Ferdi: Cannot log in in using Google Log-in for non-gmail websites

[zemmyang]

Bug description:
I get the "non trusted browser" error when I log in for things like TasksBoard or Todoist (under Ferdi Todo) using the google log-in

Steps to reproduce:
Set Ferdi todo on, set it to Todoist, click "sign in with google." Pop up shows up, says that browser is not trusted.

Trying to log in to TasksBoard.app takes me to the same pop-up.

GMail works fine, btw.

I'm using Xubuntu 20.04, Ferdi v5.50 (x64)

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the label bug to this issue, with a confidence of 0.95. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[Szybet]

For me, gmail is not working, the same issue :(

[kris7t]

@Szybet You can try modifying recipes/gmail/index.js in the Ferdi user directory (e.g. ~/.config/Ferdi on Linux) to spoof a Firefox user agent:

module.exports = Franz =>
  class Gmail extends Franz {
    modifyRequestHeaders() {
      return [
        {
          headers: {
            'user-agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:81.0) Gecko/20100101 Firefox/81.0',
          },
          requestFilters: {
            urls: ['*://*/*'],
          }
        }
      ]
    }
  };

This seems to work for now, but the problem is that Google is trying to block sign-in from Electron applications: https://groups.google.com/a/chromium.org/forum/#!msg/embedder-dev/STyM5ZNTHMM/POj1v_cqBgAJ

They suggest the OAuth 2.0 flow as a replacement, but that wouldn't be sufficient for Ferdi (you want to actually browse the Gmail web interface, not just interact with the API). This seems to be the same problem that Smart TV manufacturers face (see the thread linked above) when trying to show the Gmail web interface on an embedded device, and may also be the reason why Wavebox recently moved from Electron to a forked Chromium browser (and unfortunately and shamefully went closed-source in the process).

I couldn't figure out how Google detects Electron in their sign-in flow. The connection to the https://accounts.google.com/_/lookup/accountlookup endpoint seems to be the cornerstone, it returns an error in Electron, but succeeds in Ungoogled-Chromium (and presumably all other flavors of Chromium), but I couldn't detect any discrepancy between the request headers or the payload. However, there's a bunch of encrypted blobs in there, so, presumably, Google rejects Electron logins by inspecting some fingerprint uploaded to the endpoint in an encrypted form.

Spoofing a Firefox user agent looks like a workaround for now (maybe it disables whatever code is trying to sniff for Electron), but this looks awfully like a cat-and-mouse game. Awfully ironic from a company trying to phase out User-Agent headers.

[Szybet]

I have descriped how i did it in another issue
and i need to stop using google services
also thanks for the info :D

The google problem, with updating and or insecure browser, is not in version 5.5.0 but only in 5.6.0, i managed to make gmail and other services that require google to make on 5.5.0, and then i updated to 5.6.0, after some changing in config files, that they not collidate it works.
Also i dont connect to server, maybe this is important too

[mahadevans87]

To add to what @kris7t , you could use window.navigator.userAgent.replace(/(Ferdi|Electron)\/\S+ \([^)]+\)/g,"").trim() instead of Mozilla/5.0 (X11; Linux x86_64; rv:81.0) Gecko/20100101 Firefox/81.0 in the user-agent field.

This essentials strips of all electron tags from the user-agent which is what we do for most recipes. The Gmail recipe is not merged properly yet so that everyone can start using it. @kytwb can you please see how we can use the latest gmail recipe that was addressed here - https://github.com/getferdi/recipes/pull/194

[kris7t]

@mahadevans87 I built the recipes from git when I was playing around Ferdi on Electron 9 and it already had window.navigator.userAgent.replace(/(Ferdi|Electron)\/\S+ \([^)]+\)/g,"").trim() as the user agent string. However, that doesn't seem to be enough to allow for Google login as of now. I also tried copying a Chrome 80 (same as Electron 8 without the Ferdi/Electron tags) or a Chrome 85 (from the latest Ungoogled-Chromium, which allows for Gmail login) user agent with no avail.

I suspect shenanigans either with window.chrome or navigator.plugins (see e.g. https://github.com/Eloston/ungoogled-chromium/issues/1010#issuecomment-643740388).

[kytwb]

@mahadevans87 I will start the releases again on Thursday or Friday, starting with the nightlies. I will make sure to let you know when it will be available. Thanks for your patience!