Comment by hlandau | Hacker News Reader

Comment by hlandau | Hacker News Reader

Parent Full thread

Author here. The fact that 'every major company' has implemented risk based security doesn't automatically make it a good or sensible thing. I'm against the premise of nondeterministic login processes in general, not just for Google.

I will also say that the idea of detecting users which login from "new devices" is nonsense, at least if you're talking about a webapp. There is no such thing as a "device" as far as the web is concerned, in fact massive amounts of effort are invested into web browsers and web standards to try and prevent any kind of fingerprinting. The web platform very intentionally does not give webapps any way to identify or remember a "device".

So what "you're logging in from a new device" actually amounts to is, "you deleted the permanent cookie we tried to set". Which in my case always happens because I have cookies set to be deleted the instant the last tab from a given origin is closed. Sure enough, these sites doing this irritating 'new device' authentication incorrectly think I'm logging in from a 'new device' all the time. Reminds me of cookie popups that ironically can't be disabled when a user has cookies disabled because they use cookies to remember that they've been shown. In both cases the user is penalised for being proactive with their own privacy.

You're logging in so they know who you are, but you refuse to keep a cookie in your browser so they won't know who you are?

You know what the problem is, you just refuse to fix it.

A user agent that refreshes parts of its profile at the end of a session and deletes data, hopefully, should be something a company like Google can pick up on after enough attempts. "We can't expect the nonexistence of a persistent cookie means the user is using a new user agent because of a persistent history of successful authentication attempts without such cookie present" is not a tall order for a company like Google who is running these experiments on their users.

It is odd you are pathologizing what I would expect to be normal behavior. It's not common behavior, but it doesn't seem abnormal for user agents to do this.

Edit: for users who only access their Google accounts via shared machines like at a public library, not having a persistent cookie on every auth attempt is going to be the expected scenario.

User agents are remarkably easy to spoof at scale. Bad actors could cycle known user agents with a password until they hit the right non-2FA login agent.

It also presents an attack vector to screw up everyone's logins and repeatedly force users to re-2FA every few minutes.

I don't understand some of the ways you are using terms e.g. when you say "user agent" it sounds like you mean the User-Agent HTTP header, which is trivial to spoof, but that isn't how I'm using the word user agent, which I'm saying means the agent that a given user acts with.

I also don't quite understand your threat model here and the details of what you're proposing is an attack. If you are a user who Google consistently knows has a persistent cookie at auth time, Google can expect that in the future and therefore use that as a data point in risk based authentication. If you are a user who Google consistently knows doesn't have a persistent cookie at auth time, Google can't rely on that data point providing any signal in risk based auth, and seems to be DoSing, or at least frustrating, users in that scenario.

I can't quite respond to your comment because I don't fully understand it.

I agree that public library access for people who don't own a computer is an important and difficult problem, but you're talking about other people, not the case being discussed now. Bringing it up here is a distraction.

For someone who is tech-savvy and owns a laptop, there is a simple solution: create a new, vanilla browser profile and use it only for logging into Google. (I do the same thing, but for Facebook.) You'd don't need any privacy extensions when you want them to know who you are.

Bringing it up here isn't a distraction, it's central to my main point: the workflow of having a user agent refresh its persistent state is an expected use case, and therefore signal analysis should understand that for some users, the non-existence of a persistent cookie is no indication of elevated risk above baseline.

It's possible to come up with different solutions for different people.

> You're logging in so they know who you are, but you refuse to keep a cookie in your browser so they won't know who you are?

The two sentences are not in contradiction at all. As long as he has the credential (password and perhaps 2FA), he should be able to log in. The cookie is a convenience, and should not be a requirement.

Users typically use the same browser on each device, so using first party cookies to identify a device for web logins is not that far fetched of a solution.

Reply on news.ycombinator.com