Browsing Google Groups Now Requires You to Log In
Someone emailed me to point out that the bup-list archive link in my previous post doesn't work unless you're logged in with a Google Account.
I know this used to work, once upon a time; it's not a restricted mailing list. And the Do I need a Google Account help page is the same as ever, ie. it says you can search, browse, and read public groups without an account. There are also instructions for how to join one of their lists via email without using the web interface, and I'm pretty sure that still works.
But if you go to groups.google.com (even the home page) and you're not logged in, you get bounced to the login screen.
But it's even more insidious...
Testing this was harder than I expected. In Google Chrome, the archive page above still worked after I logged out!! It even worked when I opened a "New Incognito Window," which supposedly eats all your cookies and guarantees you some form of privacy.
But when I got to the same page in Firefox or Safari - in which I haven't logged into Google for a long time - I do indeed get the login page.
So now we have two bugs:
- Google Groups isn't as open as (I assume) they actually intended to be because they didn't test carefully enough;
- Incognito Mode in Google Chrome (6.0.472.55/MacOS) doesn't successfully hide my identity.
And maybe a third, if you're generously assuming it's classified as a bug down at Google:
- Logging out of Google doesn't remove all my cookies, so they can still associate me with my account after I log out.
I didn't bother posting this to Google's support mailing lists, because their support is so terrible that everyone knows it's a waste of time. This posting probably won't accomplish anything either, but at least I'll feel like someone heard me.
I did google around a bit to see if anyone had mentioned the problem, but I didn't see any matching results. Please let me know if I'm totally crazy and this problem doesn't really exist; but test carefully, as leftover cookies might be letting you see the site anyway.
Update 2010/09/09: Aha, not quite as scary as I was worried it might be: when I clear my Firefox cookies, it lets me access Google Groups without signing in. That suggests that it's actually old Google login credentials that are the problem; they cause it to jump to the login screen instead of just letting you through. Still a bug in Google Groups, but at least it means Chrome's private browsing seems to be okay after all.
ssh+2FA to all your machines, anywhere, without opening firewall ports.