11 ms·

They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to the

They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to their docs they're fighting MITMs by generally disallowing any browser they can't identify (so the big few). If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties. This feels very anti-competitive to me. Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic. I'm building a browser for research [2] and have to frequently find workarounds. I'm not quite sure who I'd contact to get on said whitelist either... [1] https://imgur.com/a/DASVkhl https://imgur.com/a/DASVkhl (here is the issue in the Vim browser and Min browser) [2] https://synth.app https://synth.app

manish_gill 5y ago
Just signed up. Your idea appeals to me. Hope I can take it for a spin soon!
bpye 5y ago
Wow, that's awful. I wonder who's idea it was? Is it doing anything more than checking user agent (trivial to spoof), because if not that seems entirely hostile.
- parhamn 5y ago
  It's not just the user-agent, it is definitely doing non-trivial fingerprinting (both linked projects also had UA mitigations before). We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them.
  - ilrwbwrkhv 5y ago
    What did min browser have?
  - klabb3 5y ago
    > it is definitely doing non-trivial fingerprinting Can confirm. To generalize and understand why, big corps have to deal with an insane amount of (often automated) abuse, so they build profiles using data collection to assess your risk level. Being in the wrong cohort (say unusual browser, small country, rare language, use a vpn etc) can affect your score. Basically it's these massive bayesian filters that output how suspicious some activity is. Whether you're signing in to Gmail, returning a product, buying something with a credit card or booking an Uber, some form of score is computed and then used to allow/deny/delay/verify. Obviously this is well established in the insurance and finance industries, but make no mistake, it happens everywhere. This approach is understandable from a business perspective, but imo deeply troubling for an open society. You don't have to squint much in order to see the similarities to social credit systems, EVEN if there is no grand totalitarian state-coordinated behind it. As usual, the first step is transparency so we can actually discuss these issues based on accurate data, but that's very difficult today. Usually fraud and abuse prevention is among the most secretive departments, they never share anything.
    - makeitdouble 5y ago
      To clarify, these scores can be sanely used to decide what level of trust you have, and when you have none you get a capcha, a SMS check or something heavier to authorize the access you are trying to get. In my book you’re never supposed to fully block a session because of the score, there needs to be a (potentially burdensome) way to prove the score wrong. Blocking a browser should be out of question.
      - klabb3 5y ago
        Even so, we still need to have a debate about what levels of "papieren bitte" we are willing to accept for different functions of society. The currently ubiquitous corporate-centric trend is to "nudge" instead of outright ban, i.e. instead of a bool it's numeric, and I highly doubt that the difference in data type is as significant as people think it is -- "Well you can always create a new account/buy another device/ask your friend to do it/.." and so on. If these numeric scores are affecting search results, recommendations, when sharing stuff, etc etc, there's no question that it will affect societal discourse. These hidden "algorithms" (as in the popular term) and fraud prevention systems are so far from being understood that it may be too late to reverse it when we realize what's happened.
  - 1vuio0pswjnm7 5y ago
    "We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them." First thing I do when creating a new Gmail account, using a "supported" browser, is to save the required parameters of the cookie in a text file then convert the file to a simple shell script, powered by netcat and TLS proxy. This only takes me takes seconds. Then I close the supported browser without logging out. The word "sketchy" seems applicable because unlike, e.g., a bank website, companies like Google and Facebook will let users stay "logged in" for some ridiculously long period like one year. Yikes. Two ways to disable the script are 1. log out of that session (://mail.google.com/mail/logout?ec=ABCDEF, ://accounts.google.com/Logout?service=mail&continue=https://mail.google.com/mail/ https://mail.google.com/mail/, ://mail.google.com/accounts/ClearOSID) or 2. change the password. This tiny script can be transferred to any computer and used to check and send mail from the command line. No browser, Javascript or password required. Netcat, the browser of the future! :)
- jpalomaki 5y ago
  Likely the goal is to protect users from malicious apps, trying to get user to log in on a hosted browser component in order to scrape their data (or perform activities on behalf of user).
  - Gigachad 5y ago
    I think HN users often severely downplay the threats large companies are facing and frame every anti abuse measure as a coordinated attempt to shut down their indie browser fork. People are having their lives ruined when their account gets breached which Google prioritizes over avoiding accidentally blocking a few odd users.
smitop 5y ago
I'd guess that it's because they (incorrectly) think it's an embedded Webview, which get blocked (see https://developers.googleblog.com/2021/06/upcoming-security-changes-to-googles-oauth-2.0-authorization-endpoint.html https://developers.googleblog.com/2021/06/upcoming-security-... and https://developers.google.com/identity/protocols/oauth2/policies#browsers https://developers.google.com/identity/protocols/oauth2/poli...). You could try creating an issue in the Cloud Identity issue tracker (Cloud Identity is Google's API for letting websites have a "Login with Google" thing): https://issuetracker.google.com/issues/new?component=522910&template=1192013 https://issuetracker.google.com/issues/new?component=522910&...
- gitgud 5y ago
  This is a problem I've encountered too, people are unable to login to a Google account when using insecure Webview browsers... which includes; Messenger, Facebook, Instagram... etc. But Gmail Webviews allow Google logins though :/
svnpenn 5y ago
Please dont post links to programs that arent even publicly available.
- mthoms 5y ago
  AFAIK There's nothing wrong with doing so. The comment was on topic, and the project is interesting. One of the most discussed projects on HN in the past year or so has been GPT-3 which is (was?) pretty hard to get access to.
  - astrange 5y ago
    GPT-3 is pretty open at this point.
jackdawed 5y ago
A browser environment designed for researching is something I've been investigating lately. I want to stay with Chromium for convenience (Chrome for work, ungoogled-chromium for personal). Right now I see two paths that might work for me: - A standalone browser that I use only for research purposes. Currently evaluating Bonsai [1] and am interested in Synth. - A suite of tools that makes bookmarking and organizing easier when used alongside Chrome. Currently, I pay for Raindrop [2] to manage bookmarks, most likely will pay for Slapdash [3] for indexing, and am evaluating Heyday [4]. For an end-user like me, I would much rather pay for an extension+SaaS for Chrome or Firefox, rather than deal with workarounds for browser incompatibility. [1] https://bonsaibrowser.com/ https://bonsaibrowser.com/ [2] https://raindrop.io/ https://raindrop.io/ [3] https://slapdash.com/ https://slapdash.com/ [4] https://heyday.xyz/ https://heyday.xyz/
- parhamn 5y ago
  Awesome. To keep focus on the main topic, feel free to email me to chat more (FWIW I've done the 50 extension patchwork thing and generally find the extension experience to fractured and suboptimal for me).
  - smoldesu 5y ago
    What OSes are compatible?
- leetrout 5y ago
  You might also like promnesia https://github.com/karlicoss/promnesia#readme https://github.com/karlicoss/promnesia#readme And if you're interested we have a small discord server "awesome knowledge management" come join us! https://discord.gg/XPNeDSQE2j https://discord.gg/XPNeDSQE2j
  - throw10920 5y ago
    What makes your discord server unique among the thousands of other knowledge-management organizations out there?
only4here 5y ago
Kind of unrelated to the whole Google thing, but this Synth browser is a really cool idea. I'll read more into it when I get the chance!
Wowfunhappy 5y ago
Huh. I'm using a little-known Chromium fork[0] and I haven't had any trouble logging into Google services. 0: https://github.com/blueboxd/chromium-legacy https://github.com/blueboxd/chromium-legacy
- heavyset_go 5y ago
  It might just pass as Chromium to their browser fingerprinting.
  - Wowfunhappy 5y ago
    I suppose, but then how would they detect a Chromium build with a keylogger?
    - deleted 5y ago
      [deleted]
teitoklien 5y ago
Hey, cool website !, The mailto: hyperlink on your careers button in the footer, has a typo, namely, "mailto:careers@synth.app&subject=Synth Careers&body=Please attach resume!" It should be, "mailto:careers@synth.app?subject=Synth Careers&body=Please attach resume!" that &subject instead of ?subject is causing that mailto link to not be imported properly by most mail apps, trivial thing, but thought I'd mention it. Good luck with your app !
- GekkePrutser 5y ago
  And replacing the spaces in the subject with %20 will fix it on more browsers, at least it's at the end :)
  - irae 5y ago
    And providing no email at all and using form submission with captcha will annoy a bunch people but will save you from a lot of spam ¯\_(ツ)_/¯
    - mellavora 5y ago
      You could even power the captcha with Google! <looks at subject of thread nervously>
drzaiusapelord 5y ago
Its craziness all the way down. I have a google voice number which is my "default" number with my gmail accounts. All my gmail accounts were automatically migrated to use 2FA with this number which means if I lose all my google devices and I try to log into voice, I'll get 2FA I can't see because of the catch-22 situation of not being able to log into voice. The only reason I caught this is because they send me a notice about 2FA and I thought, wait what 2FA am I using? Instead of them running a tiny check to see "Wait, is this person using a voice number" they did it anyway. Worse, they know this because if you go into the 2FA page manually it says in bold letters to not use a good voice number. At this point I'm spooked and I'm just going to port my number into our account at work and have my work phone use this number instead of having a dual number phone with voice. Voice SMS is a mess too. 50% of services can't SMS it a code because Google blocks it. Other services won't accept it for SMS codes because its "not a real phone." If I didn't catch this then there would have been a day where I'm locked out of my accounts with no apparent way back in.
- kadoban 5y ago
  > Voice SMS is a mess too. 50% of services can't SMS it a code because Google blocks it. Other services won't accept it for SMS codes because its "not a real phone." The first part of that shouldn't be true. I've used mine to receive all kinds of SMS and it always works fine _except_ for the services that just won't accept the number. Only run across maybe one or two of those, over some years. For SMS from real people it works fine ofc.
  - drzaiusapelord 5y ago
    What happens is some organizations run a verifying to see if its a VOIP number, and if it is, considers it invalid for SMS based 2FA, and other authentication, presumably to stop hackers. Some big names use these lists, most notably Zelle to transfer money. Discord as well. Why Google also seems to block incoming SMS from Microsoft Authentication and others is beyond me. Maybe MS isn't sending because it doesn't consider that number real and just fails silently on their end? Maybe Google's own lists are very aggressive. I suspect the latter because this comes up a lot. No one seems to have a good answer to any of this because there's no laws requiring transparency so they hide their rube-goldberg-esque SMS policies behind obscurity and its up to me, the customer, to somehow navigate this mess. Yes, from regular people things are fine, but my life isn't dictated by regular people but the mega corporations capitalism creates and how I have to cater to their various technological whims. If my phone can't get messages because these big companies are always feuding in some way, then I'm locked out of essential services I need to live, have a job, do banking, etc. Its a small comfort that my friends can text me when I can't get texts from my bank, money transfers, or for work. As of right now in the USA, having a VOIP number be your primary phone number is unfeasible. I have a work cell with a "real" number that I use for at least 4 different services for SMS because of this issue.
heavyset_go 5y ago
Interesting how the brand of security companies like Google keep telling us is in our best interests always seems to secure their corporate revenue streams first, while the security and freedom of users are an afterthought.
- KarlKemp 5y ago
  Yeah, they make almost tens of dollars forcing users to use Safari or Edge instead of lynx.
  - eru 5y ago
    Well, if they could make tens of dollars per user, that would be pretty good.
  - richardw 5y ago
    Yes but they save a lot not paying Firefox to be the search box.
- deckard1 5y ago
  years ago I interviewed with a startup that was aiming to put their routers in various locations like airports and coffee shops. They would offer free or cheap internet at those locations. The catch: they were going to swap out ads with their own ads on the fly. Shortly after that, Google started pushing HTTPS. I never believed that was a coincidence.
  - TedDoesntTalk 5y ago
    The great migration to https, even for read-only self-hosted blogs, has been an amazing disservice to the world. Maybe if we had non-expiring ssl certificates with working OCSP or CRL, I’d have a different opinion.
DarylZero 5y ago
Synth looks cool but why can't it just be an extension?
- parhamn 5y ago
  Well, for one, nonsense like this is why I set out to build a browser in the first place :) More generally, the user experience is, naturally, worlds apart from extensions.
emodendroket 5y ago
> Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic. OK but that also describes pretty much all the Web browsers the vast majority of Web users actually intend to use, right?
- weare138 5y ago
  How do you know what people 'intend' to use? Making it inconvenient to use alternative browsers especially when they compete with your own is manufactured consent not intention. I use FF on Linux and have to go through that crap every time FF updates even though nothing else has changed.
  - emodendroket 5y ago
    It seems to me that packaging a malicious browser to look like a familiar one is actually an attack vector
- immibis 5y ago
  Yes, in part thanks to their efforts to make it harder to use other browsers...
  - emodendroket 5y ago
    I think you are overestimating the inclination anybody has to use those.
nopenopenopeno 5y ago
What is a MITM?
- stephenhuey 5y ago
  Man In The Middle attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack
- nevster 5y ago
  Man in the middle
- antaviana 5y ago
  Man in the middle
friedturkey 5y ago
Google sometimes blocks me from searching using Firefox, saying it’s “suspicious activity” and sending me into captcha hell that always rejects my results after several screens for no reason. It’s incredibly transparent as to what they’re doing. That Google became the most anti-consumer company out there is pretty disgraceful.
- chimen 5y ago
  fake your browser header to a chrome variant.
  - syncbehind 5y ago
    That doesn't get rid of the problem, it only prolongs it.
  - eru 5y ago
    The header isn't the only thing that identifies a browser. A faked header might look even more suspicious to their algorithm?
- entropie 5y ago
  > Google sometimes blocks me from searching using Firefox, saying it’s “suspicious activity” and sending me into captcha hell that always rejects my results after several screens for no reason. That happend to me only when using tor.
  - kome 5y ago
    that happens to me all the time, i have no idea why. i'm using firefox.
  - option_greek 5y ago
    Use private mode exclusively. You will start getting into the captcha hell in a day or two.
    - 5y ago
passerby1 5y ago
I wonder if that takes long for gogle to create a premium search account product. Paid one.
vba616 5y ago
At work I use Chrome, and I was once using some more obscure features of Google Search to find Microsoft documentation and it (Google) started asking me to verify I wasn't a bot, over and over. So there's some evidence that this sort of nonsense can be other than malice.
dzmien 5y ago
I use qutebrowser[0] which is built on qtwebengine, which is based on Chromium but comes with the caveat that it will likely be blacklisted by Google since it does not follow upstream's release schedule. But it is trivial to get around this by setting the user agent to something not blacklisted. [0] https://qutebrowser.org/ https://qutebrowser.org/
weq 5y ago
How do we get our embedded webview driven app verified as a secure browser or has the AI already designated the lucky few and we are cast aside?
ngold 5y ago
Godspeed building any browser. I know it's just for research, but I miss options. Palemoon was great until it imploded.
mleonhard 5y ago
I use a proxy service (VPN) and gstatic.com blocks my requests. This breaks reCAPTCHA which defeats its entire purpose. It also breaks every site that uses Firebase. About 50% of sites load their fonts from Google and they appear with all text invisible and finally appear after about 3 seconds. A few sites, even government sites, refuse to display any content at all until they load their JavaScript from Google. Browsing from this Google-blocked VPN has been an eye-opening experience. Google tech is pervasive and makes the web hostile for everyone practicing online hygiene. When Google first blocked my proxy, suddenly search in Gmail and Drive stopped working. This was my paid Google business account. I tried to contact Google Support but found I couldn't log in. I carefully wrote down a Google Support PIN several years ago. When I tried to call Google Support, the PIN didn't work. Apparently, Google Support PINs expire after an hour. So I learned that Google provides zero support for login problems, even for paid accounts. That's a massive risk. I switched my business accounts to Zoho. It took about 4 hours to sign up and move over my domain + email + docs + spreadsheets + drive. I've been using Zoho for about 3 weeks now and it's fine. Zoho Email search is good. They let people create support tickets without logging in. And humans respond to the tickets within hours.

manish_gill 5y ago

Just signed up. Your idea appeals to me. Hope I can take it for a spin soon!

bpye 5y ago

Wow, that's awful. I wonder who's idea it was? Is it doing anything more than checking user agent (trivial to spoof), because if not that seems entirely hostile.

parhamn 5y ago
It's not just the user-agent, it is definitely doing non-trivial fingerprinting (both linked projects also had UA mitigations before). We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them.
- ilrwbwrkhv 5y ago
  What did min browser have?
- klabb3 5y ago
  > it is definitely doing non-trivial fingerprinting Can confirm. To generalize and understand why, big corps have to deal with an insane amount of (often automated) abuse, so they build profiles using data collection to assess your risk level. Being in the wrong cohort (say unusual browser, small country, rare language, use a vpn etc) can affect your score. Basically it's these massive bayesian filters that output how suspicious some activity is. Whether you're signing in to Gmail, returning a product, buying something with a credit card or booking an Uber, some form of score is computed and then used to allow/deny/delay/verify. Obviously this is well established in the insurance and finance industries, but make no mistake, it happens everywhere. This approach is understandable from a business perspective, but imo deeply troubling for an open society. You don't have to squint much in order to see the similarities to social credit systems, EVEN if there is no grand totalitarian state-coordinated behind it. As usual, the first step is transparency so we can actually discuss these issues based on accurate data, but that's very difficult today. Usually fraud and abuse prevention is among the most secretive departments, they never share anything.
  - makeitdouble 5y ago
    To clarify, these scores can be sanely used to decide what level of trust you have, and when you have none you get a capcha, a SMS check or something heavier to authorize the access you are trying to get. In my book you’re never supposed to fully block a session because of the score, there needs to be a (potentially burdensome) way to prove the score wrong. Blocking a browser should be out of question.
    - klabb3 5y ago
      Even so, we still need to have a debate about what levels of "papieren bitte" we are willing to accept for different functions of society. The currently ubiquitous corporate-centric trend is to "nudge" instead of outright ban, i.e. instead of a bool it's numeric, and I highly doubt that the difference in data type is as significant as people think it is -- "Well you can always create a new account/buy another device/ask your friend to do it/.." and so on. If these numeric scores are affecting search results, recommendations, when sharing stuff, etc etc, there's no question that it will affect societal discourse. These hidden "algorithms" (as in the popular term) and fraud prevention systems are so far from being understood that it may be too late to reverse it when we realize what's happened.
- 1vuio0pswjnm7 5y ago
  "We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them." First thing I do when creating a new Gmail account, using a "supported" browser, is to save the required parameters of the cookie in a text file then convert the file to a simple shell script, powered by netcat and TLS proxy. This only takes me takes seconds. Then I close the supported browser without logging out. The word "sketchy" seems applicable because unlike, e.g., a bank website, companies like Google and Facebook will let users stay "logged in" for some ridiculously long period like one year. Yikes. Two ways to disable the script are 1. log out of that session (://mail.google.com/mail/logout?ec=ABCDEF, ://accounts.google.com/Logout?service=mail&continue=https://mail.google.com/mail/ https://mail.google.com/mail/, ://mail.google.com/accounts/ClearOSID) or 2. change the password. This tiny script can be transferred to any computer and used to check and send mail from the command line. No browser, Javascript or password required. Netcat, the browser of the future! :)
jpalomaki 5y ago
Likely the goal is to protect users from malicious apps, trying to get user to log in on a hosted browser component in order to scrape their data (or perform activities on behalf of user).
- Gigachad 5y ago
  I think HN users often severely downplay the threats large companies are facing and frame every anti abuse measure as a coordinated attempt to shut down their indie browser fork. People are having their lives ruined when their account gets breached which Google prioritizes over avoiding accidentally blocking a few odd users.

smitop 5y ago

I'd guess that it's because they (incorrectly) think it's an embedded Webview, which get blocked (see https://developers.googleblog.com/2021/06/upcoming-security-changes-to-googles-oauth-2.0-authorization-endpoint.html https://developers.googleblog.com/2021/06/upcoming-security-... and https://developers.google.com/identity/protocols/oauth2/policies#browsers https://developers.google.com/identity/protocols/oauth2/poli...). You could try creating an issue in the Cloud Identity issue tracker (Cloud Identity is Google's API for letting websites have a "Login with Google" thing): https://issuetracker.google.com/issues/new?component=522910&template=1192013 https://issuetracker.google.com/issues/new?component=522910&...

gitgud 5y ago
This is a problem I've encountered too, people are unable to login to a Google account when using insecure Webview browsers... which includes; Messenger, Facebook, Instagram... etc. But Gmail Webviews allow Google logins though :/

svnpenn 5y ago

Please dont post links to programs that arent even publicly available.

mthoms 5y ago
AFAIK There's nothing wrong with doing so. The comment was on topic, and the project is interesting. One of the most discussed projects on HN in the past year or so has been GPT-3 which is (was?) pretty hard to get access to.
- astrange 5y ago
  GPT-3 is pretty open at this point.

jackdawed 5y ago

A browser environment designed for researching is something I've been investigating lately. I want to stay with Chromium for convenience (Chrome for work, ungoogled-chromium for personal). Right now I see two paths that might work for me: - A standalone browser that I use only for research purposes. Currently evaluating Bonsai [1] and am interested in Synth. - A suite of tools that makes bookmarking and organizing easier when used alongside Chrome. Currently, I pay for Raindrop [2] to manage bookmarks, most likely will pay for Slapdash [3] for indexing, and am evaluating Heyday [4]. For an end-user like me, I would much rather pay for an extension+SaaS for Chrome or Firefox, rather than deal with workarounds for browser incompatibility. [1] https://bonsaibrowser.com/ https://bonsaibrowser.com/ [2] https://raindrop.io/ https://raindrop.io/ [3] https://slapdash.com/ https://slapdash.com/ [4] https://heyday.xyz/ https://heyday.xyz/

parhamn 5y ago
Awesome. To keep focus on the main topic, feel free to email me to chat more (FWIW I've done the 50 extension patchwork thing and generally find the extension experience to fractured and suboptimal for me).
- smoldesu 5y ago
  What OSes are compatible?
leetrout 5y ago
You might also like promnesia https://github.com/karlicoss/promnesia#readme https://github.com/karlicoss/promnesia#readme And if you're interested we have a small discord server "awesome knowledge management" come join us! https://discord.gg/XPNeDSQE2j https://discord.gg/XPNeDSQE2j
- throw10920 5y ago
  What makes your discord server unique among the thousands of other knowledge-management organizations out there?

only4here 5y ago

Kind of unrelated to the whole Google thing, but this Synth browser is a really cool idea. I'll read more into it when I get the chance!

Wowfunhappy 5y ago

Huh. I'm using a little-known Chromium fork[0] and I haven't had any trouble logging into Google services. 0: https://github.com/blueboxd/chromium-legacy https://github.com/blueboxd/chromium-legacy

heavyset_go 5y ago
It might just pass as Chromium to their browser fingerprinting.
- Wowfunhappy 5y ago
  I suppose, but then how would they detect a Chromium build with a keylogger?
  - deleted 5y ago
    [deleted]

teitoklien 5y ago

Hey, cool website !, The mailto: hyperlink on your careers button in the footer, has a typo, namely, "mailto:careers@synth.app&subject=Synth Careers&body=Please attach resume!" It should be, "mailto:careers@synth.app?subject=Synth Careers&body=Please attach resume!" that &subject instead of ?subject is causing that mailto link to not be imported properly by most mail apps, trivial thing, but thought I'd mention it. Good luck with your app !

GekkePrutser 5y ago
And replacing the spaces in the subject with %20 will fix it on more browsers, at least it's at the end :)
- irae 5y ago
  And providing no email at all and using form submission with captcha will annoy a bunch people but will save you from a lot of spam ¯\_(ツ)_/¯
  - mellavora 5y ago
    You could even power the captcha with Google! <looks at subject of thread nervously>

drzaiusapelord 5y ago

Its craziness all the way down. I have a google voice number which is my "default" number with my gmail accounts. All my gmail accounts were automatically migrated to use 2FA with this number which means if I lose all my google devices and I try to log into voice, I'll get 2FA I can't see because of the catch-22 situation of not being able to log into voice. The only reason I caught this is because they send me a notice about 2FA and I thought, wait what 2FA am I using? Instead of them running a tiny check to see "Wait, is this person using a voice number" they did it anyway. Worse, they know this because if you go into the 2FA page manually it says in bold letters to not use a good voice number. At this point I'm spooked and I'm just going to port my number into our account at work and have my work phone use this number instead of having a dual number phone with voice. Voice SMS is a mess too. 50% of services can't SMS it a code because Google blocks it. Other services won't accept it for SMS codes because its "not a real phone." If I didn't catch this then there would have been a day where I'm locked out of my accounts with no apparent way back in.

kadoban 5y ago
> Voice SMS is a mess too. 50% of services can't SMS it a code because Google blocks it. Other services won't accept it for SMS codes because its "not a real phone." The first part of that shouldn't be true. I've used mine to receive all kinds of SMS and it always works fine _except_ for the services that just won't accept the number. Only run across maybe one or two of those, over some years. For SMS from real people it works fine ofc.
- drzaiusapelord 5y ago
  What happens is some organizations run a verifying to see if its a VOIP number, and if it is, considers it invalid for SMS based 2FA, and other authentication, presumably to stop hackers. Some big names use these lists, most notably Zelle to transfer money. Discord as well. Why Google also seems to block incoming SMS from Microsoft Authentication and others is beyond me. Maybe MS isn't sending because it doesn't consider that number real and just fails silently on their end? Maybe Google's own lists are very aggressive. I suspect the latter because this comes up a lot. No one seems to have a good answer to any of this because there's no laws requiring transparency so they hide their rube-goldberg-esque SMS policies behind obscurity and its up to me, the customer, to somehow navigate this mess. Yes, from regular people things are fine, but my life isn't dictated by regular people but the mega corporations capitalism creates and how I have to cater to their various technological whims. If my phone can't get messages because these big companies are always feuding in some way, then I'm locked out of essential services I need to live, have a job, do banking, etc. Its a small comfort that my friends can text me when I can't get texts from my bank, money transfers, or for work. As of right now in the USA, having a VOIP number be your primary phone number is unfeasible. I have a work cell with a "real" number that I use for at least 4 different services for SMS because of this issue.

heavyset_go 5y ago

Interesting how the brand of security companies like Google keep telling us is in our best interests always seems to secure their corporate revenue streams first, while the security and freedom of users are an afterthought.

KarlKemp 5y ago
Yeah, they make almost tens of dollars forcing users to use Safari or Edge instead of lynx.
- eru 5y ago
  Well, if they could make tens of dollars per user, that would be pretty good.
- richardw 5y ago
  Yes but they save a lot not paying Firefox to be the search box.
deckard1 5y ago
years ago I interviewed with a startup that was aiming to put their routers in various locations like airports and coffee shops. They would offer free or cheap internet at those locations. The catch: they were going to swap out ads with their own ads on the fly. Shortly after that, Google started pushing HTTPS. I never believed that was a coincidence.
- TedDoesntTalk 5y ago
  The great migration to https, even for read-only self-hosted blogs, has been an amazing disservice to the world. Maybe if we had non-expiring ssl certificates with working OCSP or CRL, I’d have a different opinion.

DarylZero 5y ago

Synth looks cool but why can't it just be an extension?

parhamn 5y ago
Well, for one, nonsense like this is why I set out to build a browser in the first place :) More generally, the user experience is, naturally, worlds apart from extensions.

emodendroket 5y ago

> Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic. OK but that also describes pretty much all the Web browsers the vast majority of Web users actually intend to use, right?

weare138 5y ago
How do you know what people 'intend' to use? Making it inconvenient to use alternative browsers especially when they compete with your own is manufactured consent not intention. I use FF on Linux and have to go through that crap every time FF updates even though nothing else has changed.
- emodendroket 5y ago
  It seems to me that packaging a malicious browser to look like a familiar one is actually an attack vector
immibis 5y ago
Yes, in part thanks to their efforts to make it harder to use other browsers...
- emodendroket 5y ago
  I think you are overestimating the inclination anybody has to use those.

nopenopenopeno 5y ago

What is a MITM?

stephenhuey 5y ago
Man In The Middle attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack
nevster 5y ago
Man in the middle
antaviana 5y ago
Man in the middle

friedturkey 5y ago

Google sometimes blocks me from searching using Firefox, saying it’s “suspicious activity” and sending me into captcha hell that always rejects my results after several screens for no reason. It’s incredibly transparent as to what they’re doing. That Google became the most anti-consumer company out there is pretty disgraceful.

chimen 5y ago
fake your browser header to a chrome variant.
- syncbehind 5y ago
  That doesn't get rid of the problem, it only prolongs it.
- eru 5y ago
  The header isn't the only thing that identifies a browser. A faked header might look even more suspicious to their algorithm?
entropie 5y ago
> Google sometimes blocks me from searching using Firefox, saying it’s “suspicious activity” and sending me into captcha hell that always rejects my results after several screens for no reason. That happend to me only when using tor.
- kome 5y ago
  that happens to me all the time, i have no idea why. i'm using firefox.
- option_greek 5y ago
  Use private mode exclusively. You will start getting into the captcha hell in a day or two.
  - 5y ago

passerby1 5y ago

I wonder if that takes long for gogle to create a premium search account product. Paid one.

vba616 5y ago

At work I use Chrome, and I was once using some more obscure features of Google Search to find Microsoft documentation and it (Google) started asking me to verify I wasn't a bot, over and over. So there's some evidence that this sort of nonsense can be other than malice.

dzmien 5y ago

I use qutebrowser[0] which is built on qtwebengine, which is based on Chromium but comes with the caveat that it will likely be blacklisted by Google since it does not follow upstream's release schedule. But it is trivial to get around this by setting the user agent to something not blacklisted. [0] https://qutebrowser.org/ https://qutebrowser.org/

weq 5y ago

How do we get our embedded webview driven app verified as a secure browser or has the AI already designated the lucky few and we are cast aside?

ngold 5y ago

Godspeed building any browser. I know it's just for research, but I miss options. Palemoon was great until it imploded.

mleonhard 5y ago

I use a proxy service (VPN) and gstatic.com blocks my requests. This breaks reCAPTCHA which defeats its entire purpose. It also breaks every site that uses Firebase. About 50% of sites load their fonts from Google and they appear with all text invisible and finally appear after about 3 seconds. A few sites, even government sites, refuse to display any content at all until they load their JavaScript from Google. Browsing from this Google-blocked VPN has been an eye-opening experience. Google tech is pervasive and makes the web hostile for everyone practicing online hygiene. When Google first blocked my proxy, suddenly search in Gmail and Drive stopped working. This was my paid Google business account. I tried to contact Google Support but found I couldn't log in. I carefully wrote down a Google Support PIN several years ago. When I tried to call Google Support, the PIN didn't work. Apparently, Google Support PINs expire after an hour. So I learned that Google provides zero support for login problems, even for paid accounts. That's a massive risk. I switched my business accounts to Zoho. It took about 4 hours to sign up and move over my domain + email + docs + spreadsheets + drive. I've been using Zoho for about 3 weeks now and it's fine. Zoho Email search is good. They let people create support tickets without logging in. And humans respond to the tickets within hours.