twitch one for bot creation so it is easier to get the functionality you want using Selenium.

izacus 6y ago
Why not? This restriction was added on Android years ago and it basically means that you retrieve the OAuth2 token with a normal browser and then send it to your automaton script/app. It blocks auth to prevent phishing, not actual access.

DevKoala 6y ago

Pretty much. It also helps their ad business to combat fraud.

imglorp 6y ago
This is probably the only case that actually affects them. There's really no argument for security here.

nojito 6y ago

It's to stop scraping of Google Data. There is currently millions -> hundreds of millions being made by scraping Google content.

ForHackernews 6y ago
Kind of hypocritical given that Google's entire business is founded on scraping the rest of the internet.

throwaway09223 6y ago

"The browser must not provide automation features." It would be interesting to see this examined in the context of accessibility requirements created by the ADA.

pvg 6y ago

The whole premise is a mistake, not the mention of youtube-dl. This policy doesn't ban the the things you claim it does. It is not 'everything to do with banning wget'. It's just a strange and mistaken conclusion you arrived at, seemingly by very selective reading.

kevindong 6y ago

The announcement specifically says this: > ...Google Account sign-ins from all embedded frameworks will be blocked starting on January 4, 2021 It says nothing about non-login related actions.

suifbwish 6y ago

Has anyone thought of just not using Google? By using them you give them power in your life

u801e 6y ago

> his has nothing to do with security and everything to do with banning tools like youtube-dl, wget and others Exactly. What's insecure about an application that can establish a secure connection using an accepted version of TLS and cipher?