That one is legit, I'm guessing Chrome requires users to use a gmail account in order to submit an extension to their store.

https://blogs.windows.com/windowsexperience/2021/02/05/simpl...

Talk about training users to fall for phishing schemes. Plus users have been so desensitized to entering 2FA codes they’ll type them in anywhere. I feel like web security is worse than it was 10 years ago.

We need webauthn not just 2FA

Love how the goalposts keep moving.

First arcane password rules so it takes 5 minutes and half a dozen attempts to come up with a password that is accepted. Then force the user to change it often. Then add email verification. Then SMS/phone verification. Still not good enough, now we all need to have a hardware token to buy the counterfeit garbage for sale on Amazon. Fuck that. It's just not worth the trouble. Honestly the world was a lot easier (if a bit slower) when you dealt with businesses in person or via mail. Fraud and identity theft just doesn't scale in meatspace, so it was never a big problem.

I maintain that most of what we get from the Web and computers, as individuals, is barely better than what we had before, and not enough so to justify its costs. Shopping very much included.

For some context, I grew up very much "OMG wire my brain in, let's get this future shit going!" Years of watching that future develop, and some reflection, have almost entirely reversed that sentiment, for me.

For example: are streaming services convenient? Yeah, of course. Am I actually happier with them than I was with the library, rentals, and the occasional purchased movie? Marginally, if at all. (but I have Internet service for the handful of things it actually is highly beneficial for, so, may as well use streaming, too)

Is shopping online convenient? Yes. Am I happier than when I just had way less idea what was available to buy, and there was more friction to indulging every little purchase-whim? I really wonder. This one may not just be marginally better, but net-harmful.

I can consume an order of magnitude more diverse and interesting media than I could without the internet. I can order exactly the right thing from the internet instead of making do with a kind-of solution from the store.

I think you're remembering what it was like pre-internet with rose-colored glasses.

The internet is great.

We definitely have more of everything data-related and have a much better idea of all the stuff we can buy. I'm skeptical how far that's actually moved the happiness and life-satisfaction needles, in general.

[EDIT] specifically, I think some of our "satisfaction" from this sort of consumption is itch-scratching generated by the possibility of doing it, in the same way that pre-Internet one rarely felt bothered by not knowing some piece of trivia, if no-one around happened to know either. Now it itches until someone looks it up, because you know you can find out quickly. Now if I'm not watching the best possible thing, for example, it itches, but I don't think it would have before. I think to some extent the level of choice available, aside from famously causing analysis-paralysis ("browsing Netflix" is famously an activity all its own, that may or may not end up in ever actually watching anything) also generates the very desire that it's satiating. I'm not sure I was actually less happy watching the best thing I could find at the video store, versus the best thing I can find on streaming services.

I don't know about you, but for me having access to youtube means that I can do things like fix my car, learn about medieval hats, see what kinds of weird animals exist, etc.

These sorts of things improve my life immeasurably and definitely give me a sense of 'satisfaction' that I would not otherwise have been able to achieve paying someone to fix my car, watching a reality show on TLC, or going to the library and reading a book about ducks for the 50th time.

If you were wearing a size 13 (EU 48) shoes, walking into a store and asking for what they have in your size was exclusively met with "but which do you like". It turns out none of the top 10 choices I asked about would be available, and we'd eventually retreat to "which do you have that I dislike the least?"

With online shopping, I think the biggest wins are for anyone not being in the "common" category (be it the 5-95% size, fashion, usefulness etc): if what you generally need is suitably common, you might miss the physical shopping (try-ons/try-outs for wearables/tools are very useful).

This also means that there is more incentive for non-common products to be produced because the market is larger.

Your problem isn't the Internet, it's the lack of trust busting in the tech space that prevents e.g. Disney from being able to launch its own streaming service or Amazon from promoting its own Basics products. The reason why everything sucks is because big players have zero incentive to change when they aren't punished for favoring themselves. Instagram doesn't even allow you to copy and paste photos anymore.

Note that current best practice is simple password rules, with password expiry only when there is reason to do so.

Generally the suggested rules are: be at least 12 characters long, check the password against lists of known passwords.

The Chrome Web Store does not require using a GMail address, for example, I don't have a GMail address and have items on the Chrome Web Store [0].

[0] https://chrome.google.com/webstore/detail/cackey/lpimdiknnpi...

Loved the BeOS theme!

Most of the other big extensions have their own domain email. Like Grammarly, 1Password, Zoom, Pocket.

Evernote has a normal Gmail account listed. So maybe this goes hand in hand with having a bad product.

Perhaps those orgs use Google apps?

I have a Google account on an email completely unattached to any other Google services (I think it was an originally migrated pre-Google Youtube account), so I am sure you can have a Google account with any external email address.

It does not. It does require a Chrome web store account, but you can use any email address you want for that.

A Google account, which any organization that has its shit together (and uses Google properties) has set up for their domain.

Which Microsoft, ostensibly, wouldn't be doing. Considering the whole Office 365 product exists and is a direct competitor to Google Suite.

And yet here they are.

Microsoft Edge requires a MS Live account.

> I'm guessing Chrome requires users to use a gmail account in order to submit an extension to their store.

Google apps/Gsuite/Google for work (or whatever it’s called now) accounts all work fine.

There’s no requirement to use a gmail.com account.

Source: have published extensions on my own and for my company.

Wow, I looked at the review responses by the developer and assumed from the poor English that it was fake, and reported it.

It could be this MS extension is a companion project to the latest Windows 10 update - the News and Interests taskbar widget.

It might be legit. The Microsoft rewards app uses [email protected]. I’m guessing 1 million installs makes that legit.

There’s no way even for technical people to make a proper assessment of the trustworthiness of the publisher.

Google has ruined the internet because they want Google Search to be the only “trustworthy” source online. Too bad they suck at it and Google search is a steaming pile of shit now.

1 million click farmers in china/India/Nigeria?

In general this is a good idea. But in the case of Microsoft--good luck figuring out which of Microsoft's thousands of domains are legit! :)

Reminds me of Paypal where I'm simply unable to tell whether some mails from them were phishing or not (regardless of time spent investigating these mails), and I believe that virtually no one would be able to tell.

They were even cognizant of the issue to the point where they set up a robo inbox you could forward any suspected phishing emails to and it would reply telling you if it was legit or not. It was something like [email protected]

It still frustrates me that legitimate Paypal e-mails include really big "click here to login" buttons that link you to their website. Such links are considered a hallmark of phishing, and there are many attempts to prevent people from clicking on such links. Many services I use include text like 'we will never send you such a link you know how to get to our website'.

The fact that paypal does not do this normalizes clicking on links in e-mails.

"use email for notifications, but don't trust email content" is not a solution for most users. If you can't trust email, why even have it? Install a secure app and leave email behind, or make email secure by having clients clearly display cryptographically secured provenance info, and flag unknown/untrusted senders.

There is no alternative to e-mail. Except perhaps for SMS. There is no other method for contacting people that is anywhere near as pervasive. It also has the advantage of being federated, not controlled by any specific entity.

Besides that, compared to WhatsApp and signal, email is generally for longer and less urgent messages. Those fit notifications much better.

In that context an email saying "hey this is whats up, login as you normally do if you want to verify or act accordingly".

It's far from ideal. We will probably come to some form of solution at some point. But at this moment it is a clear no-brainer.

It would seem to me that Microsoft would choose to link it to microsoft.com so that customers can easily recognize its authenticity.

Microsoft might, I suppose, have a policy against microsoft.com accounts on other firms infrastructure, and therefore if it needs a Google account uses gmail or other non-microsoft.com domains.

They have already failed this test: they are already publishing extensions using [email protected] and [email protected], doubtless many others!

I believe Google requires you publish Chrome extensions with an @gmail address, in which case MS doesn’t really have a choice.

Absolutely untrue, as mentioned elsewhere in the thread. I have Chrome extensions published under a non-gmail email address.

Any idea what problem Google is solving by requiring the use of gmail?

Naivety on the internet, and people believing what they read on a web page without checking.

Google doesn't require a gmail adresse to publish.

Yeah, I didn't think it made sense.

Good grief--that is so evil (not to mention anticompetitive) that I didn't even consider it!

Not sure what would make using a Gmail account anticompetitive, but it's also not true. You need a chrome web store account (which they amusingly encourage you not to use your personal email for) which can use any email address.

Considering APPLE goes so far to make you confirm DUNS numbers for a company acct. It seems like this would have been a good mitigating practice and already has precedence. While it’s a PITA it makes sense.

The core issue is that Apple uses humans to evaluate these requests and provide a point of contact with businesses. Google believes any process requiring a human is broken.