8 ms·
Google workspace threatening to block Firefox access
- coldfloor 4mo agoNot defending it, but given that they use the word "secure" three times in two sentences, I'm wondering if it's shown to browsers that don't support DBSC. Google has been really pushing/overselling this as a magical solution to cookie theft.
- squidi 4mo agoI was thinking it could be a Context-Aware Access thing. Firefox doesn’t support Endpoint Verification plugin
- michaelmrose 4mo agoIs it possible for a non-google browser to be said to meaningfully support this given that implementing the features wouldn't necessarily accomplish anything insofar as it wouldn't let you past the google only security gate and would represent a moving target in any case.
- jeroenhd 4mo agoIt states something about "your organisation's security requirements", do they document what requirements cause this rejection page? Some kind if changed default perhaps?
- tyingq 4mo agoMaybe not, but I have the feeling Google doesn't like that FF continues to support manifest v2.
- lokar 4mo agoI think it's just that some of the device policy restrictions the Org admin can choose to enable don't work in FF. So if they require them, no FF.
- insanitybit 4mo agoNo, this is easily the biggest flaw in CAA - there is no way to discover which policy broke your access. I have reported this to Google multiple times, even sent this directly to a Google SecEng (a well known one) to route internally. The issue persists and makes configuring CAA extremely painful and error prone.
- kmeisthax 4mo agoI am convinced there's someone who thinks debuggable security policies are a security risk and deliberately designs security APIs to be as inscrutable as possible.
- insanitybit 4mo agoIt's possible but I suspect it's just Google being a rather incompetent organization.
- functionmouse 4mo agoDo it then
- kjkjadksj 4mo agoSmells anticompetitive to me
- ferfumarma 4mo agoSeems like a monopolistic move.
- JumpCrisscross 4mo agoGoogle doesn’t have a monopoly in workspace applications.
- trey-jones 4mo agoYou don't have to have a monopoly to be monopolistic.
- redwall_hp 4mo agoThe Sherman Act says that any action by an individual, or conspiracy of a group of individuals, to "restrain trade" or seek a monopoly is illegal. Monopolies aren't a prerequisite for antitrust action, they're the failure state when you should have acted sooner.
- deleted 4mo ago[deleted]
- vel0city 4mo agoTaco Bell is a monopoly because they restrain the trade of tacos because they ask me to take my taco truck elsewhere when I park in their parking lot to sell tacos. Never mind there are other places I can set up my truck, never mind there are tons of other taco shops, Taco Bell is a monopoly as now I need to go find a different corner to sell my tacos, they're restraining the trade of tacos. Everything is a monopoly these days. Its practically meaningless in these conversations.
- vel0city 4mo agoGet this, they won't even let me sell my tacos through the Taco Bell app. What a monopoly! We need to get the FTC to enforce Taco Bell's and Taco Bueno's mobile apps to make their apps support every taco truck's ordering system. They're restraining the marketplace of selling tacos through their apps to only their own stores! Every feature of their apps needs to be easily integrated into whatever random POS every single food truck uses! I should be able to buy tacos from any taco vendor through the Taco Bell app. They're a monopoly!
- chmod775 4mo agoIt appears website developers desperately want to return to a world where browsers actively pretend to be another browser*. Want to check for DBSC? Enjoy not knowing whether the browser vendor decided to just roll a simple software implementation. Nothing good comes from browser detection over feature detection anyways. It's time to do away with user-agents and other overt identifying markers, and if we're still not in a better place, aggressively start stubbing features. * to some degree they still are. Firefox still ships with an user-agent override list for certain websites that have outdated user-agent sniffing for feature detection (and other fixes in about:compat).
- pjmlp 4mo agoYou mean the same that gave Chrome its market share, by adopting ChromeOS features, and shipping Electron apps?
- JoeAltmaier 4mo agoAnd yet, claiming support for a feature doesn't tell all. Different implementations can have subtle differences. Knowing the browser and version can allow a client to survive that.
- chmod775 4mo agoYes, that is the price developers will have to pay. Development will be harder, but users are going to prefer somewhat broken sites over being outright refused entry. At the end of the day user-preference is what dictates which browser is used and how it is configured. Developers will have to deal with what users choose to do on their end. You can only patronize people for so long before they look for a way around silly restrictions. Trying to keep someone safe by putting up walls, whether the threat is real or imaginary, is pointless when it is in the user's power to trivially defeat those walls - and when extension and browser developers are going to line up to sell them demolition tools (see ad blocking). Advice is going to go much further than roadblocks, long term.
- pjmlp 4mo ago
- lokar 4mo agoIs it not: https://knowledge.workspace.google.com/admin/security/create-context-aware-access-levels https://knowledge.workspace.google.com/admin/security/create... The Org admin can put all sorts of restrictions on who can do what based on the client device setup.
- saagarjha 4mo agoWhy is there a policy to require “Chrome” and not a policy to require another browser, hmm?
- deleted 4mo ago[deleted]
- insanitybit 4mo agoGoogle offers "Managed Chrome" as a service. What would you like them to do, offer "Managed Firefox"? Should AWS offer "Managed GCP"?
- saagarjha 4mo agoI don’t think Google should also offer a product that detects “managed Chrome”
- eli 4mo agoI don't think Google should also be allowed to remain in charge of Chrome at all but here we are.
- insanitybit 4mo agoUh, why? Context Aware Access is a policy attestation service. Managed Chrome is exactly the sort of thing you'd have policies for.
- hobofan 4mo agoOrganization admins may roll out hardened Firefox settings via their MDM solution, and then based on that want to restrict usage to Firefox.
- bgc 4mo agoThis is not a Google-wide thing… this is from Google’s Context-Aware Access product, which is configurable in Google Workspace environments. OP should direct their ire at their corporate IT or infosec team.
- dijit 4mo agoit shouldn’t be an option. Some IT departments just see a “more secure” checkbox and will always check it, even if it doesn’t make sense holistically- sometimes compliance incentivises (or forces) this behaviour. A common example is forcing intune/device enrolment for mobile devices (including ipads)- but not for the infinitely less secure laptops: because no such endpoint enforcement checkbox exists
- SoftTalker 4mo agoUsing a maintained and up-to-date browser is a reasonable requirement for an IT department (should be for anyone really). Would you suggest they should be allowing IE6 just because a user might prefer it? Of course Google is going to suggest using Chrome, if they detect that the browser might be out of date.
- dijit 4mo agoIs the implication that Firefox is not maintained or? The issue presented doesn’t seem to be “an up to date browser check” it seems to be a “is it latest chrome” check, which is a very different thing.
- SoftTalker 4mo agoWe don't know. The author doesn't mention how current the Firefox browser is/was. If the organization is indeed enabling a specific check for Chrome that seems a little over the top but they're the ones supporting their users and if they want to make their life easier by only dealing with one browser that's their decision to make. It's like saying that everyone has to use Windows, or a specific line of laptops, or any other standardization to simplify the support workload.
- add-sub-mul-div 4mo agoI use Google as a secondary search and as of roughly last week it gives me a captcha every time I try to do a search. That had never been the case before.
- hbn 4mo agoFor a few years now Google has given me a captcha whenever my VPN is on (Private Internet Access)
- TeMPOraL 4mo agoThat one has been a well-known thing for a decade if not more; it's not just Google, half the Internet will start throwing captchas or denying access once you connect via a VPN (specifically "VPN" as in one of the services you pay to avoid location-based discrimination of media streaming platforms).
- AIcanbiteme 4mo agoI browse over Tor for most things and most sites give me a captcha or just simply fail to load these days. I just close the window and move on to something else.
- SoftTalker 4mo agoI am seeing it a lot more lately with uBlock Origin. I've used DDG for search for a while now, but the last few times I've tried Google I got a captcha within a couple of queries if not immediately.
- saagarjha 4mo agoI know Google finally kicked all their employees off alternate browsers but doing it for external customers is definitely a choice
- Lendal 4mo agoI'm not so sure that enforcing an internal digital monoculture is a productive way to achieve innovation & resilience.
- wwizo 4mo agoAt least you got a heads-up. Few months back GCP "Agent Studio - Build" failed compiling the code in sandbox with a vague error message. Spent weeks troubleshooting, spoke to google engineers and reps, sending code, step by steps, screenshots. No one had a clue, until I switched from Firefox to Chrome out of desperation and it worked without a hitch.
- eikenberry 4mo agoDoes Chromium would still work?
- lelanthran 4mo ago[flagged]
- insanitybit 4mo agoSounds like you have a device policy configured and you should talk to your internal IT/Security team? edit: This title is just incredibly misleading. OP seems to have made a mistake here in thinking that this is something that Google has done when it's just that their corporate IT/ Sec team now enforces using Chrome.
- nekusar 4mo agoOh look, a monopolist is making settings "more secure" by enshrining monopoly more. And good fucking luck getting the FTC to follow monopoly law.
- sdrawkcabsti 4mo agoThey wont stop it. They will just slow down a bit if people get ruffled. That's how alphabet has handled everything else. They learned that if they can make changes slowly enough, they can do whatever the hell they want to. As we all know we can even pay 10x more for items and get next to no raise in our wages, but because it was done slowly in an "official" and "professional" manner, most folks didn't even complain, they just screamed into the giant pillow we call "the internet". Corporations of the 2020s love the internet's digital pillow and its magical crowd-quieting capabilities. If only the ancient roman empire had invented the internet they would be ruling the entire planet by now and we could watch gladiators on youtube :P provided we don't stand out too much (then we would be said gladiators)
- j45 4mo agoReading the news of EU countries leaving American cloud providers for local cloud solutions including mobile office, it's surprising to see Google doing this. It will only accelerate moves towards location of data, self-hosting, etc. The technologies to make this possible are much easier than they ever have been.
- Bill2Lewis 4mo agoThe sky is falling! The sky is falling! Do your homework before yelling "Fire!".
- hoomank3 4mo agoIt is probably Chrome Enterprise which lets you lock down, for example, what extensions people are allowed to install. There is a legit reason for organizations to want to standardize on one browser and to lock it down (as browser extensions are a major source of infiltration these days).
- goda90 4mo agoFirefox supports locking down like that as well so that sounds like lazy IT.
- Someone1234 4mo agoIf people want specifics about what this is, look here: > https://knowledge.workspace.google.com/admin/security/context-aware-access-examples-for-advanced-mode#device-examples https://knowledge.workspace.google.com/admin/security/contex... In particular "Allow access to devices using Chrome browser with security requirements" would present this message.
- RichardoC 4mo agoHi folks, blog author here. Few comments based on common threads - No we don't have, or use, IAP and haven't configured it - Yes I'm the admin so can confirm this - "Context aware access" is only available on enterprise, we're just on "Workspace business plus" Happy to answer any other questions
- nosioptar 4mo agoI love that google always sends useless canned responses after basically requiring you to perform a blood sacrifice to get ahold of anyone.
- eek2121 4mo agoThat's fine. The second I stopped caring, which is the day I stopped working for a living, I stopped worrying about what Google thinks. I don't use Google for email or search. (my email addresses are with proton, iCloud, and Hey, and my search is DDG) I'm not a big video person so I never use Youtube, the few times I need to use an office product I will either use OnlyOffice, or the Apple stuff. My Phone is an iPhone (with the stuff mentioned above) My browser is Firefox with uBlock Origin, and I almost never have problems with this setup.
- skygazer 4mo agoUnrelated to Google Workspace and Firefox, but I just noticed today that Google’s YouTube now says my iPhone’s Safari browser is incapable of playing full screen videos, which it’s not ever claimed before. I’m also getting sick of them pushing Chrome anytime I use a Google service like search or Gmail. I keep dismissing the prompts, but they are relentless. It all seems so sleezy and desperate.
- xyst 4mo agoWe have collectively let a few companies control/centralize the internet. Then have a shocked pikachu face when these same companies do shitty things.
- patchtopic 4mo agoantitrust
- jqpabc123 4mo agoJust say no to Google.