Comment by dijit | Hacker News Reader

Comment by dijit | Hacker News Reader

Parent Full thread

Odd. I dislike Google’s very much. Although I use Google’s with many accounts (personal/work/partner) sometimes URLs will just assume my identity is “logged in account index 0” and give me a permission denied, or pass me to a page which has no way of changing the active account. I found that most urls can have “u/1/“ pretty much anywhere to change accounts but if they have rewritten the url before I see the permission denied or black-hole then it’s useless.

There’s also the fact that google recently forced Javascript and specific browsers to be used in order to be able to login. So I was locked out of my account for a while until someone discovered that the “rules” are a little more lax for Firefox useragents.

To add to this: I’m certainly no Microsoft fanboy but the best login I have experienced (in my life I think) is AzureAD with SAML. It seems to use Kerberos silently in the background to do saml handshaking. It’s truly seamless and very fast.

Even if I’m logged in to outlook from office365 (from a non-enrolled computer) I won’t even be presented with another login screen. I’ll just be logged in like “magic”.

> There’s also the fact that google recently forced Javascript and specific browsers to be used in order to be able to login. So I was locked out of my account for a while until someone discovered that the “rules” are a little more lax for Firefox useragents.

There's a ton of threat mitigation and detection of unusual activities going on behind the scenes. This is a big reason why my company uses GSuite SSO - it's basically impossible to achieve a similar level of security with a DIY SSO setup. Auth is very hard to get right with all corner cases considered.

JS trickery is key to detecting bots, and blocking super-outdated browsers like Konqueror that basically lack all modern security mitigations is a reasonable thing to do (and probably allows them to remove less strict fallbacks for those browsers that were previously abused by bad actors).

What exactly is the threat model in which blocking all Konqueror users is a reasonable thing to do?

> Auth is very hard to get right with all corner cases considered

What's wrong with an x509 client certificate?

> blocking super-outdated browsers like Konqueror that basically lack all modern security mitigations is a reasonable thing to do

Except they still allow browsers far more insecure, like IE. And they could do feature detection to see if the security features are implemented or not.

Blocking user-agents does nothing good for anyone.

IE has a much larger market share, so they probably spend a lot of extra time on IE special cases.

That means it doesn't have anything to do with security.

Yeah, Google's SSO is fine unless the first logged-in account (/u/0) is one with a redirect to a company portal login. At which point you have to manipulate the URL to get to a different account.

When logging in to gmail (gsuite really) for work, I notice that I’m briefly redirected to accounts.youtube.com after putting in the otp even though the account has no youtube association. Any ideas why? I’ve tested blocking the domain and it still lets me through (after hitting back after falling to load). Is this just “because Firefox”?

From what I can tell, it's setting some kind of cookie for Youtube as part of the standard Google login flow. They probably have their cookies set up in such a way that authentication data is only accessible from first-party websites (like cookies).

I can see 11 cookies on the Youtube.com domain in my browser. Some of those seem to be purely for authentication reasons. I'm pretty sure that's why Google flows through Youtube when you log in.

As for why they always try to set Youtube cookies: I don't know, but it's probably because they don't feel like splitting up their authentication flow. Doing the redirect for accounts even when they don't have any Youtube-related is probably a no-op; leaving it like that doesn't cost anything close to the time and resources it would take to segregate their entire workflow + verify that the security is still sound.

More context to the logging in with “unable to verify the security of the browser” issue: https://forum.manjaro.org/t/google-blocks-access-logging-fro...

I use Google’s with many accounts (personal/work/partner)

You don't mention your use case but it's almost always a bad idea to be logging in as someone else, not just at Google but everywhere. Some sort of access delegation would probably be much better.

As for a work account, I keep it in a separate Chrome profile. Not because of logging in but because you can sync everything without risking spillage.

Reply on news.ycombinator.com