Tell HN: Google refusing Gmail login with Firefox | Hacker News Reader

Tell HN: Google refusing Gmail login with Firefox

50 pointsc0l024 comments

I have a mostly dormant GMail account from ages ago, which I check back into every few months to see if any mail stranded there by accident. Today was one of those days, and I tried to log in on an Arch Linux machine with Firefox 106.0.1 in Private Browsing mode, and uBlock Origin installed as the only relevant add-on.

After having provided correct credentials, instead of having been granted access to my Google account, I was instead redirected to a landing page telling me this:

    Couldn’t sign you in
    This browser or app may not be secure. [Learn more]
    Try using a different browser. If you’re already using a supported     browser, you can try again to sign in.

The "Learn more"-link lead to https://support.google.com/accounts/answer/7675428

Only after having read through that that I noticed an innocent "Try again using this browser"-link on the aforementioned landing page, which made me authenticate a second time using the very same credentials, and then, finally, letting me into my Google account.

I guess that's a new way to try shoving Chrome down even more peoples' throats?

It's high time anti-trust regulators slap the sh*t out of this corporation for its increasingly hostile tactics, similar to how the US set out to do with Microsoft back in the 90s.

I personally think you can't make statements like that without trying to reproduce this on another machine and with another account etc.

Although I don’t use Chrome and haven’t for more than a decade, this smells like normal security practice than a better-with-Netscape.

The account is dormant.

The browser is unique.

And perhaps 2fa is not used…since it is not mentioned.

What I mean is your access context probably correlated with black hat behaviors, and so putting friction into the account login makes sense.

Particularly given the low value of the content of the gMail account. Because Google knows the content of gMail accounts.

Ultimately you got access by jumping through the hoops to figure it out…basically more effort than a script kiddy is likely to expend.

Using Arch might have been good preparation for those frustrations?

Good luck.

Private browsing mode, or hard-core settings on ublock origin are likely the culprit, not firefox

I use Firefox exclusively and I have seen this message but my observation is: 1. This appears only an account that is not used frequently. 2. This never appears on an account that is used frequently. 3. Even on account used in-frequently, say once in 2 months, this appears at most once in a year. 4. The bug may be in Google's scripts or even in Firefox, it's hard to say.

I was affected when they blocked non-major browsers. In my case, KDE's Falkon.

The workaround that worked for me was to log in first with another account that didn't had 2FA (my uni's gmail account, at university they use Google services) and then add my other account - with the downside that I could not make it the main account anylonger, as now Google doesn't let you sign out on a per-account basis but from all accounts at once.

I've had similar things happen to me on Safari @ macOS. Google Drive straight up not working past the "show me files for the current dir" functionality etc. Sometimes there was some weird CSP error in the console, with other issues it didn't show anything in particular... And Chrome was just fine.

EDIT: it indeed was probably that. But well, they should handle that.

Facebook refuses copy-pasting of text and images into post-creation fields if you're on firefox.

You have the preference `dom.event.clipboardevents.enabled` disabled. Their js does not correctly handle the possibility of not getting those dom events.

I can not confirm that, works fine for me for both. FF stable on win.

In a just world, this would be totally illegal as a blatant antitrust violation. A browser vendor shouldn't be allowed to dictate what browsers you are and aren't allowed to use to access their other unrelated products. If I want to sign in to my own account with an "insecure" browser, I should be allowed to.

What's the reason to use private mode when logging on into gmail? Why not clicking onto the lock symbol in the address bar, and erasing any unwanted shit from there, with one ore two more clicks, when done?

Btw. can't reproduce. (In private mode) On some other Linux, latest stable FF, UBO (mostly default settings)

Do you have third party cookies blocked? Most Google products break for me when I have third party cookies blocked

This is what it was for me as well. Which was tough to diagnose, since I would hit "download" in a random gdrive folder, and just literally nothing would happen. It would just sit there. No message, no error, etc. So frustrating. Once I figured out you had to turn 3rd party cookies on, it worked fine. I quickly moved all my work stuff to box.com and personal stuff to protondrive and just stopped using gdrive altogether.

Just logged in with private mode firefox on my linux laptop, username, password, sms, job done.

I don't use chrome, rarely use gmail, I have ddg privacy essentials and ublock origin for my normal workflow and I get a fair few capchas from rubbish sites, but apart from that don't get a problem.

I can't reproduce this, also in Arch and uBlock in Private Mode but with FF 105

I had that happen to me too. It was related to a user agent switching plugin I had set up and forgotten to change back to a more normal user agent string.

However, I agree that this is very poor behaviour from Google.

I've gotten the same error message while using Chrome. It's not (just) a tactic to get you off other browsers.

This is more likely some other problem.

I have two working Gmail tabs at the moment (personal and work) on Firefox, with no problem.

> in Private Browsing mode

Before you get the pitchfork out maybe try using a regular browsing session to sign in

Considering that Google's own login screen suggests using a private window if you're not using your own computer, you'd think that this would work.

> Considering that Google's own login screen suggests using a private window if you're not using your own computer, you'd think that this would work.

It will, and does, normally, but it likely increases a "suspicion" score for the login. Combine that with attempting to log in to a rarely used account and potentially other factors its possible that the login attempt has gone past a threshold and gets effectively "shadowbanned".

Bold of them to shadowban somebody for just following the instructions on screen.

But it's not "just" that as many of the already known details have outlined.

Don't worry, others browsers will get this security feature soon on all modes private or not!

Reply on news.ycombinator.com