7 ms·

> To protect our users from these types of attacks Google Account sign-ins from all embedded frameworks will be blocked starting on January 4, 2021. (emphasis

> To protect our users from these types of attacks Google Account sign-ins from all embedded frameworks will be blocked starting on January 4, 2021. (emphasis mine) So I don't follow how this would have anything to do with banning youtube-dl, which doesn't require login? And as the blog post mentions, you can still bootstrap auth through a normal web browser, and pass the auth token to your command line / less secure browser / ... app. (Disclaimer: I work at Google, not on anything related to this blog post or to your hypothetical scenario.)

dleslie 6y ago
Passing oauth tokens into automation tools is a common use case in order to automate the retrieval of account-restricted content.
- dmoy 6y ago
  What does that have to do with youtube-dl? (Sorry it's been like 5 years since I used it, I don't remember that being required)
  - dleslie 6y ago
    It allows one to download private videos that your account can access.
    - joshspankit 6y ago
      Such as: - I have a script that downloads my liked videos (in case they get deleted, which I’ve found out happens a fair bit) - I also have a script to download my watch later videos (for sync to devices without YouTube Premium/Red/whatever)
      - mattl 6y ago
        Would you share those scripts?
        joshspankit 6y ago
        Sure: ```bash # !/bin/sh cd /media/youtube-dl docker-compose run --rm youtube-dl -v --cookies /etc/youtube-dl.cookies.txt https://www.youtube.com/playlist?list=INSERTYOUROWNWATCHLATERPLAYLISTIDHERE https://www.youtube.com/playlist?list=INSERTYOUROWNWATCHLATE... -o "watchlater/%(title)s-%(id)s.%(ext)s" --ignore-errors ``` That’s a bash script that runs via cron. One thing to note: this uses the cookies from a logged-in browser session because at some point YouTube blocked password log in from youtube-dl. This was is a bit of a pain to set up, and I wish it was not the case, but it mostly works.
    - dmoy 6y ago
      So the theory is this has nothing to do with security, but is only used to break private video downloading of youtube-dl?
      - dleslie 6y ago
        It blocks misrepresentation of agent, in general; automation is also blocked in general, but _especially_ for authentication.
        dmoy 6y ago
        Sure but if the goal was to block youtube-dl usage, wouldn't they target the vastly more common usecase without authentication?
  - mulmen 6y ago
    There's an ocean between required and useful.
- duskwuff 6y ago
  Which would still be fine. The only thing that'd be blocked is obtaining those OAuth tokens by passing your Google username/password to a browser automation tool.
  - dleslie 6y ago
    Which would break some common authentication options in ytdl: https://github.com/ytdl-org/youtube-dl#authentication-options https://github.com/ytdl-org/youtube-dl#authentication-option...
    - tester756 6y ago
      Let's dont act as if the whole world was trying to fight against ytdl.
      - dleslie 6y ago
        It's not just about ytdl; this policy will ban all headless browsers, text-based browsers, and browsers with automation tools.
        trickstra 6y ago
        And it's also ineffective, because any full GUI browser can be automated with extensions or userscripts, so banning useragents or non-javascript browsers won't actually prevent automates sign-ins.
    - worik 6y ago
      It is not the whole world attacking ytdl - but Google, definitely. Evil by default?
      - seniorivn 6y ago
        when you delete "don't be evil" tagline, you become evil by default
  - 6y ago
- detaro 6y ago
  How does youtube-dl obtain the token today?
  - dleslie 6y ago
    https://github.com/ytdl-org/youtube-dl#authentication-options https://github.com/ytdl-org/youtube-dl#authentication-option... Username, Password, 2FA, etc.
    - detaro 6y ago
      And you claim that doing more to stop people from giving their google account password to "random apps" (I personally trust youtube-dl a lot too, but "random apps" is what it comes down to) and forcing those apps to use OAuth to obtain scoped tokens has "nothing to do with security"?
      - dleslie 6y ago
        If that were all that they were doing I might agree; but they are blocking browser identity misrepresentation and automation, as well; it also requires that all "browsers" have a complete implementation of web standards. It explicitly blocks "headless" browsers. > You must confirm that your browser does not contain any of the following: > Headless browsers > Node.js > Text-based browsers
      - pjc50 6y ago
        Security for whom? Locking the user out of the software they want to use is not improving security for them.
        detaro 6y ago
        That's only true if you assume the user is perfectly capable of evaluating the trustworthiness and quality of the software they want to use. It's understandable that that's not the assumption Google designs their security under. Yes, that sometimes somewhat sucks for us power users.
deleted 6y ago
[deleted]
9HZZRfNlpR 6y ago
Definetly not on the right side of the history. With all the social changes and uprises we see one would expect you to do better.

dleslie 6y ago

Passing oauth tokens into automation tools is a common use case in order to automate the retrieval of account-restricted content.

dmoy 6y ago
What does that have to do with youtube-dl? (Sorry it's been like 5 years since I used it, I don't remember that being required)
- dleslie 6y ago
  It allows one to download private videos that your account can access.
  - joshspankit 6y ago
    Such as: - I have a script that downloads my liked videos (in case they get deleted, which I’ve found out happens a fair bit) - I also have a script to download my watch later videos (for sync to devices without YouTube Premium/Red/whatever)
    - mattl 6y ago
      Would you share those scripts?
      - joshspankit 6y ago
        Sure: ```bash # !/bin/sh cd /media/youtube-dl docker-compose run --rm youtube-dl -v --cookies /etc/youtube-dl.cookies.txt https://www.youtube.com/playlist?list=INSERTYOUROWNWATCHLATERPLAYLISTIDHERE https://www.youtube.com/playlist?list=INSERTYOUROWNWATCHLATE... -o "watchlater/%(title)s-%(id)s.%(ext)s" --ignore-errors ``` That’s a bash script that runs via cron. One thing to note: this uses the cookies from a logged-in browser session because at some point YouTube blocked password log in from youtube-dl. This was is a bit of a pain to set up, and I wish it was not the case, but it mostly works.
  - dmoy 6y ago
    So the theory is this has nothing to do with security, but is only used to break private video downloading of youtube-dl?
    - dleslie 6y ago
      It blocks misrepresentation of agent, in general; automation is also blocked in general, but _especially_ for authentication.
      - dmoy 6y ago
        Sure but if the goal was to block youtube-dl usage, wouldn't they target the vastly more common usecase without authentication?
- mulmen 6y ago
  There's an ocean between required and useful.
duskwuff 6y ago
Which would still be fine. The only thing that'd be blocked is obtaining those OAuth tokens by passing your Google username/password to a browser automation tool.
- dleslie 6y ago
  Which would break some common authentication options in ytdl: https://github.com/ytdl-org/youtube-dl#authentication-options https://github.com/ytdl-org/youtube-dl#authentication-option...
  - tester756 6y ago
    Let's dont act as if the whole world was trying to fight against ytdl.
    - dleslie 6y ago
      It's not just about ytdl; this policy will ban all headless browsers, text-based browsers, and browsers with automation tools.
      - trickstra 6y ago
        And it's also ineffective, because any full GUI browser can be automated with extensions or userscripts, so banning useragents or non-javascript browsers won't actually prevent automates sign-ins.
  - worik 6y ago
    It is not the whole world attacking ytdl - but Google, definitely. Evil by default?
    - seniorivn 6y ago
      when you delete "don't be evil" tagline, you become evil by default
- 6y ago
detaro 6y ago
How does youtube-dl obtain the token today?
- dleslie 6y ago
  https://github.com/ytdl-org/youtube-dl#authentication-options https://github.com/ytdl-org/youtube-dl#authentication-option... Username, Password, 2FA, etc.
  - detaro 6y ago
    And you claim that doing more to stop people from giving their google account password to "random apps" (I personally trust youtube-dl a lot too, but "random apps" is what it comes down to) and forcing those apps to use OAuth to obtain scoped tokens has "nothing to do with security"?
    - dleslie 6y ago
      If that were all that they were doing I might agree; but they are blocking browser identity misrepresentation and automation, as well; it also requires that all "browsers" have a complete implementation of web standards. It explicitly blocks "headless" browsers. > You must confirm that your browser does not contain any of the following: > Headless browsers > Node.js > Text-based browsers
    - pjc50 6y ago
      Security for whom? Locking the user out of the software they want to use is not improving security for them.
      - detaro 6y ago
        That's only true if you assume the user is perfectly capable of evaluating the trustworthiness and quality of the software they want to use. It's understandable that that's not the assumption Google designs their security under. Yes, that sometimes somewhat sucks for us power users.

deleted 6y ago

[deleted]

9HZZRfNlpR 6y ago

Definetly not on the right side of the history. With all the social changes and uprises we see one would expect you to do better.