6 ms·

I've noticed gmail randomly blocks Firefox these days under the pretence of "your browser may not be secure" (i.e it doesn't persist through page refreshes), si

by tomxor 5y ago

I've noticed gmail randomly blocks Firefox these days under the pretence of "your browser may not be secure" (i.e it doesn't persist through page refreshes), similar to how they try to make you do a captcha unless you refresh the page... I seem to have less and less control over where and how I am allowed to sign in (even thought I'm using a U2F key), and as a result I'm definitely getting pushed closer to the threshold to move away from gmail out of lockout anxiety. [edit] To all those comments that assume I'm: running an outdated browser, have a broken profile, am running untrustworthy plugins, am doing UA spoofing or have been pwned etc etc... First you are missing the point: I dislike being held to increasingly arbitrary and opaque metrics of what Google defines as "safe"... because that is anxiety inducing, what will it be next week? even if I can log in now, will I be able to log in then? Second: No, this is Google's fault, not mine. I have not been pwned, this occurs through multiple OS installs. I always keep my browser(s) up to date (i'm a web dev), I know the implications of runing lots of plugins (I do not). However i DO employ restrictions as do many HN readers that Google will find undesirable, uBlock Origin, Firefox enhanced tracking protection, block third part cookies, DNS level ad and tracker blocking etc... It's likely Google doesn't like one of these, but back to point no. 1: it's an opaque metric, I do not like this... hell it may even be because i'm running Linux - so maybe I should do UA spoofing after all to pretend to be a "normal" Windows or Mac user.

emsixteen 5y ago
Have never experienced that since switching back to Firefox after years on various Chromium browsers. Developer Edition, on Windows fwiw.
- dijit 5y ago
  As others have mentioned it's probably privacy extensions blocking google's checks. NoScript (or, not enabling javascript globally) is known to cause issues for me. Things that hide or obfuscate user agents will break google too. Anything that replaces common CDNs with privacy friendly ones also causes issues.
dageshi 5y ago
I've never experienced this and have used FF for years.
Lucasoato 5y ago
I've been using Firefox for years, never faced this issue before... have you tried updating your browser?
- rd_police 5y ago
  > have you tried being a botnet enabler? Heh.
  - vimax 5y ago
    How is updating Firefox enabling botnets?
- exhilaration 5y ago
  Seconding this. I'm running Firefox on mac, with the built-in "Enhanced Tracking Protection" enabled, and uBlock Origin with the default settings. I've never seen that error. I don't use a VPN and I'm in the United States.
  - tomxor 5y ago
    I only use uBlock Origin and the built in tracking protection. However I do not use Firefox defaults: I block all third party cookies and don't save cache/history on exit.. I guess it could well be the latter that Google finds "unusual" and frankly, this is what is pushing me away... I don't care what the metric is, I want to be in control, i'm not an idiot who tries to log in from ancient browsers or not understand the risk of logging in from a computer I don't own... But Google is optimising for the 99% at the risk of locking out 1%, that seems careless to me.
    - shadowgovt 5y ago
      It is unusual. Google uses some of those cookies to determine whether it can lower the "threat signal" on your user agent (a UA carrying tokens that only Google could have issued to it is a huge indicator that Google has a pre-existing trust relationship with that UA). By throwing away those cookies, your browser is doing the equivalent of showing up to the Google DMV wearing a different hat / sunglasses / beard pattern every time; the agent behind the counter can't say "Oh, that's just tomxor, I know them at a glance already so I by default trust they aren't an active threat to me" and has to do the equivalent of going through the process of doing a background check on you every time. > But Google is optimising for the 99% at the risk of locking out 1%, that seems careless to me. It's not careless; it's extremely intentional. Google has a responsibility to protect the 99% and assumes that those who are Internet-savvy enough to do the work to wonk up their UA's thumbprinting are Internet-savvy enough to do the additional work to make that process smooth for their fancy non-defaults configuration. At the scale they operate, you can expect Google to make the decision that benefits the 99% over the 1% most of the time (particularly when it comes to account security). They'll assuredly risk losing business by making the 1%'s auth story more inconvenient if it makes it 1% more likely that the 99% don't lose the whole farm to a hacker.
alar44 5y ago
Your device is probably pwned. But go ahead and blame Google. I love how people just ignore these warnings.
- pdpi 5y ago
  “Your browser might not be secure” is a worthless error message. If you have a strong reason to believe this is the case, you should tell me. If you don’t tell me, I’m going to assume you don’t have a good reason, and you’re just scaremongering.
  - vntok 5y ago
    They are telling you.
    - krageon 5y ago
      They're not telling you what's wrong, just that you're bad for arbitrary reasons that ultimately will end up boiling down to "we don't trust that you try to preserve your own privacy".
- idop 5y ago
  It's probably uBlock or some extension that blocks Google's tracking.
- shakna 5y ago
  That message is generally when your user agent doesn't match Google's list of allowed browsers. It has nothing at all to do with how secure the browser on the end user's computer actually is.
  - jeffbee 5y ago
    I sincerely doubt it has anything to do with a whitelist of user agents. It is probably triggered by a failure to evaluate the botguard program, which indicates that your browser may be under the control of malware.
creatonez 5y ago
This is often the result of browser extensions. Specifically, CDN replacement extensions like Decentraleyes or LocalCDN.
- tomxor 5y ago
  I only use uBlock origin, but also do DNS level ad and tracker blocking separately..
gruez 5y ago
gmail login works with tor browser (based on firefox), of all things. my guess is that you're using an outdated/weird build of firefox and/or you have extensions that mess with the javascript execution environment (eg. canvas blocker, user agent spoofer)
deleted 5y ago
[deleted]
auslegung 5y ago
You absolutely should own your own domain and use it to email somewhere besides Google. I use Fastmail but ProtonMail is great, tutanota, mailfence, etc. Getting locked out of your email is no joke you don’t want to be in that situation. I have a paid account with Fastmail and a free account with protonmail just in case something goes wrong with Fastmail I can transition my free protonmail account to paid and use it with very minimal downtime Edit: adding my fastmail referral link just in case https://ref.fm/u26310488 https://ref.fm/u26310488
- bjt2n3904 5y ago
  If you have a domain, that's just another liability for email security. Look at what NameCheap did. Imagine losing your domain for some reason -- even forgetting to renew. All your contacts need a new address now, and until then it's dropped emails. A custom domain is mostly a vanity measure. It does allow you to migrate to a new email service if your provider cancels your subscription, I suppose... But I'd rather only have one thing to worry about.
  - sgc 5y ago
    The entire point of your own domain is to provide continuity. Of course it's one more thing to worry about, but it also one more layer of protection (an important one).
  - merlinscholz 5y ago
    Password managers are just another liability. One more thing you could lose the password to. What if the service shuts down entirely?
  - mrtranscendence 5y ago
    This has happened to me, briefly. I once forgot to renew and lost access to email. Luckily I was able to fix the issue quickly. I do kind of wish I had never gone down the route of using my own domain for email. I use gmail with it, and will now have to bear a recurring payment of $6 monthly (IIRC). I could move hosts but none of them are free to my knowledge, and a free service comes with its own risks anyway. Plus that's my primary Google account. Now I feel locked in ... it's less about updating my contacts, as I don't field a lot of personal or business email from that account, but more about all of the services where my account is associated with that email address. Not to mention that I've logged into some sites via Google. It would be a royal pain to switch now. Edit: Also, my domain is super awkward, sometimes doesn't fit in the field when I'm writing it down on a form, and tends to draw comments when I just want to get my business done and go on. ALSO the account name is different from the name I actually use day to day now -- it's James when everyone knows me as Jay.
14 5y ago
I have been having lockout anxiety lately as well. I actually took the time to look up proton mail and gave been waiting for and day to add it to any accounts I need access to such as amazon, eBay, Facebook, etc. There are just too many stories of people losing their gmail and no recourse as you will never get a human on their part to fix the issue unless you are some high profile client who can rock the boar.
itvision 5y ago
I've got six google accounts and never seen this message while connecting from my normal IP address or a random VPN provider (so hundreds of users sharing the same IP address). I presume something is wrong with your Firefox profile.
- tomxor 5y ago
  > I presume something is wrong with your Firefox profile. It occurs randomly and across multiple fresh OS installs... it's Google, doesn't mean everyone will experience it, but it's annoying.
exikyut 5y ago
FWIW, I happened to try and login to my Google account a few months ago and was promptly kicked out in exactly the same way, and after root-causing "what did I do..." I realized it was because I'd just set --remote-debugging-port=.... when restarting my Chrome session. Turns out this sets navigator.webdriver (as in, makes that key exist), which Google's login chucks a wobbly at. It will not let you in with that set, sadly because dumb scammers seem to absolutely love (???) using headless Chromium to attempt to fulfill their dastardly plans. (Which is really sad, because it makes legitimate tinkering that much harder (eg, can't interact with my primary session using nodejs/whatever :<).) I'm wondering if Firefox is setting something off something similar. You say this only happens randomly? I wonder what correlated thing is happening at the same time as these failures, and if the "oh it's that" is on your or Google's side of the internet connection...
shadowgovt 5y ago
>I dislike being held to increasingly arbitrary and opaque metrics of what Google defines as "safe"... because that is anxiety inducing, what will it be next week? Unfortunately, that's the nature of computing in the era of the Internet; being connected online exposes one's accounts to every bad actor on the planet. Google has to keep adapting to the attacks that are successful against their most vulnerable users, and since attackers keep getting more savvy, countermeasures increase in complexity. I won't be surprised when Google mandates 2FA for everyone. But you're right that it puts a burden on the end user, and increases the odds of false-positive attack prevention kicking in. There really isn't a way off that anxiety-train I'm aware of that isn't "migrate to a different, far less popular service provider that won't be as large an attack target for bad actors," with all the negative consequences such a migration entails.
deleted 5y ago
[deleted]
- deleted 5y ago
  [deleted]
deleted 5y ago
[deleted]

by tomxor 5y ago

emsixteen 5y ago

Have never experienced that since switching back to Firefox after years on various Chromium browsers. Developer Edition, on Windows fwiw.

dijit 5y ago
As others have mentioned it's probably privacy extensions blocking google's checks. NoScript (or, not enabling javascript globally) is known to cause issues for me. Things that hide or obfuscate user agents will break google too. Anything that replaces common CDNs with privacy friendly ones also causes issues.

dageshi 5y ago

I've never experienced this and have used FF for years.

Lucasoato 5y ago

I've been using Firefox for years, never faced this issue before... have you tried updating your browser?

rd_police 5y ago
> have you tried being a botnet enabler? Heh.
- vimax 5y ago
  How is updating Firefox enabling botnets?
exhilaration 5y ago
Seconding this. I'm running Firefox on mac, with the built-in "Enhanced Tracking Protection" enabled, and uBlock Origin with the default settings. I've never seen that error. I don't use a VPN and I'm in the United States.
- tomxor 5y ago
  I only use uBlock Origin and the built in tracking protection. However I do not use Firefox defaults: I block all third party cookies and don't save cache/history on exit.. I guess it could well be the latter that Google finds "unusual" and frankly, this is what is pushing me away... I don't care what the metric is, I want to be in control, i'm not an idiot who tries to log in from ancient browsers or not understand the risk of logging in from a computer I don't own... But Google is optimising for the 99% at the risk of locking out 1%, that seems careless to me.
  - shadowgovt 5y ago
    It is unusual. Google uses some of those cookies to determine whether it can lower the "threat signal" on your user agent (a UA carrying tokens that only Google could have issued to it is a huge indicator that Google has a pre-existing trust relationship with that UA). By throwing away those cookies, your browser is doing the equivalent of showing up to the Google DMV wearing a different hat / sunglasses / beard pattern every time; the agent behind the counter can't say "Oh, that's just tomxor, I know them at a glance already so I by default trust they aren't an active threat to me" and has to do the equivalent of going through the process of doing a background check on you every time. > But Google is optimising for the 99% at the risk of locking out 1%, that seems careless to me. It's not careless; it's extremely intentional. Google has a responsibility to protect the 99% and assumes that those who are Internet-savvy enough to do the work to wonk up their UA's thumbprinting are Internet-savvy enough to do the additional work to make that process smooth for their fancy non-defaults configuration. At the scale they operate, you can expect Google to make the decision that benefits the 99% over the 1% most of the time (particularly when it comes to account security). They'll assuredly risk losing business by making the 1%'s auth story more inconvenient if it makes it 1% more likely that the 99% don't lose the whole farm to a hacker.

alar44 5y ago

Your device is probably pwned. But go ahead and blame Google. I love how people just ignore these warnings.

pdpi 5y ago
“Your browser might not be secure” is a worthless error message. If you have a strong reason to believe this is the case, you should tell me. If you don’t tell me, I’m going to assume you don’t have a good reason, and you’re just scaremongering.
- vntok 5y ago
  They are telling you.
  - krageon 5y ago
    They're not telling you what's wrong, just that you're bad for arbitrary reasons that ultimately will end up boiling down to "we don't trust that you try to preserve your own privacy".
idop 5y ago
It's probably uBlock or some extension that blocks Google's tracking.
shakna 5y ago
That message is generally when your user agent doesn't match Google's list of allowed browsers. It has nothing at all to do with how secure the browser on the end user's computer actually is.
- jeffbee 5y ago
  I sincerely doubt it has anything to do with a whitelist of user agents. It is probably triggered by a failure to evaluate the botguard program, which indicates that your browser may be under the control of malware.

creatonez 5y ago

This is often the result of browser extensions. Specifically, CDN replacement extensions like Decentraleyes or LocalCDN.

tomxor 5y ago
I only use uBlock origin, but also do DNS level ad and tracker blocking separately..

gruez 5y ago

gmail login works with tor browser (based on firefox), of all things. my guess is that you're using an outdated/weird build of firefox and/or you have extensions that mess with the javascript execution environment (eg. canvas blocker, user agent spoofer)

deleted 5y ago

[deleted]

auslegung 5y ago

You absolutely should own your own domain and use it to email somewhere besides Google. I use Fastmail but ProtonMail is great, tutanota, mailfence, etc. Getting locked out of your email is no joke you don’t want to be in that situation. I have a paid account with Fastmail and a free account with protonmail just in case something goes wrong with Fastmail I can transition my free protonmail account to paid and use it with very minimal downtime Edit: adding my fastmail referral link just in case https://ref.fm/u26310488 https://ref.fm/u26310488

bjt2n3904 5y ago
If you have a domain, that's just another liability for email security. Look at what NameCheap did. Imagine losing your domain for some reason -- even forgetting to renew. All your contacts need a new address now, and until then it's dropped emails. A custom domain is mostly a vanity measure. It does allow you to migrate to a new email service if your provider cancels your subscription, I suppose... But I'd rather only have one thing to worry about.
- sgc 5y ago
  The entire point of your own domain is to provide continuity. Of course it's one more thing to worry about, but it also one more layer of protection (an important one).
- merlinscholz 5y ago
  Password managers are just another liability. One more thing you could lose the password to. What if the service shuts down entirely?
- mrtranscendence 5y ago
  This has happened to me, briefly. I once forgot to renew and lost access to email. Luckily I was able to fix the issue quickly. I do kind of wish I had never gone down the route of using my own domain for email. I use gmail with it, and will now have to bear a recurring payment of $6 monthly (IIRC). I could move hosts but none of them are free to my knowledge, and a free service comes with its own risks anyway. Plus that's my primary Google account. Now I feel locked in ... it's less about updating my contacts, as I don't field a lot of personal or business email from that account, but more about all of the services where my account is associated with that email address. Not to mention that I've logged into some sites via Google. It would be a royal pain to switch now. Edit: Also, my domain is super awkward, sometimes doesn't fit in the field when I'm writing it down on a form, and tends to draw comments when I just want to get my business done and go on. ALSO the account name is different from the name I actually use day to day now -- it's James when everyone knows me as Jay.

14 5y ago

I have been having lockout anxiety lately as well. I actually took the time to look up proton mail and gave been waiting for and day to add it to any accounts I need access to such as amazon, eBay, Facebook, etc. There are just too many stories of people losing their gmail and no recourse as you will never get a human on their part to fix the issue unless you are some high profile client who can rock the boar.

itvision 5y ago

I've got six google accounts and never seen this message while connecting from my normal IP address or a random VPN provider (so hundreds of users sharing the same IP address). I presume something is wrong with your Firefox profile.

tomxor 5y ago
> I presume something is wrong with your Firefox profile. It occurs randomly and across multiple fresh OS installs... it's Google, doesn't mean everyone will experience it, but it's annoying.

exikyut 5y ago

FWIW, I happened to try and login to my Google account a few months ago and was promptly kicked out in exactly the same way, and after root-causing "what did I do..." I realized it was because I'd just set --remote-debugging-port=.... when restarting my Chrome session. Turns out this sets navigator.webdriver (as in, makes that key exist), which Google's login chucks a wobbly at. It will not let you in with that set, sadly because dumb scammers seem to absolutely love (???) using headless Chromium to attempt to fulfill their dastardly plans. (Which is really sad, because it makes legitimate tinkering that much harder (eg, can't interact with my primary session using nodejs/whatever :<).) I'm wondering if Firefox is setting something off something similar. You say this only happens randomly? I wonder what correlated thing is happening at the same time as these failures, and if the "oh it's that" is on your or Google's side of the internet connection...

shadowgovt 5y ago

>I dislike being held to increasingly arbitrary and opaque metrics of what Google defines as "safe"... because that is anxiety inducing, what will it be next week? Unfortunately, that's the nature of computing in the era of the Internet; being connected online exposes one's accounts to every bad actor on the planet. Google has to keep adapting to the attacks that are successful against their most vulnerable users, and since attackers keep getting more savvy, countermeasures increase in complexity. I won't be surprised when Google mandates 2FA for everyone. But you're right that it puts a burden on the end user, and increases the odds of false-positive attack prevention kicking in. There really isn't a way off that anxiety-train I'm aware of that isn't "migrate to a different, far less popular service provider that won't be as large an attack target for bad actors," with all the negative consequences such a migration entails.

deleted 5y ago

[deleted]

deleted 5y ago
[deleted]

deleted 5y ago

[deleted]