Hacker News new | ask | show | jobs
by eh_why_not 651 days ago
No-JS user here. A disturbing trend noticed in the past two months: can't login anymore to some financial/health services sites (bank/insurance/etc) without disabling all of NoScript - no amount of selective enabling of websites satisfies them, and those websites are using known infractors like Adobe.

In other words, there is code in the backend checking that all tracking/-ware has run on the browser, and refusing to let you login unless you let it all run, while none of it is necessary (as evidenced by older versions - and other sites - accepting only the top site being JS-enabled).

"We either track the living shit out of you, or you don't access the essential services you need, even though technically it is not needed."

4 comments

uBlock Origin has some advanced filter syntax that can sometimes deal with sites like this. It can intercept, modify or replace JavaScript functions, objects, network requests, parsing data, cookies, etc. That being said, writing filters for sites like these is somewhat of a dark art, it usually involves reverse engineering the page's JavaScript to the point where you understand what it's actually sending and checking for to function correctly, then figuring out a way to bypass those checks by selectively modifying the JavaScript's functionality.

Things like this are why I worry a bit about the proliferation of things like WASM, while JavaScript isn't great, it actually gives a great amount of control to the end user, to both see, understand and the ability to actually modify what is running in their browser. With WASM, all of this becomes highly impractical. Instead of a (semi-)readable, modifiable block of interpreted code, with the ability to inspect and modify the state at almost arbitrary points, you just get opaque binary blobs that you basically can't do anything with. As more and more sites switch to using compiled WASM blobs for their logic, it will become increasingly difficult to observe or modify any behavior of these websites as an end user.

Do you have a list of offenders by any chance?
This has been happening to me too with PG&E. The page wouldn't load until the Amplitude calls finish.
Meh, I've noticed this without any blockers at all. I cannot log in to my power company's website from my PC (on any browser) and likewise for Delta Dental on any device. So far I have been able to work around this, but I don't understand how its possible to break login so badly that even unmodified Edge doesn't work and it stays like this for months.