Rendered at 19:30:25 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
bgc 2 hours ago [-]
This is not a Google-wide thing… this is from Google’s Context-Aware Access product, which is configurable in Google Workspace environments. OP should direct their ire at their corporate IT or infosec team.
dijit 2 hours ago [-]
it shouldn’t be an option.
Some IT departments just see a “more secure” checkbox and will always check it, even if it doesn’t make sense holistically- sometimes compliance incentivises (or forces) this behaviour.
A common example is forcing intune/device enrolment for mobile devices (including ipads)- but not for the infinitely less secure laptops: because no such endpoint enforcement checkbox exists
ktm5j 1 hours ago [-]
It's their organization. They are allowed to make decisions about what software their employees use. I'm a die-hard Mozilla fan, but I don't find this unreasonable.
cmeacham98 1 hours ago [-]
The problem is Google appears to label this as a security feature. I'm fine with the feature existing, but it should say something like "require Chrome" or "block Firefox" not "require a secure browser (wink wink we actually mean Chrome)"
insanitybit 54 minutes ago [-]
The wording here is bad, but basically CAA supports non browser specific policy and, in some cases, browser specific policy (GSuite offers a "Managed Chrome" policy). Firefox users can leverage much of the non browser specific policy, they obviously can not be a part of the "Managed Chrome" offering.
dijit 1 hours ago [-]
Google and Microsoft shouldn’t be giving levers that bake you more into their ecosystem regardless.
Your corporate serfdom is not in question, but I disagree with that notion too.
ktm5j 24 minutes ago [-]
It's a paid product, they are actually allowed to do this. Google is obviously going to focus on security testing with their own browser. It's understandable that organizations want to require chrome for their employees to access their workspace in the interest of security, but it's not the default.
There is zero problem here guys.
lern_too_spel 36 minutes ago [-]
If a corporation with my data allowed access to its internal tools using any browser running any arbitrary and possibly compromised third party extensions, that's a data leak and class action lawsuit waiting to happen.
jchw 31 minutes ago [-]
Note that making lock-in features like this effectively proprietary to the Chrome browser is only possible because of the fact that it's the same company making Google Workspace and Google Chrome.
I absolutely see many problems with this and you really ought to as well.
wslh 43 minutes ago [-]
I would say it's common to find dark patterns that involves ambiguity like the discussion we are having here. We can't know for sure but Google can increase the probability of being on their ecosystem.
Doohickey-d 21 minutes ago [-]
Well, it could als also be argued that Chrome _is_ more secure, for example because it uses app-bound encryption using Windows DPAPI system, for cookies, so that it at least tries to protect cookies from malicious applications running on the device. Firefox does not do this: https://security.stackexchange.com/questions/279629/are-cook...
If course the reverse can also be argued, for example that Firefox supports proper adblocking.
farbklang 35 minutes ago [-]
Well - it does make sense. If an organisation that contracts me has to chose between a) BYOD - but restrict downloads, etc, enforce export control, directly in the browser - I happily take that, vs getting a Windows laptop that is locked down and forced to work with that.
insanitybit 1 hours ago [-]
CAA is one of the most powerful security features you can enable in an org. You can manage browser extensions, device password policy, encryption, configuration, cookie attestation, etc.
tux3 23 minutes ago [-]
CAA is completely based on trust, it's not one of the most powerful security feature. It's completely voluntary reporting by the browser, and any attacker who cares can just lie without issues.
You can make Firefox pass CAA if you want. You take the Chrome "SecureConnect Reporting" (Context-Aware Access) plugin, port it to Firefox with some light changes, and you can report whatever you want to CAA.
insanitybit 14 minutes ago [-]
That's not entirely true. For example, on ChromeOS CAA is hardware backed. But obviously CAA is not intended to be our entire MDM solution, an attacker in a position to spoof your entire browser can bypass some of the policies on some operating systems. Similarly, attackers in that same position can bypass TLS. An attacker who owns the kernel can bypass much of your MDM. An attacker who owns the hardware can bypass just about anything.
tadfisher 3 minutes ago [-]
Understand that, in this conversation, your use of "attacker" is referring to "end user of the hardware". Which might be part of the Chrome team's definition, or might not, but gosh it would be nice to cater to the folks who are using the dang computer.
SoftTalker 2 hours ago [-]
Using a maintained and up-to-date browser is a reasonable requirement for an IT department (should be for anyone really). Would you suggest they should be allowing IE6 just because a user might prefer it?
Of course Google is going to suggest using Chrome, if they detect that the browser might be out of date.
dijit 2 hours ago [-]
Is the implication that Firefox is not maintained or?
The issue presented doesn’t seem to be “an up to date browser check” it seems to be a “is it latest chrome” check, which is a very different thing.
SoftTalker 2 hours ago [-]
We don't know. The author doesn't mention how current the Firefox browser is/was.
If the organization is indeed enabling a specific check for Chrome that seems a little over the top but they're the ones supporting their users and if they want to make their life easier by only dealing with one browser that's their decision to make. It's like saying that everyone has to use Windows, or a specific line of laptops, or any other standardization to simplify the support workload.
rpdillon 45 minutes ago [-]
> This was for a Google Workspace Business Plus account and workspace, from an up to date browser and OS.
kolinko 1 hours ago [-]
Not a little over the top, it is anticompetitive behavior.
inquirerGeneral 30 minutes ago [-]
[dead]
SpicyLemonZest 2 hours ago [-]
It's not clear to me that Context-Aware Access is as configurable as you're implying. At a glance, the docs seem to suggest that Chrome is the only browser you can force standardization on, which IMO does push this towards being Google's fault.
michaelmrose 1 hours ago [-]
It's not a little over the top its an antitrust issue and clearly and obviously wrong.
ibejoeb 36 minutes ago [-]
No, not at all. The implication is that the organization is dictating the software that employees are to use. There's nothing unusual about this.
jstummbillig 1 hours ago [-]
If we are meant to believe that this is a Chrome-invasion-move, it's the least effective lever of all times. Most of the time the more plausible explanations are just the likely ones.
dijit 1 hours ago [-]
you’d probably say something different if it were microsoft.
I don’t see why I should give affordances of good will to Google here.
They’re not stupid, they know that this is an effective lever to further cement full-fat chrome as the default browser for the internet.
SoftTalker 43 minutes ago [-]
Chrome was created because Google felt that the IE monopoly was hindering the advancement of web standards and improved browser capabilities. I suppose you could argue that was a different Google at a different time, but at one point they did feel that browser diversity was a good thing.
sandeepkd 11 minutes ago [-]
Its a normal choice, given a checkbox on page which advertises that checking it would make your security posture more safe. The IT person is safeguarding their own job.
Other way to look at it is, the company is paying for everything, and they get to make decisions based on what suits their security needs.
The Org admin can put all sorts of restrictions on who can do what based on the client device setup.
whateverboat 1 hours ago [-]
Unrelated to this news, but this is so rudimentary, when the correct solution instead is:
1. Make it ridiculously easy to install hardware vendor keys and register it with OS of choice. (like a standardized dialog box in UEFI and a standardized/regulated IPMI-like interface)
2. Allow for only measured boot on those devices.
3. Provided facility to verify signatures.
Do this on consumer and enterprise laptops and desktops alike and all of these weird set of conditions just go out of play and replaced by something much much simpler.
saagarjha 2 hours ago [-]
Why is there a policy to require “Chrome” and not a policy to require another browser, hmm?
insanitybit 1 hours ago [-]
Google offers "Managed Chrome" as a service. What would you like them to do, offer "Managed Firefox"? Should AWS offer "Managed GCP"?
saagarjha 42 minutes ago [-]
I don’t think Google should also offer a product that detects “managed Chrome”
eli 29 minutes ago [-]
I don't think Google should also be allowed to remain in charge of Chrome at all but here we are.
insanitybit 29 minutes ago [-]
Uh, why? Context Aware Access is a policy attestation service. Managed Chrome is exactly the sort of thing you'd have policies for.
Macha 1 hours ago [-]
Because Google is able to configure Chrome to the admin's liking.
1 hours ago [-]
Tostino 2 hours ago [-]
"wow look at all these options available...to limit users to only use software provided by the same corp" you are missing the point entirely.
chmod775 2 hours ago [-]
It appears website developers desperately want to return to a world where browsers actively pretend to be another browser*.
Want to check for DBSC? Enjoy not knowing whether the browser vendor decided to just roll a simple software implementation.
Nothing good comes from browser detection over feature detection anyways. It's time to do away with user-agents and other overt identifying markers, and if we're still not in a better place, aggressively start stubbing features.
* to some degree they still are. Firefox still ships with an user-agent override list for certain websites that have outdated user-agent sniffing for feature detection (and other fixes in about:compat).
pjmlp 2 hours ago [-]
You mean the same that gave Chrome its market share, by adopting ChromeOS features, and shipping Electron apps?
JoeAltmaier 2 hours ago [-]
And yet, claiming support for a feature doesn't tell all. Different implementations can have subtle differences. Knowing the browser and version can allow a client to survive that.
chmod775 2 hours ago [-]
Yes, that is the price developers will have to pay. Development will be harder, but users are going to prefer somewhat broken sites over being outright refused entry.
At the end of the day user-preference is what dictates which browser is used and how it is configured. Developers will have to deal with what users choose to do on their end.
You can only patronize people for so long before they look for a way around silly restrictions. Trying to keep someone safe by putting up walls, whether the threat is real or imaginary, is pointless when it is in the user's power to trivially defeat those walls - and when extension and browser developers are going to line up to sell them demolition tools (see ad blocking).
Advice is going to go much further than roadblocks, long term.
jeroenhd 2 hours ago [-]
It states something about "your organisation's security requirements", do they document what requirements cause this rejection page? Some kind if changed default perhaps?
insanitybit 1 hours ago [-]
No, this is easily the biggest flaw in CAA - there is no way to discover which policy broke your access. I have reported this to Google multiple times, even sent this directly to a Google SecEng (a well known one) to route internally. The issue persists and makes configuring CAA extremely painful and error prone.
tyingq 2 hours ago [-]
Maybe not, but I have the feeling Google doesn't like that FF continues to support manifest v2.
lokar 2 hours ago [-]
I think it's just that some of the device policy restrictions the Org admin can choose to enable don't work in FF. So if they require them, no FF.
wwizo 2 hours ago [-]
At least you got a heads-up. Few months back GCP "Agent Studio - Build" failed compiling the code in sandbox with a vague error message. Spent weeks troubleshooting, spoke to google engineers and reps, sending code, step by steps, screenshots. No one had a clue, until I switched from Firefox to Chrome out of desperation and it worked without a hitch.
saagarjha 2 hours ago [-]
I know Google finally kicked all their employees off alternate browsers but doing it for external customers is definitely a choice
Lendal 2 hours ago [-]
I'm not so sure that enforcing an internal digital monoculture is a productive way to achieve innovation & resilience.
coldfloor 2 hours ago [-]
Not defending it, but given that they use the word "secure" three times in two sentences, I'm wondering if it's shown to browsers that don't support DBSC. Google has been really pushing/overselling this as a magical solution to cookie theft.
squidi 2 hours ago [-]
I was thinking it could be a Context-Aware Access thing. Firefox doesn’t support Endpoint Verification plugin
michaelmrose 1 hours ago [-]
Is it possible for a non-google browser to be said to meaningfully support this given that implementing the features wouldn't necessarily accomplish anything insofar as it wouldn't let you past the google only security gate and would represent a moving target in any case.
ferfumarma 2 hours ago [-]
Seems like a monopolistic move.
JumpCrisscross 2 hours ago [-]
Google doesn’t have a monopoly in workspace applications.
trey-jones 2 hours ago [-]
You don't have to have a monopoly to be monopolistic.
redwall_hp 1 hours ago [-]
The Sherman Act says that any action by an individual, or conspiracy of a group of individuals, to "restrain trade" or seek a monopoly is illegal.
Monopolies aren't a prerequisite for antitrust action, they're the failure state when you should have acted sooner.
naturalmovement 2 hours ago [-]
I doubt Microsoft would qualify as a monopoly under present-day excuses being made for Google yet here we are with Internet Explorer Part Deux.
insanitybit 1 hours ago [-]
Sounds like you have a device policy configured and you should talk to your internal IT/Security team?
eikenberry 2 hours ago [-]
Does Chromium would still work?
add-sub-mul-div 2 hours ago [-]
I use Google as a secondary search and as of roughly last week it gives me a captcha every time I try to do a search. That had never been the case before.
AIcanbiteme 2 hours ago [-]
I browse over Tor for most things and most sites give me a captcha or just simply fail to load these days. I just close the window and move on to something else.
SoftTalker 2 hours ago [-]
I am seeing it a lot more lately with uBlock Origin. I've used DDG for search for a while now, but the last few times I've tried Google I got a captcha within a couple of queries if not immediately.
hbn 2 hours ago [-]
For a few years now Google has given me a captcha whenever my VPN is on (Private Internet Access)
kjkjadksj 2 hours ago [-]
Smells anticompetitive to me
lelanthran 2 hours ago [-]
[flagged]
nekusar 59 minutes ago [-]
Oh look, a monopolist is making settings "more secure" by enshrining monopoly more.
And good fucking luck getting the FTC to follow monopoly law.
Some IT departments just see a “more secure” checkbox and will always check it, even if it doesn’t make sense holistically- sometimes compliance incentivises (or forces) this behaviour.
A common example is forcing intune/device enrolment for mobile devices (including ipads)- but not for the infinitely less secure laptops: because no such endpoint enforcement checkbox exists
Your corporate serfdom is not in question, but I disagree with that notion too.
There is zero problem here guys.
I absolutely see many problems with this and you really ought to as well.
If course the reverse can also be argued, for example that Firefox supports proper adblocking.
You can make Firefox pass CAA if you want. You take the Chrome "SecureConnect Reporting" (Context-Aware Access) plugin, port it to Firefox with some light changes, and you can report whatever you want to CAA.
Of course Google is going to suggest using Chrome, if they detect that the browser might be out of date.
The issue presented doesn’t seem to be “an up to date browser check” it seems to be a “is it latest chrome” check, which is a very different thing.
If the organization is indeed enabling a specific check for Chrome that seems a little over the top but they're the ones supporting their users and if they want to make their life easier by only dealing with one browser that's their decision to make. It's like saying that everyone has to use Windows, or a specific line of laptops, or any other standardization to simplify the support workload.
I don’t see why I should give affordances of good will to Google here.
They’re not stupid, they know that this is an effective lever to further cement full-fat chrome as the default browser for the internet.
Other way to look at it is, the company is paying for everything, and they get to make decisions based on what suits their security needs.
https://knowledge.workspace.google.com/admin/security/create...
The Org admin can put all sorts of restrictions on who can do what based on the client device setup.
1. Make it ridiculously easy to install hardware vendor keys and register it with OS of choice. (like a standardized dialog box in UEFI and a standardized/regulated IPMI-like interface)
2. Allow for only measured boot on those devices.
3. Provided facility to verify signatures.
Do this on consumer and enterprise laptops and desktops alike and all of these weird set of conditions just go out of play and replaced by something much much simpler.
Want to check for DBSC? Enjoy not knowing whether the browser vendor decided to just roll a simple software implementation.
Nothing good comes from browser detection over feature detection anyways. It's time to do away with user-agents and other overt identifying markers, and if we're still not in a better place, aggressively start stubbing features.
* to some degree they still are. Firefox still ships with an user-agent override list for certain websites that have outdated user-agent sniffing for feature detection (and other fixes in about:compat).
At the end of the day user-preference is what dictates which browser is used and how it is configured. Developers will have to deal with what users choose to do on their end.
You can only patronize people for so long before they look for a way around silly restrictions. Trying to keep someone safe by putting up walls, whether the threat is real or imaginary, is pointless when it is in the user's power to trivially defeat those walls - and when extension and browser developers are going to line up to sell them demolition tools (see ad blocking).
Advice is going to go much further than roadblocks, long term.
Monopolies aren't a prerequisite for antitrust action, they're the failure state when you should have acted sooner.
And good fucking luck getting the FTC to follow monopoly law.