Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Sounds like you have a device policy configured and you should talk to your internal IT/Security team?
edit: This title is just incredibly misleading. OP seems to have made a mistake here in thinking that this is something that Google has done when it's just that their corporate IT/ Sec team now enforces using Chrome.
by insanitybit - Reading the news of EU countries leaving American cloud providers for local cloud solutions including mobile office, it's surprising to see Google doing this.
It will only accelerate moves towards location of data, self-hosting, etc. The technologies to make this possible are much easier than they ever have been.
by j45 - They wont stop it. They will just slow down a bit if people get ruffled. That's how alphabet has handled everything else. They learned that if they can make changes slowly enough, they can do whatever the hell they want to.
As we all know we can even pay 10x more for items and get next to no raise in our wages, but because it was done slowly in an "official" and "professional" manner, most folks didn't even complain, they just screamed into the giant pillow we call "the internet".
Corporations of the 2020s love the internet's digital pillow and its magical crowd-quieting capabilities. If only the ancient roman empire had invented the internet they would be ruling the entire planet by now and we could watch gladiators on youtube :P provided we don't stand out too much (then we would be said gladiators)
by sdrawkcabsti - I know Google finally kicked all their employees off alternate browsers but doing it for external customers is definitely a choiceby saagarjha
- I'm not so sure that enforcing an internal digital monoculture is a productive way to achieve innovation & resilience.by Lendal
- Seems like a monopolistic move.by ferfumarma
- Google doesn’t have a monopoly in workspace applications.
- At least you got a heads-up. Few months back GCP "Agent Studio - Build" failed compiling the code in sandbox with a vague error message. Spent weeks troubleshooting, spoke to google engineers and reps, sending code, step by steps, screenshots. No one had a clue, until I switched from Firefox to Chrome out of desperation and it worked without a hitch.by wwizo
- I love that google always sends useless canned responses after basically requiring you to perform a blood sacrifice to get ahold of anyone.by nosioptar
- It states something about "your organisation's security requirements", do they document what requirements cause this rejection page? Some kind if changed default perhaps?by jeroenhd
- Maybe not, but I have the feeling Google doesn't like that FF continues to support manifest v2.by tyingq
- No, this is easily the biggest flaw in CAA - there is no way to discover which policy broke your access. I have reported this to Google multiple times, even sent this directly to a Google SecEng (a well known one) to route internally. The issue persists and makes configuring CAA extremely painful and error prone.by insanitybit
- It appears website developers desperately want to return to a world where browsers actively pretend to be another browser*.
Want to check for DBSC? Enjoy not knowing whether the browser vendor decided to just roll a simple software implementation.
Nothing good comes from browser detection over feature detection anyways. It's time to do away with user-agents and other overt identifying markers, and if we're still not in a better place, aggressively start stubbing features.
* to some degree they still are. Firefox still ships with an user-agent override list for certain websites that have outdated user-agent sniffing for feature detection (and other fixes in about:compat).
by chmod775 - And yet, claiming support for a feature doesn't tell all. Different implementations can have subtle differences. Knowing the browser and version can allow a client to survive that.by JoeAltmaier
- Cloudflare blocked me with a chrome windows useragent on Firefox+Fedora
- What is the process to aggressively stub features? Does that mean pushing patches to Firefox and/or Ladybird and/or Servo?by edoceo
- You mean the same that gave Chrome its market share, by adopting ChromeOS features, and shipping Electron apps?by pjmlp
- Hi folks, blog author here.
Few comments based on common threads
- No we don't have, or use, IAP and haven't configured it
- Yes I'm the admin so can confirm this
- "Context aware access" is only available on enterprise, we're just on "Workspace business plus"
Happy to answer any other questions
by RichardoC - Is it not:
https://knowledge.workspace.google.com/admin/security/create...
The Org admin can put all sorts of restrictions on who can do what based on the client device setup.
by lokar - Why is there a policy to require “Chrome” and not a policy to require another browser, hmm?by saagarjha
- "wow look at all these options available...to limit users to only use software provided by the same corp" you are missing the point entirely.by Tostino
- > The Org admin can put all sorts of restrictions on who can do what based on the client device setup.
can you put a restriction to ban Chrome and force Firefox then?
by realusername - Unrelated to this news, but this is so rudimentary, when the correct solution instead is:
1. Make it ridiculously easy to install hardware vendor keys and register it with OS of choice. (like a standardized dialog box in UEFI and a standardized/regulated IPMI-like interface)
2. Allow for only measured boot on those devices.
3. Provided facility to verify signatures.
Do this on consumer and enterprise laptops and desktops alike and all of these weird set of conditions just go out of play and replaced by something much much simpler.
by whateverboat - This is not a Google-wide thing… this is from Google’s Context-Aware Access product, which is configurable in Google Workspace environments. OP should direct their ire at their corporate IT or infosec team.by bgc
- But they explicitly negate this:
> We haven’t configured, and don’t use IAP (Identity Aware Proxy) - I’ve used this before and yes that is Chrome only due to how it does device verification
> This isn’t because of “Context Aware Access” this is an enterprise only feature, and we’re on Google Workspace Business Plus
by dvfjsdhgfv - Hi there, original author here. Can confirm we're not using IAP for this workspace, or anything I was trying to accessby RichardoC
- it shouldn’t be an option.
Some IT departments just see a “more secure” checkbox and will always check it, even if it doesn’t make sense holistically- sometimes compliance incentivises (or forces) this behaviour.
A common example is forcing intune/device enrolment for mobile devices (including ipads)- but not for the infinitely less secure laptops: because no such endpoint enforcement checkbox exists
by dijit