Stories
Slash Boxes
Comments

SoylentNews is people

Google Will Begin to Block Sign-Ins From Embedded Browser Frameworks in June

posted by janrinok on Saturday April 20 2019, @05:59PM   Printer-friendly
from the javascript==security dept.

MrPlow writes:

Submitted via IRC for ErkleLives

Phishing — schemes to nab personal data with disguised malicious webpages and emails — constituted more than 70% of all cyber attacks in 2016, according to a Verizon report. In an effort to combat them, Google last year announced it would require users to enable JavaScript during Google Account sign-in so that it could run attack-detecting risk assessments, and today, the company said it'll begin to block all sign-ins from embedded browser frameworks like Chromium Embedded Framework starting in June.

For the uninitiated, embedded browser frameworks enable developers to add basic web browsing functionality to their apps, and to use web languages like HTML, CSS, and JavaScript to create those apps' interface (or portions of it). They're typically cross-platform — Chromium Embedded Framework runs on Linux, Windows, and macOS — and they support a range of language bindings.

"We're constantly working to improve our phishing protections to keep your information secure," account security product manager Jonathan Skelker wrote in a blog post. "This is yet another layer of protection on top of existing safeguards like Safe Browsing warnings, Gmail spam filters, and account sign-in challenges."

[...] As an alternative to embedded browser frameworks, Google is suggesting that developers use browser-based OAuth authentication, which enables users to see the full address of the page where they're entering their credentials. "If you are a developer with an app that requires access to Google Account data, switch to using browser-based OAuth authentication today," Skelker said.

Source: https://venturebeat.com/2019/04/18/google-will-begin-to-block-sign-ins-from-embedded-browser-frameworks-in-june/

Original Submission

 
This discussion has been archived. No new comments can be posted.
Google Will Begin to Block Sign-Ins From Embedded Browser Frameworks in June | Log In/Create an Account | Top | 14 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 1) by ShadowSystems on Monday April 22 2019, @01:26AM

    by ShadowSystems (6185) <{ShadowSystems} {at} {Gmail.com}> on Monday April 22 2019, @01:26AM (#833220)

    Given I've turned off *all* scripting of any kind, the fact that Google or anyone would claim to require JS for my safety makes me laugh.
    I value my safety which is why I refuse to let that crap in the door.
    My old bank changed the site so it now requires JS to function, and I lost count of the number of times I emailed them with links to articles showing exactly how brain dead that was.
    I finally switched banks rather than enable JS to log in to their site, so if I'm not willing to enable it for my (now ex) bank, what chance in hell do you think anyone else has of forcing me to do it either?
    My new bank doesn't require it & maintains HTTPS just fine, so I feel rather smug.
    Dear site providers. Stop using scripts. It just makes your site a turd that doesn't take a polishing & puts lipstick on the wrong end of the pig.