This is not a Google-wide thing… this is from Google’s Context-Aware Access product, which is configurable in Google Workspace environments. OP should direct their ire at their corporate IT or infosec team.
Some IT departments just see a “more secure” checkbox and will always check it, even if it doesn’t make sense holistically- sometimes compliance incentivises (or forces) this behaviour.
A common example is forcing intune/device enrolment for mobile devices (including ipads)- but not for the infinitely less secure laptops: because no such endpoint enforcement checkbox exists
While this is true, allow me to give another POV. I run corporate security and internal IT for a 100 person SaaS. I "nudge" our users towards Chrome. Why? Because I can manage Chrome using the config infrastructure provided by Google. Because Google has more resources to secure their browser. Because my observability and DLP stuff works with Chrome and not with Firefox. And I'm probably still missing out on a bunch of things.
Those are real, practical reasons. Not just "if I do this I get to check another box".
Yes. I know. It's a pain that when you cannot do what you want to do. But it's not your laptop. It's the company's. Supporting more browsers to the same standard that I just described would take engineering resources, of which I do not have an infinite supply. And the priority goes to keeping the company secure.
> Because Google has more resources to secure their browser
They've kneecapped ad-blockers, when ad networks are perhaps one of the biggest causes of malware installs/page hijacking/other unwanted behaviour. I'm not sure how you can consider Chrome remotely secure in this light.
> I find this incredibly amusing, and at a different point in my life I'd already be gone.
How so? Bad actors buying existing extensions with large user bases then publishing a new version which does bad stuff is a pretty common pattern. It certainy seems like a reasonable concern for a corp IT department.
When there are unpatched browser vulnerabilities, attackers will use ad networks to inject attack code into reputable-but-ad-laden websites. And even when there aren't unpatched vulnerabilities out there, many ad networks will happily accept scam ads, ads that trick people into downloading malware, fake download buttons and suchlike.
Adblocking is an arms race. Google is handicapping adblocking progressively the fact that it doesn't take one day to achieve absolutely doesn't make it a myth. Adblocking is technically worse and the more locked down our environments are the easier it will be to kill or drastically reduce it.
If everyone had the same attitude this would probably already be the case.
I figure they had a switch they could toggle and they thought no further about the tradeoffs. Because their primary concern is their own liability, not what's best for the org their contract is with.
while valid points, my company uses Microsoft products and they are pretty abysmal in whatever domain they have products in. Edge for example being one of the weaker browser options. (though better than it was in the IE era).
Being forced to use various tools for compliance is frustrating, doubly so if it helps create a stronger monopoly position, because a monopoly position creates stagnation, which makes worse products.
But those worse products are forced on users, even when better ones start to come about.
This is the crux of my issue, Microsoft is the king of this behaviour, and they are using this a lot which is squeezing the metaphorical testicles of almost all companies in Europe.
It's a pain that when you cannot do what you want to do. But it's not your laptop. It's the company's.
But it is my craft, and to be limited to what tools I can use in my craft can decrease the value of my work, and in doing so decrease the company's productivity.
Let's say you earn a million dollars a year (most of us earn far less). At quite a few companies, a 50% decrease in your productivity (and changing browsers is nowhere near that) would cost the company significantly less than dealing with the fallout of any of the following:
* A user intentionally leaking sensitive documents outside the corporate network
* A user installing an infected browser extension that gives attackers access to corporate resources
* A user accessing malware or ransomware which infects corporate resources.
That's on top of the cost of having the IT department having to debug issues among users with bespoke tool sets which can often interact in unintuitive ways.
There are many stupid ways that companies "optimize" costs that cost them more in the end. Standardizing the browser and extension set for data loss protection is not one of them.
That's not obvious at all. The feature sets and tooling are very different. The person you replied to said as much.
You (and I) aren't that special. People who are actually irreplaceable are astonishingly rare, and unless you're one of them, employees who will gripe about things like what web browser they use are often not worth the trouble at scale.
If you want the security of a regular salary, you need to jump through the hoops of your employer and not expect to be able to do 'your craft' however you see fit.
I have a handful of endpoints, used by staff that represent a low level of risk, that use Firefox for that precise reason.
But really, we have a couple of million enterprise end-users, some of which surely using Edge. If we as much as move a button without telling them about it three months in advance, it's the end of the world. In 10 years time, no customer has raised it.
This is the correct answer. Having your users run multiple browsers by default (instead of with whitelisted exceptions) is now multiple attack surfaces the org has to manage.
Very curious how you avoid supporting multiple browsers. Apple, Google, and Microsoft each require users on their platforms to use their native browsers for secure connections.
And if your company has any web presence or apps, you usually can't cherry pick which browsers your customers can use. That means some portion of your company will need access to other browsers for QA purposes.
Do people get pwned by anything besides spearphishing or ads nowadays? I think ad->phish or targeted phish emails is the only shady thing I've been exposed to in like 10 years
Google has the resources to do it, but do they actually do it? By the looks of it I'd say "no".
See the whole thing with libxml2 for example, or how they started boringssl to "fix" the issues with openssl, but they run it as an internal project you cannot depend on.
It's their organization. They are allowed to make decisions about what software their employees use. I'm a die-hard Mozilla fan, but I don't find this unreasonable.
The problem is Google appears to label this as a security feature. I'm fine with the feature existing, but it should say something like "require Chrome" or "block Firefox" not "require a secure browser (wink wink we actually mean Chrome)"
The wording here is bad, but basically CAA supports non browser specific policy and, in some cases, browser specific policy (GSuite offers a "Managed Chrome" policy). Firefox users can leverage much of the non browser specific policy, they obviously can not be a part of the "Managed Chrome" offering.
There's no contradiction here; it's totally possible for a company to make a feature configurable so that it doesn't block their competitors but also intentionally design and market it in a way that's misleading in ways that will lead to their competitors getting blocked. When we're talking about a company as large as Google and a product with as much market share as Chrome, I don't think it's that crazy to think that things like this add up to encouraging even more hegemony, and when that happens to align perfectly with the incentives of the company making said product decisions, I also don't think it's crazy to think it's unlikely to be a coincidence.
If the argument is that Google has built a product that encourages use of Google products, of course. The question is whether that's some sort of trickery or odd or bad. "Google offers Managed Chrome as a service" hardly seems controversial to me.
Google offering managed chrome as a service is a completely sensible thing. The problem is that they are nearly a browser monopoly, and making Google Workspace work in such a way with Google Chrome feels to me like anti-competitive practices. If we didn't have one giant megacorp that did both things, it would be different.
Of course, so far the only workable model for web browsers is having a giant megacorp fund their development and maintenance. Which is a huge issue, and we will do basically nothing about it.
(Don't get me wrong. I have high hopes for Ladybird and even Servo, but they may come too late if effectively-proprietary features force most users to stick to Chrome anyways.)
I'm not sure what the alternative is. Is there will from Firefox to support a "standard browser config", at which point GSuite could add support for managed Firefox config? If you want managed Firefox, Mozilla could offer that as well (they have something but it's different enough).
The alternative that we've used for the past 100+ years is to force such companies apart. Is Google Docs allowed to offer a "managed chrome" policy? Sure. Is Google Chrome allowed to be a browser? Absolutely!
But if either side is close to a monopoly, both cannot be part of the same company, even if that means breaking an existing company up.
There's really nothing particularly wrong with the Chrome feature itself. There is a bit of a problem with the way it inherently results in browser vendor lock-in (regardless of whether it is a stated goal) with Google Workspace, which is by the same company. That's the main problem.
I may be missing something because I feel like this specific point has been reiterated a few times in this thread but I haven't seen it actually rebuked directly.
Look man, this is absolutely getting into the semantics phase. I know you're not stupid, don't treat me like I am.
Firstly, some Chrome features (like Chrome Remote Desktop) are delivered partly as extensions. This does not make them not features of Chrome. It makes them features that happen to be delivered in some part as extensions.
Doesn't matter. Let's say Endpoint Verification is not a Chrome feature. Thankfully, we don't actually need that for our argument. The crux of this argument is simple:
- Google Workspace depends on proprietary Chrome features,
- Chrome has specific proprietary features designed to support Google Workspace (and other proprietary Google offerings.)
What is the proprietary features I am referring to? Well, I'd just say "Endpoint Verification", but we can go a layer deeper. In order to implement Endpoint Verification, we need privileged, private extension APIs. These APIs are not for use with non-Google extensions, and Endpoint Verification uses enterprise.reportingPrivate.
You can disagree that it is a problem that Google Chrome and Google Workspace are developing proprietary integrations with each-other, that's your prerogative, but I'm not humoring this gaslighting attempt.
I'm not trying to treat you like you're stupid or to gaslight you. There is a "slice" of this that is absolutely a native, Chrome-only interface, but I just don't think that this is particularly exceptional. These sorts of Firefox-only APIs exist as well in order to support Mozilla's goals, and this is quite normal - you wouldn't expect every single aspect of the browser to be built in lockstep with every other browser.
For the most part, Mozilla could build out Endpoint Verification (and it supports a subset of the APIs anyways). Similarly, there could be a web proposal for device attestation APIs that are more generalized, etc, which I think would be great.
It is a security feature. In a corporate environment, you generally don't want users installing their own software. If it's a remote access thing from a personal device, you still generally want to be able to establish some kind of baseline. I don't like Chrome - not even a little bit - but I will admit that they have a pretty damn good security track record. I'd rather my remote users be on there than some crusty Firefox installation with 40 extensions. Organizations have the right to make these decisions when they are the ones that own the data. For example, when I was still in that world, we required personal phones to be encrypted to access corporate email. This was when a lot of people would still walk around with devices without a pin. People complained, but it was non-negotiable.
Literally the only reason they can argue Chrome is more secure than Firefox in that kind of setting is because they can Google can push Google Chrome profiles via Google Workspaces but they’ve never working with Mozilla to create an interop for Firefox.
When Microsoft did this with Windows, AD, and Internet Explore, it was deemed a breach of anti-trust laws. The question is whether such laws apply to Google given they don’t have a monopoly in the identity services domain.
If you’d asked me 5 years ago, I’d have said “no way”, but recent judgements with Apple and their App Store lead me to think there is still hope. Regardless of how remote that might be.
And Google would probably say the same thing Microsoft used to say back in the day. Their customers aren't asking for the ability to manage profiles in Firefox. I wouldn't doubt for a second that it's true.
Almost nobody outside of the minority of internet users fighting against chromium hegemony cares about Firefox. Firefox lost its casual users years ago. Hell, even most of those people sticking with it out of principle are doing it while gritting their teeth. It's been a subpar browser for a long time and the Mozilla organization kinda sucks.
Why would any for-profit enterprise waste their time or money on Firefox?
Note that making lock-in features like this effectively proprietary to the Chrome browser is only possible because of the fact that it's the same company making Google Workspace and Google Chrome.
I absolutely see many problems with this and you really ought to as well.
I didn't mean it would be physically impossible, which is hopefully implied, I mean, it would be de-facto impossible. Absent the perverse forces of anticompetitive behavior, browsers don't really have a good incentive to diminish the open nature of web standards by doing partnerships that bypass standards altogether. If you are not affiliated with Google and there is a healthy ecosystem of browsers, you just simply can tell them to bug off if they want some web feature you feel wouldn't be good for the health of the web. The interaction between browser vendors and certificate authorities has traditionally been a great example of how things can work out between different entities in an ecosystem, though outside Mozilla I am guessing most of the browser vendors are also CAs (but still have very little to no incentive to compromise or weaken the system.)
Meanwhile, in our current reality, both Google and Apple have or currently are shoehorning platform level attestation into the web in various different ways, something they are mostly able to do because they have so much control over multiple major ecosystems (among platforms, browsers, web services.) Mostly, even making them "standards", which would be hilarious if it wasn't literally evil. (Apple's approach to sneaking this in is innovative, in that it technically is a hardware platform attestation mechanism, but it was sold and initially implemented as a convenience feature. That and the underlying PAT technology can be used in strictly non-evil ways, like Kagi's rather clever application.)
It's a lot of words to say that I didn't mean literally impossible, but if we're going to get pedantic then a lot of words it is.
Why wouldn't money be an incentive. If businesses are willing to pay to have locked down browser access their cloud files, and the cloud file website wants to make money by charging businesses for this feature it makes sense that they may pay a browser to develop such a feature to use with their website.
I dunno, it just seems like the set of circumstances that would be needed to overcome the inherent friction in a "healthy" ecosystem is a lot more gymnastics than the current situation where the browser company with the vast majority of marketshare is the company that has conflicts of interest to fuck with the browser.
If a corporation with my data allowed access to its internal tools using any browser running any arbitrary and possibly compromised third party extensions, that's a data leak and class action lawsuit waiting to happen.
It's a paid product, they are actually allowed to do this. Google is obviously going to focus on security testing with their own browser. It's understandable that organizations want to require chrome for their employees to access their workspace in the interest of security, but it's not the default.
> It's understandable that organizations want to require chrome for their employees to access their workspace in the interest of security, but it's not the default.
Can you elaborate on why you think that Firefox is inherently insecure in some way for accessing Google workspaces?
> It's a paid product, they are actually allowed to do this.
If that were the only metric, then no monopoly would ever be broken up for any reason (which I guess is the way regulation seems to work nowadays, but at least in theory it's supposed to be possible for it to happen sometimes). The idea that using market pressure from one product a company sells to squeeze out competition in another is totally fine as long as the first product is paid is not a premise I agree with.
> Can you elaborate on why you think that Firefox is inherently insecure in some way for accessing Google workspaces?
Allowing users running who knows what version of Firefox (or any "non-validated"/unmanaged browser, not necessarily just Firefox) browser running who knows what extensions can be pretty unsafe. There are lots of malicious extensions out there that are stupid simple to install.
In the Workspace world, Chrome can be configured and enforced to have certain kinds of settings applied. Only allowing certain extensions. Ensure certain version ranges. That sort of thing.
It can, along with a bunch of other GPOs in an admx template.
But how many companies are running Workspace + Windows with on-prem AD? I suspect that number is shrinking pretty rapidly. You can do it with InTune as well, but it starts to get real messy if your users aren't on Windows or you have non-windows endpoints.
If you're a mac shop, on google workspace, and using something like JamF (or even Intune+EntraID), you are stuck deploying .plist files to each endpoint, you don't get compliance reporting back, and you lose a ton of visibility.
These are all things that don't matter to each individual user, but are hugely important to IT/security in the company, and Firefox unfortunately just doesn't have any centralized management platform for it.
Sure. But there's generally no standardized function ensuring they're actually only using that specifically configured browser when logging in. What happens when they try to log in from some other device? What happens when they manage to load a browser on to that machine?
This feature supposedly ensures (or at least pushes users to) only the approved browsers running approved configurations are allowed to log in to the company's instances of Workspace.
What if a company decides that their preferred browser is Firefox. Can you use this feature to only enable logins from Firefox? Or is it only for Chrome?
They can't use this feature to enforce only Firefox. Firefox doesn't have support for this feature, they really don't offer anything like Chrome Enterprise. Its just as much a feature of Chrome Enterprise that Workspace leverages rather than only a feature of Workspace that leverages Chrome.
You can still use Firefox with Workspace though, but if you want the management features of Chrome Enterprise you need to use Chrome Enterprise. Firefox itself just doesn't even begin to offer the same kind of endpoint verification.
With Firefox today, how would a web app have any serious clue the client was running approved versions of Firefox configured in approved ways on approved hardware with approved OS configurations? It wouldn't, and I take it Firefox wouldn't bother implementing that kind of technology. Which is fine, but if the customer wants to be able to ensure a certain kind of policy compliance that's just not possible when using Firefox. And that's just as much if not more of the ball being in Firefox's court as it is Google Workspace's. There's nothing for Workspace to even interface with at all from the Firefox side to ensure policy compliance.
Its like asking "can I print on this printer with this app?" when the app itself doesn't even have a concept of printing things. The basic underlying feature set just doesn't even exist, before we're even talking about some form of platform compatibility.
I don’t think anyone is saying Firefox is inherently bad. What I’m reading, and what I believe, is Google just has a better product for secure enterprise browsing because of the controls they offer
The browser is where basically all your work happens, especially as a Workspace customer—think about how much of your work is done in the browser. That makes it a huge, attractive attack surface. And attackers don't even need a browser vulnerability; they can just convince an employee to install a malicious browser extension, and suddenly they can steal passwords, watch everything you do, and hijack your sessions on other sites.
So security teams need visibility into what's happening in the browser. Google does a decent—not great—job of providing this through Managed Chrome: centralized logs, control over which extensions can be installed, even alerts when someone reuses their Workspace password elsewhere.
Firefox, Safari, and most others don't offer these business controls, which means a security team allowing them is flying blind. And a blind security team is gonna have a bad time… mmmkay.
On support: someone mentioned using Firefox to verify their app works across browsers—god's work, truly. But not every vendor does that, so IT ends up fielding "this site just isn't working" tickets that turn out to be browser compatibility issues. Fewer supported browsers means a smaller surface to support and a better experience all around.
This can't be enforced where you're not using your corporate identity. A Dropbox account on your personal email is still accessible from any browser.
I would say it's common to find dark patterns that involves ambiguity like the discussion we are having here. We can't know for sure but Google can increase the probability of being on their ecosystem.
Well, it could als also be argued that Chrome _is_ more secure, for example because it uses app-bound encryption using Windows DPAPI system, for cookies, so that it at least tries to protect cookies from malicious applications running on the device. Firefox does not do this: https://security.stackexchange.com/questions/279629/are-cook...
If course the reverse can also be argued, for example that Firefox supports proper adblocking.
Not really a serious argument when you are accessing a Google product. Sure, don't want to interact with Google? Don't interact with Google, but logging into Google workspaces with Firefox definitely isn't protecting your data from Google.
CAA is one of the most powerful security features you can enable in an org. You can manage browser extensions, device password policy, encryption, configuration, cookie attestation, etc.
CAA is completely based on trust, it's not one of the most powerful security feature. It's completely voluntary reporting by the browser, and any attacker who cares can just lie without issues.
You can make Firefox pass CAA if you want. You take the Chrome "SecureConnect Reporting" (Context-Aware Access) plugin, port it to Firefox with some light changes, and you can report whatever you want to CAA.
That's not entirely true. For example, on ChromeOS CAA is hardware backed. But obviously CAA is not intended to be our entire MDM solution, an attacker in a position to spoof your entire browser can bypass some of the policies on some operating systems. Similarly, attackers in that same position can bypass TLS. An attacker who owns the kernel can bypass much of your MDM. An attacker who owns the hardware can bypass just about anything.
I haven't dug into the native helper to see how much it checks, I can believe that ChromeOS does full remote attestation. If it's anything like Android Play Integrity, there's not a lot of flexibility without hardware exploits.
But who outside of Google is running exclusively ChromeOS?
My impression from looking at the JS part is that it's mostly obfuscation, with the possible exception of ChromeOS.
I feel like the secure connect client being closed source would have been an effective deterrent 5 years ago, but these days everyone's throwing LLMs at everything. So an attack that would have taken effort doesn't present nearly as much of a barrier anymore. At least as long as there remain some platforms that don't enforce full attestation...
My point was that CAA's threat model is flexible based on your requirements. If your requirement is "an attacker with the ability to make arbitrary network requests from the host can not pretend to be Chrome", CAA does not work unless you have OS/Hardware support (which ChromeOS provides).
I just don't think that matters much. CAA is policy enforcement, it is not a full MDM solution, nor is it antimalware.
That's just a misunderstanding of the threat model. It's like saying "if someone can just mitm TLS it's pointless" when that "someone" is in the position to run arbitrary code on the client. Mitigations map to specific attacker positions.
Understand that, in this conversation, your use of "attacker" is referring to "end user of the hardware". Which might be part of the Chrome team's definition, or might not, but gosh it would be nice to cater to the folks who are using the dang computer.
Using a maintained and up-to-date browser is a reasonable requirement for an IT department (should be for anyone really). Would you suggest they should be allowing IE6 just because a user might prefer it?
Of course Google is going to suggest using Chrome, if they detect that the browser might be out of date.
We don't know. The author doesn't mention how current the Firefox browser is/was.
If the organization is indeed enabling a specific check for Chrome that seems a little over the top but they're the ones supporting their users and if they want to make their life easier by only dealing with one browser that's their decision to make. It's like saying that everyone has to use Windows, or a specific line of laptops, or any other standardization to simplify the support workload.
It's not clear to me that Context-Aware Access is as configurable as you're implying. At a glance, the docs seem to suggest that Chrome is the only browser you can force standardization on, which IMO does push this towards being Google's fault.
That's correct, there is no way to say "only allow Firefox" in CAA because the attestations are either browser agnostic or chrome specific (as part of the managed Chrome offering that GSuite supports).
If we are meant to believe that this is a Chrome-invasion-move, it's the least effective lever of all times. Most of the time the more plausible explanations are just the likely ones.
Chrome was created because Google felt that the IE monopoly was hindering the advancement of web standards and improved browser capabilities. I suppose you could argue that was a different Google at a different time, but at one point they did feel that browser diversity was a good thing.
I mean, they claimed to be for browser diversity when it was not them on top lol. Underdogs want the race to tighten up, 85% market leaders want to stay out in front.
If that's a the goal, then IT department should start by blocking user ability to install Firefox or other unapproved software not by blocking access to google workspace. Blocking access to google workspace using Firefox doesn't prevent using it for everything else. It's not like the google services are going to exploit a vulnerability in Firefox, everything else might.
Well - it does make sense. If an organisation that contracts me has to chose between a) BYOD - but restrict downloads, etc, enforce export control, directly in the browser - I happily take that, vs getting a Windows laptop that is locked down and forced to work with that.
Its a normal choice, given a checkbox on page which advertises that checking it would make your security posture more safe. The IT person is safeguarding their own job.
Other way to look at it is, the company is paying for everything, and they get to make decisions based on what suits their security needs.
> We haven’t configured, and don’t use IAP (Identity Aware Proxy) - I’ve used this before and yes that is Chrome only due to how it does device verification
> This isn’t because of “Context Aware Access” this is an enterprise only feature, and we’re on Google Workspace Business Plus
Unrelated to this news, but this is so rudimentary, when the correct solution instead is:
1. Make it ridiculously easy to install hardware vendor keys and register it with OS of choice. (like a standardized dialog box in UEFI and a standardized/regulated IPMI-like interface)
2. Allow for only measured boot on those devices.
3. Provided facility to verify signatures.
Do this on consumer and enterprise laptops and desktops alike and all of these weird set of conditions just go out of play and replaced by something much much simpler.
I don’t think that’s true. They support OS verification for windows and Mac. If Firefox implemented verification (I doubt they would) and there was customer demand I think they would support it.
It appears website developers desperately want to return to a world where browsers actively pretend to be another browser*.
Want to check for DBSC? Enjoy not knowing whether the browser vendor decided to just roll a simple software implementation.
Nothing good comes from browser detection over feature detection anyways. It's time to do away with user-agents and other overt identifying markers, and if we're still not in a better place, aggressively start stubbing features.
* to some degree they still are. Firefox still ships with an user-agent override list for certain websites that have outdated user-agent sniffing for feature detection (and other fixes in about:compat).
Happens to me too. They are probably able to infer it is not a Chrome from the TLS handshake or they run their javascript fingerprinting and found out that the browser didn't have some Chrome features or behaved differently.
Sadly, it is much more difficult to pretend being on a different browser than it was in the past. :/
And yet, claiming support for a feature doesn't tell all. Different implementations can have subtle differences. Knowing the browser and version can allow a client to survive that.
Yes, that is the price developers will have to pay. Development will be harder, but users are going to prefer somewhat broken sites over being outright refused entry.
At the end of the day user-preference is what dictates which browser is used and how it is configured. Developers will have to deal with what users choose to do on their end.
You can only patronize people for so long before they look for a way around silly restrictions. Trying to keep someone safe by putting up walls, whether the threat is real or imaginary, is pointless when it is in the user's power to trivially defeat those walls - and when extension and browser developers are going to line up to sell them demolition tools (see ad blocking).
Advice is going to go much further than roadblocks, long term.
It states something about "your organisation's security requirements", do they document what requirements cause this rejection page? Some kind if changed default perhaps?
No, this is easily the biggest flaw in CAA - there is no way to discover which policy broke your access. I have reported this to Google multiple times, even sent this directly to a Google SecEng (a well known one) to route internally. The issue persists and makes configuring CAA extremely painful and error prone.
I am convinced there's someone who thinks debuggable security policies are a security risk and deliberately designs security APIs to be as inscrutable as possible.
At least you got a heads-up. Few months back GCP "Agent Studio - Build" failed compiling the code in sandbox with a vague error message. Spent weeks troubleshooting, spoke to google engineers and reps, sending code, step by steps, screenshots. No one had a clue, until I switched from Firefox to Chrome out of desperation and it worked without a hitch.
Taco Bell is a monopoly because they restrain the trade of tacos because they ask me to take my taco truck elsewhere when I park in their parking lot to sell tacos. Never mind there are other places I can set up my truck, never mind there are tons of other taco shops, Taco Bell is a monopoly as now I need to go find a different corner to sell my tacos, they're restraining the trade of tacos.
Everything is a monopoly these days. Its practically meaningless in these conversations.
Get this, they won't even let me sell my tacos through the Taco Bell app. What a monopoly! We need to get the FTC to enforce Taco Bell's and Taco Bueno's mobile apps to make their apps support every taco truck's ordering system. They're restraining the marketplace of selling tacos through their apps to only their own stores!
Every feature of their apps needs to be easily integrated into whatever random POS every single food truck uses! I should be able to buy tacos from any taco vendor through the Taco Bell app. They're a monopoly!
What if it was they bought a car brand and added a transponder to the car so owners of taco bell cars could be auto-identified and had their favorite orders already ordered for them while all other models of cars were still free to use the normal drive through process? Would that be a "monopoly" somehow?
Isn't that more of what's going on here? An optional feature people can use if they choose to use the holistic platform?
This isn't forcing anyone to choose Chrome. The customer can still use any browser they want with Workspace. They get an extra feature when they use Chrome though.
The article isn't accurate. One could say they're uninformed, one could say maybe they're ignorant, but it's not reality.
This is a security feature a Workspace customer can choose to enable or not. If the workspace customer wants to use Firefox they're free to not enable this security feature that isn't supported by Firefox.
It's not a requirement at all to use Workspace, it's an optional feature. You can still use Firefox or any other browser for that matter with Workspace, if the manager of that Workspace wants you to. Which it's the company's software suite, they should be able to configure it how they wish shouldn't they?
If Google actually started banning all non-Chrome browsers maybe I'd agree that's harmful to the browser market. It was a bad thing when they blocked Windows Phone from accessing Google services back in the day, for example.
They wont stop it. They will just slow down a bit if people get ruffled. That's how alphabet has handled everything else. They learned that if they can make changes slowly enough, they can do whatever the hell they want to.
As we all know we can even pay 10x more for items and get next to no raise in our wages, but because it was done slowly in an "official" and "professional" manner, most folks didn't even complain, they just screamed into the giant pillow we call "the internet".
Corporations of the 2020s love the internet's digital pillow and its magical crowd-quieting capabilities. If only the ancient roman empire had invented the internet they would be ruling the entire planet by now and we could watch gladiators on youtube :P provided we don't stand out too much (then we would be said gladiators)
Reading the news of EU countries leaving American cloud providers for local cloud solutions including mobile office, it's surprising to see Google doing this.
It will only accelerate moves towards location of data, self-hosting, etc. The technologies to make this possible are much easier than they ever have been.
Sounds like you have a device policy configured and you should talk to your internal IT/Security team?
edit: This title is just incredibly misleading. OP seems to have made a mistake here in thinking that this is something that Google has done when it's just that their corporate IT/ Sec team now enforces using Chrome.
Not defending it, but given that they use the word "secure" three times in two sentences, I'm wondering if it's shown to browsers that don't support DBSC. Google has been really pushing/overselling this as a magical solution to cookie theft.
Is it possible for a non-google browser to be said to meaningfully support this given that implementing the features wouldn't necessarily accomplish anything insofar as it wouldn't let you past the google only security gate and would represent a moving target in any case.
That's fine. The second I stopped caring, which is the day I stopped working for a living, I stopped worrying about what Google thinks. I don't use Google for email or search. (my email addresses are with proton, iCloud, and Hey, and my search is DDG) I'm not a big video person so I never use Youtube, the few times I need to use an office product I will either use OnlyOffice, or the Apple stuff. My Phone is an iPhone (with the stuff mentioned above) My browser is Firefox with uBlock Origin, and I almost never have problems with this setup.
I use Google as a secondary search and as of roughly last week it gives me a captcha every time I try to do a search. That had never been the case before.
I browse over Tor for most things and most sites give me a captcha or just simply fail to load these days. I just close the window and move on to something else.
I am seeing it a lot more lately with uBlock Origin. I've used DDG for search for a while now, but the last few times I've tried Google I got a captcha within a couple of queries if not immediately.
That one has been a well-known thing for a decade if not more; it's not just Google, half the Internet will start throwing captchas or denying access once you connect via a VPN (specifically "VPN" as in one of the services you pay to avoid location-based discrimination of media streaming platforms).
It is probably Chrome Enterprise which lets you lock down, for example, what extensions people are allowed to install. There is a legit reason for organizations to want to standardize on one browser and to lock it down (as browser extensions are a major source of infiltration these days).
Unrelated to Google Workspace and Firefox, but I just noticed today that Google’s YouTube now says my iPhone’s Safari browser is incapable of playing full screen videos, which it’s not ever claimed before. I’m also getting sick of them pushing Chrome anytime I use a Google service like search or Gmail. I keep dismissing the prompts, but they are relentless. It all seems so sleezy and desperate.
This is not a Google-wide thing… this is from Google’s Context-Aware Access product, which is configurable in Google Workspace environments. OP should direct their ire at their corporate IT or infosec team.
it shouldn’t be an option.
Some IT departments just see a “more secure” checkbox and will always check it, even if it doesn’t make sense holistically- sometimes compliance incentivises (or forces) this behaviour.
A common example is forcing intune/device enrolment for mobile devices (including ipads)- but not for the infinitely less secure laptops: because no such endpoint enforcement checkbox exists
While this is true, allow me to give another POV. I run corporate security and internal IT for a 100 person SaaS. I "nudge" our users towards Chrome. Why? Because I can manage Chrome using the config infrastructure provided by Google. Because Google has more resources to secure their browser. Because my observability and DLP stuff works with Chrome and not with Firefox. And I'm probably still missing out on a bunch of things.
Those are real, practical reasons. Not just "if I do this I get to check another box".
Yes. I know. It's a pain that when you cannot do what you want to do. But it's not your laptop. It's the company's. Supporting more browsers to the same standard that I just described would take engineering resources, of which I do not have an infinite supply. And the priority goes to keeping the company secure.
> Because Google has more resources to secure their browser
They've kneecapped ad-blockers, when ad networks are perhaps one of the biggest causes of malware installs/page hijacking/other unwanted behaviour. I'm not sure how you can consider Chrome remotely secure in this light.
My org (or rather, the org they pay to run their IT) blocked browser plugins with a security justification.
I find this incredibly amusing, and at a different point in my life I'd already be gone.
When you outsource IT, there are many, many misaligned incentives.
> I find this incredibly amusing, and at a different point in my life I'd already be gone.
How so? Bad actors buying existing extensions with large user bases then publishing a new version which does bad stuff is a pretty common pattern. It certainy seems like a reasonable concern for a corp IT department.
99% of security experts I know use ad blockers.
When there are unpatched browser vulnerabilities, attackers will use ad networks to inject attack code into reputable-but-ad-laden websites. And even when there aren't unpatched vulnerabilities out there, many ad networks will happily accept scam ads, ads that trick people into downloading malware, fake download buttons and suchlike.
> 99% of security experts I know use ad blockers.
But if they all use Chrome, wouldn't those be really weak ad blockers?
This is a common myth. I've used uBlock Origin Lite for months (a year?) and still see zero ads.
I'm extremely intolerant to ads, so I would leave Chrome if ad blocking stopped working.
Adblocking is an arms race. Google is handicapping adblocking progressively the fact that it doesn't take one day to achieve absolutely doesn't make it a myth. Adblocking is technically worse and the more locked down our environments are the easier it will be to kill or drastically reduce it.
If everyone had the same attitude this would probably already be the case.
> 99% of security experts I know use ad blockers.
100% of security experts I know find ads annoying and know ad blockers reduce how many they see.
Not GP, but I think the point was that no extensions => no ad blockers => major malware vehicle unlockable, short of disabling JS
Bingo.
I figure they had a switch they could toggle and they thought no further about the tradeoffs. Because their primary concern is their own liability, not what's best for the org their contract is with.
> My org (or rather, the org they pay to run their IT) blocked browser plugins with a security justification.
Same here, but only on Chrome. Firefox works fine.
Have they blocked vscode? I think any organisation that lets people use vscode, might just as well people do whatever they want.
Nope :)
Brave has ad-blocking built in and policies can be used to disable any unwanted features. With Chrome going user-hostile, it's a pretty great option.
Extensions are a much greater security risk than ads.
They didn’t take a decade plus to implement per-domain process isolation, for starters…
You can downvote the truth, but can’t reply to it.
Typical modern Mozilla fans, really.
while valid points, my company uses Microsoft products and they are pretty abysmal in whatever domain they have products in. Edge for example being one of the weaker browser options. (though better than it was in the IE era).
Being forced to use various tools for compliance is frustrating, doubly so if it helps create a stronger monopoly position, because a monopoly position creates stagnation, which makes worse products.
But those worse products are forced on users, even when better ones start to come about.
This is the crux of my issue, Microsoft is the king of this behaviour, and they are using this a lot which is squeezing the metaphorical testicles of almost all companies in Europe.
> I can manage Chrome using the config infrastructure provided by Google
https://mozilla.github.io/policy-templates/
It's a pain that when you cannot do what you want to do. But it's not your laptop. It's the company's.
But it is my craft, and to be limited to what tools I can use in my craft can decrease the value of my work, and in doing so decrease the company's productivity.
Let's say you earn a million dollars a year (most of us earn far less). At quite a few companies, a 50% decrease in your productivity (and changing browsers is nowhere near that) would cost the company significantly less than dealing with the fallout of any of the following:
* A user intentionally leaking sensitive documents outside the corporate network
* A user installing an infected browser extension that gives attackers access to corporate resources
* A user accessing malware or ransomware which infects corporate resources.
That's on top of the cost of having the IT department having to debug issues among users with bespoke tool sets which can often interact in unintuitive ways.
There are many stupid ways that companies "optimize" costs that cost them more in the end. Standardizing the browser and extension set for data loss protection is not one of them.
All of what you listed is preventable at a mild labor cost to the same degree as other browsers.
That's not obvious at all. The feature sets and tooling are very different. The person you replied to said as much.
You (and I) aren't that special. People who are actually irreplaceable are astonishingly rare, and unless you're one of them, employees who will gripe about things like what web browser they use are often not worth the trouble at scale.
employees who will gripe about things like what web browser they use are often not worth the trouble at scale.
Firms who enforce homogeneity through policy are not worth the trouble at scale.
> But it is my craft
Then go work for yourself.
If you want the security of a regular salary, you need to jump through the hoops of your employer and not expect to be able to do 'your craft' however you see fit.
I don't think using a popular web browser is that unreasonable an accomodation.
If you run a SaaS, large parts of your orgs should be on all major browsers regularly.
I have a handful of endpoints, used by staff that represent a low level of risk, that use Firefox for that precise reason.
But really, we have a couple of million enterprise end-users, some of which surely using Edge. If we as much as move a button without telling them about it three months in advance, it's the end of the world. In 10 years time, no customer has raised it.
Edge: Chromium with Google Chrome-like data collection, but with data going to Microsoft instead.
This is the correct answer. Having your users run multiple browsers by default (instead of with whitelisted exceptions) is now multiple attack surfaces the org has to manage.
Very curious how you avoid supporting multiple browsers. Apple, Google, and Microsoft each require users on their platforms to use their native browsers for secure connections.
And if your company has any web presence or apps, you usually can't cherry pick which browsers your customers can use. That means some portion of your company will need access to other browsers for QA purposes.
Do people get pwned by anything besides spearphishing or ads nowadays? I think ad->phish or targeted phish emails is the only shady thing I've been exposed to in like 10 years
Running npm install is a good way to get compromised.
This feels like the whole IE6 dance coming back.
People know how it ended, but don't seem to remember how it started, which is a shame.
Google has the resources to do it, but do they actually do it? By the looks of it I'd say "no".
See the whole thing with libxml2 for example, or how they started boringssl to "fix" the issues with openssl, but they run it as an internal project you cannot depend on.
having soon-to-be-nonfunctional adblocking will be far more dangerous to org than any extra security those options might provide
Ubo lite is plenty functional. It's not as full-featured as ubo, but... I don't see ads. At all. What sites doesn't it work well on?
> But it's not your laptop. It's the company's.
Sure, which is why you should lock down the laptop. Blocking Firefox in Google Workspace seems like entirely the wrong layer for this.
It's their organization. They are allowed to make decisions about what software their employees use. I'm a die-hard Mozilla fan, but I don't find this unreasonable.
The problem is Google appears to label this as a security feature. I'm fine with the feature existing, but it should say something like "require Chrome" or "block Firefox" not "require a secure browser (wink wink we actually mean Chrome)"
The wording here is bad, but basically CAA supports non browser specific policy and, in some cases, browser specific policy (GSuite offers a "Managed Chrome" policy). Firefox users can leverage much of the non browser specific policy, they obviously can not be a part of the "Managed Chrome" offering.
There's no contradiction here; it's totally possible for a company to make a feature configurable so that it doesn't block their competitors but also intentionally design and market it in a way that's misleading in ways that will lead to their competitors getting blocked. When we're talking about a company as large as Google and a product with as much market share as Chrome, I don't think it's that crazy to think that things like this add up to encouraging even more hegemony, and when that happens to align perfectly with the incentives of the company making said product decisions, I also don't think it's crazy to think it's unlikely to be a coincidence.
If the argument is that Google has built a product that encourages use of Google products, of course. The question is whether that's some sort of trickery or odd or bad. "Google offers Managed Chrome as a service" hardly seems controversial to me.
Google offering managed chrome as a service is a completely sensible thing. The problem is that they are nearly a browser monopoly, and making Google Workspace work in such a way with Google Chrome feels to me like anti-competitive practices. If we didn't have one giant megacorp that did both things, it would be different.
Of course, so far the only workable model for web browsers is having a giant megacorp fund their development and maintenance. Which is a huge issue, and we will do basically nothing about it.
(Don't get me wrong. I have high hopes for Ladybird and even Servo, but they may come too late if effectively-proprietary features force most users to stick to Chrome anyways.)
I'm not sure what the alternative is. Is there will from Firefox to support a "standard browser config", at which point GSuite could add support for managed Firefox config? If you want managed Firefox, Mozilla could offer that as well (they have something but it's different enough).
The alternative that we've used for the past 100+ years is to force such companies apart. Is Google Docs allowed to offer a "managed chrome" policy? Sure. Is Google Chrome allowed to be a browser? Absolutely!
But if either side is close to a monopoly, both cannot be part of the same company, even if that means breaking an existing company up.
I think it's fine to advocate that Google should be split up but I don't think that CAA is a good example of a company abusing power.
There's really nothing particularly wrong with the Chrome feature itself. There is a bit of a problem with the way it inherently results in browser vendor lock-in (regardless of whether it is a stated goal) with Google Workspace, which is by the same company. That's the main problem.
I may be missing something because I feel like this specific point has been reiterated a few times in this thread but I haven't seen it actually rebuked directly.
There is no Chrome feature here? We must be talking past each other, yes.
The Chrome feature is the support for Endpoint Verification that is used by CAA. That is quite literally the reason for this HN post.
Endpoint Verification is not a Chrome feature, nor is CAA. Endpoint Verification is an extension, CAA is a GSuite feature.
Look man, this is absolutely getting into the semantics phase. I know you're not stupid, don't treat me like I am.
Firstly, some Chrome features (like Chrome Remote Desktop) are delivered partly as extensions. This does not make them not features of Chrome. It makes them features that happen to be delivered in some part as extensions.
Doesn't matter. Let's say Endpoint Verification is not a Chrome feature. Thankfully, we don't actually need that for our argument. The crux of this argument is simple:
- Google Workspace depends on proprietary Chrome features,
- Chrome has specific proprietary features designed to support Google Workspace (and other proprietary Google offerings.)
What is the proprietary features I am referring to? Well, I'd just say "Endpoint Verification", but we can go a layer deeper. In order to implement Endpoint Verification, we need privileged, private extension APIs. These APIs are not for use with non-Google extensions, and Endpoint Verification uses enterprise.reportingPrivate.
You can disagree that it is a problem that Google Chrome and Google Workspace are developing proprietary integrations with each-other, that's your prerogative, but I'm not humoring this gaslighting attempt.
I'm not trying to treat you like you're stupid or to gaslight you. There is a "slice" of this that is absolutely a native, Chrome-only interface, but I just don't think that this is particularly exceptional. These sorts of Firefox-only APIs exist as well in order to support Mozilla's goals, and this is quite normal - you wouldn't expect every single aspect of the browser to be built in lockstep with every other browser.
For the most part, Mozilla could build out Endpoint Verification (and it supports a subset of the APIs anyways). Similarly, there could be a web proposal for device attestation APIs that are more generalized, etc, which I think would be great.
It is a security feature. In a corporate environment, you generally don't want users installing their own software. If it's a remote access thing from a personal device, you still generally want to be able to establish some kind of baseline. I don't like Chrome - not even a little bit - but I will admit that they have a pretty damn good security track record. I'd rather my remote users be on there than some crusty Firefox installation with 40 extensions. Organizations have the right to make these decisions when they are the ones that own the data. For example, when I was still in that world, we required personal phones to be encrypted to access corporate email. This was when a lot of people would still walk around with devices without a pin. People complained, but it was non-negotiable.
Literally the only reason they can argue Chrome is more secure than Firefox in that kind of setting is because they can Google can push Google Chrome profiles via Google Workspaces but they’ve never working with Mozilla to create an interop for Firefox.
When Microsoft did this with Windows, AD, and Internet Explore, it was deemed a breach of anti-trust laws. The question is whether such laws apply to Google given they don’t have a monopoly in the identity services domain.
If you’d asked me 5 years ago, I’d have said “no way”, but recent judgements with Apple and their App Store lead me to think there is still hope. Regardless of how remote that might be.
And Google would probably say the same thing Microsoft used to say back in the day. Their customers aren't asking for the ability to manage profiles in Firefox. I wouldn't doubt for a second that it's true.
Almost nobody outside of the minority of internet users fighting against chromium hegemony cares about Firefox. Firefox lost its casual users years ago. Hell, even most of those people sticking with it out of principle are doing it while gritting their teeth. It's been a subpar browser for a long time and the Mozilla organization kinda sucks.
Why would any for-profit enterprise waste their time or money on Firefox?
Note that making lock-in features like this effectively proprietary to the Chrome browser is only possible because of the fact that it's the same company making Google Workspace and Google Chrome.
I absolutely see many problems with this and you really ought to as well.
Is that worse than if Microsoft Exchange only worked with desktop Outlook?
>only possible
Two different companies can partner together and release features in both of the company's interests.
I didn't mean it would be physically impossible, which is hopefully implied, I mean, it would be de-facto impossible. Absent the perverse forces of anticompetitive behavior, browsers don't really have a good incentive to diminish the open nature of web standards by doing partnerships that bypass standards altogether. If you are not affiliated with Google and there is a healthy ecosystem of browsers, you just simply can tell them to bug off if they want some web feature you feel wouldn't be good for the health of the web. The interaction between browser vendors and certificate authorities has traditionally been a great example of how things can work out between different entities in an ecosystem, though outside Mozilla I am guessing most of the browser vendors are also CAs (but still have very little to no incentive to compromise or weaken the system.)
Meanwhile, in our current reality, both Google and Apple have or currently are shoehorning platform level attestation into the web in various different ways, something they are mostly able to do because they have so much control over multiple major ecosystems (among platforms, browsers, web services.) Mostly, even making them "standards", which would be hilarious if it wasn't literally evil. (Apple's approach to sneaking this in is innovative, in that it technically is a hardware platform attestation mechanism, but it was sold and initially implemented as a convenience feature. That and the underlying PAT technology can be used in strictly non-evil ways, like Kagi's rather clever application.)
It's a lot of words to say that I didn't mean literally impossible, but if we're going to get pedantic then a lot of words it is.
>browsers don't really have a good incentive
Why wouldn't money be an incentive. If businesses are willing to pay to have locked down browser access their cloud files, and the cloud file website wants to make money by charging businesses for this feature it makes sense that they may pay a browser to develop such a feature to use with their website.
I dunno, it just seems like the set of circumstances that would be needed to overcome the inherent friction in a "healthy" ecosystem is a lot more gymnastics than the current situation where the browser company with the vast majority of marketshare is the company that has conflicts of interest to fuck with the browser.
Google and Microsoft shouldn’t be giving levers that bake you more into their ecosystem regardless.
Your corporate serfdom is not in question, but I disagree with that notion too.
If a corporation with my data allowed access to its internal tools using any browser running any arbitrary and possibly compromised third party extensions, that's a data leak and class action lawsuit waiting to happen.
It's a paid product, they are actually allowed to do this. Google is obviously going to focus on security testing with their own browser. It's understandable that organizations want to require chrome for their employees to access their workspace in the interest of security, but it's not the default.
There is zero problem here guys.
> It's understandable that organizations want to require chrome for their employees to access their workspace in the interest of security, but it's not the default.
Can you elaborate on why you think that Firefox is inherently insecure in some way for accessing Google workspaces?
> It's a paid product, they are actually allowed to do this.
If that were the only metric, then no monopoly would ever be broken up for any reason (which I guess is the way regulation seems to work nowadays, but at least in theory it's supposed to be possible for it to happen sometimes). The idea that using market pressure from one product a company sells to squeeze out competition in another is totally fine as long as the first product is paid is not a premise I agree with.
> Can you elaborate on why you think that Firefox is inherently insecure in some way for accessing Google workspaces?
Allowing users running who knows what version of Firefox (or any "non-validated"/unmanaged browser, not necessarily just Firefox) browser running who knows what extensions can be pretty unsafe. There are lots of malicious extensions out there that are stupid simple to install.
In the Workspace world, Chrome can be configured and enforced to have certain kinds of settings applied. Only allowing certain extensions. Ensure certain version ranges. That sort of thing.
I'm pretty sure Firefox is configurable using AD. So is automatically updating (not sure about freezing versions).
If you don't want your user to run whatever version with whatever extension you can do that.
It can, along with a bunch of other GPOs in an admx template.
But how many companies are running Workspace + Windows with on-prem AD? I suspect that number is shrinking pretty rapidly. You can do it with InTune as well, but it starts to get real messy if your users aren't on Windows or you have non-windows endpoints.
If you're a mac shop, on google workspace, and using something like JamF (or even Intune+EntraID), you are stuck deploying .plist files to each endpoint, you don't get compliance reporting back, and you lose a ton of visibility.
These are all things that don't matter to each individual user, but are hugely important to IT/security in the company, and Firefox unfortunately just doesn't have any centralized management platform for it.
Sure. But there's generally no standardized function ensuring they're actually only using that specifically configured browser when logging in. What happens when they try to log in from some other device? What happens when they manage to load a browser on to that machine?
This feature supposedly ensures (or at least pushes users to) only the approved browsers running approved configurations are allowed to log in to the company's instances of Workspace.
Does it?
What if a company decides that their preferred browser is Firefox. Can you use this feature to only enable logins from Firefox? Or is it only for Chrome?
They can't use this feature to enforce only Firefox. Firefox doesn't have support for this feature, they really don't offer anything like Chrome Enterprise. Its just as much a feature of Chrome Enterprise that Workspace leverages rather than only a feature of Workspace that leverages Chrome.
You can still use Firefox with Workspace though, but if you want the management features of Chrome Enterprise you need to use Chrome Enterprise. Firefox itself just doesn't even begin to offer the same kind of endpoint verification.
With Firefox today, how would a web app have any serious clue the client was running approved versions of Firefox configured in approved ways on approved hardware with approved OS configurations? It wouldn't, and I take it Firefox wouldn't bother implementing that kind of technology. Which is fine, but if the customer wants to be able to ensure a certain kind of policy compliance that's just not possible when using Firefox. And that's just as much if not more of the ball being in Firefox's court as it is Google Workspace's. There's nothing for Workspace to even interface with at all from the Firefox side to ensure policy compliance.
Its like asking "can I print on this printer with this app?" when the app itself doesn't even have a concept of printing things. The basic underlying feature set just doesn't even exist, before we're even talking about some form of platform compatibility.
I don’t think anyone is saying Firefox is inherently bad. What I’m reading, and what I believe, is Google just has a better product for secure enterprise browsing because of the controls they offer
The browser is where basically all your work happens, especially as a Workspace customer—think about how much of your work is done in the browser. That makes it a huge, attractive attack surface. And attackers don't even need a browser vulnerability; they can just convince an employee to install a malicious browser extension, and suddenly they can steal passwords, watch everything you do, and hijack your sessions on other sites.
So security teams need visibility into what's happening in the browser. Google does a decent—not great—job of providing this through Managed Chrome: centralized logs, control over which extensions can be installed, even alerts when someone reuses their Workspace password elsewhere.
Firefox, Safari, and most others don't offer these business controls, which means a security team allowing them is flying blind. And a blind security team is gonna have a bad time… mmmkay.
On support: someone mentioned using Firefox to verify their app works across browsers—god's work, truly. But not every vendor does that, so IT ends up fielding "this site just isn't working" tickets that turn out to be browser compatibility issues. Fewer supported browsers means a smaller surface to support and a better experience all around.
This can't be enforced where you're not using your corporate identity. A Dropbox account on your personal email is still accessible from any browser.
I would say it's common to find dark patterns that involves ambiguity like the discussion we are having here. We can't know for sure but Google can increase the probability of being on their ecosystem.
It’s a good reminder of the fact that capitalist companies aren’t democratic places, despite how much time and energy is spent there by workers.
Well, it could als also be argued that Chrome _is_ more secure, for example because it uses app-bound encryption using Windows DPAPI system, for cookies, so that it at least tries to protect cookies from malicious applications running on the device. Firefox does not do this: https://security.stackexchange.com/questions/279629/are-cook...
If course the reverse can also be argued, for example that Firefox supports proper adblocking.
Unfortunately the malicious actor I want to protect my cookies from is Google.
Not really a serious argument when you are accessing a Google product. Sure, don't want to interact with Google? Don't interact with Google, but logging into Google workspaces with Firefox definitely isn't protecting your data from Google.
CAA is one of the most powerful security features you can enable in an org. You can manage browser extensions, device password policy, encryption, configuration, cookie attestation, etc.
CAA is completely based on trust, it's not one of the most powerful security feature. It's completely voluntary reporting by the browser, and any attacker who cares can just lie without issues.
You can make Firefox pass CAA if you want. You take the Chrome "SecureConnect Reporting" (Context-Aware Access) plugin, port it to Firefox with some light changes, and you can report whatever you want to CAA.
That's not entirely true. For example, on ChromeOS CAA is hardware backed. But obviously CAA is not intended to be our entire MDM solution, an attacker in a position to spoof your entire browser can bypass some of the policies on some operating systems. Similarly, attackers in that same position can bypass TLS. An attacker who owns the kernel can bypass much of your MDM. An attacker who owns the hardware can bypass just about anything.
I haven't dug into the native helper to see how much it checks, I can believe that ChromeOS does full remote attestation. If it's anything like Android Play Integrity, there's not a lot of flexibility without hardware exploits.
But who outside of Google is running exclusively ChromeOS? My impression from looking at the JS part is that it's mostly obfuscation, with the possible exception of ChromeOS.
I feel like the secure connect client being closed source would have been an effective deterrent 5 years ago, but these days everyone's throwing LLMs at everything. So an attack that would have taken effort doesn't present nearly as much of a barrier anymore. At least as long as there remain some platforms that don't enforce full attestation...
My point was that CAA's threat model is flexible based on your requirements. If your requirement is "an attacker with the ability to make arbitrary network requests from the host can not pretend to be Chrome", CAA does not work unless you have OS/Hardware support (which ChromeOS provides).
I just don't think that matters much. CAA is policy enforcement, it is not a full MDM solution, nor is it antimalware.
If it can't prove what it purports to prove, then it is not policy enforcement, because it is not anything enforcement.
But someone thinks it is, which is harmful to them on top of being an annoyance to everyone else.
That's just a misunderstanding of the threat model. It's like saying "if someone can just mitm TLS it's pointless" when that "someone" is in the position to run arbitrary code on the client. Mitigations map to specific attacker positions.
> But who outside of Google is running exclusively ChromeOS?
I think Chromebooks are pretty common in school settings
Understand that, in this conversation, your use of "attacker" is referring to "end user of the hardware". Which might be part of the Chrome team's definition, or might not, but gosh it would be nice to cater to the folks who are using the dang computer.
We're talking about a device managed by a corporation. I have no idea what your point is.
Using a maintained and up-to-date browser is a reasonable requirement for an IT department (should be for anyone really). Would you suggest they should be allowing IE6 just because a user might prefer it?
Of course Google is going to suggest using Chrome, if they detect that the browser might be out of date.
Is the implication that Firefox is not maintained or?
The issue presented doesn’t seem to be “an up to date browser check” it seems to be a “is it latest chrome” check, which is a very different thing.
We don't know. The author doesn't mention how current the Firefox browser is/was.
If the organization is indeed enabling a specific check for Chrome that seems a little over the top but they're the ones supporting their users and if they want to make their life easier by only dealing with one browser that's their decision to make. It's like saying that everyone has to use Windows, or a specific line of laptops, or any other standardization to simplify the support workload.
> This was for a Google Workspace Business Plus account and workspace, from an up to date browser and OS.
Not a little over the top, it is anticompetitive behavior.
[dead]
It's not a little over the top its an antitrust issue and clearly and obviously wrong.
It's not clear to me that Context-Aware Access is as configurable as you're implying. At a glance, the docs seem to suggest that Chrome is the only browser you can force standardization on, which IMO does push this towards being Google's fault.
That's correct, there is no way to say "only allow Firefox" in CAA because the attestations are either browser agnostic or chrome specific (as part of the managed Chrome offering that GSuite supports).
No, not at all. The implication is that the organization is dictating the software that employees are to use. There's nothing unusual about this.
If we are meant to believe that this is a Chrome-invasion-move, it's the least effective lever of all times. Most of the time the more plausible explanations are just the likely ones.
you’d probably say something different if it were microsoft.
I don’t see why I should give affordances of good will to Google here.
They’re not stupid, they know that this is an effective lever to further cement full-fat chrome as the default browser for the internet.
Chrome was created because Google felt that the IE monopoly was hindering the advancement of web standards and improved browser capabilities. I suppose you could argue that was a different Google at a different time, but at one point they did feel that browser diversity was a good thing.
I mean, they claimed to be for browser diversity when it was not them on top lol. Underdogs want the race to tighten up, 85% market leaders want to stay out in front.
If that's a the goal, then IT department should start by blocking user ability to install Firefox or other unapproved software not by blocking access to google workspace. Blocking access to google workspace using Firefox doesn't prevent using it for everything else. It's not like the google services are going to exploit a vulnerability in Firefox, everything else might.
Strawman argument. Firefox is maintained and up to date browser.
Why did you even compare it to IE6, out of the curiosity?
Well - it does make sense. If an organisation that contracts me has to chose between a) BYOD - but restrict downloads, etc, enforce export control, directly in the browser - I happily take that, vs getting a Windows laptop that is locked down and forced to work with that.
Its a normal choice, given a checkbox on page which advertises that checking it would make your security posture more safe. The IT person is safeguarding their own job.
Other way to look at it is, the company is paying for everything, and they get to make decisions based on what suits their security needs.
"it shouldn’t be an option."
What? Are you serious? An organization has EVERY right to enforce whatever controls they deem appropriate for their environment. Period.
Hi there, original author here. Can confirm we're not using IAP for this workspace, or anything I was trying to access
Psst, you have a merge conflict in your text
But they explicitly negate this:
> We haven’t configured, and don’t use IAP (Identity Aware Proxy) - I’ve used this before and yes that is Chrome only due to how it does device verification
> This isn’t because of “Context Aware Access” this is an enterprise only feature, and we’re on Google Workspace Business Plus
Is it not:
https://knowledge.workspace.google.com/admin/security/create...
The Org admin can put all sorts of restrictions on who can do what based on the client device setup.
Unrelated to this news, but this is so rudimentary, when the correct solution instead is:
1. Make it ridiculously easy to install hardware vendor keys and register it with OS of choice. (like a standardized dialog box in UEFI and a standardized/regulated IPMI-like interface)
2. Allow for only measured boot on those devices.
3. Provided facility to verify signatures.
Do this on consumer and enterprise laptops and desktops alike and all of these weird set of conditions just go out of play and replaced by something much much simpler.
> The Org admin can put all sorts of restrictions on who can do what based on the client device setup.
can you put a restriction to ban Chrome and force Firefox then?
If you wanted to, yes.
Can you provide a link or screenshot of that feature? Because other people are saying no you cannot
"wow look at all these options available...to limit users to only use software provided by the same corp" you are missing the point entirely.
Why is there a policy to require “Chrome” and not a policy to require another browser, hmm?
Google offers "Managed Chrome" as a service. What would you like them to do, offer "Managed Firefox"? Should AWS offer "Managed GCP"?
I don’t think Google should also offer a product that detects “managed Chrome”
I don't think Google should also be allowed to remain in charge of Chrome at all but here we are.
Uh, why? Context Aware Access is a policy attestation service. Managed Chrome is exactly the sort of thing you'd have policies for.
Google offering "Managed Chrome" is probably the root issue.
Call me old school, but wedging an already dominant browser to be the only full fledge option in GSuite using companies reeks anti-competition.
You don’t have to use managed chrome to use gsuite
I mean the issue here is Google using its dominant power to push for a specific browser within a security software they control.
This is a difference between America and Europe in mentality towards this.
I don’t think that’s true. They support OS verification for windows and Mac. If Firefox implemented verification (I doubt they would) and there was customer demand I think they would support it.
Organization admins may roll out hardened Firefox settings via their MDM solution, and then based on that want to restrict usage to Firefox.
Microsoft has a chrome and Firefox extension for similar management lockdown
Because Google is able to configure Chrome to the admin's liking.
Yep, there are a lot of high risk settings, especially extensions
Hi folks, blog author here.
Few comments based on common threads
- No we don't have, or use, IAP and haven't configured it
- Yes I'm the admin so can confirm this
- "Context aware access" is only available on enterprise, we're just on "Workspace business plus"
Happy to answer any other questions
It appears website developers desperately want to return to a world where browsers actively pretend to be another browser*.
Want to check for DBSC? Enjoy not knowing whether the browser vendor decided to just roll a simple software implementation.
Nothing good comes from browser detection over feature detection anyways. It's time to do away with user-agents and other overt identifying markers, and if we're still not in a better place, aggressively start stubbing features.
* to some degree they still are. Firefox still ships with an user-agent override list for certain websites that have outdated user-agent sniffing for feature detection (and other fixes in about:compat).
You mean the same that gave Chrome its market share, by adopting ChromeOS features, and shipping Electron apps?
What is the process to aggressively stub features? Does that mean pushing patches to Firefox and/or Ladybird and/or Servo?
Cloudflare blocked me with a chrome windows useragent on Firefox+Fedora
Happens to me too. They are probably able to infer it is not a Chrome from the TLS handshake or they run their javascript fingerprinting and found out that the browser didn't have some Chrome features or behaved differently.
Sadly, it is much more difficult to pretend being on a different browser than it was in the past. :/
And yet, claiming support for a feature doesn't tell all. Different implementations can have subtle differences. Knowing the browser and version can allow a client to survive that.
Yes, that is the price developers will have to pay. Development will be harder, but users are going to prefer somewhat broken sites over being outright refused entry.
At the end of the day user-preference is what dictates which browser is used and how it is configured. Developers will have to deal with what users choose to do on their end.
You can only patronize people for so long before they look for a way around silly restrictions. Trying to keep someone safe by putting up walls, whether the threat is real or imaginary, is pointless when it is in the user's power to trivially defeat those walls - and when extension and browser developers are going to line up to sell them demolition tools (see ad blocking).
Advice is going to go much further than roadblocks, long term.
We used to deal with what browsers users chose on their end, then came IE market dominance.
After the lawsuit against Microsoft, and the raise of Firefox, Safari and Chrome we had it all good again.
Then devs had to get comfy with Google offerings, including shipping Chrome packaged with their pseudo native applications.
It states something about "your organisation's security requirements", do they document what requirements cause this rejection page? Some kind if changed default perhaps?
No, this is easily the biggest flaw in CAA - there is no way to discover which policy broke your access. I have reported this to Google multiple times, even sent this directly to a Google SecEng (a well known one) to route internally. The issue persists and makes configuring CAA extremely painful and error prone.
I am convinced there's someone who thinks debuggable security policies are a security risk and deliberately designs security APIs to be as inscrutable as possible.
It's possible but I suspect it's just Google being a rather incompetent organization.
Maybe not, but I have the feeling Google doesn't like that FF continues to support manifest v2.
I think it's just that some of the device policy restrictions the Org admin can choose to enable don't work in FF. So if they require them, no FF.
I love that google always sends useless canned responses after basically requiring you to perform a blood sacrifice to get ahold of anyone.
At least you got a heads-up. Few months back GCP "Agent Studio - Build" failed compiling the code in sandbox with a vague error message. Spent weeks troubleshooting, spoke to google engineers and reps, sending code, step by steps, screenshots. No one had a clue, until I switched from Firefox to Chrome out of desperation and it worked without a hitch.
Seems like a monopolistic move.
Google doesn’t have a monopoly in workspace applications.
You don't have to have a monopoly to be monopolistic.
The Sherman Act says that any action by an individual, or conspiracy of a group of individuals, to "restrain trade" or seek a monopoly is illegal.
Monopolies aren't a prerequisite for antitrust action, they're the failure state when you should have acted sooner.
Taco Bell is a monopoly because they restrain the trade of tacos because they ask me to take my taco truck elsewhere when I park in their parking lot to sell tacos. Never mind there are other places I can set up my truck, never mind there are tons of other taco shops, Taco Bell is a monopoly as now I need to go find a different corner to sell my tacos, they're restraining the trade of tacos.
Everything is a monopoly these days. Its practically meaningless in these conversations.
Get this, they won't even let me sell my tacos through the Taco Bell app. What a monopoly! We need to get the FTC to enforce Taco Bell's and Taco Bueno's mobile apps to make their apps support every taco truck's ordering system. They're restraining the marketplace of selling tacos through their apps to only their own stores!
Every feature of their apps needs to be easily integrated into whatever random POS every single food truck uses! I should be able to buy tacos from any taco vendor through the Taco Bell app. They're a monopoly!
I would actually be pretty concerned if Taco Bell bought Ford and would only allow Ford cars to use their drive-through or parking lot.
Imagine a world where 95% of grocery stores insist on you driving a Ford car.
What if it was they bought a car brand and added a transponder to the car so owners of taco bell cars could be auto-identified and had their favorite orders already ordered for them while all other models of cars were still free to use the normal drive through process? Would that be a "monopoly" somehow?
Isn't that more of what's going on here? An optional feature people can use if they choose to use the holistic platform?
This isn't forcing anyone to choose Chrome. The customer can still use any browser they want with Workspace. They get an extra feature when they use Chrome though.
Sorry, how is "blocking Firefox" not forcing people to choose Chrome?
I suppose you can argue the admin is doing it and Google is merely facilitating it, but the article title is "block Firefox access"
> the article title is
The article isn't accurate. One could say they're uninformed, one could say maybe they're ignorant, but it's not reality.
This is a security feature a Workspace customer can choose to enable or not. If the workspace customer wants to use Firefox they're free to not enable this security feature that isn't supported by Firefox.
It's not a requirement at all to use Workspace, it's an optional feature. You can still use Firefox or any other browser for that matter with Workspace, if the manager of that Workspace wants you to. Which it's the company's software suite, they should be able to configure it how they wish shouldn't they?
If Google actually started banning all non-Chrome browsers maybe I'd agree that's harmful to the browser market. It was a bad thing when they blocked Windows Phone from accessing Google services back in the day, for example.
I doubt Microsoft would qualify as a monopoly under present-day excuses being made for Google yet here we are with Internet Explorer Part Deux.
I know Google finally kicked all their employees off alternate browsers but doing it for external customers is definitely a choice
I'm not so sure that enforcing an internal digital monoculture is a productive way to achieve innovation & resilience.
They wont stop it. They will just slow down a bit if people get ruffled. That's how alphabet has handled everything else. They learned that if they can make changes slowly enough, they can do whatever the hell they want to.
As we all know we can even pay 10x more for items and get next to no raise in our wages, but because it was done slowly in an "official" and "professional" manner, most folks didn't even complain, they just screamed into the giant pillow we call "the internet".
Corporations of the 2020s love the internet's digital pillow and its magical crowd-quieting capabilities. If only the ancient roman empire had invented the internet they would be ruling the entire planet by now and we could watch gladiators on youtube :P provided we don't stand out too much (then we would be said gladiators)
Reading the news of EU countries leaving American cloud providers for local cloud solutions including mobile office, it's surprising to see Google doing this.
It will only accelerate moves towards location of data, self-hosting, etc. The technologies to make this possible are much easier than they ever have been.
Sounds like you have a device policy configured and you should talk to your internal IT/Security team?
edit: This title is just incredibly misleading. OP seems to have made a mistake here in thinking that this is something that Google has done when it's just that their corporate IT/ Sec team now enforces using Chrome.
Not defending it, but given that they use the word "secure" three times in two sentences, I'm wondering if it's shown to browsers that don't support DBSC. Google has been really pushing/overselling this as a magical solution to cookie theft.
I was thinking it could be a Context-Aware Access thing. Firefox doesn’t support Endpoint Verification plugin
Is it possible for a non-google browser to be said to meaningfully support this given that implementing the features wouldn't necessarily accomplish anything insofar as it wouldn't let you past the google only security gate and would represent a moving target in any case.
That's fine. The second I stopped caring, which is the day I stopped working for a living, I stopped worrying about what Google thinks. I don't use Google for email or search. (my email addresses are with proton, iCloud, and Hey, and my search is DDG) I'm not a big video person so I never use Youtube, the few times I need to use an office product I will either use OnlyOffice, or the Apple stuff. My Phone is an iPhone (with the stuff mentioned above) My browser is Firefox with uBlock Origin, and I almost never have problems with this setup.
If people want specifics about what this is, look here:
> https://knowledge.workspace.google.com/admin/security/contex...
In particular "Allow access to devices using Chrome browser with security requirements" would present this message.
I use Google as a secondary search and as of roughly last week it gives me a captcha every time I try to do a search. That had never been the case before.
I browse over Tor for most things and most sites give me a captcha or just simply fail to load these days. I just close the window and move on to something else.
I am seeing it a lot more lately with uBlock Origin. I've used DDG for search for a while now, but the last few times I've tried Google I got a captcha within a couple of queries if not immediately.
For a few years now Google has given me a captcha whenever my VPN is on (Private Internet Access)
That one has been a well-known thing for a decade if not more; it's not just Google, half the Internet will start throwing captchas or denying access once you connect via a VPN (specifically "VPN" as in one of the services you pay to avoid location-based discrimination of media streaming platforms).
It is probably Chrome Enterprise which lets you lock down, for example, what extensions people are allowed to install. There is a legit reason for organizations to want to standardize on one browser and to lock it down (as browser extensions are a major source of infiltration these days).
Firefox supports locking down like that as well so that sounds like lazy IT.
Smells anticompetitive to me
We have collectively let a few companies control/centralize the internet. Then have a shocked pikachu face when these same companies do shitty things.
Unrelated to Google Workspace and Firefox, but I just noticed today that Google’s YouTube now says my iPhone’s Safari browser is incapable of playing full screen videos, which it’s not ever claimed before. I’m also getting sick of them pushing Chrome anytime I use a Google service like search or Gmail. I keep dismissing the prompts, but they are relentless. It all seems so sleezy and desperate.
Just say no to Google.
Does Chromium would still work?
antitrust
Oh look, a monopolist is making settings "more secure" by enshrining monopoly more.
And good fucking luck getting the FTC to follow monopoly law.
[flagged]
The sky is falling! The sky is falling!
Do your homework before yelling "Fire!".
Do it then