JavaScript is now required to sign in to Google
ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS.<p>They&#x27;re probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss of one account being popped is likely far greater than the privacy loss of thousands of users&#x27; browsing patterns being correlated.<p>tl; dr: Good luck detecting and preventing automation of sign in pages at scale without robust JS based defenses. I think there&#x27;s a shortsightedness and self-centeredness to a lot of these comments.