Hacker News Reader

Comment by koheripbal | Hacker News Reader

How on Earth is "Offered by: Microsoft Corporation" not verified in literally any way whatsoever. That's so poorly vetted it's negligent.

Maybe extensions and apps should be signed by domain ownership?

View on HN

That one is legit, I'm guessing Chrome requires users to use a gmail account in order to submit an extension to their store.

https://blogs.windows.com/windowsexperience/2021/02/05/simpl...

Talk about training users to fall for phishing schemes. Plus users have been so desensitized to entering 2FA codes they’ll type them in anywhere. I feel like web security is worse than it was 10 years ago.

We need webauthn not just 2FA

Love how the goalposts keep moving.

First arcane password rules so it takes 5 minutes and half a dozen attempts to come up with a password that is accepted. Then force the user to change it often. Then add email verification. Then SMS/phone verification. Still not good enough, now we all need to have a hardware token to buy the counterfeit garbage for sale on Amazon. Fuck that. It's just not worth the trouble. Honestly the world was a lot easier (if a bit slower) when you dealt with businesses in person or via mail. Fraud and identity theft just doesn't scale in meatspace, so it was never a big problem.

I maintain that most of what we get from the Web and computers, as individuals, is barely better than what we had before, and not enough so to justify its costs. Shopping very much included.

For some context, I grew up very much "OMG wire my brain in, let's get this future shit going!" Years of watching that future develop, and some reflection, have almost entirely reversed that sentiment, for me.

For example: are streaming services convenient? Yeah, of course. Am I actually happier with them than I was with the library, rentals, and the occasional purchased movie? Marginally, if at all. (but I have Internet service for the handful of things it actually is highly beneficial for, so, may as well use streaming, too)

Is shopping online convenient? Yes. Am I happier than when I just had way less idea what was available to buy, and there was more friction to indulging every little purchase-whim? I really wonder. This one may not just be marginally better, but net-harmful.

I can consume an order of magnitude more diverse and interesting media than I could without the internet. I can order exactly the right thing from the internet instead of making do with a kind-of solution from the store.

I think you're remembering what it was like pre-internet with rose-colored glasses.

The internet is great.

We definitely have more of everything data-related and have a much better idea of all the stuff we can buy. I'm skeptical how far that's actually moved the happiness and life-satisfaction needles, in general.

[EDIT] specifically, I think some of our "satisfaction" from this sort of consumption is itch-scratching generated by the possibility of doing it, in the same way that pre-Internet one rarely felt bothered by not knowing some piece of trivia, if no-one around happened to know either. Now it itches until someone looks it up, because you know you can find out quickly. Now if I'm not watching the best possible thing, for example, it itches, but I don't think it would have before. I think to some extent the level of choice available, aside from famously causing analysis-paralysis ("browsing Netflix" is famously an activity all its own, that may or may not end up in ever actually watching anything) also generates the very desire that it's satiating. I'm not sure I was actually less happy watching the best thing I could find at the video store, versus the best thing I can find on streaming services.

I don't know about you, but for me having access to youtube means that I can do things like fix my car, learn about medieval hats, see what kinds of weird animals exist, etc.

These sorts of things improve my life immeasurably and definitely give me a sense of 'satisfaction' that I would not otherwise have been able to achieve paying someone to fix my car, watching a reality show on TLC, or going to the library and reading a book about ducks for the 50th time.

Your problem isn't the Internet, it's the lack of trust busting in the tech space that prevents e.g. Disney from being able to launch its own streaming service or Amazon from promoting its own Basics products. The reason why everything sucks is because big players have zero incentive to change when they aren't punished for favoring themselves. Instagram doesn't even allow you to copy and paste photos anymore.

If you were wearing a size 13 (EU 48) shoes, walking into a store and asking for what they have in your size was exclusively met with "but which do you like". It turns out none of the top 10 choices I asked about would be available, and we'd eventually retreat to "which do you have that I dislike the least?"

With online shopping, I think the biggest wins are for anyone not being in the "common" category (be it the 5-95% size, fashion, usefulness etc): if what you generally need is suitably common, you might miss the physical shopping (try-ons/try-outs for wearables/tools are very useful).

This also means that there is more incentive for non-common products to be produced because the market is larger.

Note that current best practice is simple password rules, with password expiry only when there is reason to do so.

Generally the suggested rules are: be at least 12 characters long, check the password against lists of known passwords.

It could be this MS extension is a companion project to the latest Windows 10 update - the News and Interests taskbar widget.

Microsoft Edge requires a MS Live account.

A Google account, which any organization that has its shit together (and uses Google properties) has set up for their domain.

Which Microsoft, ostensibly, wouldn't be doing. Considering the whole Office 365 product exists and is a direct competitor to Google Suite.

And yet here they are.

Most of the other big extensions have their own domain email. Like Grammarly, 1Password, Zoom, Pocket.

Evernote has a normal Gmail account listed. So maybe this goes hand in hand with having a bad product.

Perhaps those orgs use Google apps?

I have a Google account on an email completely unattached to any other Google services (I think it was an originally migrated pre-Google Youtube account), so I am sure you can have a Google account with any external email address.

The Chrome Web Store does not require using a GMail address, for example, I don't have a GMail address and have items on the Chrome Web Store [0].

[0] https://chrome.google.com/webstore/detail/cackey/lpimdiknnpi...

Loved the BeOS theme!

It does not. It does require a Chrome web store account, but you can use any email address you want for that.

> I'm guessing Chrome requires users to use a gmail account in order to submit an extension to their store.

Google apps/Gsuite/Google for work (or whatever it’s called now) accounts all work fine.

There’s no requirement to use a gmail.com account.

Source: have published extensions on my own and for my company.

Wow, I looked at the review responses by the developer and assumed from the poor English that it was fake, and reported it.

It might be legit. The Microsoft rewards app uses msandapp.bgcextn@gmail.com. I’m guessing 1 million installs makes that legit.

There’s no way even for technical people to make a proper assessment of the trustworthiness of the publisher.

Google has ruined the internet because they want Google Search to be the only “trustworthy” source online. Too bad they suck at it and Google search is a steaming pile of shit now.

1 million click farmers in china/India/Nigeria?

In general this is a good idea. But in the case of Microsoft--good luck figuring out which of Microsoft's thousands of domains are legit! :)

It would seem to me that Microsoft would choose to link it to microsoft.com so that customers can easily recognize its authenticity.

They have already failed this test: they are already publishing extensions using msftliveapps@gmail.com and msandapp.bgcextn@gmail.com, doubtless many others!

I believe Google requires you publish Chrome extensions with an @gmail address, in which case MS doesn’t really have a choice.

Good grief--that is so evil (not to mention anticompetitive) that I didn't even consider it!

Not sure what would make using a Gmail account anticompetitive, but it's also not true. You need a chrome web store account (which they amusingly encourage you not to use your personal email for) which can use any email address.

Any idea what problem Google is solving by requiring the use of gmail?

Naivety on the internet, and people believing what they read on a web page without checking.

Google doesn't require a gmail adresse to publish.

Yeah, I didn't think it made sense.

Absolutely untrue, as mentioned elsewhere in the thread. I have Chrome extensions published under a non-gmail email address.

Microsoft might, I suppose, have a policy against microsoft.com accounts on other firms infrastructure, and therefore if it needs a Google account uses gmail or other non-microsoft.com domains.

Reminds me of Paypal where I'm simply unable to tell whether some mails from them were phishing or not (regardless of time spent investigating these mails), and I believe that virtually no one would be able to tell.

They were even cognizant of the issue to the point where they set up a robo inbox you could forward any suspected phishing emails to and it would reply telling you if it was legit or not. It was something like phishing@paypal.com

Considering APPLE goes so far to make you confirm DUNS numbers for a company acct. It seems like this would have been a good mitigating practice and already has precedence. While it’s a PITA it makes sense.

The core issue is that Apple uses humans to evaluate these requests and provide a point of contact with businesses. Google believes any process requiring a human is broken.

Reply on news.ycombinator.com